# Certificate Transparency Monitoring Now Generally Available

Cloudflare updates its certificate transparency monitoring system.

- **Source:** [Cloudflare Blog](https://blog.cloudflare.com)
- **Published:** 2026-08-13
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://blog.cloudflare.com/certificate-transparency-monitoring-ga/>
- **On Brifing:** https://brifing.si/s/e649f8bb-b371-4378-b623-ea6cd9f8e036

## What is Certificate Transparency Monitoring?

Certificate Transparency Monitoring is a system that alerts users when a new TLS certificate is issued for a domain. It aims to detect misissued certificates early. Cloudflare has been offering this feature in beta since 2019, and today it is active on over 650,000 customer domains.

## Certificate Renewal Issue

Certificates are short-lived and renew automatically. For example, Universal SSL certificates can renew up to six times a year. These renewals generated alerts, causing users to be overwhelmed with unnecessary notifications. Cloudflare's own certificates also contributed to this noise.

## Customer Feedback

On Cloudflare's community forum, one customer mentioned disabling the feature across all their sites because they were tired of being spammed with normal certificate renewal alerts. This situation led to important alerts being missed and reduced the system's effectiveness.

## New Filtering System

Cloudflare updated its Certificate Transparency Monitoring system to filter out its own certificates. Now, users will only receive alerts for unexpected certificates not issued by Cloudflare. This change allowed the system to become generally available.

## System Integration

Cloudflare's certificate management and CT alerting service are two separate systems. These systems handle the same certificate at different times and with different information. This situation caused unnecessary alerts to be sent. The new system aims to solve this integration issue.

## Certificate Lifecycle

Certificate issuance occurs in two stages: CA creates a pre-certificate and writes to logs, then embeds this information into the final certificate and logs it again. During this process, the alerting service sees two log entries for a single certificate order: pre-certificate and final certificate.

## Technical Solution

Cloudflare uses an internal identifier called stripped_fingerprint to prevent duplicate alerts. This identifier is the hashed value of DER-encoded TBSCertificate and is consistent and unique for a pre-certificate/final certificate pair. This solution makes the system more efficient.

## Future Steps

Cloudflare anticipates that certificate lifetimes will decrease to 47 days by 2029, increasing renewal frequency. This situation will require further optimization of the system. The new filtering system ensures users only receive important alerts despite this increase.

## Sources covering this story

- https://blog.cloudflare.com/certificate-transparency-monitoring-ga/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._