Cloudflare Adds Post-Quantum Authentication for Origin TLS Connections

Cloudflare has added post-quantum authentication to Authenticated Origin Pulls and Custom Origin Trust Store, enabling customers to use ML-DSA signatures for Cloudflare-to-origin TLS and build fully post-quantum-secure mutual TLS on that link. The company said the protection is effective only if organizations also remove trust in classical authentication paths to avoid downgrade attacks, and positioned the release as a key step toward its stated goal of full post-quantum security by 2029. Cloudflare also noted that post-quantum authentication for browser-facing WebPKI traffic will follow a different approach based on Merkle Tree Certificates.

The rollout comes amid broader industry acceleration toward quantum-safe security. Cloudflare Radar has been tracking worldwide post-quantum encryption adoption, while Microsoft said the timeline for quantum risk is shifting and urged faster migration planning. Cloudflare said the new capability required changes across its Go-based control plane and Pingora Origin data plane, and disclosed that a BoringSSL upgrade triggered a June 10, 2026 incident when stricter KeyUsage enforcement caused compatibility problems before the issue was patched and resolved.