{"id":183554,"date":"2026-10-02T22:54:30","date_gmt":"2026-10-02T20:54:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/cloudflare-sozdayot-udostoveryayushhij-czentr-dlya-besplatnoj-razdachi-tls-sertifikatov"},"modified":"2026-10-02T22:54:35","modified_gmt":"2026-10-02T20:54:35","slug":"cloudflare-creates-a-certificate-authority-to-issue-free-tls-certificates","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/cloudflare-creates-a-certificate-authority-to-issue-free-tls-certificates","title":{"rendered":"Cloudflare creates a certification authority for free distribution of TLS certificates","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Cloudflare has announced the creation of its own Certificate Authority aimed at providing free TLS certificates that use cryptographic algorithms resistant to quantum computer attacks. Simultaneously, the acquisition of the GlobalSign Certificate Authority was announced, which will serve as the foundation for this project and will allow for the immediate issuance of certificates that will ensure maximum device coverage, thanks to GlobalSign's presence in existing root certificate lists. Additionally, Cloudflare has submitted applications to include its own root certificate in the root certificate lists maintained by Google, Apple, Microsoft, and Mozilla. <\/p>\n
It is expected that the new public certificate authority will complement the Let's Encrypt service, which holds a 39.2% share among certificate authorities based on the number of issued certificates. The reliance of nearly half of websites on a single certificate authority creates systemic risks in the event of failures in Let's Encrypt due to the lack of similar free alternatives. Like Let's Encrypt, the Cloudflare service will be fully automated and will allow for certificate management using the open ACME protocol. To obtain a certificate from Cloudflare, Let's Encrypt users will only need to change the URL in their settings. <\/p>\n
The second objective of the new Certificate Authority is to prepare for the transition to post-quantum cryptography. In the first quarter of 2027, Cloudflare plans to be one of the first to implement support for the simplified certificate format MTC (Merkle Tree Certificates) in its Certificate Authority, designed for use with post-quantum cryptographic algorithms, where the size of the digital signature is approximately 40 times greater than that of traditional signatures. <\/p>\n
To reduce the data size during each TLS connection, MTC employs a tree structure known as the \"Merkle Tree,\" where each branch verifies all underlying branches and nodes through collaborative (tree-based) hashing. While in a traditional approach a certificate authority signs each certificate individually, with MTC, certificates are combined and added to a log based on the Merkle Tree, with only the root hash being signed. With this scheme, having the final hash allows one to confirm that a specific certificate is included in the current signed tree. When connecting to a website, the browser receives a shortened MTC certificate and a set of hashes for mathematical proof of its inclusion in the tree, enabling the client to verify the website's authenticity based on the confirmation that the certificate is indeed within the signed tree. <\/p>\n
The Cloudflare Certificate Authority will support both traditional and MTC certificates, allowing users to smoothly transition to the new format. The public launch of the project is expected after the testing of the new infrastructure on Cloudflare's internal services is completed. Cloudflare commits to complete transparency in the processes of the new certificate authority, publishing reproducible builds of the software used for generating digital signatures, conducting certification of the hardware security modules (HSM) that store private keys, and promptly disclosing information about issues and incidents. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"