Cloudflare Post-Quantum Setup: What Is Enabled and What You Still Need to Do
If your site is behind Cloudflare, your visitors already get post-quantum key exchange on the client-to-Cloudflare leg. Cloudflare enabled X25519MLKEM768 server-side by default, and modern browsers (Chrome, Edge, Firefox, Safari on iOS 26/macOS Tahoe) negotiate it automatically.
But that is only half the connection. The Cloudflare-to-your-origin leg may still use classical TLS. And certificate signatures remain classical unless you explicitly opt into Cloudflare’s new PQ authentication features. This guide covers what is already enabled, what still needs manual setup, and the August 2026 origin authentication upgrade.
What Cloudflare already does (no action needed)
Client-to-Cloudflare edge: PQ key exchange
- X25519MLKEM768 is accepted server-side on all Cloudflare domains by default
- No configuration needed, no dashboard toggle, it just works
- Any browser that offers X25519MLKEM768 in its ClientHello will get a PQ handshake
- As of mid-2026, approximately 35%+ of HTTPS connections to Cloudflare use PQ key exchange (growing as browser adoption increases)
What this protects: Traffic between the user’s browser and Cloudflare’s edge server is protected against harvest-now-decrypt-later attacks. An adversary storing this encrypted traffic cannot decrypt it with a future quantum computer.
Cloudflare WARP: PQ tunnel
If your users connect via Cloudflare WARP (1.1.1.1 or Zero Trust), the VPN tunnel itself uses PQ key exchange via MASQUE/QUIC. This is also enabled by default in the latest WARP client.
What you need to configure manually
Cloudflare-to-origin connections
The traffic between Cloudflare’s edge and your origin server uses a separate TLS connection. By default, this connection uses classical TLS (X25519 or P-256 key exchange).
Why this matters: If an adversary can intercept traffic between Cloudflare and your origin (colocated network, ISP-level interception, BGP hijacking), they can store this traffic and decrypt it later even though the client-to-Cloudflare leg was PQ-protected.
How to fix:
Option 1: Enable PQ key exchange on your origin server (requires OpenSSL 3.5+ or equivalent), then Cloudflare will negotiate PQ when connecting to your origin if both sides support it.
Option 2: Use Cloudflare Tunnel (cloudflared) which creates an outbound-only connection from your origin to Cloudflare. The Tunnel connection uses Cloudflare’s own TLS implementation and benefits from their PQ support.
Origin authentication with ML-DSA (new, August 2026)
In August 2026, Cloudflare announced support for post-quantum authentication to origins using ML-DSA signatures. This covers:
- Authenticated Origin Pulls: Cloudflare presents an ML-DSA client certificate when connecting to your origin, proving it is really Cloudflare (not an impersonator)
- Custom Origin Trust Store: You can upload ML-DSA certificates that your origin uses, and Cloudflare will verify them with PQ signatures
This is significant because it upgrades both the key exchange (ML-KEM, already available) and the authentication (ML-DSA, new) of the Cloudflare-to-origin connection to post-quantum.
How to enable:
- Go to Cloudflare Dashboard > SSL/TLS > Origin Server
- Enable “Authenticated Origin Pulls” if not already enabled
- Select “Post-Quantum (ML-DSA)” as the certificate type
- Configure your origin to accept the ML-DSA client certificate
Check Cloudflare’s documentation for current step-by-step instructions as this feature is new and the interface may evolve.
Full end-to-end PQ path
For complete quantum safety, you need PQ on all three legs:
| Leg | Status | Action needed |
|---|---|---|
| Client to Cloudflare edge | ✅ Enabled by default | None (automatic) |
| Cloudflare edge to origin | ⚠️ Manual | Upgrade origin TLS or use Tunnel |
| Origin internal | ⚠️ Manual | Depends on your stack |
Most sites only need to worry about the first two. The third (internal origin communication) only matters if you have services communicating within your own infrastructure that carry sensitive data worth protecting against harvest attacks.
Verifying PQ is active
Check client-to-edge PQ
Use Cloudflare Radar: radar.cloudflare.com/post-quantum
Enter your domain. It will show whether the server (Cloudflare edge) negotiates X25519MLKEM768 and what percentage of traffic uses PQ.
Check edge-to-origin PQ
Currently there is no self-service dashboard metric for this. You can verify by:
- Checking your origin server’s TLS logs for the negotiated cipher suite
- Using
openssl s_client -connect your-origin-ip:443 -groups X25519MLKEM768from a Cloudflare IP range - Enabling Cloudflare Logpush with TLS connection details
For Cloudflare One (Zero Trust) customers
Cloudflare One provides additional PQ coverage:
- WARP client to edge: PQ key exchange via MASQUE (automatic)
- Edge to private network: PQ available via Cloudflare Tunnel
- Gateway policies: traffic inspection happens after PQ decryption at the edge, then re-encrypted with PQ to the destination
This means Zero Trust customers can achieve end-to-end PQ encryption for their entire corporate traffic flow without modifying individual applications.
What Cloudflare does NOT yet support (PQ gaps)
- PQ certificates in the public trust chain: Cloudflare’s edge certificates (presented to browsers) still use ECDSA or RSA signatures. PQ certificate signatures (ML-DSA) in the public WebPKI are not yet available because browser trust stores do not yet include PQ root CAs.
- PQ for non-HTTPS protocols: Only HTTPS and WARP tunnel traffic get PQ. Other proxied protocols (WebSocket over TLS, gRPC) benefit from PQ TLS but non-TLS protocols do not.
Timeline summary
| Date | What Cloudflare shipped |
|---|---|
| 2022 | First PQ key exchange experiment (Kyber) |
| 2024 | X25519MLKEM768 server-side default for all domains |
| Jul 2026 | WARP client PQ via MASQUE |
| Aug 2026 | ML-DSA authenticated origin pulls |
| Future | PQ certificates in public trust chain (waiting on WebPKI) |
FAQ
Do I need to do anything if my site is on Cloudflare?
For client-facing PQ key exchange, no. It works automatically. For full end-to-end PQ (including origin connections), you need to upgrade your origin server’s TLS or use Cloudflare Tunnel.
Does this work with the free Cloudflare plan?
Yes. PQ key exchange is enabled for all plans including free. The ML-DSA origin authentication is available on Pro plans and above (check current plan requirements).
Will Cloudflare’s PQ slow down my site?
Negligibly. The PQ key exchange adds roughly 1 KB to the TLS handshake and low single-digit milliseconds of latency. For most sites this is undetectable. Cloudflare’s edge infrastructure handles the computation efficiently.
What about my origin on a different cloud provider?
Your origin just needs to support X25519MLKEM768 in its TLS configuration. This requires OpenSSL 3.5+ (or equivalent). Most cloud provider managed services (AWS ALB, GCP Load Balancer) do not yet expose PQ cipher suite configuration for customer-facing TLS termination.
When will Cloudflare edge certificates use PQ signatures?
When browser trust stores include PQ root CAs. This is a WebPKI-wide decision, not a Cloudflare-specific one. Expected timeline: 2027-2028 for experimental PQ roots, later for mandatory transition.