2029. That’s the year Cloudflare now says it wants to be fully post-quantum, and it moved that target because the estimated timeline for Q-Day — the day quantum computers can break the public-key cryptography holding the Internet together — has been accelerated. If you build bots for a living, that date is closer than the lifespan of most of the Docker images currently running in your fleet.
On September 29, 2026, Cloudflare announced its intent to become a public Certificate Authority. The plan has two phases. First, classical certificates, issued once the browser root program application and acceptance process wraps up. Then production Merkle Tree Certificates, or MTCs, scheduled to begin in the first quarter of 2027. To get there, Cloudflare is acquiring publicly trusted Root CA key material from GlobalSign, a deal expected to close within about two months of the announcement.
That’s the news. Here’s why I think it matters more to bot builders than to the average web developer.
Bots trust differently than browsers do
When a certificate format changes, browsers absorb it quietly. Chrome and Firefox ship updates every few weeks, root stores get refreshed, and the user never notices. Your bots are not browsers. In my experience, a typical automation stack trusts certificates through some combination of:
- A CA bundle baked into a base image that was last rebuilt whenever someone remembered to
- A pinned fingerprint added during a debugging session in 2023 and never removed
- An HTTP client library several major versions behind, because upgrading it broke the retry logic
- A custom trust store mounted from a config map that nobody fully owns anymore
- An outright
verify=Falsethat started as a temporary workaround
Every one of those is a place where a new certificate format or a new root can turn into a 3 a.m. pager alert. Not because the cryptography failed, but because your scraper’s trust configuration is a fossil record of past incidents.
Why Q1 2027 is the date to circle
The classical certificate phase should be uneventful for most of us. A new publicly trusted CA entering the ecosystem is routine, and if your trust store is current, you probably won’t notice.
Merkle Tree Certificates are the part I’d plan around. Cloudflare has said production issuance starts in Q1 2027, which means sites you depend on could begin presenting them not long after. I’m not going to pretend I know exactly how every client library will handle that format on day one — that detail isn’t in the announcement, and anyone telling you otherwise is guessing. What I do know is that “new certificate format, arriving on a published date” is the single most predictable kind of breakage in bot engineering, and predictable breakage is the kind you get ahead of.
Cloudflare has already shown it will push these upgrades without asking. Customers running the Cloudflare One Appliance got modern post-quantum encryption in version 2026.2.0, released February 11, 2026, pushed automatically with no customer action required. That’s a reasonable model for infrastructure you manage for someone else. It is not a model you get for free in your own containers.
What I’m actually doing about it
None of this requires a rewrite. It requires an inventory. Over the next few sprints, I’m working through a short list:
Find every trust decision in the codebase
Grep for pinned fingerprints, custom CA paths, disabled verification, and anywhere a bot talks TLS without going through a shared client wrapper. Write down what you find. Most teams are surprised by the count.
Centralize the TLS client
One wrapper, one place to configure trust, one place to upgrade. If your bots each construct their own HTTP session, a format change means touching dozens of files instead of one.
Make base image rebuilds boring
If your ca-certificates package updates on a schedule rather than on an incident, you’ve removed a whole class of future problem. Pin your dependencies, yes, but pin them to something you refresh on purpose.
Add a canary
A small job that connects to a handful of endpoints, verifies the chain properly, and reports failures loudly. When new certificate formats start appearing in the wild, you want to learn about it from a dashboard rather than from a customer.
The quiet advantage
Post-quantum migration tends to get framed as a cryptography story, and the crypto will mostly be handled by people far better at it than me. The part left for the rest of us is unglamorous operational hygiene: knowing what your software trusts and being able to change it without a week of archaeology.
A White House executive order has already flagged post-quantum readiness as a priority, and Cloudflare’s 2029 target reflects a timeline that keeps compressing. The teams that treat the next two years as a cleanup window will barely notice when MTCs arrive. The teams that wait will find out how many hardcoded CA bundles they shipped. I’d rather be in the first group, and the work to get there is cheap right now.
🕒 Published: