Cloudflare introduces post quantum TLS to protect origin servers

Cloudflare has implemented post-quantum authentication in its Authenticated Origin Pulls and Custom Origin Trust Store products, facilitating secure TLS connections to origin servers to counteract potential future quantum attacks. This decision is driven by recent advancements in quantum computing that threaten existing cryptographic systems.

With a planned roadmap to achieve full post-quantum security by 2029, Cloudflare has introduced ML-DSA signatures for mutually authenticated TLS connections, thereby enhancing security against impersonation attacks. This article details the differences between visitor-to-Cloudflare and Cloudflare-to-origin connections, outlines how to configure post-quantum authentication, and discusses the importance of avoiding downgrade attacks. It includes technical instructions for generating certificates and configuring systems to ensure post-quantum security.