Cloudflare filters internal cert noise in transparency alerts

Cloudflare has moved its Certificate Transparency Monitoring service from beta to general availability after implementing filtering for its own certificate issuances. The service, now active for over 650,000 customer domains, scans public Certificate Transparency logs and alerts domain owners when new TLS certificates appear for their domains. Previously, the service generated alerts for all certificates, including Cloudflare's automated renewals through Universal SSL and Advanced Certificate Manager. With certificates renewing as frequently as every 60 days (a cadence increasing to every 47 days by 2029 per CA/Browser Forum rules), this created alert fatigue. The update eliminates noise by cross-referencing internal issuance data before sending alerts, focusing notifications exclusively on third-party certificates. The solution required bridging two separate systems: the certificate management system handling internal issuance data and the CT alerting service parsing public logs. Cloudflare now filters using DER-encoded TBSCertificate hashes to deduplicate pre-certificate and final certificate entries.