acme.sh

precheck: log the socat recommendation with _info instead of _err

Missing socat only matters for standalone mode; the text even says the
warning can be ignored. Printing it to stderr made every --upgrade in a
cron noisy for DNS-only users who redirect stdout.

https://github.com/acmesh-official/acme.sh/issues/6525

neil

2026-07-12 09:30:46 +08:00

04e0422526

notify: clear inherited _H1.._H5 before running each notify hook

The dns/deploy hooks export _H1.._H5 in the main process, and the
notify hooks run in a subshell that inherits them. A hook that does
not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
etc.) sent the stale headers with its request, leaking another
service's Authorization credentials to the notify endpoint.

https://github.com/acmesh-official/acme.sh/issues/6801

neil

2026-07-11 11:56:58 +08:00

2215f1b988

acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

from https://github.com/acmesh-official/acme.sh/pull/6547

neil

2026-07-10 19:37:36 +08:00

2058a77d83

issue: strip the trailing dot of a fully-qualified alias domain

A trailing dot in --domain-alias/--challenge-alias was passed through
to the dnsapi hook verbatim. Providers with exact-match record-name
lookups (e.g. Cloudflare's name= filter) then never find the record,
so rm never deletes it and relic TXT records accumulate on every issue.
Stripping in issue() also fixes certs with a dotted alias already
saved in domain.conf.

fix https://github.com/acmesh-official/acme.sh/issues/4636

neil

2026-07-10 11:22:20 +08:00

90b4795bb1

Add _cleardeployconf to clear deploy hook keys from domain conf

Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
and the direct _cleardomainconf call in multideploy.sh.

Closes #4722. Thanks to @sg1888.

neil

2026-07-10 11:05:40 +08:00

45c0ad4112

Add support for Account Key Rollover (#7080 )

* add wiki

* feat: add support for account key rollover

* Place --update-account-key next to --update-account

* fix shfmt

* fix shfmt

* fix shfmt

* Fix from review

* fix shfmt

* fix from review

* fix review

---------

Co-authored-by: neil <gitpc@neilpang.com>

Simon V.andneil

2026-07-06 10:22:36 +08:00

ff9b969bdb

retry failed install and deploy on renew (#7083 )

* retry failed install and deploy on renew

* fix notify level for renew retry failures

PM Extra

2026-07-05 23:33:57 +08:00

58423df3e8

toPkcs8: support --password and re-export the pkcs8 file on renewal (#4134 )

neil

2026-07-05 18:04:24 +08:00

2a175f97e8

add bash completion for commands and parameters, installed via --install (#307 )

neil

2026-07-05 17:39:50 +08:00

cabe432539

support multiple account emails (#1309 )

ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
and registers all of them as ACME contact entries. The ZeroSSL EAB
endpoint takes a single address, so the first one is used there.

neil

2026-07-05 17:37:40 +08:00

1746fbdb25

_install_win_taskscheduler: zero-pad the minute in the schtasks /ST value (#4950 )

neil

2026-07-05 17:13:24 +08:00

e964157bff

_regAccount: error out clearly when the eab-hmac-key cannot be base64-decoded

An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
signature that the CA rejects with 403.

https://github.com/acmesh-official/acme.sh/issues/4082

neil

2026-07-05 16:32:57 +08:00

4256e3532b

add Nginx workflow to test the --nginx mode

Runs le_test_nginx from acmetest against Pebble: nginx listens on
Pebble's HTTP-01 validation port with an aaPanel/BT style
"location ^~ /" reverse proxy block, the regression case of #6125.

neil

2026-07-05 16:18:37 +08:00

cacafc9c23

_createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867 )

neil

2026-07-05 16:02:52 +08:00

1cd63e1480

fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

"openssl req -noout -in" aborts when the default config file is missing;
reading a CSR needs no config, so pass -config /dev/null explicitly.

Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
never worked there.

neil

2026-07-04 23:55:16 +08:00

77047eb0ef

renewAll: error out if CERT_HOME is not a directory

With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
matches nothing, so renewAll silently does nothing and returns success --
--renew-all / --cron appears to work while renewing no certificates.
Check that CERT_HOME is a directory up front and return 1 with a clear
error instead.

Closes #4508

neil

2026-07-04 23:40:31 +08:00

4978782fb8

_isIPv4: do not glob segments, require exactly 4 octets

The unquoted splitting let a "*" segment expand against files in the
current directory, so "*.*.*.*" could pass as a valid IPv4 address
(issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
"1..2.3" and bare numbers. Split with IFS under set -f, require 4
octets, and validate each as a 1-3 digit number <= 255.

Based on https://github.com/acmesh-official/acme.sh/pull/4974
fix https://github.com/acmesh-official/acme.sh/issues/4971

neil

2026-07-04 21:34:46 +08:00

988afd0f59

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

ARI - Add support for Mass Revocation (#6953 )

* ARI - Add support for Mass Revocation

* feat: update ARI each time NextRenewTime is not within the suggestedWindow

* Remove _ari_should_renew and add condition on Le_NextRenewTime

* Add support for ARI explanationURL

* Fix debug variable _d_ari

* New Banner

Updated README to include responsive images for dark and light modes.

* multiple fix

* fix

* fix shfmt

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-04 16:50:55 +08:00

e64529ab50

extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326 )

neil

2026-07-04 11:23:11 +08:00

6cd0c00a21

fix https://github.com/acmesh-official/acme.sh/issues/6388

neil

2026-07-04 00:39:52 +08:00

0a6abaf8a1

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-04 00:06:26 +08:00

0df051577c

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-03 23:55:23 +08:00

7fb40f0ccf

fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477

neil

2026-07-03 23:34:27 +08:00

b974bbd6d6

Suppress 'signal process started' message when nginx config is restored (related to issue #4995 ) (#6747 )

Trekky12

2026-07-03 22:31:31 +08:00

61400500e2

forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163

neil

2026-07-03 22:26:50 +08:00

92a1b47108

forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572

neil

2026-07-03 21:55:37 +08:00

5038d12d62

Merge pull request #6720 from magyarsz/dev

Fix a logical error in the `renew` function

magyarsz

2026-07-03 21:42:52 +08:00

7e7c0ee984

fix https://github.com/acmesh-official/acme.sh/issues/6917

neil

2026-07-03 20:04:32 +08:00

ad99628e50

fix https://github.com/acmesh-official/acme.sh/issues/7009

neil

2026-07-03 19:38:21 +08:00

1241649501

fix https://github.com/acmesh-official/acme.sh/issues/4756

neil

2026-07-03 19:01:10 +08:00

9900adb007

ARI - Run cron job more frequently (#6939 )

* ARI - Run cron job more frequently

With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
"For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."

More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.

* Fix cron job schedule for certificate renewal

* Fix random_hour syntax in cron job installation

* Update Windows task scheduler to run more frequently

Add support for randomized hour and update frequency

Ref:
* [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
* [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)

* Add padding for StartTime (/ST) in SCHTASKS.exe

* New Banner

Updated README to include responsive images for dark and light modes.

* rebase

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-03 15:12:32 +08:00

ced8d72808

fix https://github.com/acmesh-official/acme.sh/issues/6400

neil

2026-07-02 23:30:56 +08:00

116c05fbff

fix https://github.com/acmesh-official/acme.sh/issues/6986

neil

2026-07-02 23:15:41 +08:00

ccd2f04c33

fix https://github.com/acmesh-official/acme.sh/issues/7035

neil

2026-07-01 21:22:36 +08:00

d0fcafe29b

acme.sh: validate cert response before writing .cer (#7006 )

rajcz

2026-06-05 19:38:50 +02:00

58d9c8d7f6

fix localaddress

https://github.com/acmesh-official/acme.sh/issues/7009#issuecomment-4633681701

neil

2026-06-05 19:22:25 +02:00

b463471951

fix _getAKI() on OpenBSD (#7007 )

The order of the arguments does matter for OpenBSD's grep (bug or
feature).

Thomas

2026-06-04 21:15:12 +02:00

dfbe2c5bff

minor

neil

2026-05-30 11:47:25 +02:00

b7e9214e2d

ARI - Add support for switching ACME Server during renewal (#6983 )

* ARI - Add support for switching ACME Server during renewal

https://github.com/acmesh-official/acme.sh/issues/6964

* Restore old condition while adding malformed

Simon V.

2026-05-24 22:25:52 +02:00

d9ce7fefa1

Update renewal condition in acme.sh script

hebbet

2026-05-16 11:16:20 +02:00

85408bfb4d

fix format

neil

2026-05-06 20:58:54 +02:00

1687cbd5b4

fix for ari

neil

2026-05-06 20:51:49 +02:00

eaf4b62ba9

start 3.1.4

neil

2026-05-06 20:51:49 +02:00

47378b5630

support NO_ARI=1

https://github.com/acmesh-official/acme.sh/discussions/6938

neil

2026-05-06 20:51:49 +02:00

ac75c54ade

fix ari

https://github.com/acmesh-official/acme.sh/issues/6942#issuecomment-4382355708

neil

2026-05-06 20:51:49 +02:00

36667ab656

fix ari

https://github.com/acmesh-official/acme.sh/issues/6942#issuecomment-4381535765

neil

2026-05-06 20:51:49 +02:00

7b19070d98