Certificate Transparency Monitoring is now generally available
Cloudflare has made Certificate Transparency Monitoring generally available after addressing noise from its own certificate renewals. The service now filters out Cloudflare-issued certificates to reduce unnecessary alerts.
Cloudflare announced the general availability of Certificate Transparency Monitoring, a service that alerts customers when a new TLS certificate appears in public logs for their domains. Initially launched in public beta in 2019, the service now monitors over 650,000 customer domains. It serves as an early warning system for potentially mis-issued certificates, though it previously generated excessive alerts due to Cloudflare's own routine renewals. Customers reported being overwhelmed by notifications for normal certificate renewals, prompting the company to address the issue.
The previous system flagged every certificate logged in public Certificate Transparency logs, including those issued by Cloudflare for services like Universal SSL and Advanced Certificate Manager. Since certificates renew frequently—sometimes every 60 days—and browsers require logging for trust, these renewals generated repetitive alerts. Cloudflare's internal systems and the Certificate Transparency alerting service operated independently, creating a gap that led to duplicate or irrelevant notifications. Customers described the volume of alerts as disruptive, with one noting they had disabled the feature entirely due to the noise.
To resolve this, Cloudflare implemented a filtering mechanism that excludes certificates it issued from alert emails. The solution involved identifying a persistent identifier shared between Cloudflare's certificate ordering system and the public Certificate Transparency logs. The company determined that the public key, specifically its SHA-256 hash (spki_sha256), could uniquely link certificates to Cloudflare's issuance process. This identifier is recorded early in the certificate ordering flow and used by the alerting service to verify whether a logged certificate was issued internally.
The updated system now ensures alerts are sent only for certificates issued outside Cloudflare's automated processes. Notifications include the affected hostname, certificate details, and a link to the Cloudflare dashboard for review. The service remains available at no extra cost across all plans, with unified settings for managing alert recipients. Cloudflare plans to expand Certificate Transparency Monitoring to Cloudflare Notifications, allowing teams to route alerts to additional destinations such as webhooks or PagerDuty.