SSL – Noise

Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)

Suleman Ahmad — Tue, 08 Sep 2026 13:10:00 +0000

Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.

Certificate Transparency Monitoring is now generally available

Pravallika Nakarikanti — Thu, 13 Aug 2026 13:00:00 +0000

Cloudflare's Certificate Transparency Monitoring is now generally available. The biggest change: we no longer email you about certificates Cloudflare issued for your domain, so when an alert lands in your inbox, it's worth a look.

Post-quantum authentication to origins is now supported

Luke Valenta — Wed, 29 Jul 2026 13:00:00 +0000

Cloudflare now supports post-quantum (PQ) authentication when connecting to customer origin servers via Authenticated Origin Pulls and Custom Origin Trust Store. This is the first step towards providing PQ authentication for all Cloudflare products.

AI Found Twelve New Vulnerabilities in OpenSSL

Bruce Schneier — Wed, 18 Feb 2026 12:03:10 +0000

The title of the post is”What AI Security Research Looks Like When It Works,” and I agree:

In the latest OpenSSL security release> on January 27, 2026, twelve new zero-day vulnerabilities (meaning unknown to the maintainers at time of disclosure) were announced. Our AI system is responsible for the original discovery of all twelve, each found and responsibly disclosed to the OpenSSL team during the fall and winter of 2025. Of those, 10 were assigned CVE-2025 identifiers and 2 received CVE-2026 identifiers. Adding the 10 to the three we already found in the ...

How Cloudflare is helping domain owners with the upcoming Entrust CA distrust by Chrome and Mozilla

Dina Kozlov — Fri, 20 Sep 2024 07:00:00 +0000

Chrome and Mozilla will stop trusting Entrust’s public TLS certificates issued after November 2024 due to concerns about Entrust’s compliance with security standards. In response, Entrust is partnering with SSL.com to continue providing trusted certificates. Cloudflare will support SSL.com as a CA, simplifying certificate management for customers using Entrust by automating issuance and renewals.

Introducing Automatic SSL/TLS: securing and simplifying origin connectivity

Alex Krivit — Thu, 08 Aug 2024 13:05:18 +0000

This new Automatic SSL/TLS setting will maximize and simplify the encryption modes Cloudflare uses to communicate with origin servers by using the SSL/TLS Recommender

Avoiding downtime: modern alternatives to outdated certificate pinning practices

Dina Kozlov — Mon, 29 Jul 2024 13:00:37 +0000

The number of outages caused by certificate pinning is increasing. We’ll explore why certificate pinning hasn’t kept up with modern standards and recommend alternatives to improve security while reducing management overhead

How we ensure Cloudflare customers aren’t affected by Let’s Encrypt’s certificate chain change

Dina Kozlov — Fri, 12 Apr 2024 13:00:09 +0000

Let’s Encrypt’s cross-signed chain will be expiring in September. This will affect legacy devices with outdated trust stores (Android versions 7.1.1 or older). To prevent this change from impacting customers, Cloudflare will shift Let’s Encrypt certificates upon renewal to use a different CA

Upcoming Let’s Encrypt certificate chain change and impact for Cloudflare customers

Dina Kozlov — Thu, 14 Mar 2024 14:00:23 +0000

Let’s Encrypt’s cross-signed chain will be expiring in September. To prepare for the change, after May 15th, 2024, Cloudflare will start issuing certs from Let’s Encrypt’s ISRG X1 chain. This change will impact legacy devices with outdated trust stores (Android versions 7.1.1 or older)

AWS Certificate Manager will discontinue WHOIS lookup for email-validated certificates

Lerna Ekmekcioglu — Tue, 09 Jan 2024 20:31:55 +0000

AWS Certificate Manager (ACM) is a managed service that you can use to provision, manage, and deploy public and private TLS certificates for use with Amazon Web Services (AWS) and your internal connected resources. Today, we’re announcing that ACM will be discontinuing the use of WHOIS lookup for validating domain ownership when you request email-validated […]

Introducing per hostname TLS settings — security fit to your needs

Dina Kozlov — Wed, 09 Aug 2023 13:00:41 +0000

Starting today, customers that use Cloudflare’s Advanced Certificate Manager can configure TLS settings on individual hostnames within a domain

Bring your own CA for client certificate validation with API Shield

Dina Kozlov — Tue, 11 Jul 2023 13:00:21 +0000

API shield customers can now upload their own CA to use for client certificate validation. This ensures that only authorized clients and devices can make requests to your API endpoint or application.

A new, configurable and scalable version of Geo Key Manager, now available in Closed Beta

Dina Kozlov — Thu, 15 Dec 2022 14:00:00 +0000

We’re excited to announce a new version of Geo Key Manager — one that allows customers to define boundaries by country, by a region, or by a standard, such as “only store my private keys in FIPS compliant data centers” — now available in Closed Beta.

How to evaluate and use ECDSA certificates in AWS Certificate Manager

Zachary Miller — Tue, 08 Nov 2022 17:37:21 +0000

AWS Certificate Manager (ACM) is a managed service that enables you to provision, manage, and deploy public and private SSL/TLS certificates that you can use to securely encrypt network traffic. You can now use ACM to request Elliptic Curve Digital Signature Algorithm (ECDSA) certificates and associate the certificates with AWS services like Application Load Balancer (ALB) […]

Critical Vulnerability in Open SSL

Bruce Schneier — Fri, 28 Oct 2022 13:12:50 +0000

There are no details yet, but it’s really important that you patch Open SSL 3.x when the new version comes out on Tuesday.

How bad is “Critical”? According to OpenSSL, an issue of critical severity affects common configurations and is also likely exploitable.

It’s likely to be abused to disclose server memory contents, and potentially reveal user details, and could be easily exploited remotely to compromise server private keys or execute code execute remotely. In other words, pretty much everything you don’t want happening on your production systems...

Total TLS: one-click TLS for every hostname you have

Dina Kozlov — Thu, 06 Oct 2022 18:00:00 +0000

Today, we’re excited to announce Total TLS — a one-click feature that will issue individual TLS certificates for every subdomain in our customer’s domains

Amazon introduces dynamic intermediate certificate authorities

Adina Lozada — Wed, 14 Sep 2022 22:02:40 +0000

AWS Certificate Manager (ACM) is a managed service that lets you provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with Amazon Web Services (AWS) and your internal connected resources. Starting October 11, 2022, at 9:00 AM Pacific Time, public certificates obtained through ACM will be issued from […]

Introducing new Cloudflare for SaaS documentation

Mia Malden — Tue, 09 Aug 2022 13:00:00 +0000

Cloudflare for SaaS offers a suite of Cloudflare products and add-ons to improve the security, performance, and reliability of SaaS providers. Now, the Cloudflare for SaaS documentation outlines how to optimize it in order to meet your goals

Introducing: Backup Certificates

Dina Kozlov — Mon, 14 Mar 2022 12:59:10 +0000

We are excited to introduce backup certificates to increase reliability of our service for anyone using the Cloudflare platform in the event of key compromises or related issues

Cloudflare for SaaS for All, now Generally Available!

Dina Kozlov — Fri, 22 Oct 2021 15:31:00 +0000

We are very excited to announce that Cloudflare for SaaS is generally available, so that every customer, big and small, can use Cloudflare for SaaS to continue scaling and building their SaaS business.