TLS key exchange can follow the origin server’s capabilities
Preparing negotiation more carefully
On 8 September 2026, Cloudflare introduced Automatic Key Exchange. It observes origin-server capabilities to adapt the initial TLS exchange, with rollout monitoring of errors and retries.
Cryptography meets latency
TLS protects a network connection. Before carrying application data, both endpoints need common parameters. An incompatible initial choice can require another round trip. The operational interest is therefore twofold: choose appropriate protection and avoid unnecessarily long negotiation.
A team operating a website should track browser-to-proxy and proxy-to-origin paths separately. Improving the latter does not automatically describe the former. Measurements grouped by origin could also identify servers needing special attention.
Automatic does not mean uniform
Server capabilities and compatibility constraints remain decisive. A trial should record TLS failures, negotiation retries and latency before and after activation. A general setting does not establish that every connection already uses post-quantum key exchange; that property needs observation on the relevant path.
Editorial retrospective: event dates are stated in the text.