The certificates that prove a website is legitimate are signed with algorithms a large enough quantum computer could break. The replacements already exist, and they are much larger. Put those signatures on every certificate in today's chain and the TLS handshake gets heavier before a page can load.
On September 29, Cloudflare put a production date on one way through that problem. The company plans to issue its first Merkle Tree Certificates in the first quarter of 2027. Those are post-quantum certificates built to stay compact. Nothing on your site has to change this week. Classic certificates are expected to stay in use for years, and getting ready is the certificate and TLS maintenance you should already be doing.
Why today's certificate chain gets expensive
A browser trusts your site by walking a chain: your certificate, an intermediate, and a root it already knows. Each certificate in that chain carries its own signature. That is cheap with today's algorithms. Post-quantum signatures are larger, so the same chain sends more data on every new connection.
Key agreement is further along than authentication. Browsers and many servers can already mix a post-quantum key exchange into the handshake, which protects the session key. That does not replace the certificate that proves the server is the server. The certificate is the part still waiting on a format that does not blow up the handshake.
Merkle Tree Certificates
Merkle Tree Certificates (MTCs) change what the handshake has to carry. Instead of every certificate holding a large post-quantum signature, the issuer signs one tree head. Your certificate then comes with a short proof that it sits in that tree. The proof is much smaller than a chain of post-quantum signatures.
Cloudflare has been advancing this proposal at the IETF, and says Chrome has named MTCs as the preferred path for post-quantum authentication. The target for the first production certificates is the first quarter of 2027.
The change is not a cutover. Classic certificates and post-quantum certificates are expected to run side by side for many years, so a site can move when its clients and software are ready.
When the first ones are due
Those certificates are not something you can request today. Issuing them in a form browsers trust means Cloudflare has to operate a public certificate authority, and it has said it is not issuing yet. It has applied to the Chrome, Apple, Microsoft, and Mozilla root programs, and it has agreed to acquire an established GlobalSign root trusted since 2012 so certificates can reach older devices while newer roots spread. The authority is planned to be ACME-first, which means an existing ACME client would point at a different directory URL when the time comes.
Renewal automation is part of getting one
Cloudflare says it will only issue certificates to clients that support ACME Renewal Information (ARI), standardized in RFC 9773. Your automation has to poll the issuer's renewal endpoint and act on the windows it publishes. That requirement covers the classic certificates and the post-quantum ones.
The reason is revocation. When a certificate has to be replaced quickly, an issuer is stuck if subscribers cannot renew fast enough. If every subscriber is automated and ARI-aware, renewals can be pulled forward and spread out instead of failing all at once.
That lines up with a schedule already underway: the maximum lifetime of public certificates is shrinking. Manual renewal does not survive that schedule. Shorter certificate lifetimes are the nearer deadline. Post-quantum certificates arrive on top of it.
What to do now
You do not need a new certificate because of this date. You do need the machinery that can accept a new kind of certificate when clients are ready:
- Keep TLS stacks and crypto libraries current. Post-quantum support shows up in updates to servers, load balancers, and clients. Systems that cannot be updated are the ones that stay on classic certificates longest.
- Inventory your certificates. Know every certificate you depend on, who issues it, and when it expires. Forgotten certificates on old servers are where outages come from.
- Automate renewal. If any certificate is still renewed by hand, move it to ACME. Shorter lifetimes force that whether or not you ever request a Merkle Tree Certificate.
- Check ARI support in your client. Not every ACME client and version supports it yet. Find out before an issuer starts requiring it.
- Keep a second issuance path. A backup certificate from a different issuer is cheap insurance while formats and issuers change. Cloudflare already ships a backup certificate from a separate authority with each Universal SSL certificate for this reason.
The bottom line
Post-quantum certificates are a format change with a target date, not an emergency replacement for the certificate you have now. Merkle Tree Certificates are meant to keep that format small enough to use. If your certificates are inventoried, renewed automatically, and served by software you can update, you can adopt them when your clients can.
If you'd like help auditing certificates, setting up ACME automation, or planning for shorter lifetimes and post-quantum certificates across your servers, get in touch with Tierney Dynamics.
Source: Building a certificate authority for the whole Internet, Cloudflare Blog, September 29, 2026.
Comments