Cloudflare’s announcement on September 29, 2026 was phrased in a way that stuck with me: the company said it intends to become a public Certificate Authority, described as an open service, issuing both traditional and post-quantum certificates. Not a product. Not a tier. An open service. For anyone who has spent a weekend debugging why a bot’s outbound HTTPS call fails on one host and succeeds on another, that framing matters more than the quantum part.
Because here is my honest reaction as someone who builds bots for a living: I don’t lose sleep over quantum computers. I lose sleep over certificate chains. And this news is really about the second thing wearing the costume of the first.
What was actually announced
The short version, sticking strictly to what has been confirmed:
- Cloudflare plans to issue quantum-safe TLS certificates, specifically Merkle Tree Certificates (MTCs).
- It announced its intent to become a public Certificate Authority, issuing both traditional and post-quantum certificates.
- Production MTC issuance is scheduled to begin in the first quarter of 2027.
- The platform will be open source.
- Cloudflare will acquire a trusted certificate root from GlobalSign to ease the transition.
That last point is the unglamorous one that makes the whole thing workable. A brand new root takes years to land in browser and OS trust stores. Buying an already-trusted root skips that queue. If you have ever shipped a bot that talks to an endpoint whose CA your container image didn’t recognize, you understand exactly why this detail is load-bearing.
Why bot builders should care before 2027
Most tutorials treat TLS as a solved line of code. You call a library, you get a connection, you move on. That works right up until the certificate format underneath you changes shape.
Post-quantum signatures are big. That’s the practical problem Merkle Tree Certificates are designed around — reducing the size and cost of quantum-safe certificate material so handshakes stay fast. For a web browser loading one page, handshake overhead is a rounding error. For a bot, it isn’t. Think about what your architecture actually does:
- A scraping worker opening thousands of short-lived connections per minute
- An agent fanning out to six different model and tool APIs for a single user turn
- Webhook receivers doing TLS termination under burst load
- Serverless functions with cold starts where every handshake byte shows up in latency graphs
Multiply handshake cost by that volume and certificate size stops being trivia. It becomes a line item on your cloud bill and a number in your p99.
The practical prep list
You can’t test MTCs today, but you can stop writing code that will break when they arrive. A few habits worth adopting now:
- Drop certificate pinning to specific leaf certs or intermediates. If your bot pins a fingerprint, a CA transition will take you offline. Pin to a root if you must pin at all, and have a rotation plan.
- Stop assuming your TLS library version is fine forever. New certificate formats need new client support. Pin your dependency versions, yes, but actually schedule the upgrades.
- Audit your container trust stores. Slim base images sometimes ship stale CA bundles. That is already a quiet source of bugs and it gets worse during a trust-store transition.
- Instrument handshake time separately from request time. If you can’t see TLS cost in your metrics now, you won’t be able to measure the change later.
- Write code that tolerates two certificate worlds. Cloudflare is issuing both traditional and post-quantum certificates. Dual-mode is the reality for a long while.
The open-source angle is the real story
An open-source CA platform is unusual. Certificate authorities have historically been closed boxes you trusted because a browser vendor told you to. If the issuance platform is readable, that changes what builders like us can do with it — understand failure modes, reason about behavior, and build tooling that doesn’t depend on guesswork.
Early 2027 sounds distant. It isn’t, in infrastructure terms. That’s roughly one planning cycle away, and the bots you’re deploying this quarter will probably still be running when it lands. The quantum threat may or may not materialize on anyone’s predicted schedule. The certificate transition is scheduled and dated.
Build for the second one. It’s the one with a calendar entry.
🕒 Published: