Cloudflare has tested Merkle Tree Certificates (MTCs) as an alternative to traditional certificate chains, reporting 9% faster median performance in a Chrome experiment, and is developing a public certificate authority (CA) to support MTC issuance, with inclusion in Chrome’s quantum-resistant Root Store targeted for early 2027, subject to evaluation.
Cloudflare ran the experiment using its MTC approach, which batches certificate data into an append-only Merkle tree and lets clients verify certificates with compact inclusion proofs rather than transmitting a full certificate chain. The experiment served billions of MTCs to 50% of Chrome Beta 146 for selected domains on Cloudflare’s free plan before winding down in August 2026.
Post-quantum cryptography creates scaling challenges for the Web Public Key Infrastructure (Web PKI). Cloudflare said post-quantum signatures can be approximately 40 times larger than classical signatures, increasing bandwidth and storage requirements. MTCs combine certificate issuance with transparency logging: instead of signing certificates individually, a CA records certificate data in an append-only Merkle tree and signs a checkpoint, and clients verify inclusion using cryptographic proofs. An independent mirroring cosigner verifies and stores updated tree states to help detect inconsistent log views and preserve issuance records if the original log becomes unavailable.
Cloudflare CEO Matthew Prince said in a press release: "Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet."
Landmark relative certificates further reduce TLS handshake data. Cloudflare distributes authenticated landmarks to clients, which verify certificate inclusion using cryptographic proofs. In the common case, the handshake transmits one public key, one signature, and an inclusion proof smaller than 1 KB. Servers must still prove possession of their private keys. For clients that are newly installed, offline, or missing the relevant landmark update, servers must retain a standalone MTC certificate as a fallback.
Alicja Tendaj, Tier 2 Technical Support Specialist at SSL.com, raised questions about revocation and incident handling in response to Cloudflare’s announcement on LinkedIn: "With short validity and trust anchored in a tree head, a lot of the old OCSP and CRL playbook becomes a question of how quickly you can stop including a certificate."
Cloudflare identified independent monitoring at production volume, a diverse ecosystem of CAs and cosigners, and browser support as remaining requirements for broader deployment. The company’s planned public CA will require evaluation before its MTC issuance can be trusted through Chrome’s quantum-resistant Root Store. The company says production deployment will help determine whether the approach can maintain transparency, interoperability, and availability at Internet scale.
Analysis
Why This Matters
- The transition to post-quantum cryptography is urgent: quantum computers could eventually break current public-key cryptography, threatening all encrypted web traffic. Cloudflare's MTC approach aims to reduce the bandwidth and performance penalty of large post-quantum signatures.
- If adopted broadly, the technology could make quantum-resistant web security practical without major performance degradation, encouraging faster migration.
- The public CA and potential inclusion in Chrome's Root Store would set a precedent for how certificate authorities handle post-quantum issuance at scale.
Background
The Web PKI relies on certificate chains that validate website identities. Post-quantum signatures are significantly larger than classical ones (Cloudflare estimates about 40 times larger), which would bloat TLS handshakes and increase load times. Merkle Tree Certificates address this by replacing full certificate chains with small cryptographic proofs, an idea explored since the late 2010s. Cloudflare's experiment is one of the first large-scale deployments on a major browser.
Key Perspectives
Cloudflare: Sees MTCs as a necessary evolution of the web's security infrastructure, with its CEO calling the coordination challenge one of the biggest in internet history. The company is actively developing a public CA to make the approach available to all domains.
Alicja Tendaj (SSL.com): Raises concerns about how revocation and incident response would work under the new model, noting that the old OCSP and CRL mechanisms may not translate directly.
What to Watch
- Chrome's evaluation of Cloudflare's planned public CA for inclusion in the quantum-resistant Root Store, expected in early 2027.
- Adoption by other certificate authorities and cosigners to build a diverse ecosystem.
- Real-world performance and reliability data from production deployment, including how quickly compromised certificates can be blocked under the new model.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedCloudflare is developing a public certificate authority for post-quantum web security.InfoQ: “Cloudflare Develops Public Certificate Authority for Post-Quantum Web Security.”
- Partly supportedCloudflare reported 9% faster median performance in a Chrome experiment with MTCs.InfoQ: “Cloudflare has tested Merkle Tree Certificates (MTCs) as an alternative to traditional certificate chains, reporting 9% faster median performance in a Chrome experiment. ... the experiment used classical signatures rather than post-quantum signatures.”
- SupportedCloudflare CEO Matthew Prince said in a press release that upgrading web security before quantum computers can break it is one of the Internet’s biggest coordination challenges.InfoQ: “Cloudflare CEO Matthew Prince , in a press release , said: Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet.”
- SupportedAlicja Tendaj of SSL.com raised questions about revocation and incident handling in response to Cloudflare’s LinkedIn announcement, saying, “With short validity and trust anchored in a tree head, a lot of the old OCSP and CRL playbook becomes a question of how quickly you can stop including a certificate.”InfoQ: “Alicja Tendaj, Tier 2 Technical Support Specialist at SSL.com, raised questions about revocation and incident handling in response to Cloudflare’s announcement on LinkedIn : With short validity and trust anchored in a tree head, a lot of the old OCSP and CRL playbook becomes a question of how quickly you can stop including a certificate”
- SupportedCloudflare targets inclusion of its MTC issuance in Chrome’s quantum-resistant Root Store in early 2027, subject to evaluation.InfoQ: “Cloudflare wound down the experiment in August 2026 and is developing a public certificate authority (CA) that supports MTC issuance, targeting inclusion in Chrome’s quantum-resistant Root Store in early 2027, subject to evaluation.”
- SupportedThe experiment served billions of MTCs to 50% of Chrome Beta 146 for selected domains on Cloudflare’s free plan.InfoQ: “The experiment served billions of MTCs to 50% of Chrome Beta 146 for selected domains on Cloudflare’s free plan.”
- SupportedCloudflare wound down the experiment in August 2026.InfoQ: “Cloudflare wound down the experiment in August 2026”
- SupportedCloudflare said post-quantum signatures can be approximately 40 times larger than classical signatures.InfoQ: “According to Cloudflare, post-quantum signatures can be approximately 40 times larger than classical signatures, increasing bandwidth and storage requirements.”
- SupportedMTCs combine certificate issuance with transparency logging: a CA records certificate data in an append-only Merkle tree and signs a checkpoint, and clients verify inclusion with cryptographic proofs.InfoQ: “Instead of signing certificates individually, a certificate authority (CA) records certificate data in an append-only Merkle tree and signs a checkpoint. Clients verify certificate inclusion using cryptographic proofs.”
- SupportedAn independent mirroring cosigner verifies and stores updated tree states to help detect inconsistent log views and preserve issuance records if the original log becomes unavailable.InfoQ: “An independent mirroring cosigner verifies and stores updated tree states, helping detect inconsistent log views and preserve issuance records if the original log becomes unavailable.”
- SupportedIn the common case, the TLS handshake transmits one public key, one signature and an inclusion proof smaller than 1 KB.InfoQ: “In the common case, the handshake transmits one public key, one signature, and an inclusion proof smaller than 1 KB.”
- SupportedFor clients that are newly installed, offline or missing the relevant landmark update, servers must retain a standalone MTC certificate as a fallback.InfoQ: “Clients may be newly installed, offline, or missing the relevant landmark update. Servers must therefore retain a standalone MTC certificate as a fallback.”
