Cloudflare measures origin capabilities before choosing TLS keys

A TLS 1.3 client sends its proposed key agreement before learning what the server supports. Choosing poorly can add another round trip. Cloudflare’s Automatic Key Exchange probes origin servers and uses those observations to choose the first offer, preferring a post-quantum hybrid when supported. The approach turns a fixed default into a decision informed by each origin’s capabilities.

Cloudflare · Sep 8, 2026

Why it matters

Worth reading when handshake latency matters or different origin stacks support different cryptographic options.

More context

This is a September 8 catch-up article. Check your Cloudflare SSL/TLS configuration and the documented origin-readiness check; origin software must support the desired algorithm before it can be negotiated.

Keep in mind

Cloudflare reports fleet-level improvements, not a guaranteed latency saving for your service. This concerns the Cloudflare-to-origin connection, not every part of the browser’s connection.

Original read