Cloudflare makes post-quantum origin TLS automatic — and cuts p90 handshake latency by more than 150ms

On September 8, 2026, Cloudflare announced Automatic Key Exchange for origin TLS 1.3 connections. Cloudflare now probes customer origins out of band to learn the key-agreement algorithms each supports and prefers, then uses that information for the first TLS ClientHello instead of making one static guess for every origin. The system prefers the hybrid post-quantum X25519MLKEM768 exchange where the origin supports it. Automatic Key Exchange is enabled by default for existing and new domains, with separate compliance controls for organizations that need to restrict which algorithms are allowed.

Cloudflare sits between visitor traffic and millions of origin servers, so a TLS optimization at this boundary can affect both security posture and cache-miss/dynamic-request latency without requiring application changes. Before the new system, origins that preferred a different key exchange could respond with a HelloRetryRequest, adding another network round trip. Cloudflare says its scanned cohort fell from roughly 52% HRRs to 3.7%, reducing p90 origin-handshake latency by more than 150 ms. More importantly, capable origins can now move onto hybrid post-quantum exchange automatically instead of requiring each operator to understand and configure the negotiation manually.

TLS 1.3 requires the client to send an initial keyshare before the server has told it which key agreement it prefers. Cloudflare previously led with X25519 for almost every origin. Automatic Key Exchange adds active probing that records the origin’s supported/preferred algorithms, allowing the production connection to lead with the likely correct choice.

For probed origins that support X25519MLKEM768, Cloudflare prefers the standardized hybrid exchange. Cloudflare says roughly one third of its initial scanned cohort selected the post-quantum hybrid as the preferred method, and hundreds of thousands of domains have already moved onto post-quantum origin connections without individual configuration.

If the client offers the wrong first keyshare, a TLS 1.3 origin can ask it to retry, costing another round trip. Cloudflare reports that the HRR rate across scanned origins dropped from about 52% to 3.7%, and that 99.2% of post-quantum origin connections in the cohort now complete without a retry. It measured a reduction of more than 150 ms at p90 for origin handshake latency.

Automatic Key Exchange is on by default, but Cloudflare exposes controls under SSL/TLS for origin connection and post-quantum encryption. A compliance setting can constrain which algorithms Cloudflare advertises and uses, including a mode that permits only hybrid post-quantum key agreement. Cloudflare cautions that most operators should leave strict restrictions unset unless a policy requires them.

The feature applies to Cloudflare connections to origins that support TLS 1.3. It does not mean every visitor, upstream dependency or non-TLS-1.3 connection is automatically post-quantum secure. Operators should distinguish the browser-to-edge, edge-to-origin and application dependency boundaries when making migration claims.