Skip to content

SYSTEM Cited by 1 source

Cloudflare Custom Origin Trust Store

What

Custom Origin Trust Store (COTS) is a Cloudflare product (requires Advanced Certificate Manager) that allows customers to replace Cloudflare's default trust store — which consists of all commonly- trusted public CAs plus Cloudflare's Origin CA — with a set of CAs they control.

When a zone uses Full (strict) SSL mode, Cloudflare authenticates the origin certificate against this custom trust store instead of the default.

Post-quantum ML-DSA support (July 2026)

COTS now allows customers to upload ML-DSA CAs (all three FIPS 204 parameter sets: ML-DSA-44, ML-DSA-65, ML-DSA-87). Cloudflare will then trust any origin server certificate chaining to that ML-DSA CA.

Downgrade protection: uploading a COTS CA replaces the default publicly-trusted CAs for the zone. If the customer uploads only post-quantum CAs, classical certificates become untrusted — effectively implementing disable-legacy-before-rotate at the zone level to prevent downgrade attacks.

Architectural advantage over WebPKI

Because the Cloudflare→origin connection operates under a pre-existing trust relationship (Cloudflare account), COTS can use custom PKIs without the constraints of the public WebPKI (no intermediate certificates, no Certificate Transparency overhead, no CA/Browser Forum timelines). This is what enables deploying PQ authentication ahead of WebPKI support for the public Internet.

(Source: sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins)

Seen in

Last updated · 602 distilled / 1,824 read