2473 Commits

Include renames

• dns_knot: KNOT_KEY takes the TSIG key data, not a file path

  The knsupdate "key" statement wants "[alg:]name secret"; the info block
  wrongly described the option as a file path.
  
  https://github.com/acmesh-official/acme.sh/issues/6293

  neil 2026-07-12 12:22:28 +08:00
  099d88e6a9
• dns_pdns: probe zones with the server-side name filter in _get_root

  The unfiltered GET /zones lists every zone on the server; with large
  installations (100k zones) root-zone detection took minutes per domain.
  Probe each walk-up candidate with ?zone=<name> instead (exact match per
  the PowerDNS API docs); servers that ignore the parameter return the
  full list, which the existing check still handles.
  
  https://github.com/acmesh-official/acme.sh/issues/6382

  neil 2026-07-12 11:20:53 +08:00
  e94631de44
• dns_zonomi: make the API endpoint configurable via ZM_Api

  RimuHosting (which owns zonomi) exposes the identical API at
  https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
  both providers with one hook. The default stays zonomi.com and is not
  written to the account conf.
  
  https://github.com/acmesh-official/acme.sh/issues/6475

  neil 2026-07-12 10:26:40 +08:00
  7d0283ca2c
• dns_cpanel: quote inner expansion in suffix strip (SC2295)
  neil 2026-07-12 09:35:22 +08:00
  76811857a0
• dns_cloudns: include the server response in the login error

  https://github.com/acmesh-official/acme.sh/issues/6520

  neil 2026-07-12 09:34:59 +08:00
  22a5ae3ceb
• dns_cpanel: resolve the most specific zone in _get_root

  With both domain.tld and sub.domain.tld zones on the account, the first
  endswith hit could pick the parent zone while cPanel stores the record
  in the most specific one, so the cleanup never found the record and
  left an orphaned _acme-challenge TXT entry. Pick the longest matching
  zone with an exact literal suffix match (_endswith treats the needle as
  a regex, letting xdomain.tld wrongly match zone domain.tld).
  
  https://github.com/acmesh-official/acme.sh/issues/6807

  neil 2026-07-11 11:42:32 +08:00
  9366c2e065
• Microwavenby dns hostinger (#6843)

  * [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com
  
  * [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled
  
  * [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?
  
  * [Microwavenby-dns-hostinger] Responding to comments from Neil
  
  * [dns-hostinger] SHfmt and Shellcheck
  
  * [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

  Sasha Reid 2026-07-11 10:04:49 +08:00
  2e4acba105
• Fix name.com DNS API for processing IDNs (#4381)
  Mike Lei 2026-07-10 21:56:54 +08:00
  fef90e15e1
• dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999)

  Getting client_id failed due to incorrect extraction!
  
  At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
  {"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

  CV 2026-07-10 20:55:23 +08:00
  ebde8345ae
• dns_njalla.sh: accept string record ids when removing records

  The Njalla API returns record ids as JSON strings now; the numeric-only
  pattern matched nothing, so the removal never found the record id.
  Match both quoted and bare ids.
  
  from https://github.com/acmesh-official/acme.sh/pull/5121

  neil 2026-07-10 20:47:31 +08:00
  58cd667d65
• 2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171)
  Andrew V. 2026-07-10 20:36:42 +08:00
  98c30912fb
• dns_pleskxml.sh: use grep -F when matching interpolated values

  fulldomain/txtvalue/root_domain_name were interpolated into grep
  regex patterns; match them as fixed strings instead.
  
  from https://github.com/acmesh-official/acme.sh/pull/7031

  neil 2026-07-10 12:05:28 +08:00
  fa763db105
• dns_me.sh: use LC_ALL=C so the request date header is always English

  LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
  alone still produced localized day/month names on non-English systems
  and DNS Made Easy rejected the request date header. An LC_ALL=C
  command prefix beats every locale variable (same pattern as
  dns_oci.sh).
  
  Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

  neil 2026-07-10 11:20:08 +08:00
  534a1714dc
• dns_freedns.sh: use grep -E, BRE \| alternation is a GNU extension

  OpenBSD grep treats \| in a BRE as a literal | character, so
  _freedns_domain_id never matched any row and every domain lookup
  failed with "Domain not found". Switch to ERE with -E, keeping the
  parens escaped so the (.*) suffix branch still requires literal
  parentheses and does not widen the match (e.g. searching example.com
  must not match example.company).
  
  Reported-by: @katiekloss @boretom
  Ref: https://github.com/acmesh-official/acme.sh/issues/2305

  neil 2026-07-10 10:23:59 +08:00
  bed15ba844
• Add creoline API as DNS provider (#7100)

  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * acme-sh-creoline-as-dns-provider
  
  * acme-sh-creoline-as-dns-provider - Review changes implemented according code review
  
  * acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron
  
  * acme-sh-creoline-as-dns-provider - Remove debug code
  
  * acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
  Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>

  4 people 2026-07-10 10:07:12 +08:00
  cf3eab95ee
• Merge pull request #7026 from Marvo2011/dev

  Update SelfHost DNS provider

  Marvo2011 2026-07-06 21:30:13 +08:00
  b1b539695f
• Add LaoDC DNS API (dns_laodc) (#6974)

  * Added LaoDC API Module
  
  * Cleaned up debug and info
  revised get subdomain to filter by TXT records.
  
  * Added commet to _get_root
  
  * Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.
  
  Revised rm() function to do explicit record matching.
  
  * Revised _get_root() to handle different scenarios.
  
  Fixed _laodc_api() function to check if query failed to run.
  added basic json sanitation to handle \ and " in $value
  unset _H2 _H3 after call as per request from copilot.
  
  * fixed indentation of case statement block
  
  * fixed condition checking.
  
  _get_root should start at 1 so full fqdn can be tested
  $? was being reference after export command failing response checks
  removed export txtvalue
  fixed docs link and issues link
  
  * Verify key for both add and rm
  
  * fixed dns alias condition check
  validate key returns 1 if failed.
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: LaoDC <git@laodc.com>

  3 people 2026-07-05 23:30:26 +08:00
  8f3c1701f3
• dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973)
  neil 2026-07-05 18:02:34 +08:00
  d3af3315da
• migrate the legacy ACMEDNS_UPDATE_URL from the account conf (#3899)
  neil 2026-07-05 17:48:33 +08:00
  7b6d96387c
• dns_regru: require a dot boundary in root zone matching

  _get_root matched a registered domain anywhere as a substring of the
  challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
  account, issuing for subtest.com.ru wrongly picked test.com.ru as the
  root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
  boundary so a shorter domain no longer matches a longer subdomain label.
  
  Fixes the issue reported in #5036 (thanks @koledas)
  Closes #5036

  neil 2026-07-05 16:57:59 +08:00
  7def43481a
• dnsapi/dns_namecom: probe the root zone with GetDomain instead of listing all domains

  The domain list is paginated at 1000 entries per page and only the
  first page was fetched, so accounts with more than 1000 domains never
  found the root zone.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5051

  neil 2026-07-05 16:53:14 +08:00
  defd64022d
• dnsapi/dns_autodns: escape XML special characters in credentials (#5317)
  neil 2026-07-05 16:29:58 +08:00
  504540e67c
• Add dns_muumuu: muumuu-domain.com DNS API (#7012)

  * Add dns_muumuu: muumuu-domain.com DNS API
  
  * Fix: remove local keyword for POSIX sh compatibility
  
  * Fix: lowercase fulldomain for API compatibility
  
  * Style: use echo instead of printf for lower_case (consistent with other plugins)
  
  * Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL

  laineus 2026-07-05 16:05:33 +08:00
  24895a15c8
• Add WEDOS WAPI DNS API (dns_wedos) (#7072)

  * Add WEDOS WAPI DNS API (dns_wedos)
  
  * dns_wedos: fix response parsing on systems without egrep -o
  
  * dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

  Jan Forman 2026-07-05 12:44:07 +08:00
  524d96a3a8
• dns_desec: fix advertised token variable name (#7081)

  This must've been a copy-paste error from `dns_ddnss`.
  
  Fixes: 6b7b5caf54 ("DNS provider API: structured description")

  Foster Snowhill 2026-07-05 12:03:48 +08:00
  0eb5cc8384
• dns_cn: convert IDN domain to punycode before API calls

  Core-Networks' API rejects Unicode domain names with "invalid domain";
  it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
  domain straight through, so IDN certs failed at the TXT add step
  (issue #4804). Run fulldomain through _idn() in both functions. For
  ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
  unaffected.
  
  Fixes #4804

  neil 2026-07-04 21:58:57 +08:00
  9764f67619
• add application/json to acmedns (#5066)
  Ramon 2026-07-04 21:07:18 +08:00
  b92516f79e
• dns_inwx: fix _get_root false zone match for single-letter subdomains

  _get_root matched the candidate zone with _contains (grep), which treats
  the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
  "<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
  comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
  zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
  to <string>$h</string> and escape dots so the zone is compared literally.
  
  Fixes #5129

  neil 2026-07-04 20:28:56 +08:00
  fbf3b41c54
• dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

  The DNS endpoint and IAM token scope project were hardcoded to
  ap-southeast-1, which fails for accounts without that region enabled.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5302

  neil 2026-07-04 19:06:46 +08:00
  917bebd460
• dns_da: document that special characters in DA_Api credentials must be percent-encoded

  https://github.com/acmesh-official/acme.sh/issues/3468

  neil 2026-07-04 18:19:45 +08:00
  6df2d9e451
• Add Calrissia.be API (#6811)

  Co-authored-by: Ward <ward.hus@calrissia.com>

  wardhusandWard 2026-07-04 16:54:05 +08:00
  8f2a476d21
• fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895
  neil 2026-07-04 11:44:32 +08:00
  7653eaab31
• dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272
  neil 2026-07-03 23:44:22 +08:00
  780f2ad5dc
• dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487
  neil 2026-07-03 23:34:27 +08:00
  ac5624536b
• dev_mythic_beasts: Fix header name: Accepts => Accept (#6428)
  szakharchenko 2026-07-03 23:25:38 +08:00
  0ce8c24736
• dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491
  neil 2026-07-03 23:02:35 +08:00
  20254cbaf0
• dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517
  neil 2026-07-03 22:49:40 +08:00
  f4d2db64ef
• fix https://github.com/acmesh-official/acme.sh/issues/6914
  neil 2026-07-03 20:07:42 +08:00
  92bd80c07d
• fix https://github.com/acmesh-official/acme.sh/issues/6963
  neil 2026-07-03 19:38:42 +08:00
  eabd23a551
• fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077)

  _normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
  any positional argument. dns_czechia_add() called it as
  `_normalizeJson "$_res"`, so the response was discarded and the inner
  sed blocked reading from stdin.
  
  When issuing for a single domain, or for a record that already exists,
  the "already exists" branch returns early and never reaches this call,
  which is why the bug stayed hidden. With multiple domains, the first
  record often short-circuits on "already exists" while the next,
  freshly-added record reaches the broken call and hangs on interactive
  runs (or consumes unrelated stdin non-interactively).
  
  Pipe the response into _normalizeJson via stdin, matching
  dns_czechia_rm() and every other dnsapi plugin.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  CZECHIA-COMandClaude Opus 4.8 2026-07-03 18:12:25 +08:00
  f038958192
• feat: Add Volcano Engine DNS API (#7069)

  * feat: add volcengine dns api
  
  * fix(volcengine): address review findings and fix record matching
  
  Code review fixes:
  - fix format string usage in signature computation (use printf %b / %s)
  - clear _H1.._H5 header state at start of request to avoid leaking
    conditionally-set headers into subsequent requests
  - check ListZones return status in _get_root
  - document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
  - fix Docs and Issues sections
  - remove and update some code comments
  
  Functional fixes:
  - stop matching ListRecords results by FQDN string: Volcengine lowercases
    the Host/FQDN in responses, so a case-sensitive compare against
    $fulldomain failed for mixed-case names, making rm silently skip
    deletion and add lose idempotency. ListRecords is already filtered by
    ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
    result instead.
  - reset _record_id at the start of add/rm to avoid stale state leaking
    across calls within the same process
  - tag created records with Remark "acme.sh" for easier identification
  - adjust debug levels: hide Authorization header behind _debug2, surface
    response at _debug
  
  Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: wenxuan70 <t736660416@gmail.com>
  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

  3 people 2026-07-03 10:09:32 +00:00
  fdf528c26c
• fix https://github.com/acmesh-official/acme.sh/issues/6851
  neil 2026-07-02 23:18:26 +08:00
  42e13fa797
• DNS_IONOS double sending content type & case sensitive mismatch (#7028)

  * double sending content type results in error from ionos
  
  * Normalize fulldomain to lowercase in the _ionos_get_record function.

  MarFri 2026-07-02 23:08:59 +08:00
  a50fad865f
• Add Glesys dnsapi provider (#7059)

  * Add Glesys dnsapi provider
  
  * Fix typo in error message for dns_glesys_add
  
  * Use API to get record id in Glesys provider
  
  * Use listrecords API endpoint to find root domain
  
  * Remove record id parsin from add function

  Toni Karppi 2026-07-02 13:10:29 +08:00
  5433ea86c8
• fix https://github.com/acmesh-official/acme.sh/issues/7062
  neil 2026-07-02 13:09:59 +08:00
  e52d75d762
• Implemented support for Aruba Business DNS API (#7042)

  * Add support for arubabusiness api
  
  * Fix formatting
  
  * record names are always converted to lowercase
  
  * Docs
  
  * remove leftover unconditional authentication call
  lowercase
  urlencoded body + x-www-form-urlencoded content-type
  cleanup header variables
  cleanup typos
  grammar
  
  * Strengthen _ab_rest failure checks
  Properly process parallel lists in _ab_dns_record_id
  Remove hard fails when a txt record already exists
  
  * fix json parsing
  
  * Fix formatting
  
  ---------
  
  Co-authored-by: Manwe-Sulimo <blarghonaut@gmail.com>

  Manwe SulimoandManwe-Sulimo 2026-07-02 13:06:41 +08:00
  cb40b47a4e
• fix(dns_baidu): prefer new Baidu DNS API with legacy BCD fallback (#6992)

  * fix(acme): prefer new Baidu DNS API with legacy BCD fallback
  
  Keep the existing BCD implementation and add fallback support for the newer Baidu DNS record API. Prefer the new API by default, then fall back to the legacy BCD API to reduce compatibility risk.
  
  * fix(dns_baidu): route through _get/_post + restore legacy BCD auth headers
  
  Per review: _baidu_dns_call now uses _get/_post with _H1.._H5 (no raw curl, no __HTTP_STATUS__ parsing); _baidu_bcd_post restores _H1.._H5 so the legacy BCD path sends the Authorization signature again (fixes 401).
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>

  pxMan79andneil 2026-07-02 13:02:30 +08:00
  b039ff3087
• dns_inwx: fix IDN zone detection without python dependency (#7056)

  * dns_inwx: fix IDN zone detection without python dependency
  
  INWX returns zone names in Unicode form (e.g. lünenschloß.de) even when
  the domain was registered as an IDN. When acme.sh passes the SAN in
  punycode (xn--lnenschlo-o1a42a.de), _contains never matches and
  _get_root falls through to the TLD, placing the TXT record in the wrong
  zone.
  
  Previous fix used python3 which is not available in all environments
  (BusyBox, BSD, minimal containers). Replace with _idn()-based approach:
  extract <string> values from the nameserver.list XML response, encode
  each via _idn(), and compare to $h. When a match is found, use the
  original Unicode zone name for createRecord.
  
  Fixes #7038
  
  * dns_inwx: fix shebang, use _egrep_o, shfmt cleanup
  
  - Revert shebang to #!/usr/bin/env sh (POSIX sh, fixes ShellCheck)
  - Replace grep -o with _egrep_o for portability
  - shfmt -i 2: drop backslash continuation after pipe, fix indentation
  
  Requested by @neilpang
  
  * fix: drop closing </string> from _egrep_o pattern to avoid sed delimiter collision
  
  ---------
  
  Co-authored-by: bluenenschloss <bernd.luenenschloss@7p-group.com>

  bluenenschlossandbluenenschloss 2026-07-02 13:00:49 +08:00
  c83eed4994
• fix https://github.com/acmesh-official/acme.sh/issues/6498
  neil 2026-07-01 21:59:41 +08:00
  81100db2f3
• fix(dns_infomaniak): correctly detect API errors (#7048)

  The add/rm success check never rejected anything: for any non-empty API
  response it always reported "Record added"/"Record deleted" and returned
  0, so the _err branch was dead code. A valid key looked fine only because
  the API call genuinely created the record; an invalid key returning
  {"result":"error"} produced the same "Record added" output even though
  nothing was created.
  
  Root cause, in:
    if [ -n "$response" ]; then
      if [ ! "$(echo "$response" | _contains '"result":"success"')" ]; then
  
    - _contains() ignores stdin (it reads only $1 and $2), so the piped
      "$response" was discarded.
    - The pattern '"result":"success"' was passed as $1 (the haystack),
      leaving $2 (the needle) empty, so it ran:
        echo '"result":"success"' | grep -- "" >/dev/null 2>&1
      grep with an empty pattern always matches.
    - That grep output is redirected to /dev/null, so the command
      substitution always captured "", making [ ! "" ] always true.
  
  Fix: call _contains "$response" '"result":"success"' directly and branch
  on its exit code, so error responses now correctly fail (return 1).
  
  Co-authored-by: neil <github@neilpang.com>

  Jonas Zürcherandneil 2026-07-01 21:05:07 +08:00
  ae8ef74c4b