Cloudflare has tested Merkle Tree Certificates (MTCs) as an alternative to traditional certificate chains, reporting 9% faster median performance in a Chrome experiment. The approach batches certificate data into an append-only Merkle tree, letting clients verify certificates with compact inclusion proofs instead of transmitting a full certificate chain. Cloudflare attributed most of the measured improvement to eliminating intermediate certificates; the experiment used classical signatures rather than post-quantum signatures.
Building on the approach covered in InfoQ’s earlier report, Cloudflare describes how landmark-based verification and independent transparency log cosigners support certificate issuance and verification at scale.
The experiment served billions of MTCs to 50% of Chrome Beta 146 for selected domains on Cloudflare’s free plan. Cloudflare wound down the experiment in August 2026 and is developing a public certificate authority (CA) that supports MTC issuance, targeting inclusion in Chrome’s quantum-resistant Root Store in early 2027, subject to evaluation.
Cloudflare CEO Matthew Prince, in a press release, said:
Upgrading the web's security before quantum computers can break it is one of the biggest coordination challenges in the history of the Internet.
Post-quantum cryptography creates scaling challenges for the Web Public Key Infrastructure (Web PKI). According to Cloudflare, post-quantum signatures can be approximately 40 times larger than classical signatures, increasing bandwidth and storage requirements.
MTCs combine certificate issuance with transparency logging. Instead of signing certificates individually, a certificate authority (CA) records certificate data in an append-only Merkle tree and signs a checkpoint. Clients verify certificate inclusion using cryptographic proofs.
Cloudflare uses the Automated Certificate Management Environment (ACME) protocol to validate domain ownership. An independent mirroring cosigner verifies and stores updated tree states, helping detect inconsistent log views and preserve issuance records if the original log becomes unavailable.
MTC issuance and independent log mirroring (Source: Cloudflare Blog Post)
Landmark relative certificates further reduce TLS handshake data. Cloudflare distributes authenticated landmarks to clients, which verify certificate inclusion using cryptographic proofs. Servers must still prove possession of their private keys. In the common case, the handshake transmits one public key, one signature, and an inclusion proof smaller than 1 KB.
Landmark relative certificate verification using pre-distributed tree landmarks. (Source: Cloudflare Blog Post)
Clients may be newly installed, offline, or missing the relevant landmark update. Servers must therefore retain a standalone MTC certificate as a fallback. Cloudflare identifies independent monitoring at production volume, a diverse ecosystem of CAs and cosigners, and browser support as remaining requirements for broader deployment.
Alicja Tendaj, Tier 2 Technical Support Specialist at SSL.com, raised questions about revocation and incident handling in response to Cloudflare’s announcement on LinkedIn:
With short validity and trust anchored in a tree head, a lot of the old OCSP and CRL playbook becomes a question of how quickly you can stop including a certificate
Cloudflare’s planned public CA will require evaluation before its MTC issuance can be trusted through Chrome’s quantum-resistant Root Store. The company says production deployment will help determine whether the approach can maintain transparency, interoperability, and availability at Internet scale.