ssl cert password saved in cleatext #3581

New issue

Open

opened 2026-02-20 02:19:13 -05:00 by deekerman · 0 comments

deekerman commented

2026-02-20 02:19:13 -05:00

Owner

Originally created by @mamema on GitHub (Feb 27, 2024).

Is there an existing issue for this?

I have searched the existing open and closed issues

Current Behavior

in the config.xml in the line

ThissisinCleartext

the password for the pfx cert is saved in clear text.
the password of the admin user in comparison isn't

Expected Behavior

secrets shouldn't be saved in clear text

remarks: the point is, even though a reverse proxy can be / is used for external access, to adhering zero trust, also for internal access should be done everything to apply security measures.

Steps To Reproduce

open the config.xml in config path after applying pfx cert and passwort in web ui (it's masked there - huhh!)

Environment

- OS: debian 12
- Lidarr: 2.1.7.4030
- Docker Install: yes
- Using Reverse Proxy: yes
- Browser: Firefox 123
- Database: internal

What branch are you running?

Master

Trace Logs?

lidarr.trace.txt

Trace Logs have been provided as applicable. Reports may be closed if the required logs are not provided.

I have read and followed the steps in the wiki link above and provided the required trace logs - the logs contain trace - that are relevant and show this issue.

Originally created by @mamema on GitHub (Feb 27, 2024). ### Is there an existing issue for this? - [X] I have searched the existing open and closed issues ### Current Behavior in the config.xml in the line <SslCertPassword>ThissisinCleartext</SslCertPassword> the password for the pfx cert is saved in clear text. the password of the admin user in comparison isn't ### Expected Behavior secrets shouldn't be saved in clear text remarks: the point is, even though a reverse proxy can be / is used for external access, to adhering zero trust, also for internal access should be done everything to apply security measures. ### Steps To Reproduce open the config.xml in config path after applying pfx cert and passwort in web ui (it's masked there - huhh!) ### Environment ```markdown - OS: debian 12 - Lidarr: 2.1.7.4030 - Docker Install: yes - Using Reverse Proxy: yes - Browser: Firefox 123 - Database: internal ``` ### What branch are you running? Master ### Trace Logs? [lidarr.trace.txt](https://github.com/Lidarr/Lidarr/files/14419789/lidarr.trace.txt) ### Trace Logs have been provided as applicable. Reports may be closed if the required logs are not provided. - [X] I have read and followed the steps in the wiki link above and provided the required trace logs - the logs contain `trace` - that are relevant and show this issue.