From 64907f18a11b4b01e7af6ee46ef13cfbf6644453 Mon Sep 17 00:00:00 2001 From: spark Date: Wed, 9 Sep 2026 15:22:28 -0500 Subject: [PATCH 1/2] [Logs] Clarify NONE value for ClientTLSKeyExchangeGroup --- .../logs/logpush/logpush-job/datasets/zone/http_requests.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md b/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md index a5c8ce083e2..7debf4e0e7d 100644 --- a/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md +++ b/src/content/docs/logs/logpush/logpush-job/datasets/zone/http_requests.md @@ -259,7 +259,7 @@ The smoothed average of TCP round-trip time (SRTT). For the initial request on a Type: `string` -TLS key exchange group between the client and Cloudflare (for example, 'X25519MLKEM768'). 'UNK' means it could not be determined. 'NONE' means TLS was not used. +TLS key exchange group between the client and Cloudflare (for example, 'X25519MLKEM768'). 'UNK' means it could not be determined. 'NONE' means either RSA key exchange was used OR TLS was not used. ## ClientXRequestedWith From ff4871ad46b749d50ea4ba520cd29ce6c387ed03 Mon Sep 17 00:00:00 2001 From: spark Date: Thu, 10 Sep 2026 10:14:20 -0500 Subject: [PATCH 2/2] [Logs] Update NONE description in PQC changelog --- .../changelog/logs/2026-08-20-pqc-key-exchange-visibility.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/changelog/logs/2026-08-20-pqc-key-exchange-visibility.mdx b/src/content/changelog/logs/2026-08-20-pqc-key-exchange-visibility.mdx index db39229af50..1c44ef691a0 100644 --- a/src/content/changelog/logs/2026-08-20-pqc-key-exchange-visibility.mdx +++ b/src/content/changelog/logs/2026-08-20-pqc-key-exchange-visibility.mdx @@ -9,7 +9,7 @@ date: 2026-08-20 [Cloudflare Radar](https://radar.cloudflare.com/post-quantum) publishes global statistics on post-quantum key agreement adoption across all Cloudflare traffic, but until now customers had no way to see the same measurement scoped to their own zones. This is now possible because the [`http_requests`](/logs/logpush/logpush-job/datasets/zone/http_requests/) Logpush dataset — also queryable in [Log Explorer](/log-explorer/) — includes a new `ClientTLSKeyExchangeGroup` field. -The field reports the TLS key exchange group negotiated on the client-to-Cloudflare connection, by group name. Post-quantum connections appear as `X25519MLKEM768`, and classical connections appear as `X25519`, `P-256`, or another named group. A value of `UNK` means the group could not be determined, and `NONE` means TLS was not used. +The field reports the TLS key exchange group negotiated on the client-to-Cloudflare connection, by group name. Post-quantum connections appear as `X25519MLKEM768`, and classical connections appear as `X25519`, `P-256`, or another named group. A value of `UNK` means the group could not be determined, and `NONE` means either RSA key exchange was used OR TLS was not used. With this field, you can build per-zone reports showing what percentage of your inbound HTTPS traffic is protected by post-quantum key agreement, break the number down by hostname, path, user agent, or country, and push the data into your SIEM via any [Logpush destination](/logs/logpush/logpush-job/enable-destinations/).