Loading…
Certificate Transparency Monitoring is now generally available
CloudflareJenny Yang
Summary
Cloudflare announced the general availability of Certificate Transparency Monitoring alongside a filtering mechanism to eliminate noisy alert emails. Previously, the monitoring system alerted domain owners for all Certificate Transparency log entries, including routine, automated renewals for Universal SSL, Advanced Certificate Manager, and backup certificates. Because the alerting flow and certificate ordering service operated independently, existing identifiers like TBSCertificate hashes arrived too late to verify pre-certificates. To resolve this race condition, the ordering service now computes an SHA-256 hash of the DER-encoded SubjectPublicKeyInfo structure at key generation. When the alerting service discovers a log entry, it recomputes this hash to verify ownership against the ordering database, suppressing alerts for Cloudflare-managed certificates while preserving alerts for external or unexpected issuances.
Context
Cloudflare's Certificate Transparency Monitoring previously generated alert emails for every TLS certificate appearing in public CT logs across more than 650,000 domains. Because Cloudflare frequently issues routine certificates such as Universal SSL renewals and backup certificates, users received excessive notifications that obscured genuinely suspicious certificates. Additionally, the certificate ordering service and the CT alerting service operated independently, preventing the alerting pipeline from immediately identifying whether an observed certificate originated from Cloudflare's internal systems.
Approach / What changed
Cloudflare solved the alerting race condition by using the public key inside the SubjectPublicKeyInfo (SPKI) structure as a shared identifier. The certificate ordering service computes an SHA-256 hash of the DER-encoded SPKI (spki_sha256) straight from the Certificate Signing Request at key generation before issuance begins. When the CT alerting service parses a log entry for a pre-certificate or final certificate, it independently computes the same SPKI hash and checks the ordering database, suppressing alerts for matching Cloudflare-managed records while still alerting on unrecognized or externally issued certificates.
Takeaways
- Using the stripped fingerprint of the TBSCertificate failed as a deduplication key between services because it is unavailable to the ordering service during the pre-certificate stage.
- The SHA-256 hash of the DER-encoded SubjectPublicKeyInfo structure remains constant, unique, and reproducible across Certificate Signing Requests, pre-certificates, and final certificates.
- Suppressing alerts via SPKI matching silences routine renewals and abandoned pre-certificates generated by Cloudflare while preserving alerts for user-uploaded custom certificates and external issuances.
Related reading
Secure all your internal vibe-coded applications — in one click
AI-assisted development enables employees to build applications rapidly, but unmanaged deployments can accidentally expose internal company data to the public Internet. Cloudflare introduced direct Cloudflare Access integration for Cloudflare Workers, allowing organizations to enforce authentication policies directly at the account or individual Worker level rather than per hostname. When enabled, incoming requests are authenticated before reaching application code across custom domains, routes, workers.dev subdomains, and preview environments. Developers can access authenticated identity data such as emails and groups directly via the Worker context object without manually validating JSON Web Tokens. This capability was implemented on Cloudflare's Rust-based FL2 proxy, which separated Worker routing from Worker execution so routing runs safely prior to Access policy enforcement.
Chythra MalapatiBGP Role model: tracking the adoption of RFC 9234
Border Gateway Protocol route leaks occur when routing announcements propagate beyond their intended customer-provider or peer relationships, causing traffic misdirection and performance degradation. RFC 9234 embeds relationship awareness directly into BGP by establishing negotiated BGP Roles and attaching an Only to Customer (OTC) transitive path attribute to prevent unauthorized route propagation. To assess real-world adoption, Cloudflare monitored OTC attribute transmission across peer networks and discovered that 33.1 percent of IPv4 and 17 percent of IPv6 paths were missing the OTC attribute. Investigation revealed that Tier-1 transit providers AS1299 and AS3257 were stripping the attribute due to legacy defensive BGP error-handling configurations. Following direct engagement, AS1299 updated its configurations to preserve OTC propagation, whereas AS3257 continued stripping it, highlighting the necessity of broader vendor and carrier support across the Internet.
Bryton HerdesUnveiling good and bad behaviors on the Agentic Internet
Web traffic increasingly shifts between human interaction and automated agents, rendering point-in-time security checks ineffective against sophisticated automation. Cloudflare addresses this shift through continuous behavioral analysis designed to evaluate trust across entire user sessions rather than relying on static point-in-time hurdles. Its CDN-injected client-side system, Precursor, tracks continuous behavioral indicators like cursor movements to catch mid-session automated takeovers. To counter rapid bot adaptation, Cloudflare is introducing self-adjusting machine learning models under Adaptive Intelligence and non-deterministic defenses such as the AI Labyrinth. These tools allow site owners to poison scraper training data, trap crawlers in synthetic webs, or queue legitimate agents while dynamically penalizing abusive traffic.
Jin-Hee LeeThe next generation of MCP
Model Context Protocol previously required stateful connections between clients and remote servers, creating operational complexity around sticky sessions, message replay, and open streams. The newly released MCP 2026-07-28 specification transitions MCP to a fully stateless protocol alongside updated SDKs across TypeScript, Python, Go, and C#. The protocol eliminates mandatory handshakes and session identifiers from core request paths while enabling servers to run on request-scoped infrastructure like Cloudflare Workers. Interactive elicitation is restructured through Multi Round-Trip Requests, which allow servers to return input requirements without sustaining persistent connections. Standardized headers for method names and improved OAuth authorization mechanisms further enable standard web infrastructure to inspect and manage MCP traffic efficiently.
Matt Carey