100 Commits

This Branch

This Branch

All Branches

• Support wget2 in the wget code path

  Fedora 40 and later ship wget2 as wget. Under -q it prints nothing for -S,
  so $HTTP_HEADER stayed empty in wget mode (ACME_USE_WGET=1, or no curl):
  no status code, no Replay-Nonce, no Location, and every ACME request
  failed. Without -q its own "HTTP response 200 OK [url]" line would be read
  as the status line, and a HEAD response gets no headers at all.
  
  Detect wget2 by its --version line and run it without -q (and without -d,
  whose demultiplexing expects wget 1.x output). _wget2_headers keeps only
  the header blocks of its stderr; for a response without a body, where
  wget2 prints no block, it rebuilds the status line from the "HTTP
  response" line. HEAD goes through --method HEAD --save-headers, which
  writes the headers into $HTTP_HEADER. wget 1.x and curl are unchanged.

  neil 2026-09-27 19:32:38 +02:00
  acbe85b7e9
• Save CA_EMAIL only when the CA took the contact

  _regAccount wrote CA_EMAIL before sending newAccount, so it recorded an
  address the CA never stored: for an account key it already knows, the CA
  answers 200 and ignores the contact of the request. A --register-account
  -m on an existing account then left the local config claiming an email
  the account does not have.
  
  Save it in the 201 branch, and in the 200/409 branch say that the email
  was not changed and point at --update-account -m. Nothing is printed
  when the given address already matches the saved one.

  neil 2026-09-26 12:48:52 +02:00
  6ef16ffe63
• Guard the account email in __initHome too

  _process() calls __initHome directly once the option loop is over, and
  that sourcing of account.conf overwrote the address -m had just
  exported -- before any command function reaches _initpath. Guarding
  only _initpath was not enough: by then ACCOUNT_EMAIL already held the
  saved address, so it was saved and restored unchanged.
  
  Keep the live value across this sourcing as well.

  neil 2026-09-26 12:38:43 +02:00
  427787cb8f
• Keep the command line account email out of account.conf's way

  _initpath sources account.conf (twice, counting __initHome), and the
  assignment overwrote the ACCOUNT_EMAIL that -m had just exported, so
  --update-account -m sent the saved address instead of the given one.
  It also short-circuited _getAccountEmail, whose first branch is meant
  for the live value: the saved global address then won over the per-CA
  CA_EMAIL as well.
  
  Save the live value before the sourcing and restore it after. The saved
  address is still reached, by the _readaccountconf at the end of
  _getAccountEmail, which is where it belongs in the order.

  neil 2026-09-26 12:14:17 +02:00
  31f06a4ecf
• Decide the ARI replaces retry on the HTTP status, not on the CA's wording

  The retry was keyed on the message text and missed ZeroSSL, which answers
  HTTP 401 with 'The "replaces" field does not identify a certificate that
  belongs to this ACME account', so switching the ACME server failed every
  renewal.
  
  RFC 9773 Section 5 mandates a problem type only for the 409
  "alreadyReplaced" case and leaves its other checks (same account, shared
  identifier) to server policy, so the wording cannot be enumerated. Judge
  the status code instead: _isARIReplacesRejected treats only a non-2xx
  response as a rejection. That also removes a false positive on the
  success path, where the server "MUST reflect that field in the response"
  and the echoed base64url certID can itself contain "ARI".
  
  fix #7280

  neil 2026-09-26 11:50:22 +02:00
  6618d55bfc
• Merge pull request #7263 from kekropp/dns_bergdns

  Add bergdns.at DNS API

  neil 2026-09-26 11:41:07 +02:00
  879c1519bb
• start 3.1.7
  neil 2026-09-20 16:56:43 +02:00
  ceed0e0228
• allowed_signers: point the examples at 3.1.6

  The comment block told the reader to run "git verify-tag 3.1.5", which is
  exactly the tag that fails: 3.1.5 was tagged by the GitHub release form as
  a lightweight ref and carries no signature. Use 3.1.6 in the examples and
  state the baseline, so the file that teaches verification does not hand out
  a command that cannot work.
  
  https://github.com/acmesh-official/acme.sh/issues/7273

  neil 2026-09-20 13:13:20 +02:00
  aafc4efe1f
• Move the release signing baseline to 3.1.6 and catch lightweight tags in CI

  The 3.1.5 tag was created server-side by publishing the GitHub release,
  which can only produce a lightweight ref, so it carries no signature and
  git verify-tag fails on it. Rather than force-move a published tag, state
  that signing starts at 3.1.6 and cut that tag locally with git tag -s
  before the release is published.
  
  vtag.yml now fails the run when the pushed tag is not a tag object, so the
  same mistake shows up as a red check on the release instead of arriving as
  a user report. The mirror step runs first, so v<tag> is still created; its
  early "already exists" return became an else branch so the check is never
  skipped.
  
  https://github.com/acmesh-official/acme.sh/issues/7273

  neil 2026-09-20 13:06:37 +02:00
  138e0dff84
• deploy/ruckus: rename _post_file to avoid clashing with the core helper

  Core acme.sh now defines a _post_file() function. Functions and variables
  live in separate namespaces in POSIX sh, so this was not a real conflict,
  but the identical name is confusing to read. Use _post_upfile, matching the
  _post_action / _post_boundary / _post_data locals already in this function.

  neil 2026-09-19 19:20:45 +02:00
  ccb376dde3
• add _post_file
  neil 2026-09-19 16:40:40 +02:00
  8f56e8fe04
• deploy/ssh: create the backup directory only when there is a file to back up

  Follow-up to 9249c892 (#7249). The mkdir -p ran unconditionally before
  the guarded cp calls, so a first deploy left an empty backup directory
  behind. Move the mkdir into each guarded block.

  neil 2026-09-13 07:50:39 +02:00
  8e5ba60bee
• Honor an HTTP-date Retry-After when polling an order

  HARICA answers a processing order with "Retry-After: <HTTP-date>" set
  about two minutes after finalize (discussion 7190). Skipping the date
  left the poll loop on its 2s fallback, and 30 rounds ran out 21 seconds
  before the time the CA had named, so the issue failed although the
  certificate was about to be signed.
  
  Add _httpdate2time, which converts the IMF-fixdate form in shell
  arithmetic: GNU, BSD and busybox date each want a different invocation
  for it, and %a/%b are locale lookups. _retryafter_seconds prints
  delay-seconds as before and turns a date into the seconds left until
  then; a date in the past or an unparseable value still prints nothing.

  neil 2026-09-11 14:56:58 +08:00
  666bf75589
• ci: run Pebble with PEBBLE_AUTHZREUSE=0 in PebbleStrict

  Pebble reuses a valid authorization in a new order 50% of the time by
  default, so the dns manual mode case was a coin flip: a reused
  authorization left nothing for the TXT record to answer.

  neil 2026-09-11 14:23:38 +08:00
  efecf2a308
• Ignore an HTTP-date Retry-After when polling an order

  Pebble answers a processing order with "Retry-After: <HTTP-date>". The
  poll loop cut the value at the first colon and fed "Fri,11Sep202604" to
  "[ -gt 0 ]", which errored with "integer expression expected" on every
  round. Add _retryafter_seconds, which prints the header only in its
  delay-seconds form, and use it at all four Retry-After sites. The two
  sites that already filtered on digits used "[0-9]\+", which Solaris grep
  does not support.

  neil 2026-09-11 12:42:47 +08:00
  cbd68ddc02
• Both confirmed and fixed in dev.

  1. The four backup cp calls (KEYFILE/CERTFILE/CAFILE/FULLCHAIN) ran
     unguarded. With USE_SCP=yes MULTI_CALL is implicit, so each cp is its
     own ssh call and a missing source aborted the deploy. In batched mode
     it was masked because the exit code is that of the last command.
     Each cp is now wrapped in a remote [ -f ] test.
  2. deploy/ssh.sh tested DEPLOY_SSH_FULLCHAIN = "yes" instead of
     DEPLOY_SSH_MULTI_CALL (since 2017). Effect was only that the
     fullchain backup got deferred to the next batch. Fixed as well.
  
  Please upgrade with acme.sh --upgrade -b dev and retest.

  neil 2026-09-11 11:51:07 +08:00
  9249c89221
• ci: enable the dns manual mode case in PebbleStrict

  TEST_DNS_MANUAL=1 turns on le_test_dns_manual_renew, which answers the
  dns-01 challenge through the pebble-challtestsrv that the compose setup
  already runs.

  neil 2026-09-10 21:56:59 +08:00
  15bed65ce1
• ci: tolerate 422 when the latest release tag has no workflow_dispatch
  neil 2026-09-07 12:33:21 +08:00
  63ee7cb16e
• fix
  neil 2026-09-04 15:51:12 +08:00
  94d2f62626
• minor
  neil 2026-09-04 15:27:35 +08:00
  41b6371afa
• add trigger
  neil 2026-09-04 15:27:06 +08:00
  f2b0484137
• Let an explicit --days or --valid-to outrank the ARI window

  ARI has overridden Le_NextRenewTime unconditionally since 3.1.4, so a user
  who passed --days never got the schedule they asked for, and --valid-to was
  guarded at issue time but not on the renewal check: the guard survived one
  run before the next cron rewrote it and saved it back.
  
  An explicit --days or --valid-to now pins the schedule. The window is still
  taken when it is earlier than what the user asked for, so a CA can pull an
  urgent renewal forward but can never push a pinned renewal back.
  Le_RenewalDays is only written to the domain conf when --days was actually
  passed, so its presence there is what marks a schedule as pinned.
  
  A fixed-date --valid-to opts out of ARI entirely: that cert is not renewed
  automatically at all, so pulling it forward would change what it does, not
  just when it renews.
  
  Both call sites go through the new _calc_ari_renew_time.

  neil 2026-09-01 20:26:34 +08:00
  7b5a902755
• Wait for the order to be ready instead of failing the finalize
  neil 2026-09-01 18:59:56 +08:00
  4a3f8b5dea
• Treat alreadyRevoked as a successful revocation
  neil 2026-08-31 09:24:41 +08:00
  08ac83459d
• Back off between retries instead of a flat two seconds
  neil 2026-08-30 21:24:02 +08:00
  2b7487ba72
• Retry a gateway error from the CA instead of failing the order
  neil 2026-08-30 20:47:24 +08:00
  19efdf269a
• Add OPNsense and HardenedBSD to CI
  neil 2026-08-30 17:46:48 +08:00
  cdca555cad
• Fix the standalone port check on the bsds, macos and haiku
  neil 2026-08-30 17:39:57 +08:00
  cce4a28b99
• Never truncate the conf file when a saved value breaks the rewrite sed

  A value holding a backslash-digit sequence (a backreference to sed) or an
  embedded line break made _setopt's replace command fail after the shell
  had already truncated the conf file, wiping the whole domain conf; the
  next renewal then fails with an empty Le_API and no validation method.
  Same class as #2426, which escaped only '&' and '|'.
  
  Escape the backslash too, write the sed output back only when sed
  succeeds, reject values holding a line break, and rewrite the file with
  printf instead of echo in the append path and in _clear_conf: dash's
  builtin echo interprets backslash escapes and corrupted such values on
  every rewrite.
  
  https://github.com/acmesh-official/acme.sh/issues/7213

  neil 2026-08-30 16:02:57 +08:00
  4756183e30
• dns_azure: never read or persist AZUREDNS_BEARERTOKEN from account.conf

  Versions up to 3.0.9 cached the internally-acquired access token as
  SAVED_AZUREDNS_BEARERTOKEN. 3.1.0 repurposed that variable for
  user-supplied bearer tokens, so after an upgrade the stale cached token
  was read back as if user-supplied, skipped the refresh path, and failed
  renewals with 401 forever once expired.
  
  A bearer token is short-lived, so persisting it is never useful: take it
  from the environment only, and clear any stale saved value on the next
  run.
  
  fix https://github.com/acmesh-official/acme.sh/issues/7218

  neil 2026-08-30 15:42:27 +08:00
  6e1deacac0
• installcronjob: match the stale cron path without grep -F
  neil 2026-08-20 08:40:49 +08:00
  b1a8eb1c95
• fix cronjob
  neil 2026-08-19 22:50:03 +08:00
  e0c0297ba3
• deploy/unifios: document UniFi OS hardware support, not just self-hosted

  The certificate REST API this hook drives is UniFi OS's own, not
  specific to the self-hosted UniFi OS Server: user reports confirm it on
  a UDM Pro (UniFi OS 5.1.26) and a UCG Fiber (5.0.16). Reframe the scope
  around the endpoint rather than the product line, state that the choice
  between unifi and unifios is local/SSH file access vs remote REST API,
  and note that the management port is 11443 on UniFi OS Server but 443
  on hardware, so DEPLOY_UNIFIOS_HOST must be set there.

  neil 2026-08-17 13:42:10 +08:00
  1cbd223386
• fix https://github.com/acmesh-official/acme.sh/issues/7195#issuecomment-5281002963
  neil 2026-08-14 12:15:15 +08:00
  5180911929
• Mirror the tag object, not the commit, in vtag.yml

  The v-prefixed mirror was created from github.sha, so for an annotated or
  signed tag it would point at the commit and drop the signature: "git
  verify-tag v3.1.3" fails with "cannot verify a non-tag object of type
  commit" while "git verify-tag 3.1.3" succeeds. Resolve refs/tags/<tag>
  and mirror whatever object it points at instead, which keeps the current
  behaviour for lightweight tags. Also move the workflow expressions into
  env instead of interpolating them into the shell command.

  neil 2026-08-14 11:53:43 +08:00
  5ff7f0a4e7
• Fix dns_netcup reporting a bogus 4013 instead of the real zone error

  The zone lookup walked the challenge name from the right and ended up
  asking netcup for the full "_acme-challenge.<domain>" as a zone name.
  That can never be a zone, so netcup answered 4013 "Validation Error",
  which replaced the real 5028 "The zone <domain> could not be found" as
  the error shown to the user.
  
  Stop one label short of the full name, and fail explicitly when no zone
  matched, reporting the last API response plus what to check. Before, a
  run where every candidate returned 5028 fell through to logout and
  returned success.

  neil 2026-08-10 10:00:26 +08:00
  4a3bc2c919
• Listen on both IPv4 and IPv6 in standalone mode by default

  socat binds a single family unless told which one: up to 1.7.x the
  default IP version for TCP-LISTEN is 4, and 1.8.0 made it "no
  preference", which resolves to whatever getaddrinfo and bindv6only
  happen to give. So an order carrying both an IPv4 and an IPv6
  identifier could never pass both http-01 challenges.
  
  Bind one socket per family instead, with ipv6only on the IPv6 one so
  the two do not collide. IPv4-mapped IPv6 addresses are not a portable
  alternative, OpenBSD does not support them at all. The IPv6 listener
  is best effort, a host without IPv6 still gets the IPv4 one. The
  python fallback does the same. --listen-v4 and --listen-v6 keep
  forcing a single family, and passing both now means both.
  
  Le_Listen_V4 and Le_Listen_V6 were mutually exclusive in the domain
  conf, which silently dropped one of them on renewal, and
  _starttlsserver let -4 win when both were set.
  
  Fixes #7185

  neil 2026-08-08 13:09:30 +08:00
  05367d3598
• Fix dns_namecheap ignoring IsOurDNS when matching the root zone

  _get_root_by_getList() matched the candidate suffix as an unanchored
  substring of the whole domains.getList response and never looked at the
  IsOurDNS attribute. A domain parked on Namecheap's webhosting DNS is
  listed with IsOurDNS="false", yet it was still accepted as the root zone,
  so _get_root() returned success and the domains.dns.getHosts probe that
  would have found the real zone never ran. Every following getHosts call
  was then refused with error 2030288 "not using proper DNS servers" and
  the challenge failed with "invalid tld".
  
  Match the exact <Domain Name="..."> entry instead and require
  IsOurDNS="true", so a subdomain delegated to Namecheap BasicDNS/FreeDNS
  under a parent that is not on Namecheap DNS now resolves to its own zone.
  Matching the entry exactly also drops the old substring/regex match, in
  which the dots of a domain matched any character.
  
  Fixes #7178

  neil 2026-08-06 19:36:26 +08:00
  f67be78ff4
• Fix multideploy MULTIDEPLOY_FILENAME conf read and allow an absolute path

  _getdeployconf assigns and exports the variable, it does not print the
  value, so wrapping it in a command substitution ran it in a subshell and
  always yielded an empty string. A MULTIDEPLOY_FILENAME saved by an
  earlier run was therefore never restored on renewal and the hook
  silently fell back to multideploy.yml. Call it the same way every other
  deploy hook does.
  
  Also treat a MULTIDEPLOY_FILENAME starting with '/' as an absolute path
  instead of always resolving it under DOMAIN_PATH, so one deploy file can
  live outside the certificate directory and be shared by all domains.
  Names without a leading '/' keep resolving under DOMAIN_PATH as before.

  neil 2026-08-05 23:01:54 +08:00
  9aad4dcbd5
• Fix synology_dsm logging out after the temp admin is already deleted

  _temp_admin_cleanup ran before _logout, so the logout request carried
  the session id of an account synouser had already removed and DSM kept
  the orphaned entry in Connected Users. Swap the order in both terminal
  branches, and add the missing _logout to the two post-login error paths
  (CRT list failure, certificate not found without SYNO_CREATE).
  
  _logout overwrites the global $response, so the upload-failure branch
  prints its error message before calling it.
  
  Reported by @Bertl75 in #7174

  neil 2026-08-05 19:56:13 +08:00
  603a126a7c
• Fix empty finalize URL when resuming a saved DNS-manual order

  The decision to resume a pending order is keyed on Le_Vlist, but the
  decision to keep Le_OrderFinalize/Le_LinkOrder was keyed on the webroot
  being exactly "dns". Any other webroot with a saved Le_Vlist skipped
  newOrder and then finalized against an empty URL.
  
  Key both on Le_Vlist, and always clear Le_LinkCert, which is per-run
  state that is never read back from the saved domain conf.
  
  Fixes #7177

  neil 2026-08-05 19:53:52 +08:00
  5e6c263211
• Fix dns_cyon cleanup failing on FreeBSD

  _cyon_delete_txt relied on `printf "%b"` to convert a sed-injected literal
  `\n` into a real newline, but `%b` also processes the `\"` escapes that the
  JSON response is full of. glibc/bash/dash keep the backslash of such an
  undefined escape, FreeBSD's printf (sh builtin and /usr/bin/printf alike)
  drops it -- so `data-hash=\"..\"` became `data-hash=".."`, the extraction
  regex matched nothing, _dns_entries stayed empty and no TXT record was ever
  deleted.
  
  Drop the newline injection and use _egrep_o, which already yields one match
  per line, then parse each line with sed.
  
  Also feed the read loop a newline-terminated list: `printf "%s"` left the
  last line unterminated, so `read` returned non-zero at EOF and the loop
  skipped the final entry on every platform.
  
  Verified identical output on FreeBSD 14.3, Linux/bash and Linux/dash.
  
  Fixes #7169

  neil 2026-08-02 21:55:52 +08:00
  b4925052dd
• Fix --make-dns-persist-value printing a wildcard TXT record name

  For -d '*.example.com' the printed record name kept the literal '*' label
  (_validation-persist.*.example.com). The CA never queries that name, so
  issuance fails with "No TXT record found for DNS-PERSIST-01 challenge".
  
  Per draft-ietf-acme-dns-persist-01 sec 4 and 10.2 the record is published at
  the base domain's Validation Domain Name; the wildcard scope comes from
  'policy=wildcard' in the record value (sec 5.1), not from a '*' label in the
  record name. Strip the leading "*." in a new _dns_persist_txt_name helper,
  and imply --dns-persist-wildcard for a wildcard -d, since without
  policy=wildcard the printed record can never authorize the wildcard.
  
  Fixes #7168

  neil 2026-08-02 21:47:51 +08:00
  ea5e70564d
• Merge pull request #7128 from achmadalifn4/master

  Fix Notify Waha

  neil 2026-07-17 21:58:41 +08:00
  9bfcf2cf1a
• Merge pull request #7126 from acmesh-official/dev

  sync

  neil 2026-07-14 22:35:07 +08:00
  7cc16cd09a
• Merge pull request #7119 from acmesh-official/dev

  sync

  neil 2026-07-12 10:11:32 +08:00
  3e64b5e6f5
• Merge pull request #7096 from acmesh-official/dev

  one-click revert and ban

  neil 2026-07-06 17:40:51 +08:00
  347cc207cd
• Merge pull request #7095 from acmesh-official/dev

  sync

  neil 2026-07-06 16:37:03 +08:00
  1651a5a609
• Merge pull request #7094 from acmesh-official/dev

  wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org…

  neil 2026-07-06 16:28:12 +08:00
  0c76c1f211
• Merge pull request #7092 from acmesh-official/dev

  wiki-guard: log the number of write-access members loaded

  neil 2026-07-06 15:24:23 +08:00
  e00d3cfde3
• Merge pull request #7091 from acmesh-official/dev

  wiki-guard: trust repo/org members with write access in all rule checks

  neil 2026-07-06 15:12:22 +08:00
  4187ec23c1
• Merge pull request #7090 from acmesh-official/dev

  sync

  neil 2026-07-06 14:28:08 +08:00
  9f0ef7abcd
• Merge pull request #7088 from acmesh-official/dev

  add wiki-guard workflow: auto-restore wiki pages deleted or renamed b…

  neil 2026-07-06 13:37:00 +08:00
  0e2659b768
• Merge pull request #7086 from acmesh-official/dev

  sync

  neil 2026-07-06 10:37:29 +08:00
  f50401a342
• Merge pull request #7078 from acmesh-official/dev

  sync

  neil 2026-07-03 19:56:09 +08:00
  992886c4eb
• Merge pull request #7008 from acmesh-official/dev

  sync

  neil 2026-06-04 22:50:25 +02:00
  3c848adbb7
• Merge pull request #6968 from acmesh-official/dev

  sync

  neil 2026-05-16 11:17:24 +02:00
  f265c304da
• Merge pull request #6949 from acmesh-official/dev

  fix format

  neil 2026-05-06 20:59:36 +02:00
  7c91ee1fc0
• Merge pull request #6948 from acmesh-official/dev

  sync

  neil 2026-05-06 20:52:11 +02:00
  d2780eb04e
• Merge pull request #6937 from acmesh-official/dev

  sync

  neil 2026-05-02 10:56:54 +02:00
  7735cdf3ab
• Merge pull request #6934 from acmesh-official/dev

  sync

  neil 2026-04-28 22:22:24 +02:00
  76d1377fc1
• Merge pull request #6929 from acmesh-official/dev

  sync

  neil 2026-04-24 23:30:42 +02:00
  ed6d1f3447
• Merge pull request #6889 from achmadalifn4/dev

  Add BytePlus ALB deployment script

  neil 2026-04-24 21:46:10 +02:00
  d00b2722ee
• Merge pull request #6928 from acmesh-official/dev

  sync

  neil 2026-04-24 21:36:58 +02:00
  df49dd2ec9
• fix DEFAULT_RENEW

  fix https://github.com/acmesh-official/acme.sh/issues/2217#issuecomment-4155894630

  neil 2026-04-05 10:46:29 +08:00
  50dbdd781b
• Update copilot-instructions.md
  neil 2026-04-05 10:40:35 +08:00
  346acc3f33
• Merge branch 'dev' of https://github.com/acmesh-official/acme.sh into dev
  neil 2026-04-04 22:24:13 +08:00
  a79bdb9ef3
• Merge pull request #6895 from acmesh-official/dev

  sync

  neil 2026-04-04 21:19:05 +08:00
  563415d21f
• Update copilot-instructions.md
  neil 2026-04-04 21:18:36 +08:00
  c2c5c3cdb7
• Update copilot-instructions.md
  neil 2026-04-04 21:16:40 +08:00
  cf9c70a6c7
• Merge pull request #6857 from acmesh-official/dev

  sync

  neil 2026-03-13 20:19:12 +08:00
  5d158b1640
• Merge pull request #6832 from acmesh-official/dev

  sync

  neil 2026-03-08 18:51:51 +08:00
  d08b4de794
• Merge pull request #6796 from Tra5is/add_technitium_expiry_ttl

  Add Expiry TTL option for Technitium DNS API

  neil 2026-03-04 15:17:02 +08:00
  da5e818907
• Merge pull request #6793 from ecm75/fix_kemplm

  fixed checking for existing domain on loadmaster

  neil 2026-02-23 19:37:06 +08:00
  89c86efc56
• Merge pull request #6800 from pgerber/ipv6-debug

  Fix IPv6 URL when trying to fetch challenge ourselves for debugging

  neil 2026-02-22 22:35:25 +08:00
  8304d3e323
• Merge pull request #6794 from infinitydev/pvefix

  Add error check to Proxmox deploy hooks

  neil 2026-02-18 12:14:52 +08:00
  12f147bf40
• Merge pull request #6436 from invario/localcopy-deploy-hook

  Add 'localcopy' deploy-hook

  neil 2026-02-14 11:01:40 +08:00
  bdfa988b65
• Merge pull request #6786 from alexandergott-afk/dev

  Allow more than one DNS server for HA environments #6785

  neil 2026-02-13 11:13:50 +08:00
  0e93d2bee1
• Merge pull request #6775 from alexandergott-afk/master

  Add some fixes for dns_nsupdate provider

  neil 2026-02-09 20:16:49 +08:00
  f68a758974
• Merge pull request #6709 from invario/docker-non-root-supercronic

  Docker with non-root using supercronic

  neil 2026-02-09 17:43:28 +08:00
  824e7b3d80
• Merge pull request #6767 from dga-nagra/panos-api-key

  Fix bug + Allow panos deploy-hook to use PANOS_KEY

  neil 2026-02-07 22:15:28 +08:00
  b79146281c
• Merge pull request #6472 from UncleVic/master

  feat: #6471 add message_thread_id to telegram notifications

  neil 2026-02-07 22:11:42 +08:00
  ab3093d58c
• Change shebang to use env for portability
  neil 2026-02-07 22:10:48 +08:00
  c21db5c5d5
• Merge pull request #6687 from kapouer/ssh-noscp-permissions

  Ssh noscp permissions

  neil 2026-02-04 18:49:52 +08:00
  80e39eb63c
• Merge pull request #6440 from jf-lines/dns_infomaniak_API_v2

  dns_infomaniak: upgraded to API v2. v1 is deprecated.

  neil 2026-02-01 17:15:02 +01:00
  28c088611a
• Merge pull request #6760 from OpusDNS/add-opusdns-provider

  [CLOUD-31] Add acme.sh OpusDNS provider

  neil 2026-01-24 07:51:13 +01:00
  d8053ed6b2
• Update acme.sh
  neil 2026-01-24 07:49:18 +01:00
  e44809c180
• Merge pull request #6755 from zbindenp/master

  Fix dns_cyon to use correct regex

  neil 2026-01-18 14:30:53 +01:00
  8c384a92bf
• Merge pull request #6485 from Fangliding/master

  Fix ipv6 cert cannot be found

  neil 2026-01-18 14:29:33 +01:00
  ce2d9e9746
• Merge pull request #6754 from acmesh-official/dev

  sync

  neil 2026-01-13 21:50:14 +01:00
  f39d066ced
• disable notifications for myself

  disable notifications for myself

  neil 2026-01-13 21:43:46 +01:00
  e2882c536b
• fix account.conf permission

  https://github.com/acmesh-official/acme.sh/issues/6708#issuecomment-3745737079

  neil 2026-01-13 21:28:14 +01:00
  892b3ca219
• Merge pull request #6748 from acmesh-official/dev

  sync

  neil 2026-01-11 21:50:00 +01:00
  4de00d4603
• Merge pull request #6746 from d-kurz/dev

  dns_dynv6: Allow challenge strings that contain "id"

  neil 2026-01-10 12:54:47 +01:00
  bc646d120e
• Merge pull request #6678 from fratoro/master

  Update dns_cyon to use unique user-agent and all cookies

  neil 2026-01-10 12:52:24 +01:00
  c58da45917
• Merge pull request #6745 from acmesh-official/dev

  sync

  neil 2026-01-06 08:55:01 +01:00
  9e51432a6f
• Merge pull request #6724 from h-haaks/base64-encode-pfx-password

  Base64 encode pfx password

  neil 2026-01-05 21:46:34 +01:00
  188aa515ce
• Merge pull request #6631 from rperper/dev

  QUIC.cloud DNS API support (dns_api.sh)

  neil 2026-01-05 21:42:13 +01:00
  6a9776b1f0
• Merge pull request #6735 from JensSpanier/dev

  Pushover: Remove asterisks

  neil 2026-01-05 20:54:00 +01:00
  4b278dc1bb
• Merge pull request #6739 from moaminsharifi/master

  Add Virakcloud dns api

  neil 2026-01-05 20:51:43 +01:00
  9bf5179b55