6748 Commits

This Branch

This Branch

All Branches

• notify: add the customscript hook

  The wiki has documented "21. Set notification for customscript" since
  2022 but the implementation (#4193) was never merged, so following the
  wiki failed with "Cannot find the hook file". Same interface as
  documented: the script gets subject, content and status code as three
  arguments. Unlike #4193, the target script is invoked directly instead
  of through eval -- the subject/content contain domain names and CA
  messages, and eval would allow command injection through them.
  
  https://github.com/acmesh-official/acme.sh/issues/6377

  neil 2026-07-12 11:36:45 +08:00
  44c045b056
• dns_pdns: probe zones with the server-side name filter in _get_root

  The unfiltered GET /zones lists every zone on the server; with large
  installations (100k zones) root-zone detection took minutes per domain.
  Probe each walk-up candidate with ?zone=<name> instead (exact match per
  the PowerDNS API docs); servers that ignore the parameter return the
  full list, which the existing check still handles.
  
  https://github.com/acmesh-official/acme.sh/issues/6382

  neil 2026-07-12 11:20:53 +08:00
  e94631de44
• mydevil: replace BSD-only cut -w with tr + plain cut

  cut -w (split on whitespace) is a FreeBSD extension unknown to GNU
  coreutils; squeeze blanks into tabs with tr first so the field
  extraction is POSIX.
  
  https://github.com/acmesh-official/acme.sh/issues/6452

  neil 2026-07-12 10:49:49 +08:00
  a49f8c1992
• dns_zonomi: make the API endpoint configurable via ZM_Api

  RimuHosting (which owns zonomi) exposes the identical API at
  https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
  both providers with one hook. The default stays zonomi.com and is not
  written to the account conf.
  
  https://github.com/acmesh-official/acme.sh/issues/6475

  neil 2026-07-12 10:26:40 +08:00
  7d0283ca2c
• dns_cpanel: quote inner expansion in suffix strip (SC2295)
  neil 2026-07-12 09:35:22 +08:00
  76811857a0
• dns_cloudns: include the server response in the login error

  https://github.com/acmesh-official/acme.sh/issues/6520

  neil 2026-07-12 09:34:59 +08:00
  22a5ae3ceb
• precheck: log the socat recommendation with _info instead of _err

  Missing socat only matters for standalone mode; the text even says the
  warning can be ignored. Printing it to stderr made every --upgrade in a
  cron noisy for DNS-only users who redirect stdout.
  
  https://github.com/acmesh-official/acme.sh/issues/6525

  neil 2026-07-12 09:30:46 +08:00
  04e0422526
• notify: clear inherited _H1.._H5 before running each notify hook

  The dns/deploy hooks export _H1.._H5 in the main process, and the
  notify hooks run in a subshell that inherits them. A hook that does
  not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
  etc.) sent the stale headers with its request, leaking another
  service's Authorization credentials to the notify endpoint.
  
  https://github.com/acmesh-official/acme.sh/issues/6801

  neil 2026-07-11 11:56:58 +08:00
  2215f1b988
• dns_cpanel: resolve the most specific zone in _get_root

  With both domain.tld and sub.domain.tld zones on the account, the first
  endswith hit could pick the parent zone while cPanel stores the record
  in the most specific one, so the cleanup never found the record and
  left an orphaned _acme-challenge TXT entry. Pick the longest matching
  zone with an exact literal suffix match (_endswith treats the needle as
  a regex, letting xdomain.tld wrongly match zone domain.tld).
  
  https://github.com/acmesh-official/acme.sh/issues/6807

  neil 2026-07-11 11:42:32 +08:00
  9366c2e065
• Microwavenby dns hostinger (#6843)

  * [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com
  
  * [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled
  
  * [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?
  
  * [Microwavenby-dns-hostinger] Responding to comments from Neil
  
  * [dns-hostinger] SHfmt and Shellcheck
  
  * [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

  Sasha Reid 2026-07-11 10:04:49 +08:00
  2e4acba105
• Fix name.com DNS API for processing IDNs (#4381)
  Mike Lei 2026-07-10 21:56:54 +08:00
  fef90e15e1
• Feature: Support other shells then sh (#4877)

  * Add support for DEPLOY_SSH_REMOTE_SHELL
  
  * allow to configure quoting of  remote cmd string
  
  * shell check and shellfmt fixes

  Roman Lumetsberger 2026-07-10 21:02:06 +08:00
  50e5e771d5
• dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999)

  Getting client_id failed due to incorrect extraction!
  
  At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
  {"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

  CV 2026-07-10 20:55:23 +08:00
  ebde8345ae
• dns_njalla.sh: accept string record ids when removing records

  The Njalla API returns record ids as JSON strings now; the numeric-only
  pattern matched nothing, so the removal never found the record id.
  Match both quoted and bare ids.
  
  from https://github.com/acmesh-official/acme.sh/pull/5121

  neil 2026-07-10 20:47:31 +08:00
  58cd667d65
• 2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171)
  Andrew V. 2026-07-10 20:36:42 +08:00
  98c30912fb
• acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

  from https://github.com/acmesh-official/acme.sh/pull/6547

  neil 2026-07-10 19:37:36 +08:00
  2058a77d83
• deploy/synology_dsm.sh: use grep -Eo '[0-9]+' when extracting error codes

  grep -o '[0-9]*' can match the empty string; GNU grep skips empty
  matches but BSD greps handle them differently, breaking the 2FA
  login flow on OpenBSD. Force a non-empty match at all three sites.
  
  from https://github.com/acmesh-official/acme.sh/pull/6725

  neil 2026-07-10 18:37:32 +08:00
  660a5e322c
• Fix typo (#6924)
  Jan Pieper 2026-07-10 14:42:57 +08:00
  2af543a358
• dns_pleskxml.sh: use grep -F when matching interpolated values

  fulldomain/txtvalue/root_domain_name were interpolated into grep
  regex patterns; match them as fixed strings instead.
  
  from https://github.com/acmesh-official/acme.sh/pull/7031

  neil 2026-07-10 12:05:28 +08:00
  fa763db105
• issue: strip the trailing dot of a fully-qualified alias domain

  A trailing dot in --domain-alias/--challenge-alias was passed through
  to the dnsapi hook verbatim. Providers with exact-match record-name
  lookups (e.g. Cloudflare's name= filter) then never find the record,
  so rm never deletes it and relic TXT records accumulate on every issue.
  Stripping in issue() also fixes certs with a dotted alias already
  saved in domain.conf.
  
  fix https://github.com/acmesh-official/acme.sh/issues/4636

  neil 2026-07-10 11:22:20 +08:00
  90b4795bb1
• dns_me.sh: use LC_ALL=C so the request date header is always English

  LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
  alone still produced localized day/month names on non-English systems
  and DNS Made Easy rejected the request date header. An LC_ALL=C
  command prefix beats every locale variable (same pattern as
  dns_oci.sh).
  
  Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

  neil 2026-07-10 11:20:08 +08:00
  534a1714dc
• Add _cleardeployconf to clear deploy hook keys from domain conf

  Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
  the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
  and the direct _cleardomainconf call in multideploy.sh.
  
  Closes #4722. Thanks to @sg1888.

  neil 2026-07-10 11:05:40 +08:00
  45c0ad4112
• notify/smtp.sh: add --crlf so curl sends CRLF line endings

  Postfix with smtpd_forbid_bare_newline (default hardening since 3.9,
  after SMTP smuggling) rejects the message with
  "521 5.5.2 Error: bare <LF> received". RFC 5321 requires CRLF.
  The python sender is unaffected (smtplib already emits CRLF).
  
  fix https://github.com/acmesh-official/acme.sh/issues/7104

  neil 2026-07-10 10:38:52 +08:00
  83b52e0cd7
• dns_freedns.sh: use grep -E, BRE \| alternation is a GNU extension

  OpenBSD grep treats \| in a BRE as a literal | character, so
  _freedns_domain_id never matched any row and every domain lookup
  failed with "Domain not found". Switch to ERE with -E, keeping the
  parens escaped so the (.*) suffix branch still requires literal
  parentheses and does not widen the match (e.g. searching example.com
  must not match example.company).
  
  Reported-by: @katiekloss @boretom
  Ref: https://github.com/acmesh-official/acme.sh/issues/2305

  neil 2026-07-10 10:23:59 +08:00
  bed15ba844
• Docker: update crontab used (#7111)

  Signed-off-by: invario <67800603+invario@users.noreply.github.com>

  invario 2026-07-10 10:10:44 +08:00
  1324dcd472
• Add creoline API as DNS provider (#7100)

  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * acme-sh-creoline-as-dns-provider
  
  * acme-sh-creoline-as-dns-provider - Review changes implemented according code review
  
  * acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron
  
  * acme-sh-creoline-as-dns-provider - Remove debug code
  
  * acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
  Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>

  4 people 2026-07-10 10:07:12 +08:00
  cf3eab95ee
• issue.yml: match tracking issue title variants
  neil 2026-07-10 10:02:59 +08:00
  ca118be754
• Merge pull request #7026 from Marvo2011/dev

  Update SelfHost DNS provider

  Marvo2011 2026-07-06 21:30:13 +08:00
  b1b539695f
• one-click revert and ban
  neil 2026-07-06 17:39:56 +08:00
  cc64a73230
• add more events
  neil 2026-07-06 16:36:16 +08:00
  f2b37b32ff
• clean
  neil 2026-07-06 16:30:41 +08:00
  73df21abc4
• wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org write members
  neil 2026-07-06 16:27:26 +08:00
  919492df13
• wiki-guard: log the number of write-access members loaded
  neil 2026-07-06 15:23:45 +08:00
  e4eaa59063
• wiki-guard: trust repo/org members with write access in all rule checks
  neil 2026-07-06 15:11:35 +08:00
  2b5a19d34a
• issue.yml: assign and label "Report bugs to" tracking issues instead of posting the upgrade boilerplate
  neil 2026-07-06 14:27:00 +08:00
  dc1b06006f
• wiki-monitor: skip notification for the maintainer's own wiki changes
  neil 2026-07-06 14:23:51 +08:00
  8585d9f4a7
• add wiki-guard workflow: auto-restore wiki pages deleted or renamed by non-maintainer
  neil 2026-07-06 13:35:37 +08:00
  ca8ab7f8b5
• Add support for Account Key Rollover (#7080)

  * add wiki
  
  * feat: add support for account key rollover
  
  * Place --update-account-key next to --update-account
  
  * fix shfmt
  
  * fix shfmt
  
  * fix shfmt
  
  * Fix from review
  
  * fix shfmt
  
  * fix from review
  
  * fix review
  
  ---------
  
  Co-authored-by: neil <gitpc@neilpang.com>

  Simon V.andneil 2026-07-06 10:22:36 +08:00
  ff9b969bdb
• deploy/ssh: return non-zero when a server deployment fails (#6795)

  ssh_deploy() ignored the result of _ssh_deploy and always returned
  success, so a failed transfer to one (or all) of the servers in
  DEPLOY_SSH_SERVER was silently swallowed. Track the return code across
  the loop and return non-zero if any server failed, letting the caller
  handle notification.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  Oliver MuellerandClaude Opus 4.8 2026-07-06 10:11:58 +08:00
  1f778e6ef1
• retry failed install and deploy on renew (#7083)

  * retry failed install and deploy on renew
  
  * fix notify level for renew retry failures

  PM Extra 2026-07-05 23:33:57 +08:00
  58423df3e8
• Add LaoDC DNS API (dns_laodc) (#6974)

  * Added LaoDC API Module
  
  * Cleaned up debug and info
  revised get subdomain to filter by TXT records.
  
  * Added commet to _get_root
  
  * Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.
  
  Revised rm() function to do explicit record matching.
  
  * Revised _get_root() to handle different scenarios.
  
  Fixed _laodc_api() function to check if query failed to run.
  added basic json sanitation to handle \ and " in $value
  unset _H2 _H3 after call as per request from copilot.
  
  * fixed indentation of case statement block
  
  * fixed condition checking.
  
  _get_root should start at 1 so full fqdn can be tested
  $? was being reference after export command failing response checks
  removed export txtvalue
  fixed docs link and issues link
  
  * Verify key for both add and rm
  
  * fixed dns alias condition check
  validate key returns 1 if failed.
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: LaoDC <git@laodc.com>

  3 people 2026-07-05 23:30:26 +08:00
  8f3c1701f3
• toPkcs8: support --password and re-export the pkcs8 file on renewal (#4134)
  neil 2026-07-05 18:04:24 +08:00
  2a175f97e8
• dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973)
  neil 2026-07-05 18:02:34 +08:00
  d3af3315da
• migrate the legacy ACMEDNS_UPDATE_URL from the account conf (#3899)
  neil 2026-07-05 17:48:33 +08:00
  7b6d96387c
• add bash completion for commands and parameters, installed via --install (#307)
  neil 2026-07-05 17:39:50 +08:00
  cabe432539
• support multiple account emails (#1309)

  ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
  and registers all of them as ACME contact entries. The ZeroSSL EAB
  endpoint takes a single address, so the first one is used there.

  neil 2026-07-05 17:37:40 +08:00
  1746fbdb25
• deploy/panos: do not commit when the cert or key import failed (#4716)

  Committing after a failed import leaves a mismatched cert/key pair on
  the firewall (PAN-OS does not validate the pair at commit time), which
  can lock the admin out of the https management interface.

  neil 2026-07-05 17:13:59 +08:00
  d2b3772631
• _install_win_taskscheduler: zero-pad the minute in the schtasks /ST value (#4950)
  neil 2026-07-05 17:13:24 +08:00
  e964157bff
• notify/aws_ses: add container/instance IAM role auth (IMDSv2)

  aws_ses_send calls `_use_container_role || _use_instance_role` when no
  static AWS keys are set, but those functions were never defined -- only
  _use_metadata was -- so role-based auth silently fell through to the
  "no api key" error. Add both, using the current IMDSv2-capable versions
  from dns_aws.sh, and set the IMDSv2 token header in _use_metadata so the
  credential fetch works on IMDSv2-only instances.
  
  Closes #4742

  neil 2026-07-05 17:09:51 +08:00
  934711e51d
• dns_regru: require a dot boundary in root zone matching

  _get_root matched a registered domain anywhere as a substring of the
  challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
  account, issuing for subtest.com.ru wrongly picked test.com.ru as the
  root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
  boundary so a shorter domain no longer matches a longer subdomain label.
  
  Fixes the issue reported in #5036 (thanks @koledas)
  Closes #5036

  neil 2026-07-05 16:57:59 +08:00
  7def43481a