Automatic Key Exchange: Faster, Post-Quantum Secure Origin Handshakes for 45 Billion Daily Connections
Cloudflare, Tuesday, September 8th, 2026
Probing origins for supported key agreement algorithms cuts HelloRetryRequests and reduces p90 connection latency.
Automatic Key Exchange probes origin servers to discover which TLS key agreement algorithms they support, then leads with the best available choice, preferring post-quantum hybrid where possible.
The benefit is eliminating HelloRetryRequests, the extra round trip that occurs when a client guesses wrong about what the server accepts, which measurably reduces p90 connection latency across 45 billion daily connections.
It is a good illustration that post-quantum migration need not cost performance if the negotiation is handled intelligently rather than by static configuration.