Skip to content

Changelog automatic origin key exchange #32225

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ack-cf wants to merge 2 commits into
base: production
Choose a base branch
from
Open

Changelog automatic origin key exchange #32225

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
56e8b58
[SSL] Add automatic origin key exchange changelog
ack-cf Jul 21, 2026
45fc698
Merge remote-tracking branch 'upstream/production' into changelog-aut…
ack-cf Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions src/content/changelog/ssl/2026-07-21-automatic-origin-key-exchange.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
---
title: Automatic key exchange reduces origin TLS handshake latency
description: Cloudflare now selects one zone-wide key agreement from traffic-weighted origin results, reducing retries and using post-quantum encryption when supported.

@yj7o5 yj7o5 Jul 21, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... now automatically selects zone-wide preferred key ...

@lukevalenta lukevalenta Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'traffic-weighted origin results' bit is more of an implementation detail and doesn't really make a lot of sense here.. maybe this instead?

Suggested change
description: Cloudflare now selects one zone-wide key agreement from traffic-weighted origin results, reducing retries and using post-quantum encryption when supported.
description: Cloudflare now predicts the key agreement algorithm preferred by origins servers to allow for faster connection establishment.

date: 2026-07-21
products:
- ssl
---

Cloudflare now automatically selects one zone-wide key agreement for Transport Layer Security (TLS) 1.3 connections to your origins. Cloudflare derives the preference from traffic-weighted results across active origins. Sending the correct key share in the first `ClientHello` avoids a [HelloRetryRequest](https://www.rfc-editor.org/rfc/rfc8446.html#section-4.1.4), removing one network round trip from each new origin connection that would otherwise require a retry.

@lukevalenta lukevalenta Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like changelog entries are typically kept pretty brief since they all render on a single page: https://developers.cloudflare.com/changelog/

Perhaps we just state some of the higher-level details and refer to the dev docs? Did something similar here: https://github.com/cloudflare/cloudflare-docs/pull/31540/changes#diff-4f604d1132f43c41a53564b0f8c80495fa529d40a018ff6b9a40b01a69c2e70a


Automatic key exchange works with both classical and post-quantum algorithms. When the selected preference is post-quantum, Cloudflare can send the standardized `X25519MLKEM768` hybrid key share first. This protects the connection against harvest-now, decrypt-later attacks without adding a retry.

Cloudflare uses standardized ML-KEM instead of the obsolete `X25519Kyber768Draft00` key agreement.

Cloudflare applies each new preference gradually:

1. Cloudflare scans your active origins and determines a traffic-weighted preference for the zone.
2. Cloudflare sends the new preference to 1% of traffic.
3. Healthy changes increase through 10%, 25%, 50%, 75%, and 100% of traffic.
4. Unhealthy changes roll back to the previous setting.

Cloudflare continues to advertise the other key agreements allowed by your configuration. If an origin requires a different key share, it can request one without breaking the connection.

Automatic key exchange is on by default for eligible zones. You can turn it off or restrict the available key agreements with origin TLS compliance requirements.

For configuration options and detailed behavior, refer to [Automatic key exchange to origins](/ssl/origin-configuration/automatic-key-exchange/).
Loading