Cloudflare’s CA move: are your certificate controls ready?

TL;DR: Cloudflare intends to become a public certificate authority, adding a second free automated CA at internet scale while pushing stricter ACME Renewal Information support, more issuer diversity and a longer post-quantum transition, according to Red Sift research. That shifts certificate governance from simple renewal to inventory, automation and issuer visibility.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Cloudflare certificate authority: what it means for you”.

By the numbers:

• Let's Encrypt issues around 10 million certificates a day and serves more than 500 million sites.
• Under CA/Browser Forum ballot SC-081v3, maximum certificate lifetimes drop to 100 days in March 2027 and 47 days in March 2029.

Key questions

Q: How should teams handle certificate governance when new public CAs enter the ecosystem?

A: Treat CA diversity as an inventory and policy problem, not just a trust-store issue.

Q: Why do shorter certificate lifetimes create more operational risk?

A: Shorter lifetimes compress the time teams have to discover, approve, renew, and validate trust without interruption.

Q: What breaks when ACME clients cannot support renewal coordination signals?

A: When clients cannot handle coordinated renewal signals, certificate replacement becomes fragmented during revocation or policy change.

Practitioner guidance

• Inventory every public certificate issuer Track all trusted issuers across your environment, including partner CAs and any future Cloudflare-issued certificates, so issuer changes do not blend into routine renewal noise.
• Validate ACME client support for ARI Confirm that every ACME client can process ACME Renewal Information so revocation-driven renewal changes are handled automatically rather than manually.
• Prepare dual-format monitoring for classic and post-quantum certificates Plan to observe classic certificates and Merkle Tree Certificates as separate operational populations during the migration period, with distinct compatibility checks and expiry handling.

Bottom line: Cloudflare’s move to become a public CA raises the governance bar for certificate estates, especially where multiple issuers and automated renewal now coexist.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →