Cloudflare signed a definitive agreement to acquire an established root from GlobalSign and has applied to major root programs, the company said in a September 29 announcement. It is not issuing certificates today. The first machine-to-machine certificates, or MTCs, are targeted for the first quarter of 2027. That gap matters more than the announcement itself.
The context is that Cloudflare already sits in the request path for a large share of the web's TLS traffic, mostly as a customer of other certificate authorities. Owning a root changes that relationship from customer to issuer, at least for some future slice of certificates. A purchased root is not a new root. It carries existing trust relationships built over years, which is presumably the point: it shortens the distance to broad trust-store acceptance compared with starting from zero.
Cloudflare's announcement confirms the GlobalSign agreement and the root-program applications. It does not disclose financial terms, which root programs it applied to, or what proportion of Cloudflare's own certificate issuance will eventually move to the new hierarchy. It does not say whether the GlobalSign root will be rebranded, cross-signed, or run under a new policy regime during the transition. Those are open questions, not confirmed plans, and the announcement leaves them that way.
For on-call engineers, nothing in a TLS chain changes today. No certificate currently in production was issued under this arrangement, and none will be until at least Q1 2027. The near-term task is inventory, not response: know which services pin certificates, pin CAs, or hardcode trust anchors tied to existing issuers, because any future shift of Cloudflare-issued certificates to a new root could break pinning logic that was never built to expect a change. Check certificate transparency log monitoring configurations too, since a new issuing hierarchy means new CT log entries to watch for.
The open risk sits in timing and scope. Root program acceptance is not guaranteed on any fixed schedule, and a target date for first issuance is not a commitment that issuance will reach production traffic on day one. Teams running automated certificate renewal, whether through ACME clients or Cloudflare's own APIs, should treat late 2026 and early 2027 as a window worth flagging internally, even though no action is required now. A short line in a runbook costs little; a surprised on-call engineer during a root transition costs more.
What is confirmed: an agreement to acquire a GlobalSign root, applications filed with root programs, and a Q1 2027 target for first MTCs. What is not confirmed: pricing, program names, rollout scope, or whether existing Cloudflare customers will be migrated automatically or by choice. Until Cloudflare issues a certificate under the new hierarchy, the practical obligation for operators is limited to watching trust-store and CT log changes as 2027 approaches.