6691 Commits

This Branch

This Branch

All Branches

• _createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867)
  neil 2026-07-05 16:02:52 +08:00
  1cd63e1480
• DNS.yml: fix workflow warnings

  - replace deprecated set-output with GITHUB_OUTPUT
  - untap aws/tap before brew install to silence tap trust warning
  - inject safe.directory=* for cygwin git so the checkout post step
    no longer fails with dubious ownership (exit 128)

  neil 2026-07-05 15:51:38 +08:00
  31b13caf8b
• deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

  dash's echo has no -e flag and sends a literal "-e " prefix to the
  socket, so haproxy rejects the command and the hot update always fails
  on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
  which haproxy replies when an uncommitted transaction already exists.
  
  fix https://github.com/acmesh-official/acme.sh/issues/6165

  neil 2026-07-05 15:44:26 +08:00
  1e2cd50fc9
• Add WEDOS WAPI DNS API (dns_wedos) (#7072)

  * Add WEDOS WAPI DNS API (dns_wedos)
  
  * dns_wedos: fix response parsing on systems without egrep -o
  
  * dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

  Jan Forman 2026-07-05 12:44:07 +08:00
  524d96a3a8
• dns_desec: fix advertised token variable name (#7081)

  This must've been a copy-paste error from `dns_ddnss`.
  
  Fixes: 6b7b5caf54 ("DNS provider API: structured description")

  Foster Snowhill 2026-07-05 12:03:48 +08:00
  0eb5cc8384
• fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

  "openssl req -noout -in" aborts when the default config file is missing;
  reading a CSR needs no config, so pass -config /dev/null explicitly.
  
  Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
  never worked there.

  neil 2026-07-04 23:55:16 +08:00
  77047eb0ef
• renewAll: error out if CERT_HOME is not a directory

  With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
  matches nothing, so renewAll silently does nothing and returns success --
  --renew-all / --cron appears to work while renewing no certificates.
  Check that CERT_HOME is a directory up front and return 1 with a clear
  error instead.
  
  Closes #4508

  neil 2026-07-04 23:40:31 +08:00
  4978782fb8
• dns_cn: convert IDN domain to punycode before API calls

  Core-Networks' API rejects Unicode domain names with "invalid domain";
  it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
  domain straight through, so IDN certs failed at the TXT add step
  (issue #4804). Run fulldomain through _idn() in both functions. For
  ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
  unaffected.
  
  Fixes #4804

  neil 2026-07-04 21:58:57 +08:00
  9764f67619
• _isIPv4: do not glob segments, require exactly 4 octets

  The unquoted splitting let a "*" segment expand against files in the
  current directory, so "*.*.*.*" could pass as a valid IPv4 address
  (issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
  "1..2.3" and bare numbers. Split with IFS under set -f, require 4
  octets, and validate each as a 1-3 digit number <= 255.
  
  Based on https://github.com/acmesh-official/acme.sh/pull/4974
  fix https://github.com/acmesh-official/acme.sh/issues/4971

  neil 2026-07-04 21:34:46 +08:00
  988afd0f59
• add application/json to acmedns (#5066)
  Ramon 2026-07-04 21:07:18 +08:00
  b92516f79e
• dns_inwx: fix _get_root false zone match for single-letter subdomains

  _get_root matched the candidate zone with _contains (grep), which treats
  the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
  "<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
  comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
  zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
  to <string>$h</string> and escape dots so the zone is compared literally.
  
  Fixes #5129

  neil 2026-07-04 20:28:56 +08:00
  fbf3b41c54
• Accept both 401 and 403 for deactivated account detection

  RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
  signed by a deactivated account, which ZeroSSL follows, while
  Boulder (Let's Encrypt) historically returns 403. Check both codes
  in _regAccount and deactivateaccount.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5138

  neil 2026-07-04 20:21:27 +08:00
  ede9a86d46
• fix(gcore_cdn): renew login api url (#5143)

  https://api.gcore.com/docs/iam#tag/Account

  xiaopc 2026-07-04 20:14:32 +08:00
  843a7efa7d
• fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

  _contains matches with grep regex, so the '*' in "DNS:*.example.com," never
  matched and the subject was appended to the identifiers a second time.
  Escape the wildcard before the check, the same way the sed removal already does.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5251

  neil 2026-07-04 19:56:37 +08:00
  d3e12694b9
• _date2time: pass date via argv to python to prevent code injection (#6463)

  https://github.com/acmesh-official/acme.sh/issues/6463

  neil 2026-07-04 19:14:36 +08:00
  a105126063
• dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

  The DNS endpoint and IAM token scope project were hardcoded to
  ap-southeast-1, which fails for accounts without that region enabled.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5302

  neil 2026-07-04 19:06:46 +08:00
  917bebd460
• Allow creation of ACME account with EAB directly from --issue command (#5087)

  * formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue
  
  * Update acme.sh
  
  * Update acme.sh

  Clément Gouin 2026-07-04 18:54:07 +08:00
  33704fc274
• haproxy.sh: use two-argument -header form for LibreSSL (#3438)
  neil 2026-07-04 18:50:29 +08:00
  bcbfe25d08
• deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

  fix https://github.com/acmesh-official/acme.sh/issues/6115

  neil 2026-07-04 18:46:59 +08:00
  bbfb6f50ae
• dns_da: document that special characters in DA_Api credentials must be percent-encoded

  https://github.com/acmesh-official/acme.sh/issues/3468

  neil 2026-07-04 18:19:45 +08:00
  6df2d9e451
• https://github.com/acmesh-official/acme.sh/issues/3201
  neil 2026-07-04 16:55:49 +08:00
  1a36823461
• Add Calrissia.be API (#6811)

  Co-authored-by: Ward <ward.hus@calrissia.com>

  wardhusandWard 2026-07-04 16:54:05 +08:00
  8f2a476d21
• ARI - Add support for Mass Revocation (#6953)

  * ARI - Add support for Mass Revocation
  
  * feat: update ARI each time NextRenewTime is not within the suggestedWindow
  
  * Remove _ari_should_renew and add condition on Le_NextRenewTime
  
  * Add support for ARI explanationURL
  
  * Fix debug variable _d_ari
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * multiple fix
  
  * fix
  
  * fix shfmt
  
  * Reset README
  
  ---------
  
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  Simon V.andZeroSSL-Andreas 2026-07-04 16:50:55 +08:00
  e64529ab50
• fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895
  neil 2026-07-04 11:44:32 +08:00
  7653eaab31
• extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326)
  neil 2026-07-04 11:23:11 +08:00
  6cd0c00a21
• fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977)
  neil 2026-07-04 10:49:32 +08:00
  b4de9e8621
• fix https://github.com/acmesh-official/acme.sh/issues/6388
  neil 2026-07-04 00:39:52 +08:00
  0a6abaf8a1
• haproxy.sh: allows certificate deployment to multiple hosts (#5180)

  * haproxy.sh: allows certificate deployment to multiple hosts
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  ---------
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>

  Laurent GrawetandMatt Simerson 2026-07-04 00:35:02 +08:00
  f4dc9fd9d1
• Fix typo in synology_dsm.sh (#6406)

  Fix typo in an error message.

  Artur Klauser 2026-07-04 00:32:45 +08:00
  2229330c48
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-04 00:06:26 +08:00
  0df051577c
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-03 23:55:23 +08:00
  7fb40f0ccf
• dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272
  neil 2026-07-03 23:44:22 +08:00
  780f2ad5dc
• dns_aws: Fix invalid domain logging: _error => _err (#6430)

  acme.sh defines _err, not _error.

  szakharchenko 2026-07-03 23:40:39 +08:00
  adf69c4e7e
• dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487
  neil 2026-07-03 23:34:27 +08:00
  ac5624536b
• fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477
  neil 2026-07-03 23:34:27 +08:00
  b974bbd6d6
• dev_mythic_beasts: Fix header name: Accepts => Accept (#6428)
  szakharchenko 2026-07-03 23:25:38 +08:00
  0ce8c24736
• dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491
  neil 2026-07-03 23:02:35 +08:00
  20254cbaf0
• dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517
  neil 2026-07-03 22:49:40 +08:00
  f4d2db64ef
• Suppress 'signal process started' message when nginx config is restored (related to issue #4995) (#6747)
  Trekky12 2026-07-03 22:31:31 +08:00
  61400500e2
• forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163
  neil 2026-07-03 22:26:50 +08:00
  92a1b47108
• forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572
  neil 2026-07-03 21:55:37 +08:00
  5038d12d62
• Merge pull request #6720 from magyarsz/dev

  Fix a logical error in the `renew` function

  magyarsz 2026-07-03 21:42:52 +08:00
  7e7c0ee984
• fix https://github.com/acmesh-official/acme.sh/issues/6914
  neil 2026-07-03 20:07:42 +08:00
  92bd80c07d
• fix https://github.com/acmesh-official/acme.sh/issues/6917
  neil 2026-07-03 20:04:32 +08:00
  ad99628e50
• fix https://github.com/acmesh-official/acme.sh/issues/6963
  neil 2026-07-03 19:38:42 +08:00
  eabd23a551
• fix https://github.com/acmesh-official/acme.sh/issues/7009
  neil 2026-07-03 19:38:21 +08:00
  1241649501
• fix https://github.com/acmesh-official/acme.sh/issues/4756
  neil 2026-07-03 19:01:10 +08:00
  9900adb007
• New Banner

  Updated README to include responsive images for dark and light modes.

  ZeroSSL-Andreas 2026-07-03 18:33:44 +08:00
  01d6d46914
• fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077)

  _normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
  any positional argument. dns_czechia_add() called it as
  `_normalizeJson "$_res"`, so the response was discarded and the inner
  sed blocked reading from stdin.
  
  When issuing for a single domain, or for a record that already exists,
  the "already exists" branch returns early and never reaches this call,
  which is why the bug stayed hidden. With multiple domains, the first
  record often short-circuits on "already exists" while the next,
  freshly-added record reaches the broken call and hangs on interactive
  runs (or consumes unrelated stdin non-interactively).
  
  Pipe the response into _normalizeJson via stdin, matching
  dns_czechia_rm() and every other dnsapi plugin.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  CZECHIA-COMandClaude Opus 4.8 2026-07-03 18:12:25 +08:00
  f038958192
• feat: Add Volcano Engine DNS API (#7069)

  * feat: add volcengine dns api
  
  * fix(volcengine): address review findings and fix record matching
  
  Code review fixes:
  - fix format string usage in signature computation (use printf %b / %s)
  - clear _H1.._H5 header state at start of request to avoid leaking
    conditionally-set headers into subsequent requests
  - check ListZones return status in _get_root
  - document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
  - fix Docs and Issues sections
  - remove and update some code comments
  
  Functional fixes:
  - stop matching ListRecords results by FQDN string: Volcengine lowercases
    the Host/FQDN in responses, so a case-sensitive compare against
    $fulldomain failed for mixed-case names, making rm silently skip
    deletion and add lose idempotency. ListRecords is already filtered by
    ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
    result instead.
  - reset _record_id at the start of add/rm to avoid stale state leaking
    across calls within the same process
  - tag created records with Remark "acme.sh" for easier identification
  - adjust debug levels: hide Authorization header behind _debug2, surface
    response at _debug
  
  Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: wenxuan70 <t736660416@gmail.com>
  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

  3 people 2026-07-03 10:09:32 +00:00
  fdf528c26c