# Enhancing Certificate Transparency Monitoring: Filtering Out Cloudflare-Managed Certificates
Certificate Transparency (CT) monitoring is a crucial security feature that helps organizations detect misissued certificates for their domains. Since launching this feature in public beta in 2019, Cloudflare has been emailing subscribers whenever a new TLS certificate appears in a public CT log for one of their domains. However, as the feature gained adoption among our 650,000+ customer domains, we identified a significant noise problem that needed addressing.
## The Noise Problem
Cloudflare issues a large volume of certificates on behalf of our customers through Universal SSL, Advanced Certificate Manager, and backup certificates. All these certificates are logged to public CT logs by design—after all, a certificate that isn’t logged won’t be trusted by major browsers like Google Chrome and Apple’s Safari.
The issue was that every certificate renewal (which can happen as often as every 60 days for Universal SSL certificates) generated an alert. With the industry moving toward shorter certificate lifetimes (the CA/Browser Forum has voted to cut maximum certificate lifetime to 47 days by 2029), the number of renewals would only increase. At our scale, these routine renewals could appear indistinguishable from suspicious certificates, making it difficult for security teams to identify genuine threats.
## The Solution: Smarter Filtering
We’ve now implemented intelligent filtering that distinguishes between certificates we manage and those that require attention. The key was identifying the right identifier that could track certificates throughout their entire lifecycle.
## Technical Implementation
The solution centers on using the **SubjectPublicKeyInfo (SPKI)** fingerprint as the identifier that connects all stages of certificate issuance:
1. **Early identification**: The SPKI is available from the moment a key is generated, before any logging occurs
2. **Consistency**: The same SPKI value persists through all stages—CSR, pre-certificate, and final certificate
3. **Reproducibility**: The CT alerting service can independently compute the SPKI hash from log entries
4. **Uniqueness**: Each certificate gets a fresh keypair, making collisions astronomically unlikely
The system now uses `spki_sha256` (an SHA-256 hash of the DER-encoded SPKI) as the deduplication key. When the alerting service receives a log entry, it:
1. Extracts the SPKI from the certificate
2. Computes the SHA-256 hash
3. Checks if this hash matches a recorded Cloudflare-issued certificate
4. If matched, suppresses the alert; if not, sends the notification
## Benefits of the New Approach
This filtering mechanism provides three significant improvements:
1. **Cloudflare-managed certificates no longer generate alerts**: Universal SSL, Advanced Certificate Manager, Total TLS, and backup certificates all match recorded keys and pass silently
2. **Abandoned pre-certificates are silenced**: Sometimes a pre-certificate is logged but issuance never completes. These now match our records and stay quiet
3. **Suspicious certificates still trigger alerts**: Custom certificates you upload or certificates from external sources without matching SPKI fingerprints will still generate notifications—the exact scenario CT monitoring was designed to detect
## What This Means for Users
Starting today, Certificate Transparency Monitoring has become significantly more valuable:
– **Reduced noise**: Security teams can focus on genuine threats rather than sifting through routine renewals
– **Earlier detection**: You’ll still be notified of unexpected certificates issued for your domains
– **Clearer alerts**: Updated email notifications now identify affected hostnames in subject lines and include certificate details with dashboard links
## Future Enhancements
We’re planning to bring Certificate Transparency Monitoring to Cloudflare Notifications, allowing teams to route CT alerts to webhooks, PagerDuty, or additional email destinations through our notifications system.
## Try It Today
Already using Certificate Transparency Monitoring? No action needed—filtering is automatically enabled.
Not using it yet? In the Cloudflare dashboard, navigate to SSL/TLS → Edge Certificates → Certificate Transparency Monitoring and enable it. This feature is available on every plan at no additional cost, with unified settings across all plan tiers.
**Conclusion**: By identifying the right persistent identifier—the SPKI fingerprint—we’ve solved the noise problem while maintaining the security benefits of Certificate Transparency Monitoring. This enhancement represents a significant step forward in helping security teams identify genuine certificate threats without being overwhelmed by routine renewals.
