Why routine renewals buried the real alerts
Cloudflare’s Certificate Transparency (CT) Monitoring left public beta in 2019 and is now generally available, covering more than 650,000 customer domains after a change that stops it from emailing you about certificates Cloudflare already issued on your behalf Cloudflare blog. The service watches public CT logs for new TLS certificates covering your domains and acts as an early warning that someone issued a certificate for a hostname in your zone; because major browsers such as Google Chrome and Apple’s Safari refuse to trust a certificate that isn’t logged, the same transparency that helps you spot mis-issuance also surfaces every routine certificate Cloudflare renews for you.
Cloudflare issues TLS certificates for your domains automatically through products such as Universal SSL and Advanced Certificate Manager, and every one of those certificates lands in public CT logs. A single Universal SSL certificate can renew as often as every 60 days, up to about six times a year, while Universal certificates carry a 90-day validity period with auto-renewal starting 30 days before expiration Cloudflare developers docs. The CA/Browser Forum voted to cut the maximum certificate lifetime to 47 days by 2029, multiplying the routine renewals that flow through those logs CA/Browser Forum. Cloudflare has been widening its network visibility beyond certificates too, recently adding a way to flag AI agent traffic moving across company networks Cloudflare can now flag AI agent traffic across company networks.
The fix: a key that exists before issuance
Cloudflare’s alerting service and its certificate-ordering service were two independent pipelines that handled the same certificate but never shared state at the right moment, so copying a deduplication fingerprint from the ordering side failed: the ordering service never sees the pre-certificate and couldn’t generate the matching key in time Cloudflare blog. The shipped fix uses spki_sha256, an SHA-256 hash of the DER-encoded SubjectPublicKeyInfo computed from the certificate signing request at key generation, before issuance begins. Because Cloudflare generates a fresh keypair for every issuance, a certificate whose public key matches a recorded value must have come from Cloudflare, and the alerter recomputes the hash on each log entry to decide whether to suppress or send the alert.
What you’ll see now
On Cloudflare’s community forum, one user described disabling the feature across all their sites because they were “tired of regularly getting spammed with tons of completely normal certificate renewals,” adding they “weren’t even actually reading them by the end” Cloudflare blog. The change reshapes what lands in your inbox: updated emails now name the affected hostname in the subject line, include certificate details, and link to the certificate in the Cloudflare dashboard. Filtering is already enabled for existing users at no extra cost on every plan, and Cloudflare says it plans to bring CT alerts into Cloudflare Notifications so teams can route them to webhooks or PagerDuty. The alerts you receive now are the ones Cloudflare didn’t issue and you didn’t expect.
