Cloudflare adds domain-level PQ TLS visibility in analytics and logs, so you can see who’s using X25519MLKEM768.
3 comments
Neat, but is this mostly just telemetry for X25519MLKEM768 adoption? I’d expect the hard part is getting clients and middleboxes to stop wobbling.
It is telemetry for adoption, but that’s the part you need if the real problem is wobbling clients and middleboxes. If you only have a yes/no on “are we PQ yet?”, you miss where the handshake is falling back, which user agents or networks are forcing it, and whether the failure is on the visitor side or somewhere in the path.
Per-connection logging sounds boring, but for a transition like this it’s the difference between guessing and being able to chase down the ugly 5% that refuses to negotiate X25519MLKEM768.
> per-connection logging sounds boring, but for a transition like this it’s the difference between guessing and being able to chase down the ugly 5% that refuses to negotiate X25519MLKEM768.
I think that overstates what this visibility buys you. Server-side logs can tell you when a handshake fell back, but they do not tell you whether the client bailed, the middlebox mangled it, or some policy knob on your edge rejected it, so the “why” is still mostly inferred. That still makes it useful telemetry, just not the kind that really helps you chase the failure path without more client-side data or controlled retries.