Score:0

Is this OK that certificate was logged?

ru flag

I am using https://github.com/jhaals/yopass#docker-compose to configure otm service. And I have some question about nginx-proxy-letsencrypt and its logging. When I did docker logs -f otm-nginx-proxy-letsencrypt-1, I can see that cert is logged:

2022/10/10 10:31:27 [notice] 59#59: signal process started
Creating/renewal otm.my.domain certificates... (otm.my.domain)
[Mon Oct 10 10:31:28 UTC 2022] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Mon Oct 10 10:31:29 UTC 2022] Creating domain key
[Mon Oct 10 10:31:30 UTC 2022] The domain key is here: /etc/acme.sh/info@otm.my.domain/otm.my.domain/otm.my.domain.key
[Mon Oct 10 10:31:30 UTC 2022] Single domain='otm.my.domain'
[Mon Oct 10 10:31:30 UTC 2022] Getting domain auth token for each domain
[Mon Oct 10 10:31:32 UTC 2022] Getting webroot for domain='otm.my.domain'
[Mon Oct 10 10:31:32 UTC 2022] Verifying: otm.my.domain
[Mon Oct 10 10:31:36 UTC 2022] Success
[Mon Oct 10 10:31:36 UTC 2022] Verify finished, start to sign.
[Mon Oct 10 10:31:36 UTC 2022] Lets finalize the order.
[Mon Oct 10 10:31:36 UTC 2022] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/3***/1*********'
[Mon Oct 10 10:31:37 UTC 2022] Downloading cert.
[Mon Oct 10 10:31:37 UTC 2022] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/8...f'
[Mon Oct 10 10:31:37 UTC 2022] Cert success.
-----BEGIN CERTIFICATE-----
MIIGKzCCBROgAwIBAgISA9Y2oiyXcvf0rbdIWa6HeqdvMA0GCSqGSIb3DQEBCwUA
...
TwgOT5rz9z6bx9BVHsmKqw1uWwcA7ltIGWT6cJd5k8VIdnS59xfYJLiqNWNW+v0=
-----END CERTIFICATE-----
[Mon Oct 10 10:31:37 UTC 2022] Your cert is in  /etc/acme.sh/info@otm.my.domain/otm.my.domain/otm.my.domain.cer 
[Mon Oct 10 10:31:37 UTC 2022] Your cert key is in  /etc/acme.sh/info@otm.my.domain/otm.my.domain/otm.my.domain.key 
[Mon Oct 10 10:31:38 UTC 2022] The intermediate CA cert is in  /etc/acme.sh/info@otm.my.domain/otm.my.domain/ca.cer 
[Mon Oct 10 10:31:38 UTC 2022] And the full chain certs is there:  /etc/acme.sh/info@otm.my.domain/otm.my.domain/fullchain.cer 
[Mon Oct 10 10:31:38 UTC 2022] Installing cert to:/etc/nginx/certs/otm.my.domain/cert.pem
[Mon Oct 10 10:31:38 UTC 2022] Installing CA to:/etc/nginx/certs/otm.my.domain/chain.pem
[Mon Oct 10 10:31:38 UTC 2022] Installing key to:/etc/nginx/certs/otm.my.domain/key.pem
[Mon Oct 10 10:31:38 UTC 2022] Installing full chain to:/etc/nginx/certs/otm.my.domain/fullchain.pem
Reloading nginx proxy (7a...b2)...

Is this OK that there is -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- at logs?

Score:2
cn flag

If you concern about security, then there is nothing wrong for certificate to appear in logs. This object contains only public certificate information and if someone steals this string, attacker cannot do anything with it, because private key is not included in logs. And private key is the essential part an attacker can go for.

Eugen Konkov avatar
ru flag
How can I know that this is public information?
cn flag
@EugenKonkov: They mean the *public key* component of the certificate is intended to be public/shared, not secret.
Ryan Bolger avatar
tz flag
The certificate itself is also publicly available and searchable from a number of Certificate Transparency aggregators such as crt.sh. For example, here's [Google's most recent wildcard cert](https://crt.sh/?id=3144337544).
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.