"Cyber ​​Bodhisattva" Cloudflare announced that it will become a free public CA and will provide free TLS certificates to all websites and services in the future.

Abstract:

Network service provider Cloudflare recently announced that it plans to become a public certificate authority (CA) that provides services to the entire Internet, helping any website to issue its own digital certificate for HTTPS encryption and authentication. This plan is currently in the root certificate application, infrastructure construction and compliance review stages.

Since 2014, Cloudflare has helped a large number of websites deploy universal digital certificates. These digital certificates are upstream issued by other CAs. Now Cloudflare is preparing to become a root-level certificate authority. In the future, Cloudflare can issue intermediate certificates and final certificates by itself, and the relevant brand logos will also be replaced by Cloudflare's own brand.

According to Cloudflare's instructions, the company plans to sign an agreement with GlobalSign to acquire the key material of its already widely trusted root CA. From this point of view, Cloudflare Root CA may use cross-validation to gain trust. However, Cloudflare also revealed that it is applying for Chrome, Apple, Mozilla, and Microsoft root certificate programs. If it is cross-validation, there is usually no need to apply for additional certificates, so the specific details have yet to be announced by Cloudflare (it is estimated to be a dual-track system: old certificate cross-validation + new certificate check).

Cloudflare confirmed that the new CA will give priority to supporting the ACME protocol and complete certificate application and renewal through automation. For websites that already use automated services such as Let's Encrypt, theoretically only need to switch the ACME service directory address without redesigning and deploying tools.

Cloudflare also plans to force clients to support ACME Renewal Information so that when certificates need to be revoked in advance, background renewals can be triggered in batches and reduce the risk of large-scale certificate expiration at the same time. Cloudflare also promises to expose reproducible software build processes, key hardware attestations, and certificate issuance status panels.

Learn more:

https://www.cloudflare.com/zh-tw/press/press-releases/2026/cloudflare-announces-public-certificate-authority-for-the-post-quantum-web/