Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Cloudflare has introduced Automatic Key Exchange, an extension of Automatic SSL/TLS that actively probes TLS 1.3 origin servers to identify their supported and preferred key-agreement algorithms, allowing Cloudflare to select an optimal algorithm in the initial handshake rather than relying on a universal X25519 default. The system prioritizes the post-quantum hybrid X25519MLKEM768 where supported, otherwise choosing compatible classical curves, and uses staged rollouts, monitoring, and daily rescans to avoid disruptions as origin configurations change. Cloudflare reports that the feature reduced HelloRetryRequest rates among scanned origins from roughly 52% to 3.7%, cutting more than 150 milliseconds from p90 handshake latency, while 99.2% of post-quantum-capable origin connections in the scanned cohort now complete in one round trip. Enabled by default for eligible domains, the feature can be controlled through the dashboard, including optional post-quantum-only or FIPS-compliant requirements, though enforcing unsupported requirements can prevent TLS connections. Cloudflare also provides Radar tools to test origin post-quantum readiness and plans future enhancements including per-origin preferences, on-demand scans, and automated post-quantum origin authentication to reduce certificate downgrade risks.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.