For the most part, we think the information that Certbot logs in
/var/log/letsencrypt isn’t too sensitive to share publicly. Sometimes people are worried about the various numeric identifiers that appear in these logs, but none of those are private keys, and none of them are credentials that could be used without the corresponding private keys to cause certificate misissuance or otherwise impersonate a site. One example is challenge file contents, which people sometimes don’t want to share because their meaning is totally unclear and they look a lot like encryption keys (but they aren’t; they’re just random numbers which are designated by the CA for a one-time use in the context of a specific certificate request).
I know it’s a lot of information, and it’s information whose sensitivity is unclear, but I think we should probably focus on removing certain information from the logs because it’s rarely useful for debugging rather than because it’s too sensitive. (I think there’s information that could be removed for this reason, although I don’t have a specific example offhand.)
On the forum we’ve always had a lot of trouble with people not providing enough information to help the forum participants diagnose and debug problems, especially in cases where there was a DNS or firewall misconfiguration, or where the exact Let’s Encrypt error messages explained what went wrong but the users didn’t share them. I think the people answering questions on the forum are going to continue to be concerned that people asking for help are almost always sharing too little information, not too much.
Starting next month (after I leave EFF), I’m going to be available for paid support where I can help people completely privately, for a fee (so their domain names and configuration information wouldn’t be published anywhere). I hope that other people or businesses will offer similar services so that people who don’t want to share the kind of information that the forms ask for, or don’t want to share their full logs or configuration files, will still have somewhere to turn. But it’s often really important for the detailed information to be shared with someone, either with the public on the forum or with a consultant elsewhere. We don’t want to make the people who are trying to help guess about what the nature of the problem is when there are already detailed logs that would resolve that question.
If you do see specific pieces of data in your logs that you think shouldn’t be there because they’re especially sensitive or especially irrelevant for debugging, assuming you’re using Certbot, I think the Certbot team would be receptive to making changes to how that particular data is logged.