6679 Commits

This Branch

This Branch

All Branches

• fix(gcore_cdn): renew login api url (#5143)

  https://api.gcore.com/docs/iam#tag/Account

  xiaopc 2026-07-04 20:14:32 +08:00
  843a7efa7d
• fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

  _contains matches with grep regex, so the '*' in "DNS:*.example.com," never
  matched and the subject was appended to the identifiers a second time.
  Escape the wildcard before the check, the same way the sed removal already does.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5251

  neil 2026-07-04 19:56:37 +08:00
  d3e12694b9
• _date2time: pass date via argv to python to prevent code injection (#6463)

  https://github.com/acmesh-official/acme.sh/issues/6463

  neil 2026-07-04 19:14:36 +08:00
  a105126063
• dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

  The DNS endpoint and IAM token scope project were hardcoded to
  ap-southeast-1, which fails for accounts without that region enabled.
  
  fix https://github.com/acmesh-official/acme.sh/issues/5302

  neil 2026-07-04 19:06:46 +08:00
  917bebd460
• Allow creation of ACME account with EAB directly from --issue command (#5087)

  * formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue
  
  * Update acme.sh
  
  * Update acme.sh

  Clément Gouin 2026-07-04 18:54:07 +08:00
  33704fc274
• haproxy.sh: use two-argument -header form for LibreSSL (#3438)
  neil 2026-07-04 18:50:29 +08:00
  bcbfe25d08
• deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

  fix https://github.com/acmesh-official/acme.sh/issues/6115

  neil 2026-07-04 18:46:59 +08:00
  bbfb6f50ae
• dns_da: document that special characters in DA_Api credentials must be percent-encoded

  https://github.com/acmesh-official/acme.sh/issues/3468

  neil 2026-07-04 18:19:45 +08:00
  6df2d9e451
• https://github.com/acmesh-official/acme.sh/issues/3201
  neil 2026-07-04 16:55:49 +08:00
  1a36823461
• Add Calrissia.be API (#6811)

  Co-authored-by: Ward <ward.hus@calrissia.com>

  wardhusandWard 2026-07-04 16:54:05 +08:00
  8f2a476d21
• ARI - Add support for Mass Revocation (#6953)

  * ARI - Add support for Mass Revocation
  
  * feat: update ARI each time NextRenewTime is not within the suggestedWindow
  
  * Remove _ari_should_renew and add condition on Le_NextRenewTime
  
  * Add support for ARI explanationURL
  
  * Fix debug variable _d_ari
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * multiple fix
  
  * fix
  
  * fix shfmt
  
  * Reset README
  
  ---------
  
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  Simon V.andZeroSSL-Andreas 2026-07-04 16:50:55 +08:00
  e64529ab50
• fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895
  neil 2026-07-04 11:44:32 +08:00
  7653eaab31
• extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326)
  neil 2026-07-04 11:23:11 +08:00
  6cd0c00a21
• fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977)
  neil 2026-07-04 10:49:32 +08:00
  b4de9e8621
• fix https://github.com/acmesh-official/acme.sh/issues/6388
  neil 2026-07-04 00:39:52 +08:00
  0a6abaf8a1
• haproxy.sh: allows certificate deployment to multiple hosts (#5180)

  * haproxy.sh: allows certificate deployment to multiple hosts
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  * Update deploy/haproxy.sh
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>
  
  ---------
  
  Co-authored-by: Matt Simerson <matt@tnpi.net>

  Laurent GrawetandMatt Simerson 2026-07-04 00:35:02 +08:00
  f4dc9fd9d1
• Fix typo in synology_dsm.sh (#6406)

  Fix typo in an error message.

  Artur Klauser 2026-07-04 00:32:45 +08:00
  2229330c48
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-04 00:06:26 +08:00
  0df051577c
• fix https://github.com/acmesh-official/acme.sh/issues/6609
  neil 2026-07-03 23:55:23 +08:00
  7fb40f0ccf
• dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272
  neil 2026-07-03 23:44:22 +08:00
  780f2ad5dc
• dns_aws: Fix invalid domain logging: _error => _err (#6430)

  acme.sh defines _err, not _error.

  szakharchenko 2026-07-03 23:40:39 +08:00
  adf69c4e7e
• dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487
  neil 2026-07-03 23:34:27 +08:00
  ac5624536b
• fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477
  neil 2026-07-03 23:34:27 +08:00
  b974bbd6d6
• dev_mythic_beasts: Fix header name: Accepts => Accept (#6428)
  szakharchenko 2026-07-03 23:25:38 +08:00
  0ce8c24736
• dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491
  neil 2026-07-03 23:02:35 +08:00
  20254cbaf0
• dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517
  neil 2026-07-03 22:49:40 +08:00
  f4d2db64ef
• Suppress 'signal process started' message when nginx config is restored (related to issue #4995) (#6747)
  Trekky12 2026-07-03 22:31:31 +08:00
  61400500e2
• forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163
  neil 2026-07-03 22:26:50 +08:00
  92a1b47108
• forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572
  neil 2026-07-03 21:55:37 +08:00
  5038d12d62
• Merge pull request #6720 from magyarsz/dev

  Fix a logical error in the `renew` function

  magyarsz 2026-07-03 21:42:52 +08:00
  7e7c0ee984
• fix https://github.com/acmesh-official/acme.sh/issues/6914
  neil 2026-07-03 20:07:42 +08:00
  92bd80c07d
• fix https://github.com/acmesh-official/acme.sh/issues/6917
  neil 2026-07-03 20:04:32 +08:00
  ad99628e50
• fix https://github.com/acmesh-official/acme.sh/issues/6963
  neil 2026-07-03 19:38:42 +08:00
  eabd23a551
• fix https://github.com/acmesh-official/acme.sh/issues/7009
  neil 2026-07-03 19:38:21 +08:00
  1241649501
• fix https://github.com/acmesh-official/acme.sh/issues/4756
  neil 2026-07-03 19:01:10 +08:00
  9900adb007
• New Banner

  Updated README to include responsive images for dark and light modes.

  ZeroSSL-Andreas 2026-07-03 18:33:44 +08:00
  01d6d46914
• fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077)

  _normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
  any positional argument. dns_czechia_add() called it as
  `_normalizeJson "$_res"`, so the response was discarded and the inner
  sed blocked reading from stdin.
  
  When issuing for a single domain, or for a record that already exists,
  the "already exists" branch returns early and never reaches this call,
  which is why the bug stayed hidden. With multiple domains, the first
  record often short-circuits on "already exists" while the next,
  freshly-added record reaches the broken call and hangs on interactive
  runs (or consumes unrelated stdin non-interactively).
  
  Pipe the response into _normalizeJson via stdin, matching
  dns_czechia_rm() and every other dnsapi plugin.
  
  Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

  CZECHIA-COMandClaude Opus 4.8 2026-07-03 18:12:25 +08:00
  f038958192
• feat: Add Volcano Engine DNS API (#7069)

  * feat: add volcengine dns api
  
  * fix(volcengine): address review findings and fix record matching
  
  Code review fixes:
  - fix format string usage in signature computation (use printf %b / %s)
  - clear _H1.._H5 header state at start of request to avoid leaking
    conditionally-set headers into subsequent requests
  - check ListZones return status in _get_root
  - document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
  - fix Docs and Issues sections
  - remove and update some code comments
  
  Functional fixes:
  - stop matching ListRecords results by FQDN string: Volcengine lowercases
    the Host/FQDN in responses, so a case-sensitive compare against
    $fulldomain failed for mixed-case names, making rm silently skip
    deletion and add lose idempotency. ListRecords is already filtered by
    ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
    result instead.
  - reset _record_id at the start of add/rm to avoid stale state leaking
    across calls within the same process
  - tag created records with Remark "acme.sh" for easier identification
  - adjust debug levels: hide Authorization header behind _debug2, surface
    response at _debug
  
  Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: wenxuan70 <t736660416@gmail.com>
  Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

  3 people 2026-07-03 10:09:32 +00:00
  fdf528c26c
• ARI - Run cron job more frequently (#6939)

  * ARI - Run cron job more frequently
  
  With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
  "For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."
  
  More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.
  
  * Fix cron job schedule for certificate renewal
  
  * Fix random_hour syntax in cron job installation
  
  * Update Windows task scheduler to run more frequently
  
  Add support for randomized hour and update frequency
  
  Ref:
  * [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
  * [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)
  
  * Add padding for StartTime (/ST) in SCHTASKS.exe
  
  * New Banner
  
  Updated README to include responsive images for dark and light modes.
  
  * rebase
  
  * Reset README
  
  ---------
  
  Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

  Simon V.andZeroSSL-Andreas 2026-07-03 15:12:32 +08:00
  ced8d72808
• fix https://github.com/acmesh-official/acme.sh/issues/6400
  neil 2026-07-02 23:30:56 +08:00
  116c05fbff
• fix https://github.com/acmesh-official/acme.sh/issues/6851
  neil 2026-07-02 23:18:26 +08:00
  42e13fa797
• fix https://github.com/acmesh-official/acme.sh/issues/6986
  neil 2026-07-02 23:15:41 +08:00
  ccd2f04c33
• DNS_IONOS double sending content type & case sensitive mismatch (#7028)

  * double sending content type results in error from ionos
  
  * Normalize fulldomain to lowercase in the _ionos_get_record function.

  MarFri 2026-07-02 23:08:59 +08:00
  a50fad865f
• Add Glesys dnsapi provider (#7059)

  * Add Glesys dnsapi provider
  
  * Fix typo in error message for dns_glesys_add
  
  * Use API to get record id in Glesys provider
  
  * Use listrecords API endpoint to find root domain
  
  * Remove record id parsin from add function

  Toni Karppi 2026-07-02 13:10:29 +08:00
  5433ea86c8
• fix https://github.com/acmesh-official/acme.sh/issues/7062
  neil 2026-07-02 13:09:59 +08:00
  e52d75d762
• Implemented support for Aruba Business DNS API (#7042)

  * Add support for arubabusiness api
  
  * Fix formatting
  
  * record names are always converted to lowercase
  
  * Docs
  
  * remove leftover unconditional authentication call
  lowercase
  urlencoded body + x-www-form-urlencoded content-type
  cleanup header variables
  cleanup typos
  grammar
  
  * Strengthen _ab_rest failure checks
  Properly process parallel lists in _ab_dns_record_id
  Remove hard fails when a txt record already exists
  
  * fix json parsing
  
  * Fix formatting
  
  ---------
  
  Co-authored-by: Manwe-Sulimo <blarghonaut@gmail.com>

  Manwe SulimoandManwe-Sulimo 2026-07-02 13:06:41 +08:00
  cb40b47a4e
• fix(dns_baidu): prefer new Baidu DNS API with legacy BCD fallback (#6992)

  * fix(acme): prefer new Baidu DNS API with legacy BCD fallback
  
  Keep the existing BCD implementation and add fallback support for the newer Baidu DNS record API. Prefer the new API by default, then fall back to the legacy BCD API to reduce compatibility risk.
  
  * fix(dns_baidu): route through _get/_post + restore legacy BCD auth headers
  
  Per review: _baidu_dns_call now uses _get/_post with _H1.._H5 (no raw curl, no __HTTP_STATUS__ parsing); _baidu_bcd_post restores _H1.._H5 so the legacy BCD path sends the Authorization signature again (fixes 401).
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>

  pxMan79andneil 2026-07-02 13:02:30 +08:00
  b039ff3087
• dns_inwx: fix IDN zone detection without python dependency (#7056)

  * dns_inwx: fix IDN zone detection without python dependency
  
  INWX returns zone names in Unicode form (e.g. lünenschloß.de) even when
  the domain was registered as an IDN. When acme.sh passes the SAN in
  punycode (xn--lnenschlo-o1a42a.de), _contains never matches and
  _get_root falls through to the TLD, placing the TXT record in the wrong
  zone.
  
  Previous fix used python3 which is not available in all environments
  (BusyBox, BSD, minimal containers). Replace with _idn()-based approach:
  extract <string> values from the nameserver.list XML response, encode
  each via _idn(), and compare to $h. When a match is found, use the
  original Unicode zone name for createRecord.
  
  Fixes #7038
  
  * dns_inwx: fix shebang, use _egrep_o, shfmt cleanup
  
  - Revert shebang to #!/usr/bin/env sh (POSIX sh, fixes ShellCheck)
  - Replace grep -o with _egrep_o for portability
  - shfmt -i 2: drop backslash continuation after pipe, fix indentation
  
  Requested by @neilpang
  
  * fix: drop closing </string> from _egrep_o pattern to avoid sed delimiter collision
  
  ---------
  
  Co-authored-by: bluenenschloss <bernd.luenenschloss@7p-group.com>

  bluenenschlossandbluenenschloss 2026-07-02 13:00:49 +08:00
  c83eed4994
• fix https://github.com/acmesh-official/acme.sh/issues/6498
  neil 2026-07-01 21:59:41 +08:00
  81100db2f3
• fix
  neil 2026-07-01 21:33:24 +08:00
  a7ccfcf91d