acme.sh

Merge pull request #7094 from acmesh-official/dev

wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org…

neil

2026-07-06 16:28:12 +08:00

0c76c1f211

wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org write members

neil

2026-07-06 16:27:26 +08:00

919492df13

Merge pull request #7092 from acmesh-official/dev

wiki-guard: log the number of write-access members loaded

neil

2026-07-06 15:24:23 +08:00

e00d3cfde3

wiki-guard: log the number of write-access members loaded

neil

2026-07-06 15:23:45 +08:00

e4eaa59063

Merge pull request #7091 from acmesh-official/dev

wiki-guard: trust repo/org members with write access in all rule checks

neil

2026-07-06 15:12:22 +08:00

4187ec23c1

wiki-guard: trust repo/org members with write access in all rule checks

neil

2026-07-06 15:11:35 +08:00

2b5a19d34a

Merge pull request #7090 from acmesh-official/dev

sync

neil

2026-07-06 14:28:08 +08:00

9f0ef7abcd

issue.yml: assign and label "Report bugs to" tracking issues instead of posting the upgrade boilerplate

neil

2026-07-06 14:27:00 +08:00

dc1b06006f

wiki-monitor: skip notification for the maintainer's own wiki changes

neil

2026-07-06 14:23:51 +08:00

8585d9f4a7

Merge pull request #7088 from acmesh-official/dev

add wiki-guard workflow: auto-restore wiki pages deleted or renamed b…

neil

2026-07-06 13:37:00 +08:00

0e2659b768

add wiki-guard workflow: auto-restore wiki pages deleted or renamed by non-maintainer

neil

2026-07-06 13:35:37 +08:00

ca8ab7f8b5

Merge pull request #7086 from acmesh-official/dev

sync

neil

2026-07-06 10:37:29 +08:00

f50401a342

Add support for Account Key Rollover (#7080 )

* add wiki

* feat: add support for account key rollover

* Place --update-account-key next to --update-account

* fix shfmt

* fix shfmt

* fix shfmt

* Fix from review

* fix shfmt

* fix from review

* fix review

---------

Co-authored-by: neil <gitpc@neilpang.com>

Simon V.andneil

2026-07-06 10:22:36 +08:00

ff9b969bdb

deploy/ssh: return non-zero when a server deployment fails (#6795 )

ssh_deploy() ignored the result of _ssh_deploy and always returned
success, so a failed transfer to one (or all) of the servers in
DEPLOY_SSH_SERVER was silently swallowed. Track the return code across
the loop and return non-zero if any server failed, letting the caller
handle notification.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Oliver MuellerandClaude Opus 4.8

2026-07-06 10:11:58 +08:00

1f778e6ef1

retry failed install and deploy on renew (#7083 )

* retry failed install and deploy on renew

* fix notify level for renew retry failures

PM Extra

2026-07-05 23:33:57 +08:00

58423df3e8

Add LaoDC DNS API (dns_laodc) (#6974 )

* Added LaoDC API Module

* Cleaned up debug and info
revised get subdomain to filter by TXT records.

* Added commet to _get_root

* Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.

Revised rm() function to do explicit record matching.

* Revised _get_root() to handle different scenarios.

Fixed _laodc_api() function to check if query failed to run.
added basic json sanitation to handle \ and " in $value
unset _H2 _H3 after call as per request from copilot.

* fixed indentation of case statement block

* fixed condition checking.

_get_root should start at 1 so full fqdn can be tested
$? was being reference after export command failing response checks
removed export txtvalue
fixed docs link and issues link

* Verify key for both add and rm

* fixed dns alias condition check
validate key returns 1 if failed.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: LaoDC <git@laodc.com>

2026-07-05 23:30:26 +08:00

8f3c1701f3

toPkcs8: support --password and re-export the pkcs8 file on renewal (#4134 )

neil

2026-07-05 18:04:24 +08:00

2a175f97e8

dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973 )

neil

2026-07-05 18:02:34 +08:00

d3af3315da

migrate the legacy ACMEDNS_UPDATE_URL from the account conf (#3899 )

neil

2026-07-05 17:48:33 +08:00

7b6d96387c

add bash completion for commands and parameters, installed via --install (#307 )

neil

2026-07-05 17:39:50 +08:00

cabe432539

support multiple account emails (#1309 )

ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
and registers all of them as ACME contact entries. The ZeroSSL EAB
endpoint takes a single address, so the first one is used there.

neil

2026-07-05 17:37:40 +08:00

1746fbdb25

deploy/panos: do not commit when the cert or key import failed (#4716 )

Committing after a failed import leaves a mismatched cert/key pair on
the firewall (PAN-OS does not validate the pair at commit time), which
can lock the admin out of the https management interface.

neil

2026-07-05 17:13:59 +08:00

d2b3772631

_install_win_taskscheduler: zero-pad the minute in the schtasks /ST value (#4950 )

neil

2026-07-05 17:13:24 +08:00

e964157bff

notify/aws_ses: add container/instance IAM role auth (IMDSv2)

aws_ses_send calls `_use_container_role || _use_instance_role` when no
static AWS keys are set, but those functions were never defined -- only
_use_metadata was -- so role-based auth silently fell through to the
"no api key" error. Add both, using the current IMDSv2-capable versions
from dns_aws.sh, and set the IMDSv2 token header in _use_metadata so the
credential fetch works on IMDSv2-only instances.

Closes #4742

neil

2026-07-05 17:09:51 +08:00

934711e51d

dns_regru: require a dot boundary in root zone matching

_get_root matched a registered domain anywhere as a substring of the
challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
account, issuing for subtest.com.ru wrongly picked test.com.ru as the
root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
boundary so a shorter domain no longer matches a longer subdomain label.

Fixes the issue reported in #5036 (thanks @koledas)
Closes #5036

neil

2026-07-05 16:57:59 +08:00

7def43481a

dnsapi/dns_namecom: probe the root zone with GetDomain instead of listing all domains

The domain list is paginated at 1000 entries per page and only the
first page was fetched, so accounts with more than 1000 domains never
found the root zone.

fix https://github.com/acmesh-official/acme.sh/issues/5051

neil

2026-07-05 16:53:14 +08:00

defd64022d

_regAccount: error out clearly when the eab-hmac-key cannot be base64-decoded

An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
signature that the CA rejects with 403.

https://github.com/acmesh-official/acme.sh/issues/4082

neil

2026-07-05 16:32:57 +08:00

4256e3532b

add Apache workflow to test the --apache mode

Runs le_test_apache from acmetest against Pebble, with Apache
listening on Pebble's HTTP-01 validation port.

neil

2026-07-05 16:31:51 +08:00

1f94fd7fd5

deploy/docker: allow setting key file mode and owner in the container

The docker deploy hook copied the key file preserving the source mode
(root:root 0600), so a non-root container service (uid >= 1000) could not
read it. Add DEPLOY_DOCKER_CONTAINER_KEY_MODE and
DEPLOY_DOCKER_CONTAINER_KEY_OWNER, applied via chmod/chown inside the
container after the key is copied and before the reload command.

Closes #5333

neil

2026-07-05 16:30:46 +08:00

507baff2ef

dnsapi/dns_autodns: escape XML special characters in credentials (#5317 )

neil

2026-07-05 16:29:58 +08:00

504540e67c

add Nginx workflow to test the --nginx mode

Runs le_test_nginx from acmetest against Pebble: nginx listens on
Pebble's HTTP-01 validation port with an aaPanel/BT style
"location ^~ /" reverse proxy block, the regression case of #6125.

neil

2026-07-05 16:18:37 +08:00

cacafc9c23

Add dns_muumuu: muumuu-domain.com DNS API (#7012 )

* Add dns_muumuu: muumuu-domain.com DNS API

* Fix: remove local keyword for POSIX sh compatibility

* Fix: lowercase fulldomain for API compatibility

* Style: use echo instead of printf for lower_case (consistent with other plugins)

* Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL

laineus

2026-07-05 16:05:33 +08:00

24895a15c8

_createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867 )

neil

2026-07-05 16:02:52 +08:00

1cd63e1480

DNS.yml: fix workflow warnings

- replace deprecated set-output with GITHUB_OUTPUT
- untap aws/tap before brew install to silence tap trust warning
- inject safe.directory=* for cygwin git so the checkout post step
  no longer fails with dubious ownership (exit 128)

neil

2026-07-05 15:51:38 +08:00

31b13caf8b

deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

dash's echo has no -e flag and sends a literal "-e " prefix to the
socket, so haproxy rejects the command and the hot update always fails
on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
which haproxy replies when an uncommitted transaction already exists.

fix https://github.com/acmesh-official/acme.sh/issues/6165

neil

2026-07-05 15:44:26 +08:00

1e2cd50fc9

Add WEDOS WAPI DNS API (dns_wedos) (#7072 )

* Add WEDOS WAPI DNS API (dns_wedos)

* dns_wedos: fix response parsing on systems without egrep -o

* dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

Jan Forman

2026-07-05 12:44:07 +08:00

524d96a3a8

dns_desec: fix advertised token variable name (#7081 )

This must've been a copy-paste error from `dns_ddnss`.

Fixes: 6b7b5caf54 ("DNS provider API: structured description")

Foster Snowhill

2026-07-05 12:03:48 +08:00

0eb5cc8384

fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

"openssl req -noout -in" aborts when the default config file is missing;
reading a CSR needs no config, so pass -config /dev/null explicitly.

Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
never worked there.

neil

2026-07-04 23:55:16 +08:00

77047eb0ef

renewAll: error out if CERT_HOME is not a directory

With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
matches nothing, so renewAll silently does nothing and returns success --
--renew-all / --cron appears to work while renewing no certificates.
Check that CERT_HOME is a directory up front and return 1 with a clear
error instead.

Closes #4508

neil

2026-07-04 23:40:31 +08:00

4978782fb8

dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804

neil

2026-07-04 21:58:57 +08:00

9764f67619

_isIPv4: do not glob segments, require exactly 4 octets

The unquoted splitting let a "*" segment expand against files in the
current directory, so "*.*.*.*" could pass as a valid IPv4 address
(issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
"1..2.3" and bare numbers. Split with IFS under set -f, require 4
octets, and validate each as a 1-3 digit number <= 255.

Based on https://github.com/acmesh-official/acme.sh/pull/4974
fix https://github.com/acmesh-official/acme.sh/issues/4971

neil

2026-07-04 21:34:46 +08:00

988afd0f59

add application/json to acmedns (#5066 )

Ramon

2026-07-04 21:07:18 +08:00

b92516f79e

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix(gcore_cdn): renew login api url (#5143 )

https://api.gcore.com/docs/iam#tag/Account

xiaopc

2026-07-04 20:14:32 +08:00

843a7efa7d

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

haproxy.sh: use two-argument -header form for LibreSSL (#3438 )

neil

2026-07-04 18:50:29 +08:00

bcbfe25d08