Cloudflare has begun rolling out Automatic Key Exchange for origin connections, a TLS optimization aimed at making CDN-to-origin handshakes both faster and more resistant to future quantum decryption risk.
The company said the system probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support, then leads with the best option on the first connection attempt. Where an origin supports it, Cloudflare says it will prefer the hybrid post-quantum algorithm X25519MLKEM768.
For hosting teams, the practical point is that this affects the link between Cloudflare’s edge and the web server, not just the browser-to-CDN leg. Cloudflare said its rollout reduced HelloRetryRequest rates from roughly 52% to 3.7%, cutting more than 150 ms from p90 connection-handshake latency. It also said hundreds of thousands of domains are already using post-quantum origin connections without manual configuration.
The feature is enabled by default for eligible domains whose origins support TLS 1.3. Cloudflare reported that, in its initial cohort, about 64% of domains remained on X25519, about 33% moved to X25519MLKEM768, and the remaining 3% selected another classical curve preferred by the origin.
The update is another sign that post-quantum TLS work is moving from standards and browser-edge experiments into day-to-day hosting infrastructure. Site operators using Cloudflare should still audit origin TLS configuration, certificate hygiene and application compatibility, but the migration path is increasingly being handled at the CDN layer rather than requiring every small site owner to tune cryptographic preferences manually.