Cloudflare Certificate Transparency Monitoring: A Guide for Website Owners
Learn how Cloudflare Certificate Transparency Monitoring alerts website owners to certificates for their domain, how to review alerts, and what to do next.
Facts that can change should include a source and check date. Benchmark claims should state the plan, region, method, and test period.
What Certificate Transparency Monitoring does#
If you manage a website on Cloudflare and want to know when a certificate covering your domain is issued, Certificate Transparency Monitoring provides opt-in alerts when a certificate authority adds that certificate to a public Certificate Transparency (CT) log. Cloudflare-issued certificates, including backup certificates, are filtered from these alerts.
The feature does not treat every alert as evidence of an attack. Many alerts may be routine, so review the certificate details before deciding whether further action is needed.
Turn on monitoring#
In the Cloudflare dashboard:
- Open Edge Certificates.
- Turn on Certificate Transparency Monitoring.
- Select Add Email and enter the address that should receive alerts.
Cloudflare states that certificates issued outside Cloudflare can also trigger alerts, including custom certificates uploaded by the website owner.
Review each alert#
When an alert arrives, check:
| Detail | What to check |
|---|---|
| Domain | Confirm which monitored domain the certificate covers. |
| Certificate authority | Identify the authority that issued the certificate. |
| DNS names | Review the names included on the certificate and look for names you do not recognize. |
| Validity dates | Check when the certificate becomes valid and when it expires. |
If you recognize the certificate, record why it was issued and keep the alert as part of your certificate inventory. If you do not recognize it, investigate with the relevant certificate provider or your security team.
If an illegitimate certificate was issued, Cloudflare states that only the certificate authority can revoke it. Contact the issuer listed in the alert and provide the certificate details when requesting an investigation.
What the alerts do not cover#
A CT alert does not detect a lookalike phishing domain because the certificate must cover the monitored domain itself. A certificate for a different domain, even one designed to resemble yours, is outside this monitoring scope.
An alert also does not by itself prove that your website or account has been compromised. Treat it as a signal to review the certificate, confirm whether it was authorized, and escalate when the details do not match your records.
How this relates to Cloudflare SSL/TLS#
Cloudflare's SSL/TLS documentation describes a service that can involve an edge certificate between visitors and Cloudflare and an origin certificate between Cloudflare and your website's server. Certificate Transparency Monitoring is the alerting feature documented under Cloudflare Certificate Transparency Monitoring; use the certificate details in each alert to determine what was issued and who issued it.
Sources
- Cloudflare: Certificate Transparency Monitoring Checked 2026-10-14
- Cloudflare SSL/TLS documentation Checked 2026-10-14