Cloudflare takes more guesswork out of origin encryption

Announcement

8 Sept 2026

Coverage

Global

Primary source

Cloudflare Blog ↗

What changed?

A secure browser connection is only one part of a website’s journey. Traffic also travels between a delivery network and the origin server holding the site.

Cloudflare’s September 8 announcement describes Automatic Key Exchange for that second connection. The system probes origins that support TLS 1.3 to learn their key-agreement capabilities, preferring post-quantum connections where the origin supports them.

What should you keep in mind?

The qualification matters: this is not a claim that every origin suddenly supports post-quantum security. The capability of the server on the other end still determines what can be negotiated.