Before Cloudflare can send a request to an origin server, a new encrypted connection needs to agree on how it will exchange keys. A poor first guess can add another round trip. Multiply that across new connections and a small protocol detail becomes operational work.
Cloudflare announced Automatic Key Exchange on September 8. It probes an origin’s capabilities and chooses a suitable first key share, including a hybrid post-quantum option when the origin supports it. The change concerns the Cloudflare-to-origin connection.
Learn what the origin can actually do
Automatic Key Exchange uses out-of-band probes to learn which supported algorithms an origin accepts. Cloudflare describes a gradual rollout with health checks and rollback of unhealthy changes. The aim is to start a connection with an appropriate choice rather than ask every origin to handle the same default.
When the server supports a compatible hybrid post-quantum exchange, Cloudflare can select it on the first attempt. The feature does not install that support on the origin. The server’s TLS stack and the zone’s permitted algorithms remain part of the result.
Check the connection path first
The documentation lists the feature on all plans and says it is enabled for existing zones and by default for new zones. The announcement describes enrollment continuing through the rollout, so a team should check its own zone before assuming the change is active everywhere.
There are specific conditions: Full, Full (strict), or Strict mode; TLS 1.3 negotiation; and an origin connection that does not use Cloudflare Tunnel. The current algorithm preference is shared across the origins in a zone. Per-origin preferences are described as future work.
Sources and release notes: [2]
Keep performance claims in context
A key exchange happens when a connection is established. Requests that reuse an open connection do not repeat it. That distinction makes it misleading to turn a handshake improvement into a promise that every page request will be faster.
Cloudflare reports improvements in its scanned origin cohort, but those results are not measurements of a particular customer application. An operator should look at connection establishment, retries and the relevant request path before deciding how much the change affects the service.
Sources and release notes: [1]
What we would review
For a team already using Cloudflare, this belongs in a normal infrastructure review. Confirm the origin software and TLS support, understand whether traffic uses Tunnel, and check which algorithms are allowed for the zone.
Then compare the behavior of new connections over a useful observation window. Keep the existing application-level checks as well. A cleaner connection setup is valuable, but the user’s experience still depends on the rest of the system.
- Identify the actual origin connection path and eligible TLS mode.
- Check origin support before expecting a post-quantum exchange.
- Measure new-connection behavior separately from reused connections.
Sources and release notes
Original analysis by AtmosGate, based on the sources below. Vendor claims and release status are attributed to their publishers.
- Automatic Key Exchange for origins
Cloudflare · 8 September 2026
- Automatic Key Exchange documentation
Cloudflare