I got this warning from certbot when using the manual plugin to request a certificate. NOTE: The IP of this machine will be publicly logged as having requested this certificate. If you're running certbot in manual mode on a machine that is not your server, please ensure you're okay with that. A…

The IP addresses are currently not published anywhere. There are plans to publish logs containing those IPs, domain validation records and things like that in the future, but there’s no schedule (or any technical details on how the logs will be published) available yet.

Erm, why would you publish the requesting IP address? What purpose does this (too much) transparency serve?

I concur with TCM. In my opinion, publishing all certificates publicly is already kind of overstepping the line between transparency and privacy. I see no benefit whatsoever in publishing IP addresses, only the drawback of exposing origin server addresses to the public which cannot be trusted. I’m c…

Hi @McKay , We’ll have to agree to disagree on publishing certificates. That’s a core part of Let’s Encrypt’s commitment to transparency, and by next October it will be required of all CAs by Chrome policy. I will note that you do not need a Let’s Encrypt certificate to use CloudFlare’s strict SSL …

For DNS-01 this is almost guaranteed to be a different IP address. Why would you need anomaly detection algorithms if we have certificate transparency? Why isn't it enough for the CA to log for itself and access those logs only in case of malice? [image] jsha: it is provided for in our privacy …

[image] TCM: Is there any actual effort to develop such anomaly patterns right now that would absolutely need this data? There is not, which is part of why we haven't prioritized the work.

The developers of Certbot clearly thought it was worth explicitly calling out, despite being covered in the privacy policy. Isn’t there a risk that someone using a less informative client might unwittingly expose an IP address that identifies them?

In general, we don’t consider the IP addresses of publicly accessible servers to be private information. The IP address of people browsing the web, on the other hand, we do consider to be private, which is why our privacy policy specifically treats OCSP requests as more sensitive than ACME traffic. …

Of course I completely agree with you about publicly accessible servers, and OCSP requests. The tricky middle ground is precisely the concern here. [image] jsha: Most likely if we in the future prioritize publishing more detailed validation records, we would do so with preannouncement and for f…

Public IP logging

Help

MitchellK January 25, 2017, 12:55pm 2

Never seen that message before. I checked on https://crt.sh/ on some of my certs and do not see any requesting IP listed. Sure am also interested to know the answer to this.

Topic		Replies	Views
Can one DISABLE (from certbot) public IP logging to letsencrypt.org's servers of the certbot host requesting the certificate(s)? Help	8	3559	February 12, 2020
Public logging of requesting IP addresses Issuance Policy	3	2115	June 11, 2018
Public IP Logging Issuance Policy	6	2902	March 28, 2019
How to find IP in cert logs? Help	3	2077	December 8, 2021
Does a list of active SSL certs exist? Help	3	5318	July 6, 2020

Public IP logging

Related topics