[SSL] PQC docs cleanup: tighten Cloudflare One page, agentless terminology#30569
Draft
lukevalenta wants to merge 1 commit intoproductionfrom
Draft
[SSL] PQC docs cleanup: tighten Cloudflare One page, agentless terminology#30569lukevalenta wants to merge 1 commit intoproductionfrom
lukevalenta wants to merge 1 commit intoproductionfrom
Conversation
…ology
PQC and Cloudflare One (pqc-and-zero-trust.mdx):
- Tighten the intro: link to the canonical hybrid-key-agreement section
instead of restating the hybrid construction inline; drop the
duplicated harvest-now-decrypt-later explanation (keep the term as a
Wikipedia link).
- Clarify the lead-in for the worked examples ('sample configurations')
to make it clear they are use-case walkthroughs.
- Switch terminology from 'clientless' to 'agentless' to match current
docs convention. Update the page description and image alt text.
- Replace inline browser lists ('Chrome, Edge, Firefox') with a link to
the Browsers section of PQC support, which also lists Safari.
- Replace imprecise phrasing such as 'quantum-encrypted', 'quantum
threats', 'quantum safety', and 'quantum-safe SWG' with more accurate
alternatives ('protected with post-quantum encryption',
'harvest-now decrypt-later attacks', 'post-quantum protection',
'supports post-quantum cryptography').
- Rename the 'Agentless Cloudflare Access' section to 'Browser to
self-hosted application' since the cryptographic flow shown (browser
TLS, Cloudflare Tunnel) does not depend on Cloudflare Access; Access
is now described as an optional identity-policy layer on top. Pin
the existing slug (#agentless-cloudflare-access) so links from other
pages continue to resolve. Tighten the intro paragraph that conflated
the two.
- Split the overloaded 'Agentless (browser-only)' on-ramp bullet in the
intro into two distinct bullets: agentless browser access to
Cloudflare-proxied applications (Visitor-to-Cloudflare flow, used
among other things by Cloudflare Access self-hosted apps) and the
agentless browser on-ramp to Cloudflare Gateway via proxy endpoints
(a separate Gateway-stack flow).
- Drop the 'PQ ' prefix from numbered step headings (the entire page is
about PQ).
- Simplify the 'Within Cloudflare's global network' steps in the
Cloudflare One Client and Cloudflare IPsec sections to a one-liner
(the full Frankfurt-to-San-Francisco illustration remains in the
first walkthrough).
- Drop the duplicated 'Connection via Cloudflare One Client' step in
the Cloudflare IPsec section in favor of a pointer to the Cloudflare
One Client section.
- Drop the redundant intro sentence in the Cloudflare One Client
section that restated the algorithm covered by step 1.
- Remove the spurious harvest-now decrypt-later mentions in the
narrative steps.
- Remove the 'Putting it together' sentence in the browser-to-self-
hosted-application section that duplicated the section's takeaway.
- Tighten Secure Web Gateway step 1 to match the diagram, which only
illustrates the browser on-ramp. Cloudflare One Client and Cloudflare
IPsec are mentioned briefly as alternative post-quantum on-ramps via
pointers to their walkthroughs above. Replace 'Cloudflare One
Appliance' with 'Cloudflare IPsec' as the on-ramp name (the actual
on-ramp is the IPsec tunnel; the Appliance is one way to establish
it).
PQC support (pqc-support.mdx):
- Replace 'traditional X.509 post-quantum certificates' with 'standard
X.509 post-quantum certificates' in the Chrome MTC discussion, since
'traditional' is ambiguous (could imply non-PQ) in this context
(#30142 (comment)).
Contributor
|
This pull request requires reviews from CODEOWNERS as it changes files that match the following patterns:
|
1 task
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Tightens the PQC and Cloudflare One page: removes redundant content, fixes imprecise phrasing, and aligns terminology with PR #30537.
pqc-and-zero-trust.mdxclientlesstoagentlessto match current docs convention. Update the page description and image alt text.Chrome, Edge, Firefox) with a link to Browsers, which also lists Safari.quantum-encrypted,quantum threats,quantum safety, andquantum-safe SWGwithprotected with post-quantum encryption,harvest-now decrypt-later attacks,post-quantum protection, andsupports post-quantum cryptography.Agentless Cloudflare AccesstoBrowser to self-hosted applicationsince the cryptographic flow shown (browser TLS, Cloudflare Tunnel) does not depend on Cloudflare Access; Access is now described as an optional identity-policy layer on top. Pin the existing slug (#agentless-cloudflare-access) so links from other pages continue to resolve.Agentless (browser-only)on-ramp bullet into two distinct bullets covering agentless browser access to Cloudflare-proxied applications (Visitor-to-Cloudflare flow) and the agentless browser on-ramp to Cloudflare Gateway via proxy endpoints (separate Gateway-stack flow).PQprefix from numbered step headings (the entire page is about PQ).Within Cloudflare's global networkparagraphs to a one-liner in the Cloudflare One Client and Cloudflare IPsec sections (the full Frankfurt-to-San-Francisco illustration remains in the first walkthrough). Drop the duplicatedConnection via Cloudflare One Clientstep and the redundant intro sentence in the Cloudflare One Client section.Cloudflare One AppliancewithCloudflare IPsecas the on-ramp name (the actual on-ramp is the IPsec tunnel; the Appliance is one way to establish it).pqc-support.mdxtraditional X.509 post-quantum certificateswithstandard X.509 post-quantum certificatesin the Chrome MTC discussion, sincetraditionalis ambiguous in this context. Addresses #30142 (comment).Documentation checklist