Cloudflare's Automatic Key Exchange cuts origin HelloRetryRequest rates from 52 percent to 3.7 percent

Cloudflare turned on Automatic Key Exchange, or AKE, for TLS 1.3 origin connections on 8 September 2026. The change probes each TLS 1.3-capable origin, records which key agreement algorithms it supports, and then picks the strongest supported option for every connection. A story in the Hacker News front page on 14 September reached 120 points and pointed at the same post, which is what surfaced it for a wider audience.

The engineers who wrote the post are Suleman Ahmad, Yawar Jamal, and Alex Krivit. The numbers they report are for the scanned cohort of origins after the rollout, compared against the same cohort before.

What broke first

Before AKE, Cloudflare says, its origin fetcher always offered X25519 as its first key share, on the assumption that most origins wanted it. When an origin preferred a different curve, the TLS handshake stalled: the origin returned a HelloRetryRequest, or HRR, asking for a second ClientHello with a different key share. That is a full extra round trip on the origin connection, and it is the exact case where a slow first byte shows up in a p90.

Cloudflare's own measurement of the problem is the headline number: "roughly 52%" of scanned origin connections were incurring a HelloRetryRequest, and post-quantum origins were worst hit because their preferred curve was almost never Cloudflare's first guess.

The numbers after the switch

With AKE deciding per origin, Cloudflare says the HRR rate on the same cohort fell to "just 3.7%", and that "99.2% of post-quantum TLS 1.3 connections of the currently scanned cohort" now complete in a single round trip. The company puts the p90 latency saving at "more than 150 ms" on the origins where the change took effect.

The scan produced a breakdown of what origins actually prefer. Cloudflare reports that 64 percent stayed on classical X25519, 33 percent moved to X25519MLKEM768 as their first choice, and 3 percent picked a different classical curve. Traffic-wise, post-quantum origin connections grew from roughly 25 billion to 45 billion per day over the rollout, and Cloudflare says over 12 percent of individual origins now support post-quantum key agreement.

The consequence for an origin operator

Nothing has to change on the origin side, and nothing has to change on the Cloudflare side either. AKE is on by default for every zone with a TLS 1.3-capable origin, and the choice appears in the dashboard under SSL/TLS as an origin connection setting. An operator who wants to see the effect can look at their own origin latency for cold connections, since a round trip saved is a round trip that was there before.

The one action worth taking is confirming the origin is TLS 1.3 capable in the first place, because AKE only probes and switches on 1.3. An origin still on 1.2 sees none of this, and post-quantum key agreement is 1.3-only, so post-quantum support and the HRR fix arrive together or not at all. Cloudflare's numbers are its own, and the p90 improvement is a network measurement rather than an application one: an origin whose slow path is compute or database, not TLS, will see a smaller change on the wall clock.

Source

Automatic Key Exchange for origins, Suleman Ahmad, Yawar Jamal, and Alex Krivit, Cloudflare, 8 September 2026. Hacker News discussion, 120 points.