acme.sh

Merge pull request #7114 from achmadalifn4/master

Add notify waha support

ACHMAD ALIF NASRULLOH

2026-07-12 16:10:21 +08:00

f5e7e6b225

fix(notify): waha: tighten response check

Achmad Alif Nasrulloh

2026-07-12 16:07:33 +08:00

d45b6fe8e6

Add notify waha support

Achmad Alif Nasrulloh

2026-07-12 16:07:33 +08:00

237f2d9c3b

deploy/synology_dsm.sh: remove bashisms, keep the hook POSIX sh

The hook is sourced by acme.sh, so the bash shebang never takes
effect: under dash, `[ x == y ]` fails with "unexpected operator",
the 403 branch never triggers and 2FA-OTP login is skipped.
Replace `==` with `=` and use the standard sh shebang.

neil

2026-07-12 16:04:44 +08:00

ebb5cc4981

cpanel_uapi: don't spill a redirection error when the key file is absent

With --signcsr the private key never exists in the cert home, so every
renewal printed ".../domain.key: No such file or directory" from the
shell redirection. Skip the key read in that case; the install_ssl call
already ran with an empty key there and cPanel keeps the installed one.

https://github.com/acmesh-official/acme.sh/issues/6228

neil

2026-07-12 13:00:12 +08:00

3989eef5e2

dns_dynu: include the server response in the authentication error

Same as the dns_cloudns change: a bare "Authentication failed" hides
the actual API error and makes reports undiagnosable.

neil

2026-07-12 12:45:10 +08:00

2c51ac1c27

issue bot: tell reporters to redact secrets before posting logs

Debug logs occasionally contain private keys or tokens (issue 6267);
the code-side leak in the haproxy hook was fixed by #6268, this adds
the missing warning to the auto-comment that asks for logs.

neil

2026-07-12 12:32:54 +08:00

eacf0d6a87

dns_knot: KNOT_KEY takes the TSIG key data, not a file path

The knsupdate "key" statement wants "[alg:]name secret"; the info block
wrongly described the option as a file path.

https://github.com/acmesh-official/acme.sh/issues/6293

neil

2026-07-12 12:22:28 +08:00

099d88e6a9

issue: never schedule the default renewal past the cert expiry

The default schedule was a fixed CertCreateTime + RenewalDays - 1 day,
which passes notAfter entirely for short-lived certs (internal CAs
today, the CA/B SC-081 47-day maximum later) and leaves an expired cert
in place for weeks. Extract the arithmetic into _calc_next_renew_time
and cap it at one day before expiry (one hour for lifetimes of 24h or
less, mirroring --valid-to scheduling). CAs with ARI are unaffected --
the ARI window still overrides afterwards.

https://github.com/acmesh-official/acme.sh/issues/6305

neil

2026-07-12 12:12:18 +08:00

897e219743

workflows: run issue/wiki automation only in the upstream repo

neil

2026-07-12 11:49:53 +08:00

a9590c5bd7

wiki-guard: skip on forks (no <fork>.wiki repo to check out)

neil

2026-07-12 11:43:07 +08:00

c0d62eb934

notify: add the customscript hook

The wiki has documented "21. Set notification for customscript" since
2022 but the implementation (#4193) was never merged, so following the
wiki failed with "Cannot find the hook file". Same interface as
documented: the script gets subject, content and status code as three
arguments. Unlike #4193, the target script is invoked directly instead
of through eval -- the subject/content contain domain names and CA
messages, and eval would allow command injection through them.

https://github.com/acmesh-official/acme.sh/issues/6377

neil

2026-07-12 11:36:45 +08:00

44c045b056

dns_pdns: probe zones with the server-side name filter in _get_root

The unfiltered GET /zones lists every zone on the server; with large
installations (100k zones) root-zone detection took minutes per domain.
Probe each walk-up candidate with ?zone=<name> instead (exact match per
the PowerDNS API docs); servers that ignore the parameter return the
full list, which the existing check still handles.

https://github.com/acmesh-official/acme.sh/issues/6382

neil

2026-07-12 11:20:53 +08:00

e94631de44

mydevil: replace BSD-only cut -w with tr + plain cut

cut -w (split on whitespace) is a FreeBSD extension unknown to GNU
coreutils; squeeze blanks into tabs with tr first so the field
extraction is POSIX.

https://github.com/acmesh-official/acme.sh/issues/6452

neil

2026-07-12 10:49:49 +08:00

a49f8c1992

dns_zonomi: make the API endpoint configurable via ZM_Api

RimuHosting (which owns zonomi) exposes the identical API at
https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
both providers with one hook. The default stays zonomi.com and is not
written to the account conf.

https://github.com/acmesh-official/acme.sh/issues/6475

neil

2026-07-12 10:26:40 +08:00

7d0283ca2c

Merge pull request #7119 from acmesh-official/dev

sync

neil

2026-07-12 10:11:32 +08:00

3e64b5e6f5

dns_cpanel: quote inner expansion in suffix strip (SC2295)

neil

2026-07-12 09:35:22 +08:00

76811857a0

dns_cloudns: include the server response in the login error

https://github.com/acmesh-official/acme.sh/issues/6520

neil

2026-07-12 09:34:59 +08:00

22a5ae3ceb

precheck: log the socat recommendation with _info instead of _err

Missing socat only matters for standalone mode; the text even says the
warning can be ignored. Printing it to stderr made every --upgrade in a
cron noisy for DNS-only users who redirect stdout.

https://github.com/acmesh-official/acme.sh/issues/6525

neil

2026-07-12 09:30:46 +08:00

04e0422526

notify: clear inherited _H1.._H5 before running each notify hook

The dns/deploy hooks export _H1.._H5 in the main process, and the
notify hooks run in a subshell that inherits them. A hook that does
not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
etc.) sent the stale headers with its request, leaking another
service's Authorization credentials to the notify endpoint.

https://github.com/acmesh-official/acme.sh/issues/6801

neil

2026-07-11 11:56:58 +08:00

2215f1b988

dns_cpanel: resolve the most specific zone in _get_root

With both domain.tld and sub.domain.tld zones on the account, the first
endswith hit could pick the parent zone while cPanel stores the record
in the most specific one, so the cleanup never found the record and
left an orphaned _acme-challenge TXT entry. Pick the longest matching
zone with an exact literal suffix match (_endswith treats the needle as
a regex, letting xdomain.tld wrongly match zone domain.tld).

https://github.com/acmesh-official/acme.sh/issues/6807

neil

2026-07-11 11:42:32 +08:00

9366c2e065

Microwavenby dns hostinger (#6843 )

* [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com

* [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled

* [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?

* [Microwavenby-dns-hostinger] Responding to comments from Neil

* [dns-hostinger] SHfmt and Shellcheck

* [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

Sasha Reid

2026-07-11 10:04:49 +08:00

2e4acba105

Fix name.com DNS API for processing IDNs (#4381 )

Mike Lei

2026-07-10 21:56:54 +08:00

fef90e15e1

Feature: Support other shells then sh (#4877 )

* Add support for DEPLOY_SSH_REMOTE_SHELL

* allow to configure quoting of  remote cmd string

* shell check and shellfmt fixes

Roman Lumetsberger

2026-07-10 21:02:06 +08:00

50e5e771d5

dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999 )

Getting client_id failed due to incorrect extraction!

At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
{"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

CV

2026-07-10 20:55:23 +08:00

ebde8345ae

dns_njalla.sh: accept string record ids when removing records

The Njalla API returns record ids as JSON strings now; the numeric-only
pattern matched nothing, so the removal never found the record id.
Match both quoted and bare ids.

from https://github.com/acmesh-official/acme.sh/pull/5121

neil

2026-07-10 20:47:31 +08:00

58cd667d65

2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171 )

Andrew V.

2026-07-10 20:36:42 +08:00

98c30912fb

acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

from https://github.com/acmesh-official/acme.sh/pull/6547

neil

2026-07-10 19:37:36 +08:00

2058a77d83

deploy/synology_dsm.sh: use grep -Eo '[0-9]+' when extracting error codes

grep -o '[0-9]*' can match the empty string; GNU grep skips empty
matches but BSD greps handle them differently, breaking the 2FA
login flow on OpenBSD. Force a non-empty match at all three sites.

from https://github.com/acmesh-official/acme.sh/pull/6725

neil

2026-07-10 18:37:32 +08:00

660a5e322c

Fix typo (#6924 )

Jan Pieper

2026-07-10 14:42:57 +08:00

2af543a358

dns_pleskxml.sh: use grep -F when matching interpolated values

fulldomain/txtvalue/root_domain_name were interpolated into grep
regex patterns; match them as fixed strings instead.

from https://github.com/acmesh-official/acme.sh/pull/7031

neil

2026-07-10 12:05:28 +08:00

fa763db105

issue: strip the trailing dot of a fully-qualified alias domain

A trailing dot in --domain-alias/--challenge-alias was passed through
to the dnsapi hook verbatim. Providers with exact-match record-name
lookups (e.g. Cloudflare's name= filter) then never find the record,
so rm never deletes it and relic TXT records accumulate on every issue.
Stripping in issue() also fixes certs with a dotted alias already
saved in domain.conf.

fix https://github.com/acmesh-official/acme.sh/issues/4636

neil

2026-07-10 11:22:20 +08:00

90b4795bb1

dns_me.sh: use LC_ALL=C so the request date header is always English

LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
alone still produced localized day/month names on non-English systems
and DNS Made Easy rejected the request date header. An LC_ALL=C
command prefix beats every locale variable (same pattern as
dns_oci.sh).

Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

neil

2026-07-10 11:20:08 +08:00

534a1714dc

Add _cleardeployconf to clear deploy hook keys from domain conf

Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
and the direct _cleardomainconf call in multideploy.sh.

Closes #4722. Thanks to @sg1888.

neil

2026-07-10 11:05:40 +08:00

45c0ad4112

notify/smtp.sh: add --crlf so curl sends CRLF line endings

Postfix with smtpd_forbid_bare_newline (default hardening since 3.9,
after SMTP smuggling) rejects the message with
"521 5.5.2 Error: bare <LF> received". RFC 5321 requires CRLF.
The python sender is unaffected (smtplib already emits CRLF).

fix https://github.com/acmesh-official/acme.sh/issues/7104

neil

2026-07-10 10:38:52 +08:00

83b52e0cd7

dns_freedns.sh: use grep -E, BRE \| alternation is a GNU extension

OpenBSD grep treats \| in a BRE as a literal | character, so
_freedns_domain_id never matched any row and every domain lookup
failed with "Domain not found". Switch to ERE with -E, keeping the
parens escaped so the (.*) suffix branch still requires literal
parentheses and does not widen the match (e.g. searching example.com
must not match example.company).

Reported-by: @katiekloss @boretom
Ref: https://github.com/acmesh-official/acme.sh/issues/2305

neil

2026-07-10 10:23:59 +08:00

bed15ba844

Docker: update crontab used (#7111 )

Signed-off-by: invario <67800603+invario@users.noreply.github.com>

invario

2026-07-10 10:10:44 +08:00

1324dcd472

Add creoline API as DNS provider (#7100 )

* New Banner

Updated README to include responsive images for dark and light modes.

* acme-sh-creoline-as-dns-provider

* acme-sh-creoline-as-dns-provider - Review changes implemented according code review

* acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron

* acme-sh-creoline-as-dns-provider - Remove debug code

* acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>

2026-07-10 10:07:12 +08:00

cf3eab95ee

issue.yml: match tracking issue title variants

neil

2026-07-10 10:02:59 +08:00

ca118be754

Merge pull request #7026 from Marvo2011/dev

Update SelfHost DNS provider

Marvo2011

2026-07-06 21:30:13 +08:00

b1b539695f

Merge pull request #7096 from acmesh-official/dev

one-click revert and ban

neil

2026-07-06 17:40:51 +08:00

347cc207cd

one-click revert and ban

neil

2026-07-06 17:39:56 +08:00

cc64a73230

Merge pull request #7095 from acmesh-official/dev

sync

neil

2026-07-06 16:37:03 +08:00

1651a5a609

add more events

neil

2026-07-06 16:36:16 +08:00

f2b37b32ff

clean

neil

2026-07-06 16:30:41 +08:00

73df21abc4

Merge pull request #7094 from acmesh-official/dev

wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org…

neil

2026-07-06 16:28:12 +08:00

0c76c1f211

wiki-guard: use WIKI_GUARD_TOKEN (PAT with read:org) to enumerate org write members

neil

2026-07-06 16:27:26 +08:00

919492df13

Merge pull request #7092 from acmesh-official/dev

wiki-guard: log the number of write-access members loaded

neil

2026-07-06 15:24:23 +08:00

e00d3cfde3

wiki-guard: log the number of write-access members loaded

neil

2026-07-06 15:23:45 +08:00

e4eaa59063

Merge pull request #7091 from acmesh-official/dev

wiki-guard: trust repo/org members with write access in all rule checks

neil

2026-07-06 15:12:22 +08:00

4187ec23c1