acme.sh

Back off between retries instead of a flat two seconds

neil 2026-08-30 21:24:02 +08:00

2b7487ba72
Retry a gateway error from the CA instead of failing the order

neil 2026-08-30 20:47:24 +08:00

19efdf269a
Add OPNsense and HardenedBSD to CI

neil 2026-08-30 17:46:48 +08:00

cdca555cad
Fix the standalone port check on the bsds, macos and haiku

neil 2026-08-30 17:39:57 +08:00

cce4a28b99

Never truncate the conf file when a saved value breaks the rewrite sed

A value holding a backslash-digit sequence (a backreference to sed) or an
embedded line break made _setopt's replace command fail after the shell
had already truncated the conf file, wiping the whole domain conf; the
next renewal then fails with an empty Le_API and no validation method.
Same class as #2426, which escaped only '&' and '|'.

Escape the backslash too, write the sed output back only when sed
succeeds, reject values holding a line break, and rewrite the file with
printf instead of echo in the append path and in _clear_conf: dash's
builtin echo interprets backslash escapes and corrupted such values on
every rewrite.

https://github.com/acmesh-official/acme.sh/issues/7213

neil

2026-08-30 16:02:57 +08:00

4756183e30

dns_azure: never read or persist AZUREDNS_BEARERTOKEN from account.conf

Versions up to 3.0.9 cached the internally-acquired access token as
SAVED_AZUREDNS_BEARERTOKEN. 3.1.0 repurposed that variable for
user-supplied bearer tokens, so after an upgrade the stale cached token
was read back as if user-supplied, skipped the refresh path, and failed
renewals with 401 forever once expired.

A bearer token is short-lived, so persisting it is never useful: take it
from the environment only, and clear any stale saved value on the next
run.

fix https://github.com/acmesh-official/acme.sh/issues/7218

neil

2026-08-30 15:42:27 +08:00

6e1deacac0

installcronjob: match the stale cron path without grep -F

neil 2026-08-20 08:40:49 +08:00

b1a8eb1c95
fix cronjob

neil 2026-08-19 22:50:03 +08:00

e0c0297ba3

deploy/unifios: document UniFi OS hardware support, not just self-hosted

The certificate REST API this hook drives is UniFi OS's own, not
specific to the self-hosted UniFi OS Server: user reports confirm it on
a UDM Pro (UniFi OS 5.1.26) and a UCG Fiber (5.0.16). Reframe the scope
around the endpoint rather than the product line, state that the choice
between unifi and unifios is local/SSH file access vs remote REST API,
and note that the management port is 11443 on UniFi OS Server but 443
on hardware, so DEPLOY_UNIFIOS_HOST must be set there.

neil

2026-08-17 13:42:10 +08:00

1cbd223386

fix https://github.com/acmesh-official/acme.sh/issues/7195#issuecomment-5281002963

neil 2026-08-14 12:15:15 +08:00

5180911929

Mirror the tag object, not the commit, in vtag.yml

The v-prefixed mirror was created from github.sha, so for an annotated or
signed tag it would point at the commit and drop the signature: "git
verify-tag v3.1.3" fails with "cannot verify a non-tag object of type
commit" while "git verify-tag 3.1.3" succeeds. Resolve refs/tags/<tag>
and mirror whatever object it points at instead, which keeps the current
behaviour for lightweight tags. Also move the workflow expressions into
env instead of interpolating them into the shell command.

neil

2026-08-14 11:53:43 +08:00

5ff7f0a4e7

Fix dns_netcup reporting a bogus 4013 instead of the real zone error

The zone lookup walked the challenge name from the right and ended up
asking netcup for the full "_acme-challenge.<domain>" as a zone name.
That can never be a zone, so netcup answered 4013 "Validation Error",
which replaced the real 5028 "The zone <domain> could not be found" as
the error shown to the user.

Stop one label short of the full name, and fail explicitly when no zone
matched, reporting the last API response plus what to check. Before, a
run where every candidate returned 5028 fell through to logout and
returned success.

neil

2026-08-10 10:00:26 +08:00

4a3bc2c919

Listen on both IPv4 and IPv6 in standalone mode by default

socat binds a single family unless told which one: up to 1.7.x the
default IP version for TCP-LISTEN is 4, and 1.8.0 made it "no
preference", which resolves to whatever getaddrinfo and bindv6only
happen to give. So an order carrying both an IPv4 and an IPv6
identifier could never pass both http-01 challenges.

Bind one socket per family instead, with ipv6only on the IPv6 one so
the two do not collide. IPv4-mapped IPv6 addresses are not a portable
alternative, OpenBSD does not support them at all. The IPv6 listener
is best effort, a host without IPv6 still gets the IPv4 one. The
python fallback does the same. --listen-v4 and --listen-v6 keep
forcing a single family, and passing both now means both.

Le_Listen_V4 and Le_Listen_V6 were mutually exclusive in the domain
conf, which silently dropped one of them on renewal, and
_starttlsserver let -4 win when both were set.

Fixes #7185

neil

2026-08-08 13:09:30 +08:00

05367d3598

Fix dns_namecheap ignoring IsOurDNS when matching the root zone

_get_root_by_getList() matched the candidate suffix as an unanchored
substring of the whole domains.getList response and never looked at the
IsOurDNS attribute. A domain parked on Namecheap's webhosting DNS is
listed with IsOurDNS="false", yet it was still accepted as the root zone,
so _get_root() returned success and the domains.dns.getHosts probe that
would have found the real zone never ran. Every following getHosts call
was then refused with error 2030288 "not using proper DNS servers" and
the challenge failed with "invalid tld".

Match the exact <Domain Name="..."> entry instead and require
IsOurDNS="true", so a subdomain delegated to Namecheap BasicDNS/FreeDNS
under a parent that is not on Namecheap DNS now resolves to its own zone.
Matching the entry exactly also drops the old substring/regex match, in
which the dots of a domain matched any character.

Fixes #7178

neil

2026-08-06 19:36:26 +08:00

f67be78ff4

Fix multideploy MULTIDEPLOY_FILENAME conf read and allow an absolute path

_getdeployconf assigns and exports the variable, it does not print the
value, so wrapping it in a command substitution ran it in a subshell and
always yielded an empty string. A MULTIDEPLOY_FILENAME saved by an
earlier run was therefore never restored on renewal and the hook
silently fell back to multideploy.yml. Call it the same way every other
deploy hook does.

Also treat a MULTIDEPLOY_FILENAME starting with '/' as an absolute path
instead of always resolving it under DOMAIN_PATH, so one deploy file can
live outside the certificate directory and be shared by all domains.
Names without a leading '/' keep resolving under DOMAIN_PATH as before.

neil

2026-08-05 23:01:54 +08:00

9aad4dcbd5

Fix synology_dsm logging out after the temp admin is already deleted

_temp_admin_cleanup ran before _logout, so the logout request carried
the session id of an account synouser had already removed and DSM kept
the orphaned entry in Connected Users. Swap the order in both terminal
branches, and add the missing _logout to the two post-login error paths
(CRT list failure, certificate not found without SYNO_CREATE).

_logout overwrites the global $response, so the upload-failure branch
prints its error message before calling it.

Reported by @Bertl75 in #7174

neil

2026-08-05 19:56:13 +08:00

603a126a7c

Fix empty finalize URL when resuming a saved DNS-manual order

The decision to resume a pending order is keyed on Le_Vlist, but the
decision to keep Le_OrderFinalize/Le_LinkOrder was keyed on the webroot
being exactly "dns". Any other webroot with a saved Le_Vlist skipped
newOrder and then finalized against an empty URL.

Key both on Le_Vlist, and always clear Le_LinkCert, which is per-run
state that is never read back from the saved domain conf.

Fixes #7177

neil

2026-08-05 19:53:52 +08:00

5e6c263211

Fix dns_cyon cleanup failing on FreeBSD

_cyon_delete_txt relied on `printf "%b"` to convert a sed-injected literal
`\n` into a real newline, but `%b` also processes the `\"` escapes that the
JSON response is full of. glibc/bash/dash keep the backslash of such an
undefined escape, FreeBSD's printf (sh builtin and /usr/bin/printf alike)
drops it -- so `data-hash=\"..\"` became `data-hash=".."`, the extraction
regex matched nothing, _dns_entries stayed empty and no TXT record was ever
deleted.

Drop the newline injection and use _egrep_o, which already yields one match
per line, then parse each line with sed.

Also feed the read loop a newline-terminated list: `printf "%s"` left the
last line unterminated, so `read` returned non-zero at EOF and the loop
skipped the final entry on every platform.

Verified identical output on FreeBSD 14.3, Linux/bash and Linux/dash.

Fixes #7169

neil

2026-08-02 21:55:52 +08:00

b4925052dd

Fix --make-dns-persist-value printing a wildcard TXT record name

For -d '*.example.com' the printed record name kept the literal '*' label
(_validation-persist.*.example.com). The CA never queries that name, so
issuance fails with "No TXT record found for DNS-PERSIST-01 challenge".

Per draft-ietf-acme-dns-persist-01 sec 4 and 10.2 the record is published at
the base domain's Validation Domain Name; the wildcard scope comes from
'policy=wildcard' in the record value (sec 5.1), not from a '*' label in the
record name. Strip the leading "*." in a new _dns_persist_txt_name helper,
and imply --dns-persist-wildcard for a wildcard -d, since without
policy=wildcard the printed record can never authorize the wildcard.

Fixes #7168

neil

2026-08-02 21:47:51 +08:00

ea5e70564d

Merge pull request #7128 from achmadalifn4/master
```
Fix Notify Waha
```
neil 2026-07-17 21:58:41 +08:00

9bfcf2cf1a
Merge pull request #7126 from acmesh-official/dev
```
sync
```
neil 2026-07-14 22:35:07 +08:00

7cc16cd09a
Merge pull request #7119 from acmesh-official/dev
```
sync
```
neil 2026-07-12 10:11:32 +08:00

3e64b5e6f5
Merge pull request #7096 from acmesh-official/dev
```
one-click revert and ban
```
neil 2026-07-06 17:40:51 +08:00

347cc207cd
Merge pull request #7095 from acmesh-official/dev
```
sync
```
neil 2026-07-06 16:37:03 +08:00

1651a5a609
Merge pull request #7094 from acmesh-official/dev
```
wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org…
```
neil 2026-07-06 16:28:12 +08:00

0c76c1f211
Merge pull request #7092 from acmesh-official/dev
```
wiki-guard: log the number of write-access members loaded
```
neil 2026-07-06 15:24:23 +08:00

e00d3cfde3
Merge pull request #7091 from acmesh-official/dev
```
wiki-guard: trust repo/org members with write access in all rule checks
```
neil 2026-07-06 15:12:22 +08:00

4187ec23c1
Merge pull request #7090 from acmesh-official/dev
```
sync
```
neil 2026-07-06 14:28:08 +08:00

9f0ef7abcd
Merge pull request #7088 from acmesh-official/dev
```
add wiki-guard workflow: auto-restore wiki pages deleted or renamed b…
```
neil 2026-07-06 13:37:00 +08:00

0e2659b768
Merge pull request #7086 from acmesh-official/dev
```
sync
```
neil 2026-07-06 10:37:29 +08:00

f50401a342
Merge pull request #7078 from acmesh-official/dev
```
sync
```
neil 2026-07-03 19:56:09 +08:00

992886c4eb
Merge pull request #7008 from acmesh-official/dev
```
sync
```
neil 2026-06-04 22:50:25 +02:00

3c848adbb7
Merge pull request #6968 from acmesh-official/dev
```
sync
```
neil 2026-05-16 11:17:24 +02:00

f265c304da
Merge pull request #6949 from acmesh-official/dev
```
fix format
```
neil 2026-05-06 20:59:36 +02:00

7c91ee1fc0
Merge pull request #6948 from acmesh-official/dev
```
sync
```
neil 2026-05-06 20:52:11 +02:00

d2780eb04e
Merge pull request #6937 from acmesh-official/dev
```
sync
```
neil 2026-05-02 10:56:54 +02:00

7735cdf3ab
Merge pull request #6934 from acmesh-official/dev
```
sync
```
neil 2026-04-28 22:22:24 +02:00

76d1377fc1
Merge pull request #6929 from acmesh-official/dev
```
sync
```
neil 2026-04-24 23:30:42 +02:00

ed6d1f3447
Merge pull request #6889 from achmadalifn4/dev
```
Add BytePlus ALB deployment script
```
neil 2026-04-24 21:46:10 +02:00

d00b2722ee
Merge pull request #6928 from acmesh-official/dev
```
sync
```
neil 2026-04-24 21:36:58 +02:00

df49dd2ec9

fix DEFAULT_RENEW

fix https://github.com/acmesh-official/acme.sh/issues/2217#issuecomment-4155894630

neil

2026-04-05 10:46:29 +08:00

50dbdd781b

Update copilot-instructions.md

neil 2026-04-05 10:40:35 +08:00

346acc3f33
Merge branch 'dev' of https://github.com/acmesh-official/acme.sh into dev

neil 2026-04-04 22:24:13 +08:00

a79bdb9ef3
Merge pull request #6895 from acmesh-official/dev
```
sync
```
neil 2026-04-04 21:19:05 +08:00

563415d21f
Update copilot-instructions.md

neil 2026-04-04 21:18:36 +08:00

c2c5c3cdb7
Update copilot-instructions.md

neil 2026-04-04 21:16:40 +08:00

cf9c70a6c7
Merge pull request #6857 from acmesh-official/dev
```
sync
```
neil 2026-03-13 20:19:12 +08:00

5d158b1640
Merge pull request #6832 from acmesh-official/dev
```
sync
```
neil 2026-03-08 18:51:51 +08:00

d08b4de794
Merge pull request #6796 from Tra5is/add_technitium_expiry_ttl
```
Add Expiry TTL option for Technitium DNS API
```
neil 2026-03-04 15:17:02 +08:00

da5e818907
Merge pull request #6793 from ecm75/fix_kemplm
```
fixed checking for existing domain on loadmaster
```
neil 2026-02-23 19:37:06 +08:00

89c86efc56
Merge pull request #6800 from pgerber/ipv6-debug
```
Fix IPv6 URL when trying to fetch challenge ourselves for debugging
```
neil 2026-02-22 22:35:25 +08:00

8304d3e323
Merge pull request #6794 from infinitydev/pvefix
```
Add error check to Proxmox deploy hooks
```
neil 2026-02-18 12:14:52 +08:00

12f147bf40
Merge pull request #6436 from invario/localcopy-deploy-hook
```
Add 'localcopy' deploy-hook
```
neil 2026-02-14 11:01:40 +08:00

bdfa988b65
Merge pull request #6786 from alexandergott-afk/dev
```
Allow more than one DNS server for HA environments #6785
```
neil 2026-02-13 11:13:50 +08:00

0e93d2bee1
Merge pull request #6775 from alexandergott-afk/master
```
Add some fixes for dns_nsupdate provider
```
neil 2026-02-09 20:16:49 +08:00

f68a758974
Merge pull request #6709 from invario/docker-non-root-supercronic
```
Docker with non-root using supercronic
```
neil 2026-02-09 17:43:28 +08:00

824e7b3d80
Merge pull request #6767 from dga-nagra/panos-api-key
```
Fix bug + Allow panos deploy-hook to use PANOS_KEY
```
neil 2026-02-07 22:15:28 +08:00

b79146281c
Merge pull request #6472 from UncleVic/master
```
feat: #6471 add message_thread_id to telegram notifications
```
neil 2026-02-07 22:11:42 +08:00

ab3093d58c
Change shebang to use env for portability

neil 2026-02-07 22:10:48 +08:00

c21db5c5d5
Merge pull request #6687 from kapouer/ssh-noscp-permissions
```
Ssh noscp permissions
```
neil 2026-02-04 18:49:52 +08:00

80e39eb63c
Merge pull request #6440 from jf-lines/dns_infomaniak_API_v2
```
dns_infomaniak: upgraded to API v2. v1 is deprecated.
```
neil 2026-02-01 17:15:02 +01:00

28c088611a
Merge pull request #6760 from OpusDNS/add-opusdns-provider
```
[CLOUD-31] Add acme.sh OpusDNS provider
```
neil 2026-01-24 07:51:13 +01:00

d8053ed6b2
Update acme.sh

neil 2026-01-24 07:49:18 +01:00

e44809c180
Merge pull request #6755 from zbindenp/master
```
Fix dns_cyon to use correct regex
```
neil 2026-01-18 14:30:53 +01:00

8c384a92bf
Merge pull request #6485 from Fangliding/master
```
Fix ipv6 cert cannot be found
```
neil 2026-01-18 14:29:33 +01:00

ce2d9e9746
Merge pull request #6754 from acmesh-official/dev
```
sync
```
neil 2026-01-13 21:50:14 +01:00

f39d066ced
disable notifications for myself
```
disable notifications for myself
```
neil 2026-01-13 21:43:46 +01:00

e2882c536b

fix account.conf permission

https://github.com/acmesh-official/acme.sh/issues/6708#issuecomment-3745737079

neil

2026-01-13 21:28:14 +01:00

892b3ca219

Merge pull request #6748 from acmesh-official/dev
```
sync
```
neil 2026-01-11 21:50:00 +01:00

4de00d4603
Merge pull request #6746 from d-kurz/dev
```
dns_dynv6: Allow challenge strings that contain "id"
```
neil 2026-01-10 12:54:47 +01:00

bc646d120e
Merge pull request #6678 from fratoro/master
```
Update dns_cyon to use unique user-agent and all cookies
```
neil 2026-01-10 12:52:24 +01:00

c58da45917
Merge pull request #6745 from acmesh-official/dev
```
sync
```
neil 2026-01-06 08:55:01 +01:00

9e51432a6f
Merge pull request #6724 from h-haaks/base64-encode-pfx-password
```
Base64 encode pfx password
```
neil 2026-01-05 21:46:34 +01:00

188aa515ce
Merge pull request #6631 from rperper/dev
```
QUIC.cloud DNS API support (dns_api.sh)
```
neil 2026-01-05 21:42:13 +01:00

6a9776b1f0
Merge pull request #6735 from JensSpanier/dev
```
Pushover: Remove asterisks
```
neil 2026-01-05 20:54:00 +01:00

4b278dc1bb
Merge pull request #6739 from moaminsharifi/master
```
Add Virakcloud dns api
```
neil 2026-01-05 20:51:43 +01:00

9bf5179b55
Merge pull request #6728 from jwaterwater/feat/qiniu-force-https-config
```
Feat/qiniu force https config
```
neil 2026-01-02 15:36:09 +01:00

06d9ca61a3
Merge pull request #6731 from jdevera/posix_globs_for_list
```
Fix `--list` regression in POSIX / Docker environments
```
neil 2026-01-02 15:34:27 +01:00

dc6a996cc3
Merge pull request #6717 from acmesh-official/ari
```
Ari
```
neil 2025-12-27 12:29:55 +01:00

d795cb4850
Merge pull request #6716 from acmesh-official/dev
```
sync
```
neil 2025-12-27 11:49:21 +01:00

1bd2922bc3
Update supported OS table in README
```
add openindiana
```
neil 2025-12-27 11:47:16 +01:00

47f24126f5

Add OpenIndiana CI workflow and badge

Introduced a new OpenIndiana job to the DNS GitHub Actions workflow for testing, including necessary environment variables and steps. Updated README to display the OpenIndiana workflow status badge.

neil

2025-12-27 11:41:58 +01:00

76fdac59bc

Add OpenIndiana CI workflow

Introduces a GitHub Actions workflow for OpenIndiana to automate testing of shell scripts.

neil

2025-12-27 11:37:39 +01:00

49a3d586a3

use nfs for vms
```
use nfs for vms
```
neil 2025-12-27 11:26:59 +01:00

361e7c5ad4
Merge pull request #6715 from acmesh-official/dev
```
sync
```
neil 2025-12-27 11:22:22 +01:00

3ae9711892
change default renew to 30 days
```
change default renew to 30 days
and fix readme
```
neil 2025-12-27 11:20:22 +01:00

fc7168e11d
Merge pull request #6241 from tomo2403/multideploy-yaml
```
Multideploy: Deploy to multiple hooks of the same type
```
neil 2025-12-27 11:04:17 +01:00

260df0048b
Merge pull request #6714 from xiagw/fix-ali-cdn-timestamp
```
fix: update timestamp variable for ali CDN and DCDN SSL certificate queries
```
neil 2025-12-27 11:00:06 +01:00

cbd5dae3b4
Merge pull request #6697 from sergiustheblack/fix/strongswan
```
Fix strongswan deploy hook
```
neil 2025-12-25 13:39:05 +01:00

d24c7e977e
Merge pull request #6710 from erfantkerfan/dev
```
improve: change sotoon api to v2.1 with simplification
```
neil 2025-12-25 13:36:06 +01:00

6a1ff1c0a6
Merge pull request #6696 from taoso/dev
```
Support list IPv6 address certificate
```
neil 2025-12-23 21:42:01 +01:00

dba4be8065
Merge pull request #6692 from as-kholin/omglol_202512
```
Minor updates to the Omg.lol DNS API
```
neil 2025-12-22 20:09:23 +01:00

a670c07caf
Merge pull request #6690 from flybyray/issue6688
```
inwx API change
```
neil 2025-12-22 20:06:16 +01:00

09cc2bdfa5
Merge pull request #6655 from hostup/dev
```
Add: Hostup DNS provider
```
neil 2025-12-22 19:48:07 +01:00

cc897cab4c
Merge pull request #6659 from erfantkerfan/master
```
Added Sotoon dns api
```
neil 2025-12-22 19:42:12 +01:00

7ba9597928
Merge pull request #6705 from mq00fc/dev
```
Fix ali-cdn deploy hook
```
neil 2025-12-22 19:41:00 +01:00

d2d862420e
Merge pull request #6675 from imiric/fix/exoscale-dns
```
fix: update Exoscale DNS script
```
neil 2025-12-17 20:49:41 +01:00

6004e7f5cd
Merge pull request #6676 from acmesh-official/dev
```
sync
```
neil 2025-12-08 21:17:08 +01:00

37cf431e80
Merge pull request #6638 from pini-gh/fix-6081
```
dnsapi/dns_gandi_livedns.sh: save Gandi LiveDNS variables with prefix 'SAVED_'
```
neil 2025-12-08 21:14:48 +01:00

0c9d2dafe3
Merge pull request #6671 from ufozone/dev
```
Add mgw-media.de DNS API
```
neil 2025-12-08 20:14:00 +01:00

79592c700f