Cloudflare Measures Origin TLS Preferences, Cutting Handshake Retries from 52% to 3.7%

7.3 relevance

Cloudflare's origin TLS optimization, relevant to cloud infrastructure and performance.

Cloud infoq.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a Solutions Architect focused on cloud infrastructure and platform engineering, this demonstrates how proactive measurement and per-origin optimization can eliminate systemic latency penalties at scale, a pattern directly applicable to any service managing heterogeneous client/server TLS configurations.

Key Takeaways

Evaluate your own TLS termination layer for static assumptions that may be costing round trips, and consider implementing origin probing to reduce handshake retries.

Cloudflare Measures Origin TLS Preferences, Cutting Handshake Retries from 52% to 3.7%

Summary

Cloudflare's Automatic Key Exchange, an extension of Automatic SSL/TLS, probes origins daily to replace the static X25519 guess, slashing HelloRetryRequests from 52% to 3.7% and cutting p90 latency by 150ms. The feature prefers post-quantum hybrid X25519MLKEM768 where supported, eliminating the mandatory second round trip that previously affected all post-quantum handshakes, while handling the 0.34% of origins that fail on multi-packet ClientHellos. Among scanned origins, 33% moved to post-quantum, 3% to other classical curves, and 64% remained on X25519.

Author

Steef-Jan Wiggers