Certificate Transparency Monitoring is now generally available (opens in new tab)
Certificate Transparency Monitoring helps detect unexpected TLS certificates issued for a domain, but Cloudflare’s own frequent renewals created overwhelming noise. Cloudflare now filters certificates it issued or manages by matching their public-key fingerprints, so customers receive alerts primarily for certificates issued outside Cloudflare. The improved system is now generally available. ## The Problem with Certificate Transparency Alerts - CT monitoring alerts when a certificate for a customer’s hostname appears in a public CT log. - Cloudflare routinely issues certificates through: - Universal SSL - Advanced Certificate Manager - Total TLS - Backup Certificates - Short certificate lifetimes and automatic renewals generated repeated alerts—potentially up to six renewals per year for one certificate. - As certificate lifetimes move toward 47 days by 2029, this noise would increase further. - Customers reported disabling monitoring because routine renewals made meaningful alerts easy to overlook. ## Why Filtering Was Difficult - Certificate management and CT alerting operate as separate systems. - The ordering system knows which certificates Cloudflare creates, while the alerting system only sees public CT log data. - A certificate produces two CT entries: - A pre-certificate - The final certificate - Cloudflare used `stripped_fingerprint` to associate those entries, but the ordering system could not calculate it early enough. - Since the pre-certificate might reach the CT log before the final certificate is recorded internally, lookups could fail and generate duplicate or unnecessary alerts. ## Using the Public Key as the Identifier - Cloudflare needed an identifier that was: - Created before logging begins - Stable from CSR through final certificate - Recomputable from CT data - Unique to each certificate order - The certificate’s public key, contained in `SubjectPublicKeyInfo` (SPKI), satisfies these requirements. - Cloudflare now stores `spki_sha256`, an SHA-256 hash of the DER-encoded SPKI. - The ordering service calculates and records this hash when generating the keypair. - Because Cloudflare creates a fresh keypair for each issuance, matching SPKI values reliably identify Cloudflare-managed certificates. ## How Alert Filtering Works - When the CT alerting service sees a certificate, it recomputes `spki_sha256` from the certificate’s public key. - If the hash exists in the ordering database, the certificate is recognized as Cloudflare-issued and the alert is suppressed. - If no match exists, the certificate is treated as external and an alert is sent. - The same key appears in both the pre-certificate and final certificate, eliminating ordering and timing problems. - Abandoned pre-certificates are also suppressed because they still match a recorded Cloudflare key. - Customer-uploaded certificates continue to generate alerts because Cloudflare did not create their keypairs. Cloudflare’s updated CT Monitoring reduces routine renewal noise while preserving warnings for certificates issued outside its systems, making the feature more useful for detecting genuine certificate mis-issuance.