Is registration email address stored in certificate or elsewhere?

[jvanasco]

@lonix1

So the only ones who know that (very powerful) email address are me, and letsencrypt?

Yes.

@lonix1

I also can't find it in transparency logs, or some other weird place? (Sorry, I'm not an expert in these things.)

The correlation of email to account/domains only exists in two places:

1- LetsEncrypt's database, which associates an Email Address to an Account ID. LetsEncrypt staff can pull this info themselves. You can pull this info yourself by presenting LetsEncrypt with the current AccountKey, which happens under secure https connections. No third party can access this information from LetsEncrypt. Intercepting this information during an API call would require a MITM or other attack.

2- If LetsEncrypt sends an expiry email, that email may be relayed to you by trusted third parties. It is possible, but incredibly unlikely, that (i) LetsEncrypt's email service providers or (ii) your email service provider, are mining this information from the emails they relay and store.