From 56e8b58017b836a719332c45917569378a7c8302 Mon Sep 17 00:00:00 2001 From: Alex Krivit Date: Tue, 21 Jul 2026 17:35:41 -0500 Subject: [PATCH] [SSL] Add automatic origin key exchange changelog --- ...26-07-21-automatic-origin-key-exchange.mdx | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx diff --git a/src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx b/src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx new file mode 100644 index 00000000000..924c978941c --- /dev/null +++ b/src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx @@ -0,0 +1,26 @@ +--- +title: Automatic key exchange reduces origin TLS handshake latency +description: Cloudflare now selects one zone-wide key agreement from traffic-weighted origin results, reducing retries and using post-quantum encryption when supported. +date: 2026-07-21 +products: + - ssl +--- + +Cloudflare now automatically selects one zone-wide key agreement for Transport Layer Security (TLS) 1.3 connections to your origins. Cloudflare derives the preference from traffic-weighted results across active origins. Sending the correct key share in the first `ClientHello` avoids a [HelloRetryRequest](https://www.rfc-editor.org/rfc/rfc8446.html#section-4.1.4), removing one network round trip from each new origin connection that would otherwise require a retry. + +Automatic key exchange works with both classical and post-quantum algorithms. When the selected preference is post-quantum, Cloudflare can send the standardized `X25519MLKEM768` hybrid key share first. This protects the connection against harvest-now, decrypt-later attacks without adding a retry. + +Cloudflare uses standardized ML-KEM instead of the obsolete `X25519Kyber768Draft00` key agreement. + +Cloudflare applies each new preference gradually: + +1. Cloudflare scans your active origins and determines a traffic-weighted preference for the zone. +2. Cloudflare sends the new preference to 1% of traffic. +3. Healthy changes increase through 10%, 25%, 50%, 75%, and 100% of traffic. +4. Unhealthy changes roll back to the previous setting. + +Cloudflare continues to advertise the other key agreements allowed by your configuration. If an origin requires a different key share, it can request one without breaking the connection. + +Automatic key exchange is on by default for eligible zones. You can turn it off or restrict the available key agreements with origin TLS compliance requirements. + +For configuration options and detailed behavior, refer to [Automatic key exchange to origins](/ssl/origin-configuration/automatic-key-exchange/).