Cloudflare adds post-quantum authentication for origin servers

Cloudflare has introduced post-quantum authentication for traffic between its edge network and customer origin servers. The update allows operators to secure mutual TLS (mTLS) connections using Module-Lattice-Based Digital Signature Algorithm (ML-DSA) signatures, addressing risks from quantum computing advancements that could compromise classical cryptographic credentials.

How the feature works

The implementation targets the second leg of a typical Cloudflare-proxied request: the connection from Cloudflare’s edge to the customer’s origin server. While the visitor-to-Cloudflare connection has relied on post-quantum encryption since 2022, authentication for the origin leg now supports ML-DSA via two existing products. Authenticated Origin Pulls (AOP) lets customers require Cloudflare to present a client certificate, while Custom Origin Trust Store (COTS) allows replacement of the default certificate authority (CA) trust store with customer-controlled CAs. Both now accept ML-DSA certificates, enabling fully post-quantum-secure mTLS when used together.

Cloudflare recommends ML-DSA-44 for most use cases, citing its balance of performance and NIST category 2 security strength. The company has also updated its control plane and data plane services to parse and validate ML-DSA certificates, though an internal dependency on an older BoringSSL fork initially caused compatibility issues with some customer certificates during testing.

Configuration and requirements

To deploy the feature, customers must generate ML-DSA certificate chains using OpenSSL 3.5.0 or later, with private keys in FIPS 204 seed-only encoding. The process involves creating separate certificate authorities for the origin server and Cloudflare client certificates, then uploading them via Cloudflare’s API. Origins must run TLS 1.3 and be configured to reject non-post-quantum authentication methods to prevent downgrade attacks. Cloudflare provides NGINX configuration examples for both COTS and AOP setups, as well as verification steps to confirm the handshake uses ML-DSA.

Limitations and roadmap

The feature currently excludes the global configuration level for Authenticated Origin Pulls, which remains under development. Cloudflare also plans to add support for Merkle Tree Certificates (MTC) on the origin connection, aligning with its collaboration with Google and the IETF to standardize fast post-quantum certificates for the public web. Native ML-DSA support in Go 1.27, expected in August 2026, is expected to simplify adoption for Go-based services.

An incident in June 2026 highlighted the challenges of migrating legacy systems: a BoringSSL update enforcing stricter KeyUsage validation temporarily invalidated some customer certificates, prompting a rollback and patch to maintain compatibility with non-compliant RSA certificates.