acme.sh

DNS.yml: fix workflow warnings

- replace deprecated set-output with GITHUB_OUTPUT
- untap aws/tap before brew install to silence tap trust warning
- inject safe.directory=* for cygwin git so the checkout post step
  no longer fails with dubious ownership (exit 128)

neil

2026-07-05 15:51:38 +08:00

31b13caf8b

deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

dash's echo has no -e flag and sends a literal "-e " prefix to the
socket, so haproxy rejects the command and the hot update always fails
on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
which haproxy replies when an uncommitted transaction already exists.

fix https://github.com/acmesh-official/acme.sh/issues/6165

neil

2026-07-05 15:44:26 +08:00

1e2cd50fc9

Add WEDOS WAPI DNS API (dns_wedos) (#7072 )

* Add WEDOS WAPI DNS API (dns_wedos)

* dns_wedos: fix response parsing on systems without egrep -o

* dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

Jan Forman

2026-07-05 12:44:07 +08:00

524d96a3a8

dns_desec: fix advertised token variable name (#7081 )

This must've been a copy-paste error from `dns_ddnss`.

Fixes: 6b7b5caf54 ("DNS provider API: structured description")

Foster Snowhill

2026-07-05 12:03:48 +08:00

0eb5cc8384

fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

"openssl req -noout -in" aborts when the default config file is missing;
reading a CSR needs no config, so pass -config /dev/null explicitly.

Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
never worked there.

neil

2026-07-04 23:55:16 +08:00

77047eb0ef

renewAll: error out if CERT_HOME is not a directory

With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
matches nothing, so renewAll silently does nothing and returns success --
--renew-all / --cron appears to work while renewing no certificates.
Check that CERT_HOME is a directory up front and return 1 with a clear
error instead.

Closes #4508

neil

2026-07-04 23:40:31 +08:00

4978782fb8

dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804

neil

2026-07-04 21:58:57 +08:00

9764f67619

_isIPv4: do not glob segments, require exactly 4 octets

The unquoted splitting let a "*" segment expand against files in the
current directory, so "*.*.*.*" could pass as a valid IPv4 address
(issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
"1..2.3" and bare numbers. Split with IFS under set -f, require 4
octets, and validate each as a 1-3 digit number <= 255.

Based on https://github.com/acmesh-official/acme.sh/pull/4974
fix https://github.com/acmesh-official/acme.sh/issues/4971

neil

2026-07-04 21:34:46 +08:00

988afd0f59

add application/json to acmedns (#5066 )

Ramon

2026-07-04 21:07:18 +08:00

b92516f79e

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix(gcore_cdn): renew login api url (#5143 )

https://api.gcore.com/docs/iam#tag/Account

xiaopc

2026-07-04 20:14:32 +08:00

843a7efa7d

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

haproxy.sh: use two-argument -header form for LibreSSL (#3438 )

neil

2026-07-04 18:50:29 +08:00

bcbfe25d08

deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

fix https://github.com/acmesh-official/acme.sh/issues/6115

neil

2026-07-04 18:46:59 +08:00

bbfb6f50ae

dns_da: document that special characters in DA_Api credentials must be percent-encoded

https://github.com/acmesh-official/acme.sh/issues/3468

neil

2026-07-04 18:19:45 +08:00

6df2d9e451

https://github.com/acmesh-official/acme.sh/issues/3201

neil

2026-07-04 16:55:49 +08:00

1a36823461

Add Calrissia.be API (#6811 )

Co-authored-by: Ward <ward.hus@calrissia.com>

wardhusandWard

2026-07-04 16:54:05 +08:00

8f2a476d21

ARI - Add support for Mass Revocation (#6953 )

* ARI - Add support for Mass Revocation

* feat: update ARI each time NextRenewTime is not within the suggestedWindow

* Remove _ari_should_renew and add condition on Le_NextRenewTime

* Add support for ARI explanationURL

* Fix debug variable _d_ari

* New Banner

Updated README to include responsive images for dark and light modes.

* multiple fix

* fix

* fix shfmt

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-04 16:50:55 +08:00

e64529ab50

fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895

neil

2026-07-04 11:44:32 +08:00

7653eaab31

extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326 )

neil

2026-07-04 11:23:11 +08:00

6cd0c00a21

fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977 )

neil

2026-07-04 10:49:32 +08:00

b4de9e8621

fix https://github.com/acmesh-official/acme.sh/issues/6388

neil

2026-07-04 00:39:52 +08:00

0a6abaf8a1

haproxy.sh: allows certificate deployment to multiple hosts (#5180 )

* haproxy.sh: allows certificate deployment to multiple hosts

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

---------

Co-authored-by: Matt Simerson <matt@tnpi.net>

Laurent GrawetandMatt Simerson

2026-07-04 00:35:02 +08:00

f4dc9fd9d1

Fix typo in synology_dsm.sh (#6406 )

Fix typo in an error message.

Artur Klauser

2026-07-04 00:32:45 +08:00

2229330c48

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-04 00:06:26 +08:00

0df051577c

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-03 23:55:23 +08:00

7fb40f0ccf

dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272

neil

2026-07-03 23:44:22 +08:00

780f2ad5dc

dns_aws: Fix invalid domain logging: _error => _err (#6430 )

acme.sh defines _err, not _error.

szakharchenko

2026-07-03 23:40:39 +08:00

adf69c4e7e

dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487

neil

2026-07-03 23:34:27 +08:00

ac5624536b

fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477

neil

2026-07-03 23:34:27 +08:00

b974bbd6d6

dev_mythic_beasts: Fix header name: Accepts => Accept (#6428 )

szakharchenko

2026-07-03 23:25:38 +08:00

0ce8c24736

dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491

neil

2026-07-03 23:02:35 +08:00

20254cbaf0

dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517

neil

2026-07-03 22:49:40 +08:00

f4d2db64ef

Suppress 'signal process started' message when nginx config is restored (related to issue #4995 ) (#6747 )

Trekky12

2026-07-03 22:31:31 +08:00

61400500e2

forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163

neil

2026-07-03 22:26:50 +08:00

92a1b47108

forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572

neil

2026-07-03 21:55:37 +08:00

5038d12d62

Merge pull request #6720 from magyarsz/dev

Fix a logical error in the `renew` function

magyarsz

2026-07-03 21:42:52 +08:00

7e7c0ee984

fix https://github.com/acmesh-official/acme.sh/issues/6914

neil

2026-07-03 20:07:42 +08:00

92bd80c07d

fix https://github.com/acmesh-official/acme.sh/issues/6917

neil

2026-07-03 20:04:32 +08:00

ad99628e50

fix https://github.com/acmesh-official/acme.sh/issues/6963

neil

2026-07-03 19:38:42 +08:00

eabd23a551

fix https://github.com/acmesh-official/acme.sh/issues/7009

neil

2026-07-03 19:38:21 +08:00

1241649501

fix https://github.com/acmesh-official/acme.sh/issues/4756

neil

2026-07-03 19:01:10 +08:00

9900adb007

New Banner

Updated README to include responsive images for dark and light modes.

ZeroSSL-Andreas

2026-07-03 18:33:44 +08:00

01d6d46914

fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077 )

_normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
any positional argument. dns_czechia_add() called it as
`_normalizeJson "$_res"`, so the response was discarded and the inner
sed blocked reading from stdin.

When issuing for a single domain, or for a record that already exists,
the "already exists" branch returns early and never reaches this call,
which is why the bug stayed hidden. With multiple domains, the first
record often short-circuits on "already exists" while the next,
freshly-added record reaches the broken call and hangs on interactive
runs (or consumes unrelated stdin non-interactively).

Pipe the response into _normalizeJson via stdin, matching
dns_czechia_rm() and every other dnsapi plugin.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CZECHIA-COMandClaude Opus 4.8

2026-07-03 18:12:25 +08:00

f038958192

feat: Add Volcano Engine DNS API (#7069 )

* feat: add volcengine dns api

* fix(volcengine): address review findings and fix record matching

Code review fixes:
- fix format string usage in signature computation (use printf %b / %s)
- clear _H1.._H5 header state at start of request to avoid leaking
  conditionally-set headers into subsequent requests
- check ListZones return status in _get_root
- document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
- fix Docs and Issues sections
- remove and update some code comments

Functional fixes:
- stop matching ListRecords results by FQDN string: Volcengine lowercases
  the Host/FQDN in responses, so a case-sensitive compare against
  $fulldomain failed for mixed-case names, making rm silently skip
  deletion and add lose idempotency. ListRecords is already filtered by
  ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
  result instead.
- reset _record_id at the start of add/rm to avoid stale state leaking
  across calls within the same process
- tag created records with Remark "acme.sh" for easier identification
- adjust debug levels: hide Authorization header behind _debug2, surface
  response at _debug

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: wenxuan70 <t736660416@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 10:09:32 +00:00

fdf528c26c

ARI - Run cron job more frequently (#6939 )

* ARI - Run cron job more frequently

With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
"For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."

More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.

* Fix cron job schedule for certificate renewal

* Fix random_hour syntax in cron job installation

* Update Windows task scheduler to run more frequently

Add support for randomized hour and update frequency

Ref:
* [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
* [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)

* Add padding for StartTime (/ST) in SCHTASKS.exe

* New Banner

Updated README to include responsive images for dark and light modes.

* rebase

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-03 15:12:32 +08:00

ced8d72808