{
  "id": 8644725,
  "title": "Cloudflare Measures Origin TLS Preferences, Cutting Handshake Retries from 52% to 3.7%",
  "url": "https://urgent.news/2026/09/20/cloudflare-measures-origin-tls-preferences-cutting-handshake-retries",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-20T08:15:00.000Z",
  "source": {
    "name": "InfoQ",
    "slug": "infoq",
    "url": "https://www.infoq.com/news/2026/09/cloudflare-automatic-key-exchang/"
  },
  "original_language": "en",
  "account": "Cloudflare has begun actively probing origins to measure their TLS preferences, which has led to a significant reduction in handshake retries. Previously, Cloudflare assumed X25519 as the key agreement algorithm for every origin, but measurements showed this guess was optimal only for about 30% of connections. By probing, Cloudflare discovered that 30% of origins preferred X25519 or X384, incurring an extra round trip for incorrect guesses. The new ability to probe per-origin has uncovered thousands of instances where post-quantum support was never revealed passively. Cloudflare now leads with the preferred algorithm, reducing handshake latency by removing the HelloRetryRequest. This improvement has cut handshake retries from 52% to 3.7% and reduced the p90 handshake latency by over 150ms.",
  "summary": "Cloudflare has replaced its static X25519 guess for origin TLS handshakes with per-origin measurement. HelloRetryRequests on scanned origins fell from roughly 52% to 3.7%, removing over 150 ms from p90 latency. Post-quantum connections completing in one round trip rose from 0% to 99.2%, though only 12.8% of origins support it. By Steef-Jan Wiggers",
  "key_points": [
    "Cloudflare probes origins to measure TLS preferences",
    "30% of connections optimal for X25519 or X384",
    "Handshake retries reduced from 52% to 3.7%"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}