Cloudflare has announced that its Certificate Transparency Monitoring feature is now generally available to all customers, according to the Cloudflare Blog. The tool watches public Certificate Transparency (CT) logs — the append-only, publicly auditable records that certificate authorities are required to publish whenever they issue a TLS certificate — and alerts domain owners when a certificate is issued for a domain they control, regardless of whether they requested it.
Certificate Transparency logs have existed for years as a browser-security backstop: any certificate not logged in a recognized CT log is generally rejected by modern browsers. But simply having the logs public doesn't mean anyone is watching them on your behalf. Historically, spotting a fraudulent or unauthorized certificate issued for your domain required either manually querying CT log search tools or paying for a dedicated monitoring service. Cloudflare's move folds that monitoring directly into its existing platform and, per the announcement, makes it available without requiring a separate paid tier for the core alerting functionality.
The mechanics are straightforward: once enabled for a zone, Cloudflare continuously checks new CT log entries against the domains and subdomains under that zone. If a new certificate appears — say, for a subdomain nobody on the team remembers provisioning, or a wildcard certificate issued through a compromised account with a certificate authority — the owner is notified. This matters because a fraudulently issued certificate is one of the more effective tools for impersonation: paired with a look-alike domain or a compromised DNS record, it lets an attacker present a browser padlock and a technically "valid" HTTPS connection while intercepting or spoofing traffic meant for the real organization.
Cloudflare frames this as closing a detection gap rather than introducing new prevention. It doesn't stop a certificate authority from mis-issuing a certificate, and it doesn't replace existing controls like CAA (Certification Authority Authorization) DNS records, which restrict which authorities are allowed to issue certificates for a domain in the first place. What it adds is visibility: a notification loop so that if mis-issuance happens, the domain owner finds out from Cloudflare rather than from a customer reporting a suspicious login page, or not at all.
The feature had reportedly been in limited or beta availability before this general release; Cloudflare's post does not specify exact prior enrollment numbers or a rollout timeline beyond the GA announcement itself, and those details should be treated as unconfirmed pending further detail from Cloudflare. The company positions the change as consistent with its broader push to bundle security tooling — bot management, DNS security, and now certificate monitoring — into its baseline offering rather than as paid add-ons, though pricing tiers for advanced configuration options were not fully detailed in the announcement.