tls-certificates

Certificate Transparency Monitoring is now generally available (opens in new tab)

Certificate Transparency Monitoring helps detect unexpected TLS certificates issued for a domain, but Cloudflare’s own frequent renewals created overwhelming noise. Cloudflare now filters certificates it issued or manages by matching their public-key fingerprints, so customers receive alerts primarily for certificates issued outside Cloudflare. The improved system is now generally available. ## The Problem with Certificate Transparency Alerts - CT monitoring alerts when a certificate for a customer’s hostname appears in a public CT log. - Cloudflare routinely issues certificates through: - Universal SSL - Advanced Certificate Manager - Total TLS - Backup Certificates - Short certificate lifetimes and automatic renewals generated repeated alerts—potentially up to six renewals per year for one certificate. - As certificate lifetimes move toward 47 days by 2029, this noise would increase further. - Customers reported disabling monitoring because routine renewals made meaningful alerts easy to overlook. ## Why Filtering Was Difficult - Certificate management and CT alerting operate as separate systems. - The ordering system knows which certificates Cloudflare creates, while the alerting system only sees public CT log data. - A certificate produces two CT entries: - A pre-certificate - The final certificate - Cloudflare used `stripped_fingerprint` to associate those entries, but the ordering system could not calculate it early enough. - Since the pre-certificate might reach the CT log before the final certificate is recorded internally, lookups could fail and generate duplicate or unnecessary alerts. ## Using the Public Key as the Identifier - Cloudflare needed an identifier that was: - Created before logging begins - Stable from CSR through final certificate - Recomputable from CT data - Unique to each certificate order - The certificate’s public key, contained in `SubjectPublicKeyInfo` (SPKI), satisfies these requirements. - Cloudflare now stores `spki_sha256`, an SHA-256 hash of the DER-encoded SPKI. - The ordering service calculates and records this hash when generating the keypair. - Because Cloudflare creates a fresh keypair for each issuance, matching SPKI values reliably identify Cloudflare-managed certificates. ## How Alert Filtering Works - When the CT alerting service sees a certificate, it recomputes `spki_sha256` from the certificate’s public key. - If the hash exists in the ordering database, the certificate is recognized as Cloudflare-issued and the alert is suppressed. - If no match exists, the certificate is treated as external and an alert is sent. - The same key appears in both the pre-certificate and final certificate, eliminating ordering and timing problems. - Abandoned pre-certificates are also suppressed because they still match a recorded Cloudflare key. - Customer-uploaded certificates continue to generate alerts because Cloudflare did not create their keypairs. Cloudflare’s updated CT Monitoring reduces routine renewal noise while preserving warnings for certificates issued outside its systems, making the feature more useful for detecting genuine certificate mis-issuance.

Automate public TLS certificate issuance with ACME support in AWS Certificate Manager | Amazon Web Services (opens in new tab)

AWS Certificate Manager (ACM) now supports public TLS certificate issuance through ACMEv2, enabling automation with clients such as Certbot, cert-manager, and acme.sh. This addresses increasingly short certificate lifetimes—100 days from 2027 and 47 days by 2029—while centralizing certificate governance and visibility in AWS. The service combines Amazon Trust Services certificates with IAM, domain scopes, CloudTrail, CloudWatch, and ACM expiry notifications. ## Why ACME Automation Matters - Manual certificate renewal risks outages and browser errors. - ACME is an open protocol used by Let’s Encrypt and many certificate clients. - ACM’s managed ACME endpoint allows organizations to continue using standard ACME tooling without relying on separate certificate authorities. - Certificates issued through ACME appear alongside other ACM certificates in centralized searches and dashboards. ## Centralized Governance and Monitoring - PKI administrators can create one or more managed ACME endpoints. - IAM roles can be associated with ACME accounts to control which domains clients may request. - Endpoint-level domain scopes restrict requests to: - Exact domains - Subdomains - Wildcard certificates - AWS CloudTrail records certificate requests for auditing. - Amazon CloudWatch provides operational metrics. - ACM sends notifications as certificates approach expiration. - Centralized controls reduce the need for separate lifecycle-management products or custom policy systems. ## Endpoint and Domain Configuration - Administrators create a public ACME endpoint in ACM. - Certificates are issued by Amazon Trust Services and are trusted by standard browsers and operating systems. - Supported key types include: - ECDSA P-256 by default - RSA 2048 - ECDSA P-384 - Domains are validated once at the endpoint level using DNS validation. - Route 53 hosted zones can be updated automatically; other DNS providers require manual creation of the supplied CNAME record. - Application owners do not need access to DNS credentials. ## External Account Binding - Clients register with the ACME server using External Account Binding (EAB). - EAB consists of: - A key identifier - An HMAC key - After registration, the ACME client creates its own asymmetric key pair for subsequent authentication. - EAB credentials can be named and given expiration dates, limiting their lifetime and exposure. ## Using Existing ACME Clients - ACM provides command examples for Certbot and acme.sh. - A Certbot request uses: - The ACM ACME directory URL - EAB key ID and HMAC key - An issuance timeout - The requested domain - Clients can run in containers such as `certbot/certbot`. - The same endpoint can support existing ACME-compatible automation workflows. ACM’s ACME support is best suited to organizations that want automated public certificate issuance without sacrificing centralized policy, auditing, and monitoring. Administrators should validate domains centrally, limit wildcard access where possible, use short-lived EAB credentials, and integrate the endpoint with their existing ACME client automation.