Cloudflare's Certificate Transparency Monitoring is now generally available with filtered alerts

General Availability and Noise Reduction

Cloudflare has announced the general availability of its Certificate Transparency Monitoring service. This service, which has been in public beta since 2019, sends alerts to subscribers when a new TLS certificate appears in a public Certificate Transparency (CT) log for their domains. The key improvement in this release is the implementation of a filter that removes alerts for certificates issued by Cloudflare itself.

Addressing the Alert Volume Problem

Previously, the monitoring service generated a high volume of alerts due to Cloudflare's own certificate issuance and renewal processes, such as Universal SSL renewals and certificates from Advanced Certificate Manager. These certificates are intentionally logged to public CT logs to ensure browser trust. However, the frequent renewals, which can occur as often as every 60 days, led to an overwhelming number of notifications, making it difficult for users to identify genuinely suspicious certificates.

Impact of Filtering

The new filtering mechanism ensures that users only receive alerts for certificates they did not expect and that were not issued by Cloudflare. This significantly reduces the "noise" in the alert system, allowing users to focus on potential mis-issuances or unauthorized certificate activity. The change aims to make the early warning system more effective and actionable for the more than 650,000 customer domains currently using the service.