6775 Commits

This Branch

This Branch

All Branches

• valid-to: allow a negative --days to set the renewal margin

  A negative --days is anchored to the expiry, so it composes with a
  relative --valid-to: "--valid-to +30d --days -7" renews 7 days before
  the expiry instead of the hardcoded 1 day. A positive --days and any
  --days with a fixed-date --valid-to are still rejected.
  
  https://github.com/acmesh-official/acme.sh/issues/6570

  neil 2026-07-14 21:12:55 +08:00
  1dbabf0da9
• fix(dns_oci): read ~/.oci/config before cached account.conf values (#7124)

  The OCI DNS plugin cached the tenancy, user, region and signing key into
  acme.sh's account.conf at issuance and then, on subsequent runs, read those
  cached values before consulting ~/.oci/config. A value cached at issuance
  therefore permanently shadowed the config file, so editing ~/.oci/config
  afterwards (most visibly rotating the API signing key) had no effect and
  renewals kept using stale credentials, failing authentication.
  
  Resolve each field in the order: explicit environment variable, then
  ~/.oci/config when it exists, then the cached account.conf value as a
  fallback for env-only installs that have no config file. The signing key
  likewise prefers the key_file resolved from the environment or ~/.oci/config
  over any cached key.
  
  Signed-off-by: Avi Miller <me@dje.li>

  Avi Miller 2026-07-14 20:58:47 +08:00
  2499ee1ab9
• Deploy certificate to FortiGate firewall using API (#6236)

  * Deploy certificate to FortiGate firewall using API
  
  * Refactor FortiGate deployment functions
  
  Prefix private functions and working variables and use a timestamped certificate name.
  
  * Replace grep -o for POSIX compatibility

  NotAnotherHelloWorld 2026-07-14 09:02:34 +08:00
  1a746d98b8
• challenge: use portable [{] literal-brace in _egrep_o patterns (#968)

  _egrep_o falls back to a BRE sed expression on shells without egrep -o
  (Solaris, DD-WRT busybox). A bare "\{" there is a BRE interval operator
  and aborts ("sed: command garbled" / "Invalid content of \{\}"), so the
  challenge-status-invalid path extracted an empty error object and the
  CA's failure reason was lost. Replace the escaped braces with "[{]"/"[}]"
  bracket expressions, unambiguous literal braces in both BRE and ERE, at
  all four call sites (challenge type/error extraction and profiles).

  neil 2026-07-13 11:59:35 +08:00
  4558a8aa98
• account: keep restored ACCOUNT_URL in the EAB-already-bound path

  When re-registering an already-bound EAB account (HTTP 400 "not
  awaiting external account binding"), the else branch restored
  ACCOUNT_URL from ca.conf but the following unconditional
  `export ACCOUNT_URL="$_accUri"` clobbered it with an empty _accUri
  (never set on that path), so later signed requests failed with
  "A Key ID MUST be specified" / "account URL is empty". Assign the
  restored value to _accUri so the shared export uses it.
  https://github.com/acmesh-official/acme.sh/issues/3382

  neil 2026-07-13 10:43:08 +08:00
  1a54307dbf
• dns_infomaniak: log zones response and fail early in _get_zone

  The sed in _get_zone passed the raw JSON through when the response
  contained no [{"fqdn":", so an API error turned the zone into "{" and
  the failure only surfaced later as POST /2/zones/{/records
  "method_not_found". Log the response at debug2, error out on
  non-success results, and parse fqdn position-independently.
  
  https://github.com/acmesh-official/acme.sh/issues/6851

  neil 2026-07-13 08:30:43 +08:00
  020123d812
• installcronjob: Solaris grep takes only one -e, use separate greps

  The "no crontab" whitelist used multiple -e patterns, but Solaris
  /usr/bin/grep honors only a single -e, so a fresh install was
  refused there. Use one plain grep per message pattern, which every
  grep implementation supports (caught by le_test_installcronjob_no_wipe
  on the Solaris CI).

  neil 2026-07-12 22:28:56 +08:00
  17964cfd6e
• fix
  neil 2026-07-12 20:18:36 +08:00
  d621d6952a
• dns_knot: add KNOT_ZONE for delegated subdomain zones

  The zone cannot be derived from the record name when the Knot server
  is only authoritative for a delegated subdomain; let the user name it
  explicitly, like NSUPDATE_ZONE.
  
  fixes https://github.com/acmesh-official/acme.sh/issues/2881

  neil 2026-07-12 19:22:03 +08:00
  5e33e9f5f1
• dns_dynu: use mutable conf storage so newly exported credentials win

  Same stale-account.conf override as dns_dnsimple: the sourced plain
  copy shadowed newly exported Dynu_ClientId/Dynu_Secret.
  
  https://github.com/acmesh-official/acme.sh/issues/3216

  neil 2026-07-12 19:21:56 +08:00
  3fddea2962
• dns_dnsimple: use mutable conf storage so a newly exported token wins

  The legacy plain _saveaccountconf copy in account.conf is sourced at
  startup and silently overrides a newly exported DNSimple_OAUTH_TOKEN,
  so rotated tokens never took effect.
  
  fixes https://github.com/acmesh-official/acme.sh/issues/3422

  neil 2026-07-12 19:21:48 +08:00
  a6766d4186
• installcronjob: never wipe existing cron jobs when crontab -l fails

  Piping a failed 'crontab -l' straight back into 'crontab -' replaced
  the whole crontab with just the acme.sh entry when the listing failed
  while jobs existed (seen on cPanel/CloudLinux jailshell). Capture the
  listing first and refuse to write unless the failure is the normal
  "no crontab for user" case.
  
  https://github.com/acmesh-official/acme.sh/issues/3079

  neil 2026-07-12 19:21:40 +08:00
  b9ce911eb1
• update-account: persist the new email into the CA conf

  "--update-account -m new@example.com" updated the contact on the CA but
  never saved it locally, so CA_EMAIL kept showing the old address on
  every later run. Save it in the success path like _regAccount does.
  
  https://github.com/acmesh-official/acme.sh/issues/4673

  neil 2026-07-12 17:34:37 +08:00
  15a1067f1b
• dns_ali: convert IDN domains to punycode

  The Aliyun API only accepts punycode domain names, and a raw UTF-8
  domain also breaks the request signature. Same _idn pattern as
  dns_namecom.
  
  https://github.com/acmesh-official/acme.sh/issues/4733

  neil 2026-07-12 17:21:19 +08:00
  447dc3c7e7
• fix: dnsexit api rejects a TTL of zero, changed to 1 (minute) (#7107)
  Kat Crichton-Seager 2026-07-12 16:37:21 +08:00
  5a8c685fd3
• dns_ovh specific permission for record removal (#6386)

  Co-authored-by: amk <amk@medlin.mikus.sk>

  amk1969andamk 2026-07-12 16:21:00 +08:00
  dd6540ce46
• Add Baidu Cloud CDN deploy hook (#6951)

  * add Baidu Cloud CDN deploy hook
  
  Code generated by GitHub Copilot with Claude Sonnet 4.6. Tested with local environment by human.
  
  * inline functions
  
  Code generated by OpenAI Codex with GPT-5.5 Sol. Tested with local environment by human.

  Steven Qiu 2026-07-12 16:15:59 +08:00
  cd486cfbb9
• Matthiasvpfr patch 1 (#7108)

  * Add files via upload
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * Add files via upload
  
  Remove usage of jq and curl
  should be compliant with acme.sh api dev guide
  
  * Add files via upload
  
  * Add files via upload
  
  change CR LF to LF
  
  * Add files via upload
  
  missing CR
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  correct auth
  
  * Add files via upload
  
  better manage group_id
  
  * Add files via upload
  
  manage wrong / missing domain
  
  * Add files via upload
  
  strip domain to manage subdomain requests
  
  * Add files via upload
  
  fix wrong id selection in get root
  
  * Add files via upload
  
  fix parsing of IDs
  
  * Add files via upload
  
  correct get_root to better handle unexisting domaines (acmetest)
  
  * Add files via upload
  
  correct token incorrect in auth
  
  * Add files via upload
  
  manage case web api reply is empty
  
  * Add files via upload
  
  try to resolve error when adding unexisting subdmain txt entry
  
  * Add files via upload
  
  correct domain parsing
  
  * Add files via upload
  
  revert changes when adding record (name)
  change rm to better handle complex urls
  
  * Add files via upload
  
  correct rm function to better manage records deletion
  
  * Add files via upload
  
  ensure auth variable arent lost during calls
  
  * Add files via upload
  
  try to keep autj variables accross executions
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  fix stripping subdomains
  
  * Add files via upload
  
  * Add files via upload
  
  keep auth token instead of requesting it each time
  
  * Add files via upload
  
  debug
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  better manage record deletion to avoid orphans
  added some debug and checks
  
  * Add files via upload
  
  paginated api support for rm function
  
  * Add files via upload
  
  * Add files via upload
  
  delay to manage api 404
  
  * Add files via upload
  
  enhance parsing of records in rm
  
  * Add files via upload
  
  fix incorrect record detection in rm
  
  * Add files via upload
  
  better manage filters on api to limit errors
  
  * Add files via upload
  
  try to handle 404 when requesting API too frequently
  
  * Add files via upload
  
  * Add files via upload
  
  sleep during auth
  
  * Add files via upload
  
  manage 404 errors in get_root
  
  * Add files via upload
  
  correct variable overide
  translate comments
  prefix all variables
  
  * Add files via upload
  
  correct variable
  
  * Add files via upload
  
  typo
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  * Add files via upload
  
  correct variable naming (_comlaude prefix missing)
  correct rm return code when non existing record
  typo
  
  * Add files via upload
  
  log an info instead of an error if no dns record found in RM function.
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: Matthiasvpfr <matthias.dupont@vetpartners.fr>
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  4 people 2026-07-12 16:13:42 +08:00
  e828b285ad
• Merge pull request #7114 from achmadalifn4/master

  Add notify waha support

  ACHMAD ALIF NASRULLOH 2026-07-12 16:10:21 +08:00
  f5e7e6b225
• deploy/synology_dsm.sh: remove bashisms, keep the hook POSIX sh

  The hook is sourced by acme.sh, so the bash shebang never takes
  effect: under dash, `[ x == y ]` fails with "unexpected operator",
  the 403 branch never triggers and 2FA-OTP login is skipped.
  Replace `==` with `=` and use the standard sh shebang.

  neil 2026-07-12 16:04:44 +08:00
  ebb5cc4981
• cpanel_uapi: don't spill a redirection error when the key file is absent

  With --signcsr the private key never exists in the cert home, so every
  renewal printed ".../domain.key: No such file or directory" from the
  shell redirection. Skip the key read in that case; the install_ssl call
  already ran with an empty key there and cPanel keeps the installed one.
  
  https://github.com/acmesh-official/acme.sh/issues/6228

  neil 2026-07-12 13:00:12 +08:00
  3989eef5e2
• dns_dynu: include the server response in the authentication error

  Same as the dns_cloudns change: a bare "Authentication failed" hides
  the actual API error and makes reports undiagnosable.

  neil 2026-07-12 12:45:10 +08:00
  2c51ac1c27
• issue bot: tell reporters to redact secrets before posting logs

  Debug logs occasionally contain private keys or tokens (issue 6267);
  the code-side leak in the haproxy hook was fixed by #6268, this adds
  the missing warning to the auto-comment that asks for logs.

  neil 2026-07-12 12:32:54 +08:00
  eacf0d6a87
• dns_knot: KNOT_KEY takes the TSIG key data, not a file path

  The knsupdate "key" statement wants "[alg:]name secret"; the info block
  wrongly described the option as a file path.
  
  https://github.com/acmesh-official/acme.sh/issues/6293

  neil 2026-07-12 12:22:28 +08:00
  099d88e6a9
• issue: never schedule the default renewal past the cert expiry

  The default schedule was a fixed CertCreateTime + RenewalDays - 1 day,
  which passes notAfter entirely for short-lived certs (internal CAs
  today, the CA/B SC-081 47-day maximum later) and leaves an expired cert
  in place for weeks. Extract the arithmetic into _calc_next_renew_time
  and cap it at one day before expiry (one hour for lifetimes of 24h or
  less, mirroring --valid-to scheduling). CAs with ARI are unaffected --
  the ARI window still overrides afterwards.
  
  https://github.com/acmesh-official/acme.sh/issues/6305

  neil 2026-07-12 12:12:18 +08:00
  897e219743
• workflows: run issue/wiki automation only in the upstream repo
  neil 2026-07-12 11:49:53 +08:00
  a9590c5bd7
• wiki-guard: skip on forks (no <fork>.wiki repo to check out)
  neil 2026-07-12 11:43:07 +08:00
  c0d62eb934
• notify: add the customscript hook

  The wiki has documented "21. Set notification for customscript" since
  2022 but the implementation (#4193) was never merged, so following the
  wiki failed with "Cannot find the hook file". Same interface as
  documented: the script gets subject, content and status code as three
  arguments. Unlike #4193, the target script is invoked directly instead
  of through eval -- the subject/content contain domain names and CA
  messages, and eval would allow command injection through them.
  
  https://github.com/acmesh-official/acme.sh/issues/6377

  neil 2026-07-12 11:36:45 +08:00
  44c045b056
• dns_pdns: probe zones with the server-side name filter in _get_root

  The unfiltered GET /zones lists every zone on the server; with large
  installations (100k zones) root-zone detection took minutes per domain.
  Probe each walk-up candidate with ?zone=<name> instead (exact match per
  the PowerDNS API docs); servers that ignore the parameter return the
  full list, which the existing check still handles.
  
  https://github.com/acmesh-official/acme.sh/issues/6382

  neil 2026-07-12 11:20:53 +08:00
  e94631de44
• mydevil: replace BSD-only cut -w with tr + plain cut

  cut -w (split on whitespace) is a FreeBSD extension unknown to GNU
  coreutils; squeeze blanks into tabs with tr first so the field
  extraction is POSIX.
  
  https://github.com/acmesh-official/acme.sh/issues/6452

  neil 2026-07-12 10:49:49 +08:00
  a49f8c1992
• dns_zonomi: make the API endpoint configurable via ZM_Api

  RimuHosting (which owns zonomi) exposes the identical API at
  https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
  both providers with one hook. The default stays zonomi.com and is not
  written to the account conf.
  
  https://github.com/acmesh-official/acme.sh/issues/6475

  neil 2026-07-12 10:26:40 +08:00
  7d0283ca2c
• dns_cpanel: quote inner expansion in suffix strip (SC2295)
  neil 2026-07-12 09:35:22 +08:00
  76811857a0
• dns_cloudns: include the server response in the login error

  https://github.com/acmesh-official/acme.sh/issues/6520

  neil 2026-07-12 09:34:59 +08:00
  22a5ae3ceb
• precheck: log the socat recommendation with _info instead of _err

  Missing socat only matters for standalone mode; the text even says the
  warning can be ignored. Printing it to stderr made every --upgrade in a
  cron noisy for DNS-only users who redirect stdout.
  
  https://github.com/acmesh-official/acme.sh/issues/6525

  neil 2026-07-12 09:30:46 +08:00
  04e0422526
• notify: clear inherited _H1.._H5 before running each notify hook

  The dns/deploy hooks export _H1.._H5 in the main process, and the
  notify hooks run in a subshell that inherits them. A hook that does
  not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
  etc.) sent the stale headers with its request, leaking another
  service's Authorization credentials to the notify endpoint.
  
  https://github.com/acmesh-official/acme.sh/issues/6801

  neil 2026-07-11 11:56:58 +08:00
  2215f1b988
• dns_cpanel: resolve the most specific zone in _get_root

  With both domain.tld and sub.domain.tld zones on the account, the first
  endswith hit could pick the parent zone while cPanel stores the record
  in the most specific one, so the cleanup never found the record and
  left an orphaned _acme-challenge TXT entry. Pick the longest matching
  zone with an exact literal suffix match (_endswith treats the needle as
  a regex, letting xdomain.tld wrongly match zone domain.tld).
  
  https://github.com/acmesh-official/acme.sh/issues/6807

  neil 2026-07-11 11:42:32 +08:00
  9366c2e065
• Microwavenby dns hostinger (#6843)

  * [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com
  
  * [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled
  
  * [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?
  
  * [Microwavenby-dns-hostinger] Responding to comments from Neil
  
  * [dns-hostinger] SHfmt and Shellcheck
  
  * [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

  Sasha Reid 2026-07-11 10:04:49 +08:00
  2e4acba105
• Fix name.com DNS API for processing IDNs (#4381)
  Mike Lei 2026-07-10 21:56:54 +08:00
  fef90e15e1
• Feature: Support other shells then sh (#4877)

  * Add support for DEPLOY_SSH_REMOTE_SHELL
  
  * allow to configure quoting of  remote cmd string
  
  * shell check and shellfmt fixes

  Roman Lumetsberger 2026-07-10 21:02:06 +08:00
  50e5e771d5
• dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999)

  Getting client_id failed due to incorrect extraction!
  
  At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
  {"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

  CV 2026-07-10 20:55:23 +08:00
  ebde8345ae
• dns_njalla.sh: accept string record ids when removing records

  The Njalla API returns record ids as JSON strings now; the numeric-only
  pattern matched nothing, so the removal never found the record id.
  Match both quoted and bare ids.
  
  from https://github.com/acmesh-official/acme.sh/pull/5121

  neil 2026-07-10 20:47:31 +08:00
  58cd667d65
• 2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171)
  Andrew V. 2026-07-10 20:36:42 +08:00
  98c30912fb
• acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

  from https://github.com/acmesh-official/acme.sh/pull/6547

  neil 2026-07-10 19:37:36 +08:00
  2058a77d83
• deploy/synology_dsm.sh: use grep -Eo '[0-9]+' when extracting error codes

  grep -o '[0-9]*' can match the empty string; GNU grep skips empty
  matches but BSD greps handle them differently, breaking the 2FA
  login flow on OpenBSD. Force a non-empty match at all three sites.
  
  from https://github.com/acmesh-official/acme.sh/pull/6725

  neil 2026-07-10 18:37:32 +08:00
  660a5e322c
• Fix typo (#6924)
  Jan Pieper 2026-07-10 14:42:57 +08:00
  2af543a358
• dns_pleskxml.sh: use grep -F when matching interpolated values

  fulldomain/txtvalue/root_domain_name were interpolated into grep
  regex patterns; match them as fixed strings instead.
  
  from https://github.com/acmesh-official/acme.sh/pull/7031

  neil 2026-07-10 12:05:28 +08:00
  fa763db105
• issue: strip the trailing dot of a fully-qualified alias domain

  A trailing dot in --domain-alias/--challenge-alias was passed through
  to the dnsapi hook verbatim. Providers with exact-match record-name
  lookups (e.g. Cloudflare's name= filter) then never find the record,
  so rm never deletes it and relic TXT records accumulate on every issue.
  Stripping in issue() also fixes certs with a dotted alias already
  saved in domain.conf.
  
  fix https://github.com/acmesh-official/acme.sh/issues/4636

  neil 2026-07-10 11:22:20 +08:00
  90b4795bb1
• dns_me.sh: use LC_ALL=C so the request date header is always English

  LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
  alone still produced localized day/month names on non-English systems
  and DNS Made Easy rejected the request date header. An LC_ALL=C
  command prefix beats every locale variable (same pattern as
  dns_oci.sh).
  
  Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

  neil 2026-07-10 11:20:08 +08:00
  534a1714dc
• Add _cleardeployconf to clear deploy hook keys from domain conf

  Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
  the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
  and the direct _cleardomainconf call in multideploy.sh.
  
  Closes #4722. Thanks to @sg1888.

  neil 2026-07-10 11:05:40 +08:00
  45c0ad4112
• notify/smtp.sh: add --crlf so curl sends CRLF line endings

  Postfix with smtpd_forbid_bare_newline (default hardening since 3.9,
  after SMTP smuggling) rejects the message with
  "521 5.5.2 Error: bare <LF> received". RFC 5321 requires CRLF.
  The python sender is unaffected (smtplib already emits CRLF).
  
  fix https://github.com/acmesh-official/acme.sh/issues/7104

  neil 2026-07-10 10:38:52 +08:00
  83b52e0cd7