# Does x509.log contain the raw certificate? **URL:** \ **Category:** Zeek\ **Created:** [November 19, 2016, 9:44pm UTC](https://community.zeek.org/t/does-x509-log-contain-the-raw-certificate/4499 "2016-11-19T21:44:11Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Robert\_Harrelson](https://avatars.discourse-cdn.com/v4/letter/r/f1d935/32.png) [@Robert\_Harrelson](https://community.zeek.org/u/Robert_Harrelson)\ **Post date:** [November 19, 2016, 9:44pm UTC](https://community.zeek.org/t/does-x509-log-contain-the-raw-certificate/4499/1 "2016-11-19T21:44:11Z")
The log file x509.log contains parsed information from the X.509 certificate. However, I would like to know if the x509.log file contains the raw X.509 certificate itself. If yes, how do I extract the certificate from the log, not in real-time? Thanks ---
**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\ **Post date:** [November 19, 2016, 11:06pm UTC](https://community.zeek.org/t/does-x509-log-contain-the-raw-certificate/4499/2 "2016-11-19T23:06:21Z")
The certificates are not contained in any log file, just certificate meta data. To enable certificate extraction you need to enable the files framework which will write certificates to disk. -AK ---
**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\ **Post date:** [November 28, 2016, 10:55pm UTC](https://community.zeek.org/t/does-x509-log-contain-the-raw-certificate/4499/3 "2016-11-28T22:55:46Z")
Just to expand on this a bit - if you want the certificates dumped in pem format, there also is a policy script for this that ships with Bro; you can just load protocols/ssl/extract-certs-pem.bro. Johanna ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/does-x509-log-contain-the-raw-certificate/4499/4 "2022-05-06T15:44:18Z")