Cloudflare makes Certificate Transparency Monitoring generally available

CloudFlare has moved Certificate Transparency Monitoring from public beta to general availability, adding a filter designed to remove alerts for certificates it issues on customers’ behalf. The service has been active since 2019 and now covers more than 650,000 customer domains.

Certificate Transparency logs are intended to make certificate issuance visible, giving security teams an early warning when a certificate appears for a hostname they control. But the system generated substantial noise: Cloudflare’s Universal SSL, Advanced Certificate Manager, and backup certificates all appear in public logs, and routine renewals could look identical to an unexpected issuance.

That problem is becoming more significant as certificate lifetimes shrink. Universal SSL certificates can renew as often as every 60 days—roughly six times per year—and the CA/Browser Forum has voted to reduce the maximum lifetime to 47 days by 2029. More frequent renewals would otherwise mean even more routine notifications.

The new monitoring workflow suppresses certificates Cloudflare can identify as its own and sends alerts for certificates issued externally. Cloudflare says the engineering challenge was connecting its certificate-management and CT-alerting systems, which operate independently and see different parts of the issuance process.

The filtering uses the certificate’s public key, carried in its SubjectPublicKeyInfo structure. That key is available early, remains consistent through pre-certificate and final-certificate stages, and can be recomputed from CT log data. For teams building automated security workflows around AI services, APIs, or customer domains, fewer false positives should make certificate alerts more practical to route, prioritize, and investigate.

Source: CloudFlare