Dispatch
Cloudflare's Automatic Key Exchange cut origin HelloRetryRequests from 52% to 3.7% and saved 150ms at p90
Cloudflare shipped Automatic Key Exchange in September 2026, probing TLS 1.3 origins to learn which key agreement algorithms they actually support instead of guessing X25519 first. The static guess was wrong for roughly 30% of origins and forced a retry handshake costing two round trips; after the change 99.2% of post-quantum TLS 1.3 connections complete without a retry and p90 handshake latency dropped by more than 150ms. Post-quantum origin traffic is now at 45 billion daily connections, which is the number that made the guess expensive.
↳ Follow the thread