Cloudflare announced an expansion of its Automatic SSL/TLS service with the Automatic Key Exchange feature, which learns the capabilities of customers’ origin servers before actual connections and then selects the appropriate key-exchange algorithm on the first attempt. The feature prefers the quantum-resistant hybrid algorithm X25519MLKEM768 when the origin server and network path are capable of using it.
The feature targets the second connection established by Cloudflare between its infrastructure and the origin server, not the user’s connection to the platform. Because TLS 1.3 requires the client to send a key-exchange algorithm in the first message, Cloudflare had to use a fixed guess: X25519. If the server preferred another algorithm, it sent a HelloRetryRequest, causing the handshake to restart and adding a full network round trip.
From Guessing to Measurement
Cloudflare performs a series of lightweight TLS handshakes outside the production traffic path, presenting one algorithm in each test from among X25519, P-256, P-384, P-521, and X25519MLKEM768. It uses the results to determine what each origin supports, evaluating subdomains independently and weighting the results according to each one’s actual traffic volume.
The platform then selects the highest available option according to an order that begins with the post-quantum hybrid algorithm, then falls back to the fastest classical algorithm accepted by the origin. Cloudflare rolls out the change gradually to a small portion of the origin’s traffic and monitors the failure rate and HelloRetryRequest requests, then reverts the setting if performance exceeds the baseline. It also rescans origins daily to keep up with changes to load balancers, TLS libraries, or server configurations.
Announced Impact on Performance and Security
Cloudflare says the HelloRetryRequest rate among the measured origins fell from approximately 52% to 3.7%, with a reduction of more than 150 milliseconds in handshake time at the 90th percentile. The impact is particularly visible in requests that require a new connection to the origin, such as dynamic requests or cache misses from the CDN; existing keep-alive connections do not need a new handshake.
According to the company, 99.2% of TLS 1.3 post-quantum connections in the tested group now complete in a single round trip. The volume of traffic from origins using post-quantum key exchange also increased from approximately 25 billion connections to 45 billion connections per day, while hundreds of thousands of domains received this protection without manual intervention. Cloudflare says that 33% of more than one million domains in the initial batch were assigned X25519MLKEM768, while 64% remained on X25519 and 3% used other classical algorithms.
What Changes for Customers in Practice?
The feature is enabled by default for new and existing domains that use origins supporting TLS 1.3, and it can be controlled from the Cloudflare dashboard under SSL/TLS, then Origin connection & post-quantum encryption. If the origin does not support X25519MLKEM768, the feature will not add this capability automatically, but it can select a compatible classical algorithm and avoid unnecessary handshakes.
Cloudflare also provides two compliance settings: restricting negotiation to post-quantum hybrid exchange, or restricting it to FIPS-compatible algorithms. However, enabling post-quantum exchange on an origin that does not support it may cause all TLS 1.3 connections to fail, so the company warns against using this option without prior verification. Cloudflare Radar provides a check of the server and network path’s ability to handle these connections, including issues involving firewalls, middleboxes, and fragmented messages.
Why Does This Announcement Matter?
The change combines a direct performance improvement with an effort to expand adoption of post-quantum encryption without requiring website operators to specify the algorithm manually. However, it does not replace upgrading the origin server or load balancer; the platform cannot negotiate an unsupported algorithm. Post-quantum key exchange also protects against the scenario of recording encrypted data and decrypting it later, but it does not by itself address origin impersonation or authentication downgrade risks. Cloudflare says the next steps include checking support for ML-DSA certificates and preventing fallback to classical certificates when strict post-quantum protection is available.