Cloudflare announced the general availability of Certificate Transparency Monitoring, which monitors public Certificate Transparency logs to detect new TLS certificates associated with customers’ domains. The key change is that the service will no longer send alerts about certificates Cloudflare issues on behalf of the customer, making incoming messages more focused on unexpected certificates or those not issued by Cloudflare.
The service was launched in public beta in 2019 and is now used with more than 650,000 customer domains. Monitoring Certificate Transparency logs provides an early signal that a certificate has been issued for a hostname within a given domain, which can help detect certificates issued by mistake or without authorization.
Reducing Renewal Noise
The main problem was that Cloudflare issues a large number of certificates on behalf of customers, including Universal SSL renewals, Advanced Certificate Manager certificates, and backup certificates. Because certificates must be recorded in public CT logs for major browsers such as Google Chrome and Apple Safari to trust them, these issuances appeared in monitoring alongside external certificates.
Certificates are also short-lived and renew automatically. A single Universal SSL certificate can renew approximately every 60 days, up to six times per year. Renewal frequency is expected to increase after the CA/Browser Forum voted to reduce the maximum certificate lifetime to 47 days by 2029. As a result, a legitimate alert could be lost among notifications about routine renewals.
The Identifier Used for Filtering
Cloudflare relies on the spki_sha256 value, which is the SHA-256 hash of the DER-encoded SubjectPublicKeyInfo structure. The certificate ordering service calculates this value from the certificate signing request when the key is created, before the issuance process begins.
The alerting service recalculates the value from the public key contained in the CT log entry, then searches for it in the certificate ordering service’s database. If a match is found, Cloudflare knows that the certificate was issued by its systems and suppresses the alert. If the value is not found, the alert is sent as before.
The public key was chosen because it remains constant across the certificate signing request, precertificate, and final certificate stages, and because Cloudflare creates a new key pair for each issuance. It can therefore be used as a practical and unique identifier for the certificate request, even if the precertificate and final certificate logs arrive at different times.
What Changes in the Alerts?
- Certificates managed by Cloudflare, including Universal SSL, Advanced Certificate Manager, Total TLS, and backup certificates, will no longer generate email alerts.
- Abandoned precertificates, which are sometimes logged without the issuance process being completed, will not send alerts as long as they are associated with an issuance known to Cloudflare.
- Custom certificates uploaded by the customer will continue to generate alerts because their keys were not created by Cloudflare and have no record in its issuance service.
Cloudflare also updated email messages to display the affected domain name in the subject line and include certificate details and a link to it in the dashboard, so users can review it and take appropriate action.
Availability and Next Steps
Filtering is already enabled for existing users, and no action is required. Those who have not yet used the service can enable it in the Cloudflare dashboard by navigating to SSL/TLS, then Edge Certificates, then Certificate Transparency Monitoring. The service is available on all plans at no additional cost, with unified settings for alert recipients across plan levels.
Cloudflare plans to add the service to Cloudflare Notifications later, allowing CT alerts to be directed to webhooks, PagerDuty, or additional email addresses instead of relying solely on email as is currently the case.