Is letsencrypt registration email address stored in certificate

Question

I'm using letsencrypt in two ways: a docker stack using certbot, and another using traefik (which performs certificate management automatically, using lego). In both cases there's a setting for the registration email address.

Is that email address stored in the certificate, or elsewhere? And can anyone (other than letsencypt) discover that email address?

Answer 1

The beginning of the certificate process starts with creating a CSR or Certificate Signing Request. This request allows the optional entry of an email address which would then be embedded into the certificate once it was provided.

The documentation and video at the link below shows how they are created.

https://www.ssl.com/how-to/manually-generate-a-certificate-signing-request-csr-using-openssl/

Answer 2

From the letsencrypt forum:

• The only ones who know that (very powerful) email address are you, and Let's Encrypt
• It's used by Let's Encrypt to inform you of a pending expiration
• It won't be encoded into the certificate
• It won't be published anywhere, and so won't be contained in any "transparency logs" service

And:

The correlation of email to account/domains only exists in two places:

• LetsEncrypt's database, which associates an Email Address to an Account ID. LetsEncrypt staff can pull this info themselves. You can pull this info yourself by presenting LetsEncrypt with the current AccountKey, which happens under secure https connections. No third party can access this information from LetsEncrypt. Intercepting this information during an API call would require a MITM or other attack.
• If LetsEncrypt sends an expiry email, that email may be relayed to you by trusted third parties. It is possible, but incredibly unlikely, that (i) LetsEncrypt's email service providers or (ii) your email service provider, are mining this information from the emails they relay and store.