TL;DR: Cloudflare intends to become a public certificate authority, adding a second free automated CA at internet scale while pushing stricter ACME Renewal Information support, more issuer diversity and a longer post-quantum transition, according to Red Sift research. That shifts certificate governance from simple renewal to inventory, automation and issuer visibility.
At a glance
What this is: Red Sift reports that Cloudflare plans to become a public certificate authority, which would add a new large-scale issuer into an already changing TLS ecosystem.
Why it matters: For IAM and security teams, the practical issue is not just certificate issuance, but maintaining inventory, renewal automation and issuer trust as more CAs and certificate formats enter the estate.
By the numbers:
- Cloudflare sits in front of more than 20% of global web request traffic.
- Let's Encrypt issues around 10 million certificates a day and serves more than 500 million sites.
- Under CA/Browser Forum ballot SC-081v3, maximum certificate lifetimes drop to 100 days in March 2027 and 47 days in March 2029.
Context
Certificate authorities are part of the trust layer behind TLS, but most practitioners experience them only when renewal breaks or issuer trust changes. This article is really about governance pressure: more issuers, shorter lifetimes, stricter automation requirements and a harder inventory problem.
Cloudflare’s move matters because it combines scale, automation and post-quantum planning in one development. For teams managing machine identities and certificates, the core issue is whether their estate can absorb issuer change without losing visibility or control.
The article’s certificate focus is typical of modern PKI operations at internet scale, but the expected increase in issuer diversity makes the control problem more acute than before.
Key questions
Q: How should teams handle certificate governance when new public CAs enter the ecosystem?
A: Treat CA diversity as an inventory and policy problem, not just a trust-store issue. Teams should track every issuer, validate renewal automation across all clients, and make unexpected provenance visible in monitoring. The goal is to prevent new issuers from slipping into the estate without review or lifecycle control.
Q: Why do shorter certificate lifetimes create more operational risk?
A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption. If those steps are manual or fragmented, more frequent renewals increase the chance of missed deadlines and failed services. The risk is not the shorter lifetime itself. The risk is weak lifecycle discipline at higher tempo.
Q: What breaks when ACME clients cannot support renewal coordination signals?
A: When clients cannot handle coordinated renewal signals, certificate replacement becomes fragmented during revocation or policy change. Some systems renew too late, others miss the timing window entirely, and teams are left with manual recovery. That failure mode matters because automation only works if the client can act on CA instructions.
Q: What does a parallel classic and post-quantum certificate estate mean for compliance and operations?
A: It means teams must govern two certificate populations at once, each with its own compatibility profile, monitoring logic and renewal rhythm. That increases the chance of blind spots if inventory is incomplete. Security and compliance teams need to confirm that controls can distinguish format, issuer and lifecycle stage cleanly.
Technical breakdown
Why more free CAs change certificate governance
A certificate authority is a trust anchor that browsers and operating systems rely on to validate TLS certificates. When only a few issuers dominate, teams can treat renewal and trust monitoring as a narrow operational task. When a large network operator enters the CA market, the problem shifts to ecosystem governance: more issuance paths, more trust relationships, and more certificate records to reconcile across tooling. That is especially relevant for NHI and machine identity programmes because certificates are credentials, not just transport artefacts.
Practical implication: inventory every issuer in use and treat CA diversity as a governance control, not just a procurement detail.
How ACME and ARI reshape renewal automation
ACME is the protocol that automates certificate issuance, while ACME Renewal Information lets a CA tell clients when to renew. That matters because renewal at scale is not only about expiry dates; it is about coordinated replacement when revocation or policy change affects many certificates at once. If clients cannot act on ARI, they may miss CA-driven timing signals and fail at the exact point where rapid replacement matters most. In a machine identity estate, that is a lifecycle control issue, not a convenience feature.
Practical implication: validate ARI support in every ACME client before relying on automated issuance from multiple CAs.
Why post-quantum certificate formats create a parallel lifecycle
Merkle Tree Certificates are designed to reduce the size and operational burden of post-quantum certificate chains. The significance is not the format itself, but the coexistence period: classic certificates and post-quantum certificates will need to run side by side for years, with different compatibility and monitoring requirements. That creates two certificate lifecycles in parallel, which raises the bar for inventory, policy enforcement and device compatibility tracking. The governance issue is transition management, not just cryptographic novelty.
Practical implication: prepare separate monitoring and compatibility checks for classic and post-quantum certificate populations.
NHI Mgmt Group analysis
Certificate sprawl is becoming a machine identity governance problem, not a PKI footnote. The article shows that issuer diversity, shorter lifetimes and automated renewal are converging. That means security teams need to treat public TLS certificates as governed credentials with lifecycle, scope and inventory requirements. The practitioner conclusion is simple: if you cannot see every certificate and issuer, you cannot govern the estate.
ARI support is turning renewal timing into a control boundary. Once a CA can dictate renewal windows, the quality of the ACME client becomes part of the trust model. Organisations that still rely on manual exception handling or brittle tooling will struggle to absorb revocation events cleanly. The practical takeaway is that certificate automation must be validated as an end-to-end control, not assumed because issuance is automated.
Post-quantum migration will expose hidden weaknesses in certificate inventories. Running classic certificates and Merkle Tree Certificates side by side increases the chance that monitoring, compatibility and exception handling drift out of sync. That is a familiar identity governance pattern: when a transition creates parallel credential types, unmanaged complexity grows faster than policy. The practitioner conclusion is to prepare for dual-format certificate oversight now, before the migration becomes urgent.
Cloudflare’s CA move also validates the need for issuer-aware observability. A new trusted issuer can appear as a harmless change unless monitoring is tuned to distinguish expected renewal from unexpected certificate provenance. For teams responsible for NHI and certificate governance, the issue is not simply expiry alerting but provenance tracking across the full certificate estate. The practitioner conclusion is to monitor issuer changes as first-class events.
Certificate lifecycle management is now a resilience control. The move toward more frequent renewals and more automated replacement makes certificate governance part of operational continuity, not just security hygiene. The article’s core signal is that teams with weak inventory discipline will feel the transition first. The practitioner conclusion is to align certificate management with resilience planning and identity governance oversight.
What this signals
Cloudflare’s CA plan is a reminder that machine identity programmes need issuer-aware inventory, not just renewal automation. Once multiple free CAs coexist, the governance challenge becomes provenance tracking across the full certificate estate. The practical question for security teams is whether their tooling can distinguish expected issuer change from unapproved certificate issuance.
Dual-format certificate operations will expose weak lifecycle discipline. Classic certificates and post-quantum certificates will coexist for years, which means policy, monitoring and compatibility will need to work across two formats at once. Teams that cannot separate those populations cleanly will struggle to maintain control during the transition.
Certificate lifecycle management now sits closer to resilience and trust governance than to simple expiry handling. The operational risk is not only failure to renew, but failure to understand where certificates came from, which clients can accept them, and how quickly they can be replaced after policy change.
For practitioners
- Inventory every public certificate issuer Track all trusted issuers across your environment, including partner CAs and any future Cloudflare-issued certificates, so issuer changes do not blend into routine renewal noise.
- Validate ACME client support for ARI Confirm that every ACME client can process ACME Renewal Information so revocation-driven renewal changes are handled automatically rather than manually.
- Prepare dual-format monitoring for classic and post-quantum certificates Plan to observe classic certificates and Merkle Tree Certificates as separate operational populations during the migration period, with distinct compatibility checks and expiry handling.
- Update certificate inventory alerts for new issuer names Tune monitoring so a new issuer is treated as expected change when approved, while still flagging unexpected provenance or unexplained certificate issuance.
Key takeaways
- Cloudflare’s move to become a public CA raises the governance bar for certificate estates, especially where multiple issuers and automated renewal now coexist.
- The article points to a wider shift toward shorter lifetimes, stricter client requirements and dual-format certificate operations during the post-quantum transition.
- Teams need inventory, issuer visibility and ACME client validation now, because the control problem is moving from renewal dates to lifecycle governance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Public certificates are credentials that must be inventoried and tracked across issuers. |
| NHI-07 — Long-Lived Secrets | The article’s shorter renewal cycles and parallel formats increase lifecycle pressure on certificate estates. | |
| Recommendation — Inventory issued certificates and revoke any untracked or unexpected credentials immediately. Shorten certificate lifetimes where possible and enforce renewal automation before expiry windows collapse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Certificate renewal, rotation and revocation are authenticator lifecycle controls. |
| Recommendation — Apply IA-5 to manage certificate issuance, renewal and revocation as a governed lifecycle. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Certificate trust and issuer control affect how credentials are authorised and accepted. |
| Recommendation — Use PR.AA-05 to enforce approved certificate issuance and acceptance across the environment. | ||
| CIS Controls v8 | CIS-5 — Account Management | Certificate estates require ownership and lifecycle control similar to account governance. |
| Recommendation — Extend account-style ownership and review processes to certificate issuance and retirement. | ||
Key terms
- Certificate Authority: A Certificate Authority is a trusted organisation that issues and signs digital certificates binding identities to public keys. Defenders rely on it to establish trust for TLS and other certificate-based systems, while attackers target weak issuance processes, stolen signing keys, or mis-issuance to impersonate services and users.
- ACME Renewal Information: ACME Renewal Information is a protocol extension that tells clients when certificate renewal should happen. It helps operators avoid mass expirations by distributing renewal timing more predictably, which is especially useful in large or highly automated PKI environments where synchronized renewals can cause outages.
- Merkle Tree Certificate: A certificate format that proves inclusion in a transparent log instead of relying only on a traditional signed chain. It compresses validation into a Merkle inclusion proof, which keeps transport overhead lower while preserving verifiable trust and append-only auditability.
- Certificate Inventory: A certificate inventory is the authoritative list of all certificates in use across an environment, including owner, expiry, issuing authority, and deployment location. It is the control foundation for monitoring and renewal because teams cannot govern what they cannot reliably enumerate.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, machine identity security and secrets management in a structured practitioner format, including the NHI Foundation Level course, the industry's only accredited NHI security programme. It helps security and IAM practitioners connect identity lifecycle control to broader operational resilience.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org