Skip to content
pqdoctor

ML-DSA origin certificates

Cloudflare authenticates the origin with ML-DSA once two things are true: the zone’s Custom Origin Trust Store holds an ML-DSA root CA, and the origin serves a certificate from it (Cloudflare blog, 2026-07-29; docs). Public CAs don’t issue ML-DSA certificates yet, so the CA has to be your own.

Flarebox does both halves.

1. Make the CA and certificate

Section titled “1. Make the CA and certificate”

SSL/TLS tab → Post-quantum origin certificates (ML-DSA):

  • An ML-DSA-44 CA and an origin certificate issued by it, made on your machine with aws-lc-rs. The keys never leave it.
  • The CA lives 10 years. Origin certificates last 90, 365, 825 or 1,825 days, for hostnames on the zone only.
  • Keys are written as new files only, never over existing ones. You can reuse an existing CA.
  • You get the files and the CA’s SHA-256.

2. Install it next to the current certificate

Section titled “2. Install it next to the current certificate”

The install guide gives nginx and Apache dual-certificate configs. They keep the current ECDSA or RSA certificate, add the ML-DSA pair, and set TLS 1.3 with X25519MLKEM768:X25519. Then it gives the checks:

Terminal window
openssl verify -CAfile ca.crt origin.crt
openssl s_client -connect origin.example.com:443 -sigalgs mldsa44 -brief   # expect "Signature type: mldsa44"

…and a check that a classical-only client still gets the classical certificate.

3. Upload the CA to the trust store

Section titled “3. Upload the CA to the trust store”

The trust store list shows each entry’s status (initializing → pending deployment → active), the zone’s encryption mode, how many origins are proxied, and whether Advanced Certificate Manager is on.

Upload is offered only with Advanced Certificate Manager and Full (strict). Otherwise the tab says what’s missing. Uploads go through the same safe change path as everything else, with undo.

What’s proven

Section titled “What’s proven”
  • OpenSSL 3.5.5 verifies the CA and the certificate Flarebox makes, and loads the key.
  • A dual-certificate lab server (ECDSA + Flarebox’s ML-DSA-44 certificate) gives pqdoctor’s ML-DSA check “Serves an ML-DSA certificate”, while classical clients still get ECDSA.
  • Against real zones, the trust store read correctly says the Free zones need Advanced Certificate Manager. An early version thought ACM was on, because Free zones have “advanced”-type certificate packs too. That was fixed.
  • Not yet: a real trust store upload (it needs ACM, a paid add-on) or an ML-DSA certificate on a real origin behind Cloudflare.