Certificate Transparency (CT) Monitoring is an opt-in feature that lets you double-check any SSL/TLS certificates issued for your domain.
CT Monitoring alerts are triggered whenever a certificate that covers your monitored domain is issued by a Certificate Authority (CA) and added to a public CT log. Alerts for certificates Cloudflare issues on your behalf, including backup certificates, are automatically filtered out. For more information, refer to Certificate Transparency Monitoring filtering behavior ↗, or to the introductory blog post ↗ to learn more about how CT Monitoring works.
Alerts are turned off by default. If you want to receive alerts, go to the Edge Certificates ↗ page and turn on Certificate Transparency Monitoring, then select Add Email.
To stop receiving alerts, turn off Certificate Transparency Monitoring or remove your email from the feature card.
Cloudflare filters out the certificates it issues for you, so every alert you get is worth a quick look.
Most alerts are routine. Open the email and check three things:
- Your domain. Does it match what you own?
- The issuer. Did you or your organization request this certificate, or was it requested by a service you use? The issuer is listed as the Certificate Authority in the email.
- The DNS names and validity dates. Do they look reasonable?
If you can confirm that your organization or a service you use requested the certificate, no action is required. Otherwise, investigate the issuance with your security team or certificate provider. You can review certificates configured on Cloudflare from the Edge Certificates page ↗ in the dashboard. For external certificates, review the CT log entry or use Certificate Search ↗.
Take action if:
- You do not recognize the issuer or did not request the certificate.
- You do not recognize the DNS names.
- Your website has been acting strangely.
Only Certificate Authorities can revoke malicious certificates. If you believe an illegitimate certificate was issued for your domain, contact the Certificate Authority listed as the Issuer in the email.
Domain registrars may be able to suspend potentially malicious domains. If, for example, you notice that a malicious domain was registered through GoDaddy, contact GoDaddy’s support team to see if they can help you. Do the same for other registrars.
There are other ways to combat malicious certificates. You can warn your visitors with an on-site notification or ask browser makers (Google for Chrome, etc.) to block these domains.
If someone is attempting to impersonate you online, you should absolutely take action. This is usually difficult to recognize, so exercise caution. Remember: the vast majority of certificates are not malicious. Only take action if you believe something is wrong.
Certificate Transparency Monitoring addresses the same problems as HTTP Public Key Pinning (HPKP), but with fewer technical issues ↗.
Cloudflare does not offer or support HPKP and advises against using it with Universal SSL.