SYSTEM Cited by 1 source
Cloudflare Custom Origin Trust Store¶
What¶
Custom Origin Trust Store (COTS) is a Cloudflare product (requires Advanced Certificate Manager) that allows customers to replace Cloudflare's default trust store — which consists of all commonly- trusted public CAs plus Cloudflare's Origin CA — with a set of CAs they control.
When a zone uses Full (strict) SSL mode, Cloudflare authenticates the origin certificate against this custom trust store instead of the default.
Post-quantum ML-DSA support (July 2026)¶
COTS now allows customers to upload ML-DSA CAs (all three FIPS 204 parameter sets: ML-DSA-44, ML-DSA-65, ML-DSA-87). Cloudflare will then trust any origin server certificate chaining to that ML-DSA CA.
Downgrade protection: uploading a COTS CA replaces the default publicly-trusted CAs for the zone. If the customer uploads only post-quantum CAs, classical certificates become untrusted — effectively implementing disable-legacy-before-rotate at the zone level to prevent downgrade attacks.
Architectural advantage over WebPKI¶
Because the Cloudflare→origin connection operates under a pre-existing trust relationship (Cloudflare account), COTS can use custom PKIs without the constraints of the public WebPKI (no intermediate certificates, no Certificate Transparency overhead, no CA/Browser Forum timelines). This is what enables deploying PQ authentication ahead of WebPKI support for the public Internet.
(Source: sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins)
Seen in¶
- sources/2026-07-29-cloudflare-post-quantum-authentication-to-origins — ML-DSA support announcement, API walkthrough, downgrade avoidance guide.
Related¶
- systems/cloudflare-authenticated-origin-pulls — client-side companion
- concepts/downgrade-attack — why PQ-only trust store prevents downgrade
- systems/merkle-tree-certificates — the WebPKI-side PQ solution (Mid-2027)
- patterns/default-on-security-upgrade — posture (COTS requires ACM, unlike AOP)