Cloudflare automates post-quantum TLS for 45bn daily origin links

Cloudflare has rolled out Automatic Key Exchange, a feature that replaces static guesswork in TLS 1.3 handshakes with active measurement of each origin server’s capabilities. The system now negotiates the optimal key agreement algorithm on the first attempt, reducing failed handshakes and enabling post-quantum encryption without requiring manual intervention from site operators.

How the system works

TLS 1.3 requires the client to commit to a key agreement algorithm in the initial ClientHello message before receiving any response from the server. Cloudflare previously defaulted to X25519 for all origin connections, a widely supported but quantum-vulnerable algorithm. If the origin preferred a different algorithm—such as P-256, P-384, or the post-quantum hybrid X25519MLKEM768—the server would respond with a HelloRetryRequest (HRR), forcing a second round trip and adding latency.

Automatic Key Exchange eliminates this guesswork by scanning origin servers out-of-band. The system conducts lightweight TLS handshakes, each offering a single key agreement group (X25519, P-256, P-384, P-521, or X25519MLKEM768), to determine the full set of algorithms the origin supports. Results are weighted by actual traffic volume, ensuring high-traffic subdomains influence the domain-wide preference more than dormant ones. The system then selects the strongest supported algorithm, prioritizing post-quantum hybrids where available, and falls back to the fastest classical option otherwise.

Impact on security and performance

The rollout has two primary effects: faster connections and broader adoption of post-quantum encryption. By avoiding HRRs, the system reduces handshake latency by over 150 ms at the 90th percentile, a benefit that compounds for dynamic requests and CDN cache misses requiring new TLS connections. For post-quantum security, the change is more significant. Before Automatic Key Exchange, nearly all post-quantum origin handshakes required an HRR because Cloudflare’s static default was classical X25519. Now, 99.2% of post-quantum TLS 1.3 connections complete in a single round trip.

The system also accelerates post-quantum adoption by uncovering origins whose support was previously invisible. Many servers accept multiple key agreement algorithms without actively preferring one, meaning passive observation could not detect their full capabilities. Active probing revealed thousands of origins that support X25519MLKEM768 but had never negotiated it in production traffic. Once the scanner updated their preferences, post-quantum connections quickly became the majority for those domains.

Configuration and limitations

Automatic Key Exchange is enabled by default for all domains using Cloudflare’s proxy, requiring no manual action for most setups. Operators can manage settings in the Cloudflare dashboard under SSL/TLS > Overview > Configure > Origin connection & post-quantum encryption. Two compliance-focused options are available:

• Post-quantum hybrid: Restricts negotiation to X25519MLKEM768, removing classical algorithms entirely.
• FIPS: Limits key agreements to FIPS-compliant algorithms.

Selecting both options requires an algorithm that satisfies both criteria; if none exists, the configuration is rejected. These settings are intended for strict policy environments, as enforcing post-quantum hybrid on an origin without X25519MLKEM768 support will cause TLS 1.3 connections to fail. Cloudflare recommends leaving both options unselected unless required by compliance obligations.

What’s next

Cloudflare plans to extend the system’s granularity to the subdomain or origin level, allowing key agreement preferences to vary across multiple backends serving a single domain. An on-demand scan feature is also in development, enabling operators to trigger rescans after upgrading their TLS stack rather than waiting for the next scheduled scan. Longer-term, the company aims to automate post-quantum origin authentication, detecting support for ML-DSA certificates and disabling classical fallback for customers requiring strict post-quantum protection.