Cloudflare cuts TLS handshake retries from 52% to 3.7% by measuring origin preferences

Cloudflare replaced a static assumption about X25519 support in TLS handshakes with per-origin preference measurement. The HelloRetryRequest rate on scanned origins fell from about 52% to 3.7%, and p90 handshake latency dropped by more than 150 ms.

• Handshake retry rate fell from 52% to 3.7%
• p90 handshake latency dropped by more than 150 ms
• Post-quantum key exchange support rose from 0.5% in 2023 to 12.8%
• Post-quantum traffic grew from 25 to 45 billion connections per day