Full Post-Quantum mTLS with ML-DSA-44: AOP + COTS on NGINX and OpenSSL 3.5
TL;DR — Cloudflare now supports ML-DSA-44 (FIPS 204) for both Authenticated Origin Pulls (AOP) and Custom Origin Trust Store (COTS). This post walks through building OpenSSL 3.5.0 from source, generating two separate post-quantum cert chains, and wiring up full bidirectional ML-DSA authentication between Cloudflare and an NGINX origin. The result: a connection where Cloudflare authenticates itself to the origin and the origin authenticates itself to Cloudflare — both with post-quantum signatures. Combined with X25519MLKEM768 key agreement, no classical cryptography is involved at any point. ...