# Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

DevFeed: [Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)](<https://devfeed.tech/articles/automatic-key-exchange-faster-post-quantum-secure-origin-handshakes-for-45-billion-daily-connections-and-counting-106.md>)

Original publisher: [Read original article](<https://blog.cloudflare.com/automatic-key-exchange-for-origins/>)

Author: Alex Krivit

Published: 2026-09-08T13:10:00Z

Content type: release

Language: en

Sources: [Cloudflare Blog](<https://devfeed.tech/sources/cloudflare-blog.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>), [SSL](<https://devfeed.tech/topics/ssl.md>), [Latency](<https://devfeed.tech/topics/latency.md>), [Encryption](<https://devfeed.tech/topics/encryption.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [application-services](<https://devfeed.tech/tags/application-services.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [latency](<https://devfeed.tech/tags/latency.md>), [performance](<https://devfeed.tech/tags/performance.md>), [post-quantum](<https://devfeed.tech/tags/post-quantum.md>), [research](<https://devfeed.tech/tags/research.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [tls](<https://devfeed.tech/tags/tls.md>)

## AI overview

Cloudflare announces Automatic Key Exchange, which probes TLS 1.3 origins for supported key-agreement algorithms and uses the preferred option on the first connection attempt. The rollout reduces HelloRetryRequests and handshake latency while automatically preferring post-quantum hybrid connections where supported.

## Source excerpt

Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.