Cert Camel — Security

Security

Cert Camel holds the keys to your certificates. This page is written to help you decide against running it as easily as for it — so it leads with the exposures rather than the reassurances.

The one that matters most

Private certificate keys are stored unencrypted on disk

certs\ and acme-state\ contain unencrypted private certificate keys. That is how PEM works and every ACME client on every platform is the same — but it is the single largest exposure here, and it is worth being deliberate about rather than surprised by.

Worth separating from the other thing people mean by “keys”: your API credentials — DNS tokens, load-balancer and SMTP passwords — are a different store and are encrypted, with Windows DPAPI. See Credentials below.

Both folders are excluded from git. Gitignore does not stop file sync. If the Cert Camel folder lives inside OneDrive, Dropbox, Google Drive or similar, exclude those two folders — otherwise your private keys are being copied to somebody else's servers.

Download on a certificate also puts a private key in your Downloads folder in the clear — that is what the button is for, and it is still a second copy in a folder nothing is watching. Delete it once deployed.

What the loopback binding and token actually do

The page is served from 127.0.0.1 and every API request needs a token minted fresh each time the server starts.

Loopback is not access control. Every other program running on that PC can reach 127.0.0.1, and so can any web page you happen to have open in a browser. That is precisely why the token exists — not to keep out the network, which cannot reach it anyway, but to keep out other software on the same machine.

Three things follow from that, and they decide what a URL can and cannot do:

The token does not stay in the address. It arrives on the query string, because that is the only way the server can hand it to a page it is opening, and the page stores it for the tab and rewrites the address immediately. Nothing live is left in history, in a browser profile syncing to an account, or in a screenshot. Started at boot, the server serves one token for as long as the machine stays up — so an address copied out of history weeks later would otherwise still work.
No address produces a private key. The download is a request the page makes with the token in a header; opening the same address directly is refused. It is the only secret the API hands back at all — every stored credential comes back as a yes/no that one exists, never as itself.
Requests must carry a Host header the server recognises. A hostile page can point a name it controls at 127.0.0.1, but it cannot forge the header the browser sends. The check runs in front of the pages and their data, not only the API, because that kind of attack goes for whatever needs no token.

It is not designed to be exposed to a network

There is no login, no user accounts and no roles. The token is the only thing between a caller and everything the tool can do, private keys included — there is no second factor, no per-user permission and nothing to limit what one leaked token reaches.

The web server is also single-threaded: one client that connects and sends nothing blocks it for fifteen seconds, which is fine on loopback and would not be on a network anyone else can reach — a vulnerability scanner alone would stall it repeatedly.

Credentials

DNS API tokens, load-balancer passwords and any SMTP password are encrypted with Windows DPAPI and stored in secrets.xml. They are never written to settings.json, and never sent to the browser — the page is told only whether a credential exists, never what it is.

DPAPI protects the file, not the session. Copy secrets.xml to another machine and it is useless, but anything already running as you on that machine can decrypt it. That is the normal bar for a local tool; it is not a vault.

Credentials are bound to one Windows account on one machine

This is a feature — copy the folder to a colleague and nobody inherits your API keys — and a trap. If you change which account runs Cert Camel, it can no longer decrypt its own credentials, and DNS automation and deployments start failing while everything else looks fine. Re-enter them as the new account.

The same applies to backups: certificates restore to new hardware, credentials do not.

What is recorded, and what never is

An append-only audit trail records one line per state change — when, who, whether a person or the scheduler did it, what changed and whether it worked. It is deliberately exempt from log retention, because deleting audit records to reclaim disk is the opposite of the point.

No credential value, no private key and no certificate body ever reaches a log. Credential changes are recorded by key name only, and every line passes through a redaction step on the way in, so a debug line added later cannot leak one by accident.

The audit trail. Every line records who, whether a person or the scheduler, what changed and whether it worked — and never a credential value. (click to enlarge)

What needs administrator, and why

Task	Admin?	Why
Watching certificates	No	Nothing is installed
Renewing and deploying	No	Posh-ACME is fetched into the folder, not the system
Tasks that run while you are signed out	Yes	Needs the Log on as a batch job right
Starting the page at boot on a server	Yes	Same

If setup is run without elevation it still works, but the scheduled tasks fall back to running only while you are signed in — and it says so at the time. On a server that is silently fatal: the renewal never fires, Task Scheduler still reports the task as healthy, and the first symptom is an expired certificate.

What it does not do

No telemetry, no analytics, no phoning home.
No CDN — the page loads nothing from the internet, so it works on an isolated network. The one exception is Check for updates, which asks GitHub for the newest release, and only when you press it.
No build step and no package manager. What you download is what runs.
Nothing is committed to git that belongs to you: domains, credentials, certificates and logs are all excluded, so the folder can be handed on clean.

Reporting something

There is no public issue tracker yet. If you find a security problem, get in touch through wherever you obtained this — and please do that rather than posting it somewhere public.

This is a one-person beta project. There is no security team and no response-time promise, which is itself worth weighing before you deploy it somewhere that matters.