Certificate Transparency Monitoring Now Generally Available
Cloudflare updates its certificate transparency monitoring system.
1What is Certificate Transparency Monitoring?
Certificate Transparency Monitoring is a system that alerts users when a new TLS certificate is issued for a domain. It aims to detect misissued certificates early. Cloudflare has been offering this feature in beta since 2019, and today it is active on over 650,000 customer domains.
2Certificate Renewal Issue
Certificates are short-lived and renew automatically. For example, Universal SSL certificates can renew up to six times a year. These renewals generated alerts, causing users to be overwhelmed with unnecessary notifications. Cloudflare's own certificates also contributed to this noise.
3Customer Feedback
On Cloudflare's community forum, one customer mentioned disabling the feature across all their sites because they were tired of being spammed with normal certificate renewal alerts. This situation led to important alerts being missed and reduced the system's effectiveness.
4New Filtering System
Cloudflare updated its Certificate Transparency Monitoring system to filter out its own certificates. Now, users will only receive alerts for unexpected certificates not issued by Cloudflare. This change allowed the system to become generally available.
5System Integration
Cloudflare's certificate management and CT alerting service are two separate systems. These systems handle the same certificate at different times and with different information. This situation caused unnecessary alerts to be sent. The new system aims to solve this integration issue.
6Certificate Lifecycle
Certificate issuance occurs in two stages: CA creates a pre-certificate and writes to logs, then embeds this information into the final certificate and logs it again. During this process, the alerting service sees two log entries for a single certificate order: pre-certificate and final certificate.
7Technical Solution
Cloudflare uses an internal identifier called stripped_fingerprint to prevent duplicate alerts. This identifier is the hashed value of DER-encoded TBSCertificate and is consistent and unique for a pre-certificate/final certificate pair. This solution makes the system more efficient.
8Future Steps
Cloudflare anticipates that certificate lifetimes will decrease to 47 days by 2029, increasing renewal frequency. This situation will require further optimization of the system. The new filtering system ensures users only receive important alerts despite this increase.
Original article: Cloudflare Blog — Certificate Transparency Monitoring Artık Genel Kullanımda