Post-Quantum Origin Authentication: Implementing ML-DSA in Cloudflare AOP and Custom Trust Stores

Post-quantum cryptography (PQC) deployment is rapidly shifting focus from data confidentiality to identity authenticity. While post-quantum key exchange mechanisms mitigate "harvest-now, decrypt-later" attacks, post-quantum authentication protects infrastructure against attackers who will eventually use quantum computers to forge classical credentials and conduct impersonation attacks. Cloudflare has reached a key milestone in its roadmap toward full post-quantum security by enabling post-quantum authentication on connections established between Cloudflare's edge proxy and customer origin servers.

This support utilizes the Module-Lattice-Based Digital Signature Algorithm (ML-DSA) defined in FIPS 204 across two key products: Custom Origin Trust Store (COTS) and Authenticated Origin Pulls (AOP). Implementing these technologies allows organizations to build fully post-quantum secure mutually authenticated TLS (mTLS) connections to their origins.

Understanding Visitor Connections vs. Cloudflare-to-Origin Topology

When a client requests a resource proxied through Cloudflare, the communication path consists of two separate TLS connections:

• Connection 1 (Visitor-to-Cloudflare): The client browser connects directly to Cloudflare's edge.
• Connection 2 (Cloudflare-to-Origin): Cloudflare opens a secondary backend connection to fetch non-cached content from the origin server.

Achieving total quantum resilience requires securing both stages. Cloudflare deployed post-quantum key agreement (encryption) for visitor-to-Cloudflare and Cloudflare-to-origin connections in 2022 and 2023, respectively. However, post-quantum authentication requirements differ significantly between these two tiers.

For visitor-to-Cloudflare connections, Cloudflare is collaborating with Google and the IETF to develop Merkle Tree Certificates (MTC) targeting 2027 deployments to overcome WebPKI and Certificate Transparency limits. Conversely, on the Cloudflare-to-origin tier, Cloudflare operates as the TLS client. This architecture allows connection pooling to fan in traffic from across the edge network into fewer persistent origin connections. The overhead of larger post-quantum signature sizes is amortized across many requests, making direct ML-DSA signatures viable today without awaiting broader public WebPKI overhauls.

Cryptographic Specifications: ML-DSA and FIPS 204

Post-quantum authentication on Cloudflare-to-origin links relies on ML-DSA, standardized under FIPS 204. Cloudflare supports all three parameter sets:

• ML-DSA-44: Recommended for most deployment workloads. It offers NIST Category 2 security strength combined with superior performance characteristics and lower handshake size overhead.
• ML-DSA-65: Provides NIST Category 3 security strength.
• ML-DSA-87: Provides NIST Category 5 security strength.

To ensure compatibility with Cloudflare's control plane parsing logic, private keys uploaded to Cloudflare must be encoded strictly in the FIPS 204 seed-only format.

Product Integration: COTS and Authenticated Origin Pulls

Configuring mutually authenticated post-quantum TLS requires managing certificate verification in both directions using two distinct features:

Custom Origin Trust Store (COTS)

When Cloudflare connects to an origin set to Full (strict) SSL mode, it default-validates origin certificates against public Certificate Authorities (CAs). COTS (which requires Cloudflare's Advanced Certificate Manager) enables organizations to replace the public default trust store with custom CA certificates. By uploading an ML-DSA CA certificate, Cloudflare will strictly trust origin certificates chaining back to that specific post-quantum authority.

Authenticated Origin Pulls (AOP)

AOP allows origin servers to verify that incoming HTTP/HTTPS connections originate strictly from Cloudflare. Cloudflare presents a client certificate during the TLS handshake to achieve mutual TLS (mTLS). AOP is available across all plan tiers and supports per-zone and per-hostname configurations for uploading custom ML-DSA client certificates and private keys. (Global-level AOP support is scheduled for a future update).

Generating ML-DSA Certificates with OpenSSL 3.5.0+

Creating valid certificate chains for COTS and AOP requires OpenSSL 3.5.0 or later, specifying the seed-only output format for key generation.

# 1. Generate Origin CA and Server Certificate (for COTS)
openssl genpkey -algorithm mldsa44 
  -provparam ml-dsa.output_formats=seed-only 
  -out origin-ca.key

openssl req -new -x509 -key origin-ca.key 
  -out origin-ca.crt -days 10950 
  -subj "/CN=Origin Server CA"

openssl genpkey -algorithm mldsa44 
  -provparam ml-dsa.output_formats=seed-only 
  -out origin-server.key

openssl req -new -key origin-server.key 
  -out origin-server.csr 
  -subj "/CN=origin.example.com"

openssl x509 -req -in origin-server.csr 
  -CA origin-ca.crt -CAkey origin-ca.key -CAcreateserial 
  -out origin-server.crt -days 5475 
  -extfile <(printf "basicConstraints=CA:FALSEnkeyUsage=digitalSignaturensubjectAltName=DNS:origin.example.comn")

# 2. Generate AOP Client CA and Client Certificate (for Cloudflare AOP)
openssl genpkey -algorithm mldsa44 
  -provparam ml-dsa.output_formats=seed-only 
  -out aop-ca.key

openssl req -new -x509 -key aop-ca.key 
  -out aop-ca.crt -days 10950 
  -subj "/CN=Authenticated Origin Pull CA"

openssl genpkey -algorithm mldsa44 
  -provparam ml-dsa.output_formats=seed-only 
  -out aop-client.key

openssl req -new -key aop-client.key 
  -out aop-client.csr 
  -subj "/CN=cloudflare-aop-client"

openssl x509 -req -in aop-client.csr 
  -CA aop-ca.crt -CAkey aop-ca.key -CAcreateserial 
  -out aop-client.crt -days 5475 
  -extfile <(printf "basicConstraints=CA:FALSEnkeyUsage=digitalSignaturen")

Cloudflare API Provisioning Guide

After generating your certificate materials, configure Cloudflare via the REST API using jq to handle multi-line PEM string formatting.

# Upload Origin CA to Custom Origin Trust Store (COTS)
CA_CERT=$(jq -Rs . < origin-ca.crt)
curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/acm/custom_trust_store" 
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" 
  --header "Content-Type: application/json" 
  --json "{"certificate": $CA_CERT}"

# Upload ML-DSA Client Certificate for Zone-Level AOP
CERT=$(jq -Rs . < aop-client.crt)
KEY=$(jq -Rs . < aop-client.key)

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/origin_tls_client_auth" 
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" 
  --header "Content-Type: application/json" 
  --json "{"certificate": $CERT, "private_key": $KEY}"

# Enable Authenticated Origin Pulls
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/origin_tls_client_auth/settings" 
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" 
  --header "Content-Type: application/json" 
  --json '{"enabled": true}'

# Enforce SSL/TLS Full (Strict) Mode
curl -X PATCH "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/ssl" 
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" 
  --header "Content-Type: application/json" 
  --json '{"value": "strict"}'

Origin Server Implementation: NGINX Configuration

To enforce full post-quantum mTLS on your origin server, configure NGINX to present the ML-DSA origin certificate and validate Cloudflare's incoming AOP client certificate.

server {
    listen 443 ssl;
    server_name origin.example.com;

    # COTS: Server presents ML-DSA certificate to Cloudflare
    ssl_certificate /etc/ssl/origin-server.crt;
    ssl_certificate_key /etc/ssl/origin-server.key;

    # AOP: Server verifies Cloudflare's ML-DSA client certificate
    ssl_client_certificate /etc/ssl/aop-ca.crt;
    ssl_verify_client on;

    # Security Constraints
    ssl_protocols TLSv1.3;
}

Preventing Downgrade Attacks and Handshake Verification

Supporting post-quantum signature algorithms alone does not guarantee security if quantum-vulnerable algorithms remain accepted. If an origin server or verifying proxy allows fallbacks to classical RSA or ECDSA, an on-path attacker with quantum capabilities can forge classical credentials to force a downgrade.

To mitigate downgrade risks, origins must completely remove trust in legacy CAs and classical mechanisms. Validate your post-quantum deployment through direct testing and logging verification:

• Direct Connection Testing: Verify that unauthorized requests without a client certificate are terminated immediately:

  openssl s_client -connect <ORIGIN_IP>:443 -servername origin.example.com -brief

  An active ssl_verify_client on directive will reject connection setup with a TLS alert.

• Verifying Origin Logs: Update NGINX access log formats to output client certificate attributes and verify successful handshake parameters:

  log_format pq_verify '$remote_addr - $ssl_client_serial $ssl_client_s_dn';
  access_log /var/log/nginx/pq-verify.log pq_verify;

• Hybrid Key Exchange: Ensure origin TLS libraries support and prioritize X25519MLKEM768 for quantum-resistant key agreement during the TLS 1.3 handshake.

Control Plane and Data Plane Engineering Retrospective

Deploying post-quantum authentication required major updates across Cloudflare's architecture:

Control Plane Integration

Cloudflare's control plane handles API configurations and pushes settings across edge data stores. Written primarily in Go, the control plane faced an immediate hurdle: standard Go X.509 and TLS libraries lacked ML-DSA parsing capabilities. Cloudflare patched its open-source CIRCL (Cloudflare Interoperable Reusable Cryptographic Library) dependency to support ML-DSA validation. Native support is anticipated in Go 1.27 (scheduled for August 2026), which will allow Cloudflare to decommission custom patches.

Data Plane & BoringSSL Upgrade

Edge proxy operations are handled by Pingora Origin, an internal framework executing millions of requests per second. Pingora Origin relies on BoringSSL for TLS termination. Prior to this deployment, Cloudflare maintained a custom internal fork of BoringSSL, remaining un-updated from upstream for four years.

When official post-quantum authentication features landed in upstream BoringSSL in April 2026, Cloudflare re-based Pingora Origin onto the updated library. During the rollout, strict KeyUsage validation enforcement in the updated BoringSSL code broke a subset of customer origin connections utilizing non-RFC-compliant RSA certificates, leading to an operational incident on June 10, 2026. Cloudflare briefly rolled back, applied a compatibility patch for legacy RSA certificates with non-standard KeyUsage fields, and successfully finalized the global post-quantum deployment.

Primary reference: Review the original announcement for exact release details. This article is an independent explanation and does not reproduce the source text.