Origins Just Got Quantum-Resistant Authentication!

Hey everyone, it's Shii-chan! Today I've got news that any security fan will love: a step toward the quantum-computing era!

Cloudflare Blog blog.cloudflare.com

What was announced?

On Cloudflare's Blog, they announced that authentication for connections to customer origin servers can now use post-quantum (PQ) cryptography. Specifically, two mechanisms, Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS), now support ML-DSA, a signature algorithm designed to resist quantum computers. Cloudflare has a goal of achieving full post-quantum security across all its products by 2029, and this is the first milestone on that path.

The story so far

Quantum computers raise the concern of a 'harvest-now, decrypt-later' attack: an attacker collects today's encrypted traffic now, planning to decrypt it later once a sufficiently powerful quantum computer exists.

Cloudflare already made visitor-to-Cloudflare traffic post-quantum encrypted in 2022, and Cloudflare-to-origin traffic post-quantum encrypted in 2023. But the authentication piece, verifying that the other side is who it claims to be, was still using classical algorithms like RSA or ECDSA. If authentication can be broken by a quantum computer, it opens the door to impersonation and man-in-the-middle attacks, so authentication needed to go post-quantum too, not just encryption.

What changes

With this update, both AOP and COTS now support ML-DSA.

• Authenticated Origin Pulls (AOP): mutual TLS where Cloudflare presents a client certificate to your origin server. ML-DSA is now supported at the zone and hostname level (global-level support is coming later). It's free on every Cloudflare plan
• Custom Origin Trust Store (COTS): validates the certificate your origin server presents. You can now upload your own ML-DSA certificate authority (CA). It requires Full (strict) SSL mode and the paid Advanced Certificate Manager add-on

If you run your own origin server and want both ends of the connection to be quantum-resistant, this is a welcome upgrade.

Dive Deep

Cloudflare supports ML-DSA as defined in FIPS 204, with three parameter sets to choose from.

• ML-DSA-44: recommended for speed (NIST Category 2)
• ML-DSA-65: medium strength
• ML-DSA-87: highest security

Key exchange uses X25519MLKEM768, and private keys must be uploaded in 'FIPS 204 seed-only encoding' format. You'll need OpenSSL 3.5.0 or newer, generating CAs and certificates with commands like openssl genpkey -algorithm mldsa44 and uploading them through Cloudflare's API (the /acm/custom_trust_store and /origin_tls_client_auth endpoints). On the origin server side, an NGINX setup just needs ssl_certificate and ssl_client_certificate configured, and TLS 1.3 is recommended.

The behind-the-scenes work wasn't trivial either. Go's standard X.509/TLS library didn't support ML-DSA yet, so Cloudflare added the implementation to its own CIRCL library (native support is expected once Go 1.27 ships in August 2026). On the data plane, they had to update both the Pingora-based origin connection service and an internal BoringSSL fork that had been frozen for four years, bringing it back in line with upstream. During that work, an incident on June 10, 2026 saw stricter certificate KeyUsage validation reject some existing customer certificates; it was resolved with a patch that also supports certificates that aren't fully RFC-compliant.

There's also a warning about downgrade attacks: to stay safe, you should trust only quantum-resistant authentication mechanisms and remove classical ones entirely. Leaving both in place gives attackers a weaker option to exploit.

Looking ahead, Cloudflare plans to extend post-quantum authentication to the visitor-to-Cloudflare leg too, using Merkle Tree Certificates (MTC), a mechanism it's standardizing with Google and others at the IETF, with an initial rollout targeted around 2027.

Wrap-up

• Cloudflare added post-quantum authentication (ML-DSA) to Authenticated Origin Pulls and Custom Origin Trust Store
• AOP works at the zone/hostname level for free on every plan; COTS requires Full strict mode plus Advanced Certificate Manager
• Supports ML-DSA-44/65/87 parameters and X25519MLKEM768 key exchange, requiring OpenSSL 3.5.0+
• Preventing downgrade attacks means removing classical authentication mechanisms entirely
• More updates are coming as Cloudflare works toward visitor-side authentication and full post-quantum security by 2029

If you're securing your origin servers with mTLS, this update is for you!