Docs automatic origin key exchange

[ack-cf]

Summary

Screenshots (optional)

Documentation checklist

• Is there a changelog entry (guidelines)? If you don't add one for something awesome and new (however small) — how will our customers find out? Changelogs are automatically posted to RSS feeds, the Discord, and X.
• The change adheres to the documentation style guide.
• If a larger change - such as adding a new page- an issue has been opened in relation to any incorrect or out of date information that this PR fixes.
• Files which have changed name or location have been allocated redirects.

[cloudflare-docs-bot]

Review

⚠️ 3 warnings, 💡 1 suggestion found in commit 2a60722.

👉 Fix in your agent 👈

Fix the following review findings in PR #32224 (https://github.com/cloudflare/cloudflare-docs/pull/32224).

Before making changes, review each finding and present a brief summary table:
- For each finding, state whether you agree, disagree, or need clarification
- If you disagree (e.g. the fix requires disproportionate effort for minimal benefit,
  or the finding is factually incorrect), explain why
- If you need clarification before deciding, ask those questions
- Then share your plan for which issues to tackle and in what order

After triaging, follow this order:
1. Post a comment on this PR for any findings you are skipping, with the finding ID and your reasoning.
2. Then commit the fixes for the legitimate findings.

The comment must come before the commit — the bot reads PR comments when a new
push triggers a review, so skip comments posted after the push will be missed.

---

## Code Review

### Warnings (1)

#### CR-5bb424dd9319 · Duplicate sidebar order
- **File:** `src/content/docs/ssl/origin-configuration/automatic-key-exchange.mdx` line 7
- **Issue:** This page sets `sidebar.order: 2`, which duplicates the existing `ssl-tls-recommender.mdx` in `src/content/docs/ssl/origin-configuration/`.
- **Fix:** Choose a unique `sidebar.order` value for this page (for example, 7) unless the SSL/TLS Recommender page is also being removed or reordered in the same PR.

---

## Conventions

### Warnings (2)

#### CV-6b439235c0b4 · Description explains the work
- **File:** PR-level finding
- **Issue:** The PR description is identical to the empty template: the Summary section has no content and the checklist items are unchecked, so it provides no explanation of what the PR does.
- **Fix:** Write a short human explanation in the Summary section describing the changes.

#### CV-5a8b810cda95 · Scope accuracy
- **File:** PR-level finding
- **Issue:** The PR adds a new docs page at src/content/docs/ssl/origin-configuration/automatic-key-exchange.mdx and substantially modifies src/content/docs/ssl/post-quantum-cryptography/pqc-to-origin.mdx, but the description does not mention either change.
- **Fix:** Update the description to mention the new automatic key exchange page and the changes to the PQC-to-origin page.

---

## Style Guide Review

### Suggestions (1)

#### SG-1d9d7b427d2d · Use sentence case for headings
- **File:** `src/content/docs/ssl/origin-configuration/automatic-key-exchange.mdx` line 95
- **Issue:** Heading uses title case: `## Origin Post-Quantum Encryption API`
- **Fix:** Use sentence case unless every capitalized word is a proper noun, e.g. `## Origin post-quantum encryption API`

Code Review

This code review is in beta and may not always be helpful — use your judgment.

Warnings (1)

File	Issue
ssl/origin-configuration/automatic-key-exchange.mdx line 7	Duplicate sidebar order — This page sets sidebar.order: 2, which duplicates the existing ssl-tls-recommender.mdx in src/content/docs/ssl/origin-configuration/. Fix: Choose a unique sidebar.order value for this page (for example, 7) unless the SSL/TLS Recommender page is also being removed or reordered in the same PR.

Conventions

Warnings (2)

File	Issue
PR	Description explains the work — The PR description is identical to the empty template: the Summary section has no content and the checklist items are unchecked, so it provides no explanation of what the PR does. Fix: Write a short human explanation in the Summary section describing the changes.
PR	Scope accuracy — The PR adds a new docs page at src/content/docs/ssl/origin-configuration/automatic-key-exchange.mdx and substantially modifies src/content/docs/ssl/post-quantum-cryptography/pqc-to-origin.mdx, but the description does not mention either change. Fix: Update the description to mention the new automatic key exchange page and the changes to the PQC-to-origin page.

Style Guide Review

Suggestions (1)

File	Issue
ssl/origin-configuration/automatic-key-exchange.mdx line 95	Use sentence case for headings — Heading uses title case: ## Origin Post-Quantum Encryption API Fix: Use sentence case unless every capitalized word is a proper noun, e.g. ## Origin post-quantum encryption API

Commands

Only codeowners can run commands. Post a comment with the command to trigger it.

Command	Description
/review	Runs a review now. Incremental if a prior review exists, full if not.
/full-review	Re-reviews the entire PR diff from scratch, ignoring incremental history. Useful after a rebase, when you want a fresh review, or if the bot gets out of sync and reports issues that no longer exist.
/ignore-review-limit	Permanently lifts the 2-review automatic limit for this PR. Future pushes will trigger reviews as normal.
/disable-auto-review	Stops automatic reviews from triggering on future pushes to this PR. Codeowners can still run /review or /full-review manually.
/rebase	Rebases the PR branch against production. On conflict, attempts to resolve automatically using AI. Stops with an explanation if confidence is not high enough.

[yj7o5]

missing change log entry?

[SulemanAhmadd]

We should mention that:

"When an origin supports both classical and post-quantum key agreements, Cloudflare prefers post-quantum options"

[SulemanAhmadd]

@yj7o5 do we filter TLS 1.2 ciphersuites based on compliance mode settings? I thought the compliance mode was strictly for TLS 1.3 too.

[yj7o5]

We are not doing the filtering.

[SulemanAhmadd]

We should deprecate this API. Why remain available?

[lukevalenta]

Left some non-blocking suggestions, but otherwise lgtm.