# Cloudflare makes post-quantum origin TLS automatic — and cuts p90 handshake latency by more than 150ms Cloudflare’s Automatic Key Exchange now probes TLS 1.3 origins and chooses their preferred key agreement before traffic arrives, automatically preferring the post-quantum X25519MLKEM768 hybrid where supported instead of paying a second-round-trip retry. The useful shift is automation at the CDN-to-origin boundary: operators no longer need to manually force post-quantum key exchange, while Cloudflare says its measured HelloRetryRequest rate fell from about 52% to 3.7% across the scanned cohort. - Status: Active - Published: 2026-09-09T20:32:44+12:00 - Updated: 2026-09-09T20:32:44+12:00 - Categories: Cloud & Infrastructure, Edge & CDN - Tags: Cloudflare, network performance, post-quantum cryptography, TLS - Canonical HTML: https://beyondthe.news/dossiers/cloudflare-automatic-key-exchange-post-quantum-origin-tls ## What changed On September 8, 2026, Cloudflare announced Automatic Key Exchange for origin TLS 1.3 connections. Cloudflare now probes customer origins out of band to learn the key-agreement algorithms each supports and prefers, then uses that information for the first TLS ClientHello instead of making one static guess for every origin. The system prefers the hybrid post-quantum X25519MLKEM768 exchange where the origin supports it. Automatic Key Exchange is enabled by default for existing and new domains, with separate compliance controls for organizations that need to restrict which algorithms are allowed. ## Why it matters Cloudflare sits between visitor traffic and millions of origin servers, so a TLS optimization at this boundary can affect both security posture and cache-miss/dynamic-request latency without requiring application changes. Before the new system, origins that preferred a different key exchange could respond with a HelloRetryRequest, adding another network round trip. Cloudflare says its scanned cohort fell from roughly 52% HRRs to 3.7%, reducing p90 origin-handshake latency by more than 150 ms. More importantly, capable origins can now move onto hybrid post-quantum exchange automatically instead of requiring each operator to understand and configure the negotiation manually. ## The CDN learns origin capabilities before the real connection TLS 1.3 requires the client to send an initial keyshare before the server has told it which key agreement it prefers. Cloudflare previously led with X25519 for almost every origin. Automatic Key Exchange adds active probing that records the origin’s supported/preferred algorithms, allowing the production connection to lead with the likely correct choice. ## Post-quantum exchange becomes the preferred path when the origin can support it For probed origins that support X25519MLKEM768, Cloudflare prefers the standardized hybrid exchange. Cloudflare says roughly one third of its initial scanned cohort selected the post-quantum hybrid as the preferred method, and hundreds of thousands of domains have already moved onto post-quantum origin connections without individual configuration. ## The latency win comes from avoiding HelloRetryRequest If the client offers the wrong first keyshare, a TLS 1.3 origin can ask it to retry, costing another round trip. Cloudflare reports that the HRR rate across scanned origins dropped from about 52% to 3.7%, and that 99.2% of post-quantum origin connections in the cohort now complete without a retry. It measured a reduction of more than 150 ms at p90 for origin handshake latency. ## The feature is automatic but not invisible to compliance teams Automatic Key Exchange is on by default, but Cloudflare exposes controls under SSL/TLS for origin connection and post-quantum encryption. A compliance setting can constrain which algorithms Cloudflare advertises and uses, including a mode that permits only hybrid post-quantum key agreement. Cloudflare cautions that most operators should leave strict restrictions unset unless a policy requires them. ## This protects the Cloudflare-to-origin leg, not every link in the system The feature applies to Cloudflare connections to origins that support TLS 1.3. It does not mean every visitor, upstream dependency or non-TLS-1.3 connection is automatically post-quantum secure. Operators should distinguish the browser-to-edge, edge-to-origin and application dependency boundaries when making migration claims. ## Key details - Automatic Key Exchange was announced September 8, 2026. - It is enabled by default for new and existing Cloudflare domains. - Cloudflare actively probes TLS 1.3 origins to learn supported and preferred key-agreement algorithms. - The system prefers hybrid X25519MLKEM768 where supported. - Cloudflare says more than a million domains had been assigned key-exchange preferences during the rollout. - About 33% of its initial scanned cohort preferred X25519MLKEM768; roughly 64% stayed on X25519 and about 3% preferred another classical curve. - Cloudflare reports post-quantum origin traffic rising from roughly 25 billion to 45 billion connections per day during the rollout. - The scanned-cohort HelloRetryRequest rate fell from roughly 52% to 3.7%. - Cloudflare reports more than 150 ms lower p90 TLS origin-handshake latency for the scanned cohort. - 99.2% of post-quantum TLS 1.3 connections in that cohort completed without a HelloRetryRequest. - Compliance controls can restrict permitted origin key agreements. ## Builder takeaways - If you use Cloudflare in front of TLS 1.3 origins, verify that your origin software actually supports the hybrid post-quantum exchange before assuming the security upgrade applies. - Measure cache-miss and dynamic-request latency separately from cached edge responses; existing keep-alive origin connections do not pay a new TLS handshake on every request. - Avoid hard-coding one TLS curve or disabling modern negotiation without a compliance reason, because doing so can defeat both performance and migration benefits. - Treat post-quantum migration as multiple network legs: edge-to-origin protection does not automatically cover every client or downstream service. - If policy requires PQ-only or FIPS-compatible behavior, test strict algorithm constraints against every origin and failover endpoint before enforcing them globally. ## What to watch - Completion of the rollout across Cloudflare’s full origin fleet. - Independent measurements of latency changes for real workloads and geographies. - Expansion of automatic post-quantum negotiation to other protocol or connection boundaries. - Origin-server support for X25519MLKEM768 across common web servers, load balancers and cloud platforms. - How Cloudflare’s 2029 post-quantum migration goal changes default cryptographic policy over time. ## Uncertainties - The reported HRR and latency improvements are Cloudflare measurements from the scanned cohort, not an independent internet-wide benchmark. - Benefits apply when a new TLS 1.3 origin connection is created; requests using existing keep-alive connections are unaffected. - Post-quantum preference depends on the origin actually supporting the relevant hybrid exchange. - Cloudflare’s daily post-quantum connection count reflects its own network traffic rather than a census of global TLS adoption. ## Sources - [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)](https://blog.cloudflare.com/automatic-key-exchange-for-origins/) — Cloudflare · primary engineering · 2026-09-08T00:00:00+12:00. Primary source for architecture, default rollout, post-quantum preference, connection volumes, HRR and p90 latency measurements. - [Post-quantum authentication to origins is now supported](https://blog.cloudflare.com/post-quantum-authentication-to-origins/) — Cloudflare · primary engineering · 2026-07-29T00:00:00+12:00. Background on Cloudflare’s broader post-quantum origin migration and distinction between encryption/key exchange and authentication.