Post-quantum key exchange on Cloudflare
Draft: not yet tested on a real zone. Each point marked "check" must be confirmed against Cloudflare's current documentation before this guide is published.
Cloudflare offers hybrid post-quantum key exchange to browsers on its edge for every plan. Your visitors' connections to Cloudflare can be post-quantum with no change on your side (check: still the default, and whether any plan or setting turns it off).
1. Check your minimum TLS version
Cloudflare's default minimum TLS version accepts TLS 1.0. That's a hygiene issue that caps your grade at B.
- In the dashboard, open your domain, then SSL/TLS → Edge Certificates.
- Set Minimum TLS Version to TLS 1.2 (check: the menu path).
2. The connection from Cloudflare to your server
The edge serving post-quantum key exchange doesn't protect the hop from Cloudflare to your origin server. That hop needs your origin to support X25519MLKEM768 too (see the nginx, Go and OpenSSL guides) (check: whether Cloudflare offers post-quantum key exchange to origins by default, and the setting if not).
Our scan sees only the edge, so answers about traffic behind it come from what you declare.
Then scan your domain below.