Post-quantum TLSTLSThe protocol behind the padlock in a browser. It encrypts traffic between a visitor and a website, and it is the single biggest place post-quantum encryption has to land. has moved beyond protecting the exchange of session keys. On 29 July 2026, Cloudflare published the engineering details behind ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. certificate support for Authenticated Origin Pulls and Custom Origin Trust Store.
The feature applies to the connection between Cloudflare and a customer’s origin server. Within that controlled boundary, operators can now combine a post-quantum key agreement with post-quantum certificate authentication. That makes this a useful production case study—but not evidence that the public browser certificate ecosystem has completed its migration.
Key agreement and authentication solve different problems
A TLSTLSThe protocol behind the padlock in a browser. It encrypts traffic between a visitor and a website, and it is the single biggest place post-quantum encryption has to land. connection needs to establish session keys and authenticate the systems at each end. Those functions face related but different quantum risks.
The hybrid X25519MLKEM768 mechanism addresses key establishment. It combines the established X25519 exchange with NIST’s ML-KEM-768ML-KEM-1024The NIST-standardised way for two systems to agree on a secret key without a quantum computer being able to work it out. It replaces the key exchange used by most of the internet today.. Its immediate value is reducing harvest-now, decrypt-later exposure: recorded traffic should not become readable later merely because the classical component is broken.
Certificates and digital signatures authenticate the peers. A future cryptographically relevant quantum computer could threaten widely deployed RSA and elliptic-curve credentials, creating an impersonation risk. ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered., standardised by NIST in FIPS 204, is designed for this signature layer.
A migration dashboard therefore needs separate fields for key agreement and authentication. “PQC enabled” is too vague to show what a connection actually protects.
What Cloudflare supports on the origin hop
The two affected controls protect opposite directions of trust:
- Authenticated Origin Pulls (AOP) lets Cloudflare present a client certificate that the origin verifies. Per-zone and per-hostname configurations can now use ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. certificates.
- Custom Origin Trust Store (COTS) lets Cloudflare verify an origin certificate against a customer-controlled certificate authority. That private trust chain can now use ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered..
- When both are configured, the Cloudflare-to-origin hop can authenticate both peers with ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered.. With X25519MLKEM768, the same hop can use post-quantum mechanisms for key establishment as well.
Cloudflare supports ML-DSA-44, ML-DSA-65 and ML-DSA-87ML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered., and recommends ML-DSA-44 for most applications because of its performance profile. Its current origin guidance calls for TLS 1.3, a compatible TLS stack such as OpenSSL 3.5.0 or later, and FIPS 204FIPS numbersFIPS is the US government publication series that makes an algorithm official. A FIPS number means the algorithm is approved for real deployment, not still a proposal. seed-only encoding for uploaded private keys.
This is not yet the public post-quantum WebPKIPKIThe certificate system that proves a server or a person is genuine. Every certificate is signed, so a quantum-safe signature has to reach all of them.
Cloudflare can move faster on the origin connection because it already has an account and configuration relationship with the customer. A private trust model does not face every root-program, Certificate Transparency and broad-client-compatibility constraint of public HTTPS.
The browser-facing connection is a separate programme. Google and other IETF participants are experimenting with Merkle Tree Certificates to control the bandwidth cost of post-quantum authentication on the public web, with broader phases planned for 2027. The accurate conclusion is narrow: ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. authentication is now operator-configurable on a controlled infrastructure hop.
Support is not the same as downgrade resistance
If a verifier accepts both an ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. credential and a quantum-vulnerable classical credential for the same identity, a future attacker may select the weaker path. Avoiding that outcome requires policy on the verifying side, not only support on the presenting side.
Cloudflare advises customers seeking downgrade resistance to remove trust in classical certificate authorities for the protected origin path and configure the origin to require the intended ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. client credential. Teams should test rejection paths as deliberately as successful handshakes.
The rollout exposed an ordinary migration risk
Adding ML-DSAML-DSA-87A quantum-safe digital signature. It is what proves a message, a software update, or a server really came from who it claims, and has not been altered. support required Cloudflare to update the BoringSSL version used by its origin proxy. The newer library also enforced existing certificate KeyUsage rules more strictly. A small number of technically invalid legacy RSA certificates then failed validation, contributing to an incident on 10 June 2026. Cloudflare rolled back and added a compatibility patch before proceeding.
The lesson is broader than one vendor: a cryptographic upgrade can expose dormant defects in certificates, proxies and middleware that are unrelated to the new algorithm. Representative test data, staged rollout, telemetry and a rehearsed rollback path remain essential.
What infrastructure teams should verify
- Map every TLSTLSThe protocol behind the padlock in a browser. It encrypts traffic between a visitor and a website, and it is the single biggest place post-quantum encryption has to land. hop separately: browser-to-edge, edge-to-origin, service-to-service, API gateway and administrative paths.
- Record negotiated key agreement and signature algorithms, not only configured capability.
- Inventory runtime TLSTLSThe protocol behind the padlock in a browser. It encrypts traffic between a visitor and a website, and it is the single biggest place post-quantum encryption has to land. libraries, reverse proxies, certificate tooling, HSMHSMA hardware security module: a sealed, tamper-evident box that generates and stores private keys so they never exist in ordinary computer memory.s and monitoring systems.
- Test legacy certificate validity, classical fallback, downgrade behaviour and rollback before production rollout.
- Verify successful and rejected handshakes from origin logs or packet captures.
This deployment is important because it turns a standardised post-quantum signature into an operator-controlled production feature. It also shows the right unit of migration: a defined trust boundary with observable confidentiality, authentication and downgrade behaviour.