6685 Commits

This Branch

This Branch

All Branches

• renewAll: error out if CERT_HOME is not a directory

  With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
  matches nothing, so renewAll silently does nothing and returns success --
  --renew-all / --cron appears to work while renewing no certificates.
  Check that CERT_HOME is a directory up front and return 1 with a clear
  error instead.
  
  Closes #4508

  neil 2026-07-04 23:40:31 +08:00
  4978782fb8
• dns_cn: convert IDN domain to punycode before API calls

  Core-Networks' API rejects Unicode domain names with "invalid domain";
  it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
  domain straight through, so IDN certs failed at the TXT add step
  (issue #4804). Run fulldomain through _idn() in both functions. For
  ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
  unaffected.
  
  Fixes #4804

  neil 2026-07-04 21:58:57 +08:00
  9764f67619
• _isIPv4: do not glob segments, require exactly 4 octets

  The unquoted splitting let a "*" segment expand against files in the
  current directory, so "*.*.*.*" could pass as a valid IPv4 address
  (issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
  "1..2.3" and bare numbers. Split with IFS under set -f, require 4
  octets, and validate each as a 1-3 digit number <= 255.
  
  Based on https://github.com/acmesh-official/acme.sh/pull/4974
  fix https://github.com/acmesh-official/acme.sh/issues/4971

  neil 2026-07-04 21:34:46 +08:00
  988afd0f59
• add application/json to acmedns (#5066)
  Ramon 2026-07-04 21:07:18 +08:00
  b92516f79e
• dns_inwx: fix _get_root false zone match for single-letter subdomains

  _get_root matched the candidate zone with _contains (grep), which treats
  the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
  "<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
  comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
  zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
  to <string>$h</string> and escape dots so the zone is compared literally.
  
  Fixes #5129

  neil 2026-07-04 20:28:56 +08:00
  fbf3b41c54
• Accept both 401 and 403 for deactivated account detection

  RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
  signed by a deactivated account, which ZeroSSL follows, while
  Boulder (Let's Encrypt) historically returns 403. Check both codes
  in _regAccount and deactivateaccount.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5138

  neil 2026-07-04 20:21:27 +08:00
  ede9a86d46
• fix(gcore_cdn): renew login api url (#5143)

  https://api.gcore.com/docs/iam#tag/Account

  xiaopc 2026-07-04 20:14:32 +08:00
  843a7efa7d
• fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

  _contains matches with grep regex, so the '*' in "DNS:*.example.com," never
  matched and the subject was appended to the identifiers a second time.
  Escape the wildcard before the check, the same way the sed removal already does.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5251

  neil 2026-07-04 19:56:37 +08:00
  d3e12694b9
• _date2time: pass date via argv to python to prevent code injection (#6463)

  https://github.com/acmesh-official/acme.sh/issues/6463

  neil 2026-07-04 19:14:36 +08:00
  a105126063
• dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

  The DNS endpoint and IAM token scope project were hardcoded to
  ap-southeast-1, which fails for accounts without that region enabled.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5302

  neil 2026-07-04 19:06:46 +08:00
  917bebd460
• Allow creation of ACME account with EAB directly from --issue command (#5087)

  * formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue
  
  * Update acme.sh
  
  * Update acme.sh

  Clément Gouin 2026-07-04 18:54:07 +08:00
  33704fc274
• haproxy.sh: use two-argument -header form for LibreSSL (#3438)
  neil 2026-07-04 18:50:29 +08:00
  bcbfe25d08
• deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

  fix https://github.com/acmesh-official/acme.sh/issues/6115

  neil 2026-07-04 18:46:59 +08:00
  bbfb6f50ae
• dns_da: document that special characters in DA_Api credentials must be percent-encoded

  https://github.com/acmesh-official/acme.sh/issues/3468

  neil 2026-07-04 18:19:45 +08:00
  6df2d9e451
• https://github.com/acmesh-official/acme.sh/issues/3201
  neil 2026-07-04 16:55:49 +08:00
  1a36823461
• Add Calrissia.be API (#6811)

  Co-authored-by: Ward <ward.hus@calrissia.com>

  wardhusandWard 2026-07-04 16:54:05 +08:00
  8f2a476d21
• ARI - Add support for Mass Revocation (#6953)

  * ARI - Add support for Mass Revocation
  
  * feat: update ARI each time NextRenewTime is not within the suggestedWindow
  
  * Remove _ari_should_renew and add condition on Le_NextRenewTime
  
  * Add support for ARI explanationURL
  
  * Fix debug variable _d_ari
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * multiple fix
  
  * fix
  
  * fix shfmt
  
  * Reset README
  
  ---------
  
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  Simon V.andZeroSSL-Andreas 2026-07-04 16:50:55 +08:00
  e64529ab50
• fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895
  neil 2026-07-04 11:44:32 +08:00
  7653eaab31
• extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326)
  neil 2026-07-04 11:23:11 +08:00
  6cd0c00a21
• fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977)
  neil 2026-07-04 10:49:32 +08:00
  b4de9e8621
• fix https://github.com/acmesh-official/acme.sh/issues/6388
  neil 2026-07-04 00:39:52 +08:00
  0a6abaf8a1
• haproxy.sh: allows certificate deployment to multiple hosts (#5180)

  * haproxy.sh: allows certificate deployment to multiple hosts
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  ---------
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>

  Laurent GrawetandMatt Simerson 2026-07-04 00:35:02 +08:00
  f4dc9fd9d1
• Fix typo in synology_dsm.sh (#6406)

  Fix typo in an error message.

  Artur Klauser 2026-07-04 00:32:45 +08:00
  2229330c48
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-04 00:06:26 +08:00
  0df051577c
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-03 23:55:23 +08:00
  7fb40f0ccf
• dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272
  neil 2026-07-03 23:44:22 +08:00
  780f2ad5dc
• dns_aws: Fix invalid domain logging: _error => _err (#6430)

  acme.sh defines _err, not _error.

  szakharchenko 2026-07-03 23:40:39 +08:00
  adf69c4e7e
• dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487
  neil 2026-07-03 23:34:27 +08:00
  ac5624536b
• fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477
  neil 2026-07-03 23:34:27 +08:00
  b974bbd6d6
• dev_mythic_beasts: Fix header name: Accepts => Accept (#6428)
  szakharchenko 2026-07-03 23:25:38 +08:00
  0ce8c24736
• dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491
  neil 2026-07-03 23:02:35 +08:00
  20254cbaf0
• dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517
  neil 2026-07-03 22:49:40 +08:00
  f4d2db64ef
• Suppress 'signal process started' message when nginx config is restored (related to issue #4995) (#6747)
  Trekky12 2026-07-03 22:31:31 +08:00
  61400500e2
• forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163
  neil 2026-07-03 22:26:50 +08:00
  92a1b47108
• forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572
  neil 2026-07-03 21:55:37 +08:00
  5038d12d62
• Merge pull request #6720 from magyarsz/dev

  Fix a logical error in the `renew` function

  magyarsz 2026-07-03 21:42:52 +08:00
  7e7c0ee984
• fix https://github.com/acmesh-official/acme.sh/issues/6914
  neil 2026-07-03 20:07:42 +08:00
  92bd80c07d
• fix https://github.com/acmesh-official/acme.sh/issues/6917
  neil 2026-07-03 20:04:32 +08:00
  ad99628e50
• fix https://github.com/acmesh-official/acme.sh/issues/6963
  neil 2026-07-03 19:38:42 +08:00
  eabd23a551
• fix https://github.com/acmesh-official/acme.sh/issues/7009
  neil 2026-07-03 19:38:21 +08:00
  1241649501
• fix https://github.com/acmesh-official/acme.sh/issues/4756
  neil 2026-07-03 19:01:10 +08:00
  9900adb007
• New Banner

  Updated README to include responsive images for dark and light modes.

  ZeroSSL-Andreas 2026-07-03 18:33:44 +08:00
  01d6d46914
• fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077)

  _normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
  any positional argument. dns_czechia_add() called it as
  `_normalizeJson "$_res"`, so the response was discarded and the inner
  sed blocked reading from stdin.
  
  When issuing for a single domain, or for a record that already exists,
  the "already exists" branch returns early and never reaches this call,
  which is why the bug stayed hidden. With multiple domains, the first
  record often short-circuits on "already exists" while the next,
  freshly-added record reaches the broken call and hangs on interactive
  runs (or consumes unrelated stdin non-interactively).
  
  Pipe the response into _normalizeJson via stdin, matching
  dns_czechia_rm() and every other dnsapi plugin.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  CZECHIA-COMandClaude Opus 4.8 2026-07-03 18:12:25 +08:00
  f038958192
• feat: Add Volcano Engine DNS API (#7069)

  * feat: add volcengine dns api
  
  * fix(volcengine): address review findings and fix record matching
  
  Code review fixes:
  - fix format string usage in signature computation (use printf %b / %s)
  - clear _H1.._H5 header state at start of request to avoid leaking
    conditionally-set headers into subsequent requests
  - check ListZones return status in _get_root
  - document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
  - fix Docs and Issues sections
  - remove and update some code comments
  
  Functional fixes:
  - stop matching ListRecords results by FQDN string: Volcengine lowercases
    the Host/FQDN in responses, so a case-sensitive compare against
    $fulldomain failed for mixed-case names, making rm silently skip
    deletion and add lose idempotency. ListRecords is already filtered by
    ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
    result instead.
  - reset _record_id at the start of add/rm to avoid stale state leaking
    across calls within the same process
  - tag created records with Remark "acme.sh" for easier identification
  - adjust debug levels: hide Authorization header behind _debug2, surface
    response at _debug
  
  Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: wenxuan70 <t736660416@gmail.com>
  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

  3 people 2026-07-03 10:09:32 +00:00
  fdf528c26c
• ARI - Run cron job more frequently (#6939)

  * ARI - Run cron job more frequently
  
  With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
  "For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."
  
  More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.
  
  * Fix cron job schedule for certificate renewal
  
  * Fix random_hour syntax in cron job installation
  
  * Update Windows task scheduler to run more frequently
  
  Add support for randomized hour and update frequency
  
  Ref:
  * [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
  * [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)
  
  * Add padding for StartTime (/ST) in SCHTASKS.exe
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * rebase
  
  * Reset README
  
  ---------
  
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  Simon V.andZeroSSL-Andreas 2026-07-03 15:12:32 +08:00
  ced8d72808
• fix https://github.com/acmesh-official/acme.sh/issues/6400
  neil 2026-07-02 23:30:56 +08:00
  116c05fbff
• fix https://github.com/acmesh-official/acme.sh/issues/6851
  neil 2026-07-02 23:18:26 +08:00
  42e13fa797
• fix https://github.com/acmesh-official/acme.sh/issues/6986
  neil 2026-07-02 23:15:41 +08:00
  ccd2f04c33
• DNS_IONOS double sending content type & case sensitive mismatch (#7028)

  * double sending content type results in error from ionos
  
  * Normalize fulldomain to lowercase in the _ionos_get_record function.

  MarFri 2026-07-02 23:08:59 +08:00
  a50fad865f
• Add Glesys dnsapi provider (#7059)

  * Add Glesys dnsapi provider
  
  * Fix typo in error message for dns_glesys_add
  
  * Use API to get record id in Glesys provider
  
  * Use listrecords API endpoint to find root domain
  
  * Remove record id parsin from add function

  Toni Karppi 2026-07-02 13:10:29 +08:00
  5433ea86c8