Is your domain using post-quantum encryption? Now you can see for yourself

Cloudflare has added post-quantum TLS 1.3 visibility to HTTP Traffic Analytics, Log Explorer, and Logpush, enabling customers to monitor the key-exchange algorithms used for individual visitor connections and assess cryptographic readiness by domain. The new telemetry highlights use of the hybrid X25519MLKEM768 algorithm, which combines classical X25519 with post-quantum ML-KEM and is the recommended TLS 1.3 approach for defending against harvest-now-decrypt-later threats, while also identifying traffic that uses classical algorithms, deprecated draft implementations, RSA-based exchanges, or no TLS. Cloudflare reports that roughly 70% of browser traffic reaching its network already uses hybrid ML-KEM, compared with about 15% of Cloudflare-to-origin connections, illustrating a gap in origin adoption. Customers can use the ClientTLSKeyExchangeGroup and OriginTLSKeyExchangeGroup log fields to investigate both visitor-to-Cloudflare and Cloudflare-to-origin encryption, enable TLS 1.3 to allow automatic post-quantum negotiation, or use Cloudflare Tunnel to protect connections to legacy origins. The release is part of Cloudflare’s broader effort to achieve full post-quantum security by 2029, with future plans to expose post-quantum authentication data as certificate and signature technologies become more widely deployed.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.