acme.sh

fix bug for solaris.

dnsapi/deploy: remove POSIX character classes from sed/grep patterns

Solaris /usr/bin/sed and /usr/bin/grep parse [[:space:]] etc. as a
literal bracket set and silently mis-match. Replace with [ ]* for
JSON matching, a printf-tab bracket for user-input trimming, and
[0-9] for digits; also drop GNU-only sed -r/-E in rage4, selfhost
and selectel, and reuse _strip_blank_lines in byteplus_alb.

neil

2026-07-17 12:38:14 +08:00

59a97d7f8b

start 3.1.5

neil

2026-07-17 10:10:07 +08:00

a836e747d1

fix https://github.com/acmesh-official/acme.sh/issues/1940#issuecomment-4971257867

neil

2026-07-15 20:41:35 +08:00

3faf65c46d

valid-to: allow a negative --days to set the renewal margin

A negative --days is anchored to the expiry, so it composes with a
relative --valid-to: "--valid-to +30d --days -7" renews 7 days before
the expiry instead of the hardcoded 1 day. A positive --days and any
--days with a fixed-date --valid-to are still rejected.

https://github.com/acmesh-official/acme.sh/issues/6570

neil

2026-07-14 21:12:55 +08:00

1dbabf0da9

challenge: use portable [{] literal-brace in _egrep_o patterns (#968 )

_egrep_o falls back to a BRE sed expression on shells without egrep -o
(Solaris, DD-WRT busybox). A bare "\{" there is a BRE interval operator
and aborts ("sed: command garbled" / "Invalid content of \{\}"), so the
challenge-status-invalid path extracted an empty error object and the
CA's failure reason was lost. Replace the escaped braces with "[{]"/"[}]"
bracket expressions, unambiguous literal braces in both BRE and ERE, at
all four call sites (challenge type/error extraction and profiles).

neil

2026-07-13 11:59:35 +08:00

4558a8aa98

account: keep restored ACCOUNT_URL in the EAB-already-bound path

When re-registering an already-bound EAB account (HTTP 400 "not
awaiting external account binding"), the else branch restored
ACCOUNT_URL from ca.conf but the following unconditional
`export ACCOUNT_URL="$_accUri"` clobbered it with an empty _accUri
(never set on that path), so later signed requests failed with
"A Key ID MUST be specified" / "account URL is empty". Assign the
restored value to _accUri so the shared export uses it.
https://github.com/acmesh-official/acme.sh/issues/3382

neil

2026-07-13 10:43:08 +08:00

1a54307dbf

installcronjob: Solaris grep takes only one -e, use separate greps

The "no crontab" whitelist used multiple -e patterns, but Solaris
/usr/bin/grep honors only a single -e, so a fresh install was
refused there. Use one plain grep per message pattern, which every
grep implementation supports (caught by le_test_installcronjob_no_wipe
on the Solaris CI).

neil

2026-07-12 22:28:56 +08:00

17964cfd6e

fix

neil

2026-07-12 20:18:36 +08:00

d621d6952a

installcronjob: never wipe existing cron jobs when crontab -l fails

Piping a failed 'crontab -l' straight back into 'crontab -' replaced
the whole crontab with just the acme.sh entry when the listing failed
while jobs existed (seen on cPanel/CloudLinux jailshell). Capture the
listing first and refuse to write unless the failure is the normal
"no crontab for user" case.

https://github.com/acmesh-official/acme.sh/issues/3079

neil

2026-07-12 19:21:40 +08:00

b9ce911eb1

update-account: persist the new email into the CA conf

"--update-account -m new@example.com" updated the contact on the CA but
never saved it locally, so CA_EMAIL kept showing the old address on
every later run. Save it in the success path like _regAccount does.

https://github.com/acmesh-official/acme.sh/issues/4673

neil

2026-07-12 17:34:37 +08:00

15a1067f1b

issue: never schedule the default renewal past the cert expiry

The default schedule was a fixed CertCreateTime + RenewalDays - 1 day,
which passes notAfter entirely for short-lived certs (internal CAs
today, the CA/B SC-081 47-day maximum later) and leaves an expired cert
in place for weeks. Extract the arithmetic into _calc_next_renew_time
and cap it at one day before expiry (one hour for lifetimes of 24h or
less, mirroring --valid-to scheduling). CAs with ARI are unaffected --
the ARI window still overrides afterwards.

https://github.com/acmesh-official/acme.sh/issues/6305

neil

2026-07-12 12:12:18 +08:00

897e219743

precheck: log the socat recommendation with _info instead of _err

Missing socat only matters for standalone mode; the text even says the
warning can be ignored. Printing it to stderr made every --upgrade in a
cron noisy for DNS-only users who redirect stdout.

https://github.com/acmesh-official/acme.sh/issues/6525

neil

2026-07-12 09:30:46 +08:00

04e0422526

notify: clear inherited _H1.._H5 before running each notify hook

The dns/deploy hooks export _H1.._H5 in the main process, and the
notify hooks run in a subshell that inherits them. A hook that does
not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
etc.) sent the stale headers with its request, leaking another
service's Authorization credentials to the notify endpoint.

https://github.com/acmesh-official/acme.sh/issues/6801

neil

2026-07-11 11:56:58 +08:00

2215f1b988

acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

from https://github.com/acmesh-official/acme.sh/pull/6547

neil

2026-07-10 19:37:36 +08:00

2058a77d83

issue: strip the trailing dot of a fully-qualified alias domain

A trailing dot in --domain-alias/--challenge-alias was passed through
to the dnsapi hook verbatim. Providers with exact-match record-name
lookups (e.g. Cloudflare's name= filter) then never find the record,
so rm never deletes it and relic TXT records accumulate on every issue.
Stripping in issue() also fixes certs with a dotted alias already
saved in domain.conf.

fix https://github.com/acmesh-official/acme.sh/issues/4636

neil

2026-07-10 11:22:20 +08:00

90b4795bb1

Add _cleardeployconf to clear deploy hook keys from domain conf

Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
and the direct _cleardomainconf call in multideploy.sh.

Closes #4722. Thanks to @sg1888.

neil

2026-07-10 11:05:40 +08:00

45c0ad4112

Add support for Account Key Rollover (#7080 )

* add wiki

* feat: add support for account key rollover

* Place --update-account-key next to --update-account

* fix shfmt

* fix shfmt

* fix shfmt

* Fix from review

* fix shfmt

* fix from review

* fix review

---------

Co-authored-by: neil <gitpc@neilpang.com>

Simon V.andneil

2026-07-06 10:22:36 +08:00

ff9b969bdb

retry failed install and deploy on renew (#7083 )

* retry failed install and deploy on renew

* fix notify level for renew retry failures

PM Extra

2026-07-05 23:33:57 +08:00

58423df3e8

toPkcs8: support --password and re-export the pkcs8 file on renewal (#4134 )

neil

2026-07-05 18:04:24 +08:00

2a175f97e8

add bash completion for commands and parameters, installed via --install (#307 )

neil

2026-07-05 17:39:50 +08:00

cabe432539

support multiple account emails (#1309 )

ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
and registers all of them as ACME contact entries. The ZeroSSL EAB
endpoint takes a single address, so the first one is used there.

neil

2026-07-05 17:37:40 +08:00

1746fbdb25

_install_win_taskscheduler: zero-pad the minute in the schtasks /ST value (#4950 )

neil

2026-07-05 17:13:24 +08:00

e964157bff

_regAccount: error out clearly when the eab-hmac-key cannot be base64-decoded

An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
signature that the CA rejects with 403.

https://github.com/acmesh-official/acme.sh/issues/4082

neil

2026-07-05 16:32:57 +08:00

4256e3532b

add Nginx workflow to test the --nginx mode

Runs le_test_nginx from acmetest against Pebble: nginx listens on
Pebble's HTTP-01 validation port with an aaPanel/BT style
"location ^~ /" reverse proxy block, the regression case of #6125.

neil

2026-07-05 16:18:37 +08:00

cacafc9c23

_createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867 )

neil

2026-07-05 16:02:52 +08:00

1cd63e1480

fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

"openssl req -noout -in" aborts when the default config file is missing;
reading a CSR needs no config, so pass -config /dev/null explicitly.

Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
never worked there.

neil

2026-07-04 23:55:16 +08:00

77047eb0ef

renewAll: error out if CERT_HOME is not a directory

With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
matches nothing, so renewAll silently does nothing and returns success --
--renew-all / --cron appears to work while renewing no certificates.
Check that CERT_HOME is a directory up front and return 1 with a clear
error instead.

Closes #4508

neil

2026-07-04 23:40:31 +08:00

4978782fb8

_isIPv4: do not glob segments, require exactly 4 octets

The unquoted splitting let a "*" segment expand against files in the
current directory, so "*.*.*.*" could pass as a valid IPv4 address
(issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
"1..2.3" and bare numbers. Split with IFS under set -f, require 4
octets, and validate each as a 1-3 digit number <= 255.

Based on https://github.com/acmesh-official/acme.sh/pull/4974
fix https://github.com/acmesh-official/acme.sh/issues/4971

neil

2026-07-04 21:34:46 +08:00

988afd0f59

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

ARI - Add support for Mass Revocation (#6953 )

* ARI - Add support for Mass Revocation

* feat: update ARI each time NextRenewTime is not within the suggestedWindow

* Remove _ari_should_renew and add condition on Le_NextRenewTime

* Add support for ARI explanationURL

* Fix debug variable _d_ari

* New Banner

Updated README to include responsive images for dark and light modes.

* multiple fix

* fix

* fix shfmt

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-04 16:50:55 +08:00

e64529ab50

extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326 )

neil

2026-07-04 11:23:11 +08:00

6cd0c00a21

fix https://github.com/acmesh-official/acme.sh/issues/6388

neil

2026-07-04 00:39:52 +08:00

0a6abaf8a1

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-04 00:06:26 +08:00

0df051577c

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-03 23:55:23 +08:00

7fb40f0ccf

fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477

neil

2026-07-03 23:34:27 +08:00

b974bbd6d6

Suppress 'signal process started' message when nginx config is restored (related to issue #4995 ) (#6747 )

Trekky12

2026-07-03 22:31:31 +08:00

61400500e2

forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163

neil

2026-07-03 22:26:50 +08:00

92a1b47108

forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572

neil

2026-07-03 21:55:37 +08:00

5038d12d62

Merge pull request #6720 from magyarsz/dev

Fix a logical error in the `renew` function

magyarsz

2026-07-03 21:42:52 +08:00

7e7c0ee984

fix https://github.com/acmesh-official/acme.sh/issues/6917

neil

2026-07-03 20:04:32 +08:00

ad99628e50

fix https://github.com/acmesh-official/acme.sh/issues/7009

neil

2026-07-03 19:38:21 +08:00

1241649501

fix https://github.com/acmesh-official/acme.sh/issues/4756

neil

2026-07-03 19:01:10 +08:00

9900adb007

ARI - Run cron job more frequently (#6939 )

* ARI - Run cron job more frequently

With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
"For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."

More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.

* Fix cron job schedule for certificate renewal

* Fix random_hour syntax in cron job installation

* Update Windows task scheduler to run more frequently

Add support for randomized hour and update frequency

Ref:
* [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
* [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)

* Add padding for StartTime (/ST) in SCHTASKS.exe

* New Banner

Updated README to include responsive images for dark and light modes.

* rebase

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-03 15:12:32 +08:00

ced8d72808

fix https://github.com/acmesh-official/acme.sh/issues/6400

neil

2026-07-02 23:30:56 +08:00

116c05fbff

fix https://github.com/acmesh-official/acme.sh/issues/6986

neil

2026-07-02 23:15:41 +08:00

ccd2f04c33

fix https://github.com/acmesh-official/acme.sh/issues/7035