Post-quantum authentication to origins is now supported
Jul 29, 2026Luke Valenta, Kevin Guthrie
Summary
This post details the implementation of post-quantum authentication for Cloudflare-to-origin connections using ML-DSA signatures. It covers the configuration of Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS) products to support ML-DSA CAs and client certificates. The post also provides detailed instructions for generating ML-DSA certificates and configuring these products via the Cloudflare API, emphasizing the importance of avoiding downgrade attacks.
More from the Random Number Generation for Security trail
- Support for modern cryptographic algorithms in Workers
- Using AI to chart a course for our post-quantum migration
- Why we cannot wait for better post-quantum signature algorithms
- The White House's post-quantum executive order is an important milestone. It’s time to get to work
- Post-quantum encryption for Cloudflare IPsec is generally available