JA EN
shiichan

Say Goodbye to "Not This Cert Again"! CT Monitoring Gets Smarter at GA

Cloudflare Blog ★★ View Markdown
#cloudflare#security

Hey everyone, it's Shiichan! Today's post from Cloudflare's engineering blog is packed with detail about how they fixed a long-standing certificate alerting problem.

Cloudflare Blog blog.cloudflare.com

What was announced?

Cloudflare's Engineering blog announced that Certificate Transparency Monitoring has reached general availability. It's a system that alerts you when a new TLS certificate for your domain shows up in a public Certificate Transparency (CT) log, so you can catch unauthorized issuance early. It's been in beta since 2019 and is already used across more than 650,000 customer domains.

The story so far

The long-running problem was alert noise. Cloudflare issues a huge number of certificates on customers' behalf — Universal SSL renewals, Advanced Certificate Manager certificates, backup certificates — and every single one lands in a CT log. Since certificates can renew as often as every 60 days, users kept getting notified about their own completely routine renewals.

On the community forums, people reported being "tired of regularly getting spammed with tons of completely normal certificate renewals," and some ended up disabling the feature entirely. That's a real problem, because it meant the alerts that actually mattered — signs of unauthorized issuance — could get lost in the noise too.

What changes

At GA, Cloudflare added automatic filtering that suppresses alerts for certificates it issued itself. That now covers:

  • Universal SSL renewals
  • Advanced Certificate Manager certificates
  • Total TLS certificates
  • Backup certificates
  • Incomplete pre-certificates

Certificates you upload yourself are still fully monitored. The feature is now available on every plan at no extra cost, so the alerting experience is consistent regardless of plan tier.

The alert emails themselves are better too — the subject line now names the affected hostname, and the body includes structured certificate details plus a direct link to the certificate in the Cloudflare dashboard.

Dive Deep

How does Cloudflare actually tell which certificates it issued? Here's the mechanism.

Each certificate's public key info (SPKI, or SubjectPublicKeyInfo) gets hashed with SHA-256 into a value called spki_sha256. This hash is recorded at key-generation time and stays consistent across both the pre-certificate and the final certificate.

The CT alerting service recomputes spki_sha256 from each CT log entry and checks it against the ordering service's database, which tracks certificate issuance. A match means Cloudflare issued it, so the alert is suppressed; no match means it came from elsewhere, so the alert goes out.

Certificate Transparency Monitoring is now generally available across all Cloudflare plans.

You can enable it from the Cloudflare dashboard under SSL/TLS → Edge Certificates → Certificate Transparency Monitoring. Cloudflare also plans to integrate with Cloudflare Notifications, so alerts could eventually route to webhooks, PagerDuty, or additional email destinations.

Wrap-up

  • Certificate Transparency Monitoring is now GA on every plan, with over 650,000 customer domains already using it since its 2019 beta
  • A SHA-256 hash of each certificate's public key (spki_sha256) identifies Cloudflare-issued certificates and suppresses their alerts automatically
  • Universal SSL renewals, Advanced Certificate Manager, Total TLS, backup certificates, and incomplete pre-certificates are now excluded (user-uploaded custom certificates are still monitored)
  • Alert emails now include the hostname, structured certificate details, and a dashboard link
  • Integration with Cloudflare Notifications (webhooks, PagerDuty) is planned

If alert fatigue made you switch this feature off before, this update is a good reason to turn it back on.

Related posts