acme.sh

notify/aws_ses: add container/instance IAM role auth (IMDSv2)

aws_ses_send calls `_use_container_role || _use_instance_role` when no
static AWS keys are set, but those functions were never defined -- only
_use_metadata was -- so role-based auth silently fell through to the
"no api key" error. Add both, using the current IMDSv2-capable versions
from dns_aws.sh, and set the IMDSv2 token header in _use_metadata so the
credential fetch works on IMDSv2-only instances.

Closes #4742

neil

2026-07-05 17:09:51 +08:00

934711e51d

dns_regru: require a dot boundary in root zone matching

_get_root matched a registered domain anywhere as a substring of the
challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
account, issuing for subtest.com.ru wrongly picked test.com.ru as the
root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
boundary so a shorter domain no longer matches a longer subdomain label.

Fixes the issue reported in #5036 (thanks @koledas)
Closes #5036

neil

2026-07-05 16:57:59 +08:00

7def43481a

dnsapi/dns_namecom: probe the root zone with GetDomain instead of listing all domains

The domain list is paginated at 1000 entries per page and only the
first page was fetched, so accounts with more than 1000 domains never
found the root zone.

fix https://github.com/acmesh-official/acme.sh/issues/5051

neil

2026-07-05 16:53:14 +08:00

defd64022d

_regAccount: error out clearly when the eab-hmac-key cannot be base64-decoded

An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
signature that the CA rejects with 403.

https://github.com/acmesh-official/acme.sh/issues/4082

neil

2026-07-05 16:32:57 +08:00

4256e3532b

add Apache workflow to test the --apache mode

Runs le_test_apache from acmetest against Pebble, with Apache
listening on Pebble's HTTP-01 validation port.

neil

2026-07-05 16:31:51 +08:00

1f94fd7fd5

deploy/docker: allow setting key file mode and owner in the container

The docker deploy hook copied the key file preserving the source mode
(root:root 0600), so a non-root container service (uid >= 1000) could not
read it. Add DEPLOY_DOCKER_CONTAINER_KEY_MODE and
DEPLOY_DOCKER_CONTAINER_KEY_OWNER, applied via chmod/chown inside the
container after the key is copied and before the reload command.

Closes #5333

neil

2026-07-05 16:30:46 +08:00

507baff2ef

dnsapi/dns_autodns: escape XML special characters in credentials (#5317 )

neil

2026-07-05 16:29:58 +08:00

504540e67c

add Nginx workflow to test the --nginx mode

Runs le_test_nginx from acmetest against Pebble: nginx listens on
Pebble's HTTP-01 validation port with an aaPanel/BT style
"location ^~ /" reverse proxy block, the regression case of #6125.

neil

2026-07-05 16:18:37 +08:00

cacafc9c23

Add dns_muumuu: muumuu-domain.com DNS API (#7012 )

* Add dns_muumuu: muumuu-domain.com DNS API

* Fix: remove local keyword for POSIX sh compatibility

* Fix: lowercase fulldomain for API compatibility

* Style: use echo instead of printf for lower_case (consistent with other plugins)

* Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL

laineus

2026-07-05 16:05:33 +08:00

24895a15c8

_createcsr: omit CN from the CSR subject when it exceeds 64 characters (#4867 )

neil

2026-07-05 16:02:52 +08:00

1cd63e1480

DNS.yml: fix workflow warnings

- replace deprecated set-output with GITHUB_OUTPUT
- untap aws/tap before brew install to silence tap trust warning
- inject safe.directory=* for cygwin git so the checkout post step
  no longer fails with dubious ownership (exit 128)

neil

2026-07-05 15:51:38 +08:00

31b13caf8b

deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

dash's echo has no -e flag and sends a literal "-e " prefix to the
socket, so haproxy rejects the command and the hot update always fails
on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
which haproxy replies when an uncommitted transaction already exists.

fix https://github.com/acmesh-official/acme.sh/issues/6165

neil

2026-07-05 15:44:26 +08:00

1e2cd50fc9

Add WEDOS WAPI DNS API (dns_wedos) (#7072 )

* Add WEDOS WAPI DNS API (dns_wedos)

* dns_wedos: fix response parsing on systems without egrep -o

* dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

Jan Forman

2026-07-05 12:44:07 +08:00

524d96a3a8

dns_desec: fix advertised token variable name (#7081 )

This must've been a copy-paste error from `dns_ddnss`.

Fixes: 6b7b5caf54 ("DNS provider API: structured description")

Foster Snowhill

2026-07-05 12:03:48 +08:00

0eb5cc8384

fix CSR reading on systems without a default openssl.cnf (e.g. NetBSD)

"openssl req -noout -in" aborts when the default config file is missing;
reading a CSR needs no config, so pass -config /dev/null explicitly.

Stock NetBSD does not install /etc/openssl/openssl.cnf, so --signcsr
never worked there.

neil

2026-07-04 23:55:16 +08:00

77047eb0ef

renewAll: error out if CERT_HOME is not a directory

With a misconfigured $HOME / CERT_HOME the glob over "$CERT_HOME"/*.*
matches nothing, so renewAll silently does nothing and returns success --
--renew-all / --cron appears to work while renewing no certificates.
Check that CERT_HOME is a directory up front and return 1 with a clear
error instead.

Closes #4508

neil

2026-07-04 23:40:31 +08:00

4978782fb8

dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804

neil

2026-07-04 21:58:57 +08:00

9764f67619

_isIPv4: do not glob segments, require exactly 4 octets

The unquoted splitting let a "*" segment expand against files in the
current directory, so "*.*.*.*" could pass as a valid IPv4 address
(issue 4971). The old code also accepted "", "1.2.3", "1.2.3.4.5",
"1..2.3" and bare numbers. Split with IFS under set -f, require 4
octets, and validate each as a 1-3 digit number <= 255.

Based on https://github.com/acmesh-official/acme.sh/pull/4974
fix https://github.com/acmesh-official/acme.sh/issues/4971

neil

2026-07-04 21:34:46 +08:00

988afd0f59

add application/json to acmedns (#5066 )

Ramon

2026-07-04 21:07:18 +08:00

b92516f79e

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix(gcore_cdn): renew login api url (#5143 )

https://api.gcore.com/docs/iam#tag/Account

xiaopc

2026-07-04 20:14:32 +08:00

843a7efa7d

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

haproxy.sh: use two-argument -header form for LibreSSL (#3438 )

neil

2026-07-04 18:50:29 +08:00

bcbfe25d08

deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

fix https://github.com/acmesh-official/acme.sh/issues/6115

neil

2026-07-04 18:46:59 +08:00

bbfb6f50ae

dns_da: document that special characters in DA_Api credentials must be percent-encoded

https://github.com/acmesh-official/acme.sh/issues/3468

neil

2026-07-04 18:19:45 +08:00

6df2d9e451

https://github.com/acmesh-official/acme.sh/issues/3201

neil

2026-07-04 16:55:49 +08:00

1a36823461

Add Calrissia.be API (#6811 )

Co-authored-by: Ward <ward.hus@calrissia.com>

wardhusandWard

2026-07-04 16:54:05 +08:00

8f2a476d21

ARI - Add support for Mass Revocation (#6953 )

* ARI - Add support for Mass Revocation

* feat: update ARI each time NextRenewTime is not within the suggestedWindow

* Remove _ari_should_renew and add condition on Le_NextRenewTime

* Add support for ARI explanationURL

* Fix debug variable _d_ari

* New Banner

Updated README to include responsive images for dark and light modes.

* multiple fix

* fix

* fix shfmt

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-04 16:50:55 +08:00

e64529ab50

fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895

neil

2026-07-04 11:44:32 +08:00

7653eaab31

extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326 )

neil

2026-07-04 11:23:11 +08:00

6cd0c00a21

fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977 )

neil

2026-07-04 10:49:32 +08:00

b4de9e8621

fix https://github.com/acmesh-official/acme.sh/issues/6388

neil

2026-07-04 00:39:52 +08:00

0a6abaf8a1

haproxy.sh: allows certificate deployment to multiple hosts (#5180 )

* haproxy.sh: allows certificate deployment to multiple hosts

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

---------

Co-authored-by: Matt Simerson <matt@tnpi.net>

Laurent GrawetandMatt Simerson

2026-07-04 00:35:02 +08:00

f4dc9fd9d1