--- title: SSL/TLS Changelog image: https://edgetunnel-b2h.pages.dev/cf-twitter-card.png --- > Documentation Index > Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt > Use this file to discover all available pages before exploring further. [Skip to content](#%5Ftop) # Changelog New updates and improvements at Cloudflare. [ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) SSL/TLS ![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) Jun 17, 2026 1. ### [Post-quantum ML-DSA certificates for Authenticated Origin Pulls and Custom Origin Trust Store](https://edgetunnel-b2h.pages.dev/changelog/post/2026-06-17-pqc-mldsa-aop-cots/) [ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) Cloudflare now accepts [ML-DSA ↗](https://csrc.nist.gov/pubs/fips/204/final) (FIPS 204) post-quantum certificates on the connection between Cloudflare's edge and your origin server. Combined with our existing [X25519MLKEM768](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/#hybrid-key-agreement) key agreement, this lets you establish end-to-end post-quantum authentication on the Cloudflare-to-origin connection. ML-DSA is supported in two origin-facing features: * [Authenticated Origin Pulls](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/) (AOP) — upload an ML-DSA client certificate that Cloudflare will present during the mTLS handshake to your origin. Available at both zone-level and per-hostname scopes. * [Custom Origin Trust Store](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/custom-origin-trust-store/) (COTS) — upload an ML-DSA certificate authority that Cloudflare will trust when validating your origin server certificate under [Full (strict) encryption mode](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/ssl-modes/full-strict/). Refer to [Post-quantum signatures](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/pqc-to-origin/#post-quantum-signatures) for certificate generation and setup guidance, and to [PQC in Cloudflare products](https://edgetunnel-b2h.pages.dev/ssl/post-quantum-cryptography/pqc-cloudflare-products/) for the current post-quantum deployment status across Cloudflare. Apr 07, 2026 1. ### [Manage mTLS and BYO CA certificates from the Cloudflare dashboard](https://edgetunnel-b2h.pages.dev/changelog/post/2026-04-07-mtls-byoca-dashboard/) [ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required. Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard: * **AOP certificate management** — Upload and manage your own certificate authorities for [Authenticated Origin Pulls (AOP)](https://edgetunnel-b2h.pages.dev/ssl/origin-configuration/authenticated-origin-pull/)directly from the dashboard. * **BYO Client mTLS certificate management** — Upload and manage your own CA certificates for [client mTLS enforcement](https://edgetunnel-b2h.pages.dev/ssl/client-certificates/byo-ca/)without needing API access. * **CDN hostname to client mTLS certificate mapping** — Associate client mTLS certificates with specific hostnames directly from the dashboard. Aug 25, 2025 1. ### [Manage and deploy your AI provider keys through Bring Your Own Key (BYOK) with AI Gateway, now powered by Cloudflare Secrets Store](https://edgetunnel-b2h.pages.dev/changelog/post/2025-08-25-secrets-store-ai-gateway/) [ Secrets Store ](https://edgetunnel-b2h.pages.dev/secrets-store/)[ AI Gateway ](https://edgetunnel-b2h.pages.dev/ai-gateway/)[ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) Cloudflare Secrets Store is now integrated with AI Gateway, allowing you to store, manage, and deploy your AI provider keys in a secure and seamless configuration through [Bring Your Own Key ↗](https://edgetunnel-b2h.pages.dev/ai-gateway/configuration/bring-your-own-keys/). Instead of passing your AI provider keys directly in every request header, you can centrally manage each key with Secrets Store and deploy in your gateway configuration using only a reference, rather than passing the value in plain text. You can now create a secret directly from your AI Gateway [in the dashboard ↗](http://dash.cloudflare.com/?to=/:account/ai-gateway) by navigating into your gateway -> **Provider Keys** \-> **Add**. ![Import repo or choose template](https://edgetunnel-b2h.pages.dev/_astro/add-secret-ai-gateway.B-SIPr6s_jJjDD.webp) You can also create your secret with the newly available **ai\_gateway** scope via [wrangler ↗](https://edgetunnel-b2h.pages.dev/workers/wrangler/commands/), the [Secrets Store dashboard ↗](http://dash.cloudflare.com/?to=/:account/secrets-store), or the [API ↗](https://edgetunnel-b2h.pages.dev/api/resources/secrets%5Fstore/). Then, pass the key in the request header using its Secrets Store reference: ```bash curl -X POST https://gateway.ai.cloudflare.com/v1//my-gateway/anthropic/v1/messages \ --header 'cf-aig-authorization: ANTHROPIC_KEY_1 \ --header 'anthropic-version: 2023-06-01' \ --header 'Content-Type: application/json' \ --data '{"model": "claude-3-opus-20240229", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}' ``` Or, using Javascript: ```plaintext import Anthropic from '@anthropic-ai/sdk'; const anthropic = new Anthropic({ apiKey: "ANTHROPIC_KEY_1", baseURL: "https://gateway.ai.cloudflare.com/v1//my-gateway/anthropic", }); const message = await anthropic.messages.create({ model: 'claude-3-opus-20240229', messages: [{role: "user", content: "What is Cloudflare?"}], max_tokens: 1024 }); ``` For more information, check out the [blog ↗](https://blog.cloudflare.com/ai-gateway-aug-2025-refresh)! May 27, 2025 1. ### [Increased limits for Cloudflare for SaaS and Secrets Store free and Pay-as-you-go plans](https://edgetunnel-b2h.pages.dev/changelog/post/2025-05-19-paygo-updates/) [ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/)[ Cloudflare for SaaS ](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/)[ Secrets Store ](https://edgetunnel-b2h.pages.dev/secrets-store/) With upgraded limits to [all free and paid plans ↗](https://www.cloudflare.com/plans/), you can now scale more easily with [Cloudflare for SaaS ↗](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/) and [Secrets Store ↗](https://edgetunnel-b2h.pages.dev/secrets-store/). [Cloudflare for SaaS ↗](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/) allows you to extend the benefits of Cloudflare to your customers via their own custom or vanity domains. Now, the [limit for custom hostnames ↗](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/plans/) on a Cloudflare for SaaS Pay-as-you-go plan has been **raised from 5,000 custom hostnames to 50,000 custom hostnames.** With custom origin server -- previously an enterprise-only feature -- you can route traffic from one or more custom hostnames somewhere other than your default proxy fallback. [Custom origin server ↗](https://edgetunnel-b2h.pages.dev/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/custom-origin/) is now available to Cloudflare for SaaS customers on Free, Pro, and Business plans. You can enable custom origin server on a per-custom hostname basis [via the API ↗](https://edgetunnel-b2h.pages.dev/api/resources/custom%5Fhostnames/methods/edit/) or the UI: ![Import repo or choose template](https://edgetunnel-b2h.pages.dev/_astro/custom-origin-server.B-BXcG-1_ZUd9i6.webp) Currently [in beta with a Workers integration ↗](https://blog.cloudflare.com/secrets-store-beta/), [Cloudflare Secrets Store ↗](https://edgetunnel-b2h.pages.dev/secrets-store/) allows you to store, manage, and deploy account level secrets from a secure, centralized platform your [Cloudflare Workers ↗](https://edgetunnel-b2h.pages.dev/workers/). Now, you can create and deploy **100 secrets per account**. Try it out [in the dashboard ↗](http://dash.cloudflare.com/?to=/:account/secrets-store), with [Wrangler ↗](https://edgetunnel-b2h.pages.dev/secrets-store/integrations/workers/), or [via the API ↗](https://edgetunnel-b2h.pages.dev/api/resources/secrets%5Fstore/) today. Apr 09, 2025 1. ### [Cloudflare Secrets Store now available in Beta](https://edgetunnel-b2h.pages.dev/changelog/post/2025-04-09-secrets-store-beta/) [ Secrets Store ](https://edgetunnel-b2h.pages.dev/secrets-store/)[ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) Cloudflare Secrets Store is available today in Beta. You can now store, manage, and deploy account level secrets from a secure, centralized platform to your Workers. ![Import repo or choose template](https://edgetunnel-b2h.pages.dev/_astro/secrets-store-landing-page.BQoEWsq8_ZUrGq1.webp) To spin up your Cloudflare Secrets Store, simply click the new Secrets Store tab [in the dashboard ↗](http://dash.cloudflare.com/?to=/:account/secrets-store) or use this Wrangler command: ```sh wrangler secrets-store store create --remote ``` The following are supported in the Secrets Store beta: * Secrets Store UI & API: create your store & create, duplicate, update, scope, and delete a secret * Workers UI: bind a new or existing account level secret to a Worker and deploy in code * Wrangler: create your store & create, duplicate, update, scope, and delete a secret * Account Management UI & API: assign Secrets Store permissions roles & view audit logs for actions taken in Secrets Store core platform For instructions on how to get started, visit our [developer documentation](https://edgetunnel-b2h.pages.dev/secrets-store/). Feb 14, 2025 1. ### [Upload a certificate bundle with an RSA and ECDSA certificate per custom hostname](https://edgetunnel-b2h.pages.dev/changelog/post/2025-02-14-cert-bundling-for-custom-hostnames/) [ SSL/TLS ](https://edgetunnel-b2h.pages.dev/ssl/) Cloudflare has supported both RSA and ECDSA certificates across our platform for a number of years. Both certificates offer the same security, but ECDSA is more performant due to a smaller key size. However, RSA is more widely adopted and ensures compatibility with legacy clients. Instead of choosing between them, you may want both – that way, ECDSA is used when clients support it, but RSA is available if not. Now, you can upload both an RSA and ECDSA certificate on a custom hostname via the API. ```plaintext curl -X POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames \ -H 'Content-Type: application/json' \ -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \ -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \ -d '{ "hostname": "hostname", "ssl": { "custom_cert_bundle": [ { "custom_certificate": "RSA Cert", "custom_key": "RSA Key" }, { "custom_certificate": "ECDSA Cert", "custom_key": "ECDSA Key" } ], "bundle_method": "force", "wildcard": false, "settings": { "min_tls_version": "1.0" } } }’ ``` You can also: * [Upload](https://edgetunnel-b2h.pages.dev/api/resources/custom%5Fhostnames/methods/create/) an RSA or ECDSA certificate to a custom hostname with an existing ECDSA or RSA certificate, respectively. * [Replace](https://edgetunnel-b2h.pages.dev/api/resources/custom%5Fhostnames/subresources/certificate%5Fpack/subresources/certificates/methods/update/) the RSA or ECDSA certificate with a certificate of its same type. * [Delete](https://edgetunnel-b2h.pages.dev/api/resources/custom%5Fhostnames/subresources/certificate%5Fpack/subresources/certificates/methods/delete/) the RSA or ECDSA certificate (if the custom hostname has both an RSA and ECDSA uploaded). This feature is available for Business and Enterprise customers who have purchased custom certificates. ```json {"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/product/ssl/#page","headline":"SSL/TLS Changelog | Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/changelog/product/ssl/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/cf-twitter-card.png","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}} ```