Certificate Transparency Monitoring is now generally available

This post details the technical solution for reducing noise in Certificate Transparency (CT) monitoring alerts. The core problem was distinguishing between routine Cloudflare-issued certificates and potentially malicious ones. The solution involves identifying a consistent, reproducible, and early identifier: the SHA-256 hash of the SubjectPublicKeyInfo (SPKI). The certificate ordering service now records this `spki_sha256` at key generation. The CT alerting service recomputes this hash from log entries and checks it against the ordering service's database. A match suppresses the alert, while a non-match triggers an alert. This resolves the issue of separate systems lacking a common identifier and the timing problem of `stripped_fingerprint` arriving too late. The post also describes improvements to alert emails and future plans for integration with Cloudflare Notifications.