SSL/TLS

Keyless SSL supports TLS 1.3 with ECDSA certificates

Keyless SSL supports TLS 1.3 for ECDSA certificates. When TLS 1.3 is enabled on your zone, visitors connecting to a hostname that serves a Keyless ECDSA certificate negotiate TLS 1.3, and your private keys stay on your own key server. Keyless SSL connections that use RSA certificates continue to negotiate up to TLS 1.2. For details, refer to the Keyless SSL limitations.

View your data localization settings in one dashboard page

The Cloudflare dashboard now includes a Data Localization Suite Overview, a read-only view of the data localization settings on your account. It shows your Regional Services, Customer Metadata Boundary, and Geo Key Manager settings in one place, so you no longer need to check several dashboard pages and APIs to see where your traffic is processed and where your logs and private keys are stored. T…

Certificate Transparency Monitoring is now Generally Available

Certificate Transparency Monitoring is now generally available ↗︎ across all Cloudflare plans. Alerts for certificates Cloudflare issues on your behalf (Universal SSL renewals, backup certificates, Advanced Certificate Manager, Total TLS) are now automatically filtered out. Alert emails are also clearer and more actionable, with structured certificate details and a direct link to manage CT Monito…

Faster and more secure TLS handshakes to your origins, automatically

Cloudflare now takes the guesswork out of TLS 1.3 key agreement with your origins. Automatic key exchange predicts the preferred algorithm and sends its key share in the first ClientHello, helping avoid a HelloRetryRequest and one extra network round trip. Automatic key exchange is on for all existing zones and on by default for new zones. When an origin supports both classical and post-quantum k…

Post-quantum ML-DSA certificates for Authenticated Origin Pulls and Custom Origin Trust Store

Cloudflare now accepts ML-DSA ↗︎ (FIPS 204) post-quantum certificates on the connection between Cloudflare's edge and your origin server. Combined with our existing X25519MLKEM768 key agreement, this lets you establish end-to-end post-quantum authentication on the Cloudflare-to-origin connection. ML-DSA is supported in two origin-facing features: Authenticated Origin Pulls (AOP) — upload an ML-DS…

Manage mTLS and BYO CA certificates from the Cloudflare dashboard

You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required. Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard: AOP certificate management — Upload and manage your own certificate authorities for Authenticated Origin Pulls (AOP) direct…

Manage and deploy your AI provider keys through Bring Your Own Key (BYOK) with AI Gateway, now powered by Cloudflare Secrets Store

Cloudflare Secrets Store is now integrated with AI Gateway, allowing you to store, manage, and deploy your AI provider keys in a secure and seamless configuration through Bring Your Own Key ↗︎. Instead of passing your AI provider keys directly in every request header, you can centrally manage each key with Secrets Store and deploy in your gateway configuration using only a reference, rather than…

Increased limits for Cloudflare for SaaS and Secrets Store free and Pay-as-you-go plans

With upgraded limits to all free and paid plans ↗︎, you can now scale more easily with Cloudflare for SaaS ↗︎ and Secrets Store ↗︎. Cloudflare for SaaS ↗︎ allows you to extend the benefits of Cloudflare to your customers via their own custom or vanity domains. Now, the limit for custom hostnames ↗︎ on a Cloudflare for SaaS Pay-as-you-go plan has been raised from 5,000 custom hostnames to 50,000 c…

Cloudflare Secrets Store now available in Beta

Cloudflare Secrets Store is available today in Beta. You can now store, manage, and deploy account level secrets from a secure, centralized platform to your Workers. To spin up your Cloudflare Secrets Store, simply click the new Secrets Store tab in the dashboard ↗︎ or use this Wrangler command: wrangler secrets-store store create <name> --remote The following are supported in the Secrets Store b…

Upload a certificate bundle with an RSA and ECDSA certificate per custom hostname

Cloudflare has supported both RSA and ECDSA certificates across our platform for a number of years. Both certificates offer the same security, but ECDSA is more performant due to a smaller key size. However, RSA is more widely adopted and ensures compatibility with legacy clients. Instead of choosing between them, you may want both – that way, ECDSA is used when clients support it, but RSA is ava…