Breaking Lab srl
The problem with encryption you can’t see
Every time someone visits your website, their browser and your server do a quick, invisible handshake. This handshake — handled by a protocol called TLS — agrees on how the connection will be encrypted. Most website owners never think about it. But a quiet change Cloudflare just rolled out affects every site sitting behind its network, and it matters more than it might sound.
What Cloudflare changed, and why
There are two legs to any Cloudflare-protected connection: visitor to Cloudflare, and Cloudflare to your own server (called the “origin”). Cloudflare already handles the visitor side well. The origin side — the link between Cloudflare’s edge and your actual server — has historically been weaker, because it depended on whatever your server happened to support.
The new system, called Automatic Key Exchange, changes that. Cloudflare now quietly probes your origin server to find out which encryption methods it supports. When it connects, it automatically picks the strongest option available — favouring post-quantum algorithms where your server supports them. Post-quantum encryption means methods designed to resist attacks from quantum computers, which are expected to eventually break the most common encryption in use today.
No configuration needed on your end. If your server already supports the newer algorithms, Cloudflare will use them. If not, it falls back gracefully. Cloudflare says this now covers around 45 billion connections per day across its network.
Why should a site owner care right now?
Quantum computers capable of cracking today’s encryption don’t exist yet at scale — but security researchers have long warned about “harvest now, decrypt later” attacks. Bad actors can record encrypted traffic today and crack it years down the line once the hardware catches up. Sensitive data with a long shelf life — think customer records, login sessions, financial transactions — is already at risk from this strategy.
For most small site owners, the immediate practical takeaway is simpler: Cloudflare is doing the hard work for you, silently upgrading the security of your backend connection without you lifting a finger. That is genuinely unusual. Security improvements at this layer normally require server admin work, certificate changes, or manual configuration.
What you should check
If you run a Linux-based web server, keeping your software stack reasonably up to date means you are likely already benefiting. Modern versions of nginx, Apache, and common TLS libraries like OpenSSL already support TLS 1.3, which is the minimum Cloudflare needs to apply the stronger algorithms. If you are on very old server software, now is a good time to check for updates — not just for this, but for general hygiene.
The bigger picture
Cloudflare’s move is part of a broader industry shift toward post-quantum readiness that is picking up speed. Regulators and standards bodies are starting to set deadlines. For site owners, the message is straightforward: the encryption underpinning the web is being quietly upgraded, and the less you have to do manually to keep up, the better.
