proomt

Search

Search posts, papers, and topics

All posts

InfoQSteef-Jan Wiggers5 min readintermediate

Cloudflare Measures Origin TLS Preferences, Cutting Handshake Retries from 52% to 3.7%

Read on infoq.com

Summary

Cloudflare replaced a static assumption about origin TLS preferences with per-origin measurement, significantly reducing HelloRetryRequests (HRR) during TLS 1.3 handshakes. This optimization cut HRR from 52% to 3.7% for scanned origins and improved p90 handshake latency by over 150ms.

  • TLS 1.3 requires clients to commit to a key agreement algorithm in the first ClientHello.
  • An incorrect client guess results in a HelloRetryRequest (HRR) from the server, adding a round trip.
  • Cloudflare moved from a static assumption to dynamically measuring each origin's TLS preferences.
  • This change reduced HRR occurrences on scanned origins from 52% to 3.7%.

Engineers managing high-traffic services or CDNs should care about this as it demonstrates a practical, data-driven approach to significantly improve TLS handshake performance and reduce overhead.

6/10
securityperformancenetworkingtlscdn

Related reading

  1. Cloudflare Quick Tunnels

    Cloudflare Quick Tunnels let you expose a local service via an outbound‑only connection to Cloudflare’s edge network. The service gets a public URL (anycast across 335+ cities) with automatic TLS, DDoS protection, and no inbound ports. It’s positioned for short‑lived agents, webhooks, and testing loops, with JSON health output and no config files.

    Hacker News front pagecloudflare.com1 minreleaseHN831316
  2. 1 points

    Saving another 100TB of RAM with math (and Rust)

    Cloudflare reduced the memory footprint of its Pingora Backend Router by re‑examining the consistent‑hashing implementation in the pingora‑ketama library. By increasing the number of virtual hash points per server from the default 1 to the standard 160 (and applying weighted hashing based on disk capacity), they cut the per‑node overhead enough to reclaim >100 TB of RAM across the fleet. The post…

    Hacker News front pagecloudflare.com13 minHN478120lobste.rs33

  3. Cloudflare Introduces the Agent Development Lifecycle to Replace Traditional SDLC

    Cloudflare’s Agent Development Lifecycle (ADLC) replaces the classic SDLC with an autonomous, event‑driven workflow system that lets AI agents handle code generation, testing, deployment, and maintenance. The platform builds on Cloudflare Workflows and the new @cloudflare/ci library to spin up containers, run headless browsers, and chain steps with caching and credential support. Observability is…

    InfoQinfoq.com2 min

  5. When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

    Cloudflare’s Page Shield uses a graph‑neural‑network (GNN) to model JavaScript as a syntax‑tree graph, followed by a lightweight LLM for second‑opinion triage and an ensemble of frontier models for deep analysis. This pipeline caught eight malicious payloads across four distinct affiliate‑theft and backdoor techniques that traditional scanners missed, demonstrating the need for runtime, behavior‑…

    Cloudflarecloudflare.com21 minHN2