6833 Commits

This Branch

This Branch

All Branches

• dns_jd: upgrade to JD Cloud v2 API (#7207)
  skysaint 2026-08-30 15:33:32 +08:00
  c6cd844986
• dns_easydns: match the TXT record by its rdata when removing (#7199)

  dns_easydns_rm() picked the first id in the search response and ignored
  $txtvalue. When two challenge records exist under the same host - for
  example when example.com and *.example.com are issued as separate
  certificates - a concurrent run's record could be deleted instead of
  our own.
  
  Select the record by its rdata instead, following the dns_cf.sh
  convention of matching name + value. tr '{' '\n' puts one record per
  line, so both _egrep_o branches - egrep -o and the BRE sed fallback -
  return the same single id. Without it the sed fallback would return
  only the last match, since .* is greedy.
  
  An empty record_id is now treated as "nothing to remove" and returns 0,
  rather than being reported as an error.
  
  Also add the credential check that _rm was missing. It deliberately
  does not call _saveaccountconf_mutable, as _add already does that.
  
  Co-authored-by: wurzelpanzer <wurzelpanzer@maximolider.net>

  wurzelpanzerandwurzelpanzer 2026-08-22 10:15:52 +08:00
  ef7b2d3c2e
• Merge pull request #5194 from flesniak/myloc

  Add dnsapi script for myloc.de/webtropia.com

  Fabian Lesniak 2026-08-22 10:13:58 +08:00
  b481ffb81b
• installcronjob: match the stale cron path without grep -F
  neil 2026-08-20 08:40:49 +08:00
  b1a8eb1c95
• fix cronjob
  neil 2026-08-19 22:50:03 +08:00
  e0c0297ba3
• deploy/unifios: document UniFi OS hardware support, not just self-hosted

  The certificate REST API this hook drives is UniFi OS's own, not
  specific to the self-hosted UniFi OS Server: user reports confirm it on
  a UDM Pro (UniFi OS 5.1.26) and a UCG Fiber (5.0.16). Reframe the scope
  around the endpoint rather than the product line, state that the choice
  between unifi and unifios is local/SSH file access vs remote REST API,
  and note that the management port is 11443 on UniFi OS Server but 443
  on hardware, so DEPLOY_UNIFIOS_HOST must be set there.

  neil 2026-08-17 13:42:10 +08:00
  1cbd223386
• fix https://github.com/acmesh-official/acme.sh/issues/7195#issuecomment-5281002963
  neil 2026-08-14 12:15:15 +08:00
  5180911929
• Mirror the tag object, not the commit, in vtag.yml

  The v-prefixed mirror was created from github.sha, so for an annotated or
  signed tag it would point at the commit and drop the signature: "git
  verify-tag v3.1.3" fails with "cannot verify a non-tag object of type
  commit" while "git verify-tag 3.1.3" succeeds. Resolve refs/tags/<tag>
  and mirror whatever object it points at instead, which keeps the current
  behaviour for lightweight tags. Also move the workflow expressions into
  env instead of interpolating them into the shell command.

  neil 2026-08-14 11:53:43 +08:00
  5ff7f0a4e7
• Add UniFi OS Server deploy hook (#7184)

  * Add UniFi OS Server deploy hook
  
  Uses UniFi OS Server's local REST API (login, list, upload, activate,
  remove superseded) since it stores certificates in its own Postgres
  database rather than flat config files, unlike the Cloud Key/UDM
  hardware covered by the existing unifi deploy hook. Tested against
  real instances on both macOS and Ubuntu 26.04 (self-hosted, remote).
  
  * Address review: portable sed/grep, scoped HTTPS_INSECURE, fingerprint matching
  
  - Replace GNU-only \n in sed replacement with a portable literal newline
    (matches dnsapi/dns_cpanel_uapi.sh, dnsapi/dns_glesys.sh); pipe the
    list response through _normalizeJson first for consistent formatting.
  - Use grep -F for the domain-name match instead of an unescaped BRE --
    a wildcard cert name (*.example.com) broke the regex.
  - Drop \W (undocumented, GNU-only) from the cookie lookup in favor of
    an anchored `^Set-Cookie: *NAME=` match.
  - Scope HTTPS_INSECURE=1 inside the hook (matches deploy/proxmoxve.sh,
    deploy/fritzbox.sh) instead of requiring the caller to export it for
    the whole acme.sh run, which would also disable verification for the
    connection to the ACME CA.
  - On a duplicate-certificate response, match the existing entry by
    fingerprint instead of taking the first name match -- with more than
    one stale entry for a domain, the wrong one could get activated.
  - Check the list endpoint's response code before proceeding.
  - Save username/password with the "base64" flag (matches
    deploy/synology_dsm.sh) since _save_conf wraps values in unescaped
    single quotes.
  
  * Rework certificate handling: unique names per upload, drop cleanup
  
  Testing against a real UniFi OS Server showed the server enforces name
  uniqueness independently of fingerprint uniqueness, and that activation is
  exclusive server-wide regardless of name/domain. A unique name per upload
  avoids the name-collision path entirely (previously only handled as a
  retry-of-identical-content edge case), and removes the need for the
  post-hoc cleanup loop, which risked deleting the wrong entry.
  
  Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
  
  * Shorten generated certificate name to Unix epoch seconds
  
  Real-hardware testing showed the UniFi OS Server certificate list's name
  column is fixed-width and doesn't wrap, so a full human-readable timestamp
  overlaps the Expires column and makes both unreadable. Epoch seconds are
  still short enough to fit while remaining unique.
  
  Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
  
  * Add scoped cleanup of old certificate entries, use _time helper
  
  Per review: dropping cleanup entirely went further than the original bug
  required, and left old entries (each holding a private key) accumulating
  indefinitely. Since every upload now gets a name unique to its domain and
  run, cleanup can safely target only entries whose name starts with that
  domain -- entries this hook itself created -- excluding the one just
  activated. Also swaps date +%s for the core _time helper, and rewrote the
  design comments to make them clearer and match the current behavior
  instead of the pre-redesign one.
  
  Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
  
  ---------
  
  Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

  PabloandClaude Sonnet 5 2026-08-13 14:57:44 +08:00
  41bdd4cd0e
• add deploy hook support for ikuai (#6456)

  * add deploy hook support for ikuai
  
  * fix shellcheck warn and shfmt the code
  
  * 1.fix config load 2.use _secre_debug2 to log password 3.use fullchain to deploy 4.fix hardcode id 5.change shebang
  
  * fix miss ; after cookie
  
  * 1.fix shfmt ; 2.fix IKUAI_CERT_ID conf load; 3.correct IKUAI_CERT_ID description
  
  * fix some log msg
  
  * fix shfmt

  XuChao 2026-08-13 14:52:48 +08:00
  a89ba9c2e5
• Remove deprecated Linode API v3 DNS plugin (#7054)

  Signed-off-by: Zhiwei Liang <zhiwei.liang@zliang.me>

  Zhiwei Liang 2026-08-12 22:47:58 +08:00
  2e2782f0d8
• Fix dns_netcup reporting a bogus 4013 instead of the real zone error

  The zone lookup walked the challenge name from the right and ended up
  asking netcup for the full "_acme-challenge.<domain>" as a zone name.
  That can never be a zone, so netcup answered 4013 "Validation Error",
  which replaced the real 5028 "The zone <domain> could not be found" as
  the error shown to the user.
  
  Stop one label short of the full name, and fail explicitly when no zone
  matched, reporting the last API response plus what to check. Before, a
  run where every candidate returned 5028 fell through to logout and
  returned success.

  neil 2026-08-10 10:00:26 +08:00
  4a3bc2c919
• Listen on both IPv4 and IPv6 in standalone mode by default

  socat binds a single family unless told which one: up to 1.7.x the
  default IP version for TCP-LISTEN is 4, and 1.8.0 made it "no
  preference", which resolves to whatever getaddrinfo and bindv6only
  happen to give. So an order carrying both an IPv4 and an IPv6
  identifier could never pass both http-01 challenges.
  
  Bind one socket per family instead, with ipv6only on the IPv6 one so
  the two do not collide. IPv4-mapped IPv6 addresses are not a portable
  alternative, OpenBSD does not support them at all. The IPv6 listener
  is best effort, a host without IPv6 still gets the IPv4 one. The
  python fallback does the same. --listen-v4 and --listen-v6 keep
  forcing a single family, and passing both now means both.
  
  Le_Listen_V4 and Le_Listen_V6 were mutually exclusive in the domain
  conf, which silently dropped one of them on renewal, and
  _starttlsserver let -4 win when both were set.
  
  Fixes #7185

  neil 2026-08-08 13:09:30 +08:00
  05367d3598
• feat: added nexdns dnsapi (#7170)

  * feat: added nexdns dnsapi
  
  Adds a DNS-01 hook for NexDNS, an authoritative DNS service with a REST API.
  
  dns_nexdns_add walks the label list to find the zone that owns the challenge
  name and creates the TXT record in it. dns_nexdns_rm lists the TXT records at
  that name, picks the one carrying exactly this challenge value and deletes it
  by id, so a wildcard and its base domain do not remove each other's record.
  
  A 429 is waited out and the request retried, in the shape dns_hetznercloud.sh
  and dns_bunny.sh already use.
  
  * dns_nexdns: cap the rate-limit wait, judge success by status, add the tracking issue

  Alexey Morozov 2026-08-07 09:22:28 +08:00
  f1cbba05f6
• Fix dns_namecheap ignoring IsOurDNS when matching the root zone

  _get_root_by_getList() matched the candidate suffix as an unanchored
  substring of the whole domains.getList response and never looked at the
  IsOurDNS attribute. A domain parked on Namecheap's webhosting DNS is
  listed with IsOurDNS="false", yet it was still accepted as the root zone,
  so _get_root() returned success and the domains.dns.getHosts probe that
  would have found the real zone never ran. Every following getHosts call
  was then refused with error 2030288 "not using proper DNS servers" and
  the challenge failed with "invalid tld".
  
  Match the exact <Domain Name="..."> entry instead and require
  IsOurDNS="true", so a subdomain delegated to Namecheap BasicDNS/FreeDNS
  under a parent that is not on Namecheap DNS now resolves to its own zone.
  Matching the entry exactly also drops the old substring/regex match, in
  which the dots of a domain matched any character.
  
  Fixes #7178

  neil 2026-08-06 19:36:26 +08:00
  f67be78ff4
• Fix multideploy MULTIDEPLOY_FILENAME conf read and allow an absolute path

  _getdeployconf assigns and exports the variable, it does not print the
  value, so wrapping it in a command substitution ran it in a subshell and
  always yielded an empty string. A MULTIDEPLOY_FILENAME saved by an
  earlier run was therefore never restored on renewal and the hook
  silently fell back to multideploy.yml. Call it the same way every other
  deploy hook does.
  
  Also treat a MULTIDEPLOY_FILENAME starting with '/' as an absolute path
  instead of always resolving it under DOMAIN_PATH, so one deploy file can
  live outside the certificate directory and be shared by all domains.
  Names without a leading '/' keep resolving under DOMAIN_PATH as before.

  neil 2026-08-05 23:01:54 +08:00
  9aad4dcbd5
• Fix synology_dsm logging out after the temp admin is already deleted

  _temp_admin_cleanup ran before _logout, so the logout request carried
  the session id of an account synouser had already removed and DSM kept
  the orphaned entry in Connected Users. Swap the order in both terminal
  branches, and add the missing _logout to the two post-login error paths
  (CRT list failure, certificate not found without SYNO_CREATE).
  
  _logout overwrites the global $response, so the upload-failure branch
  prints its error message before calling it.
  
  Reported by @Bertl75 in #7174

  neil 2026-08-05 19:56:13 +08:00
  603a126a7c
• Fix empty finalize URL when resuming a saved DNS-manual order

  The decision to resume a pending order is keyed on Le_Vlist, but the
  decision to keep Le_OrderFinalize/Le_LinkOrder was keyed on the webroot
  being exactly "dns". Any other webroot with a saved Le_Vlist skipped
  newOrder and then finalized against an empty URL.
  
  Key both on Le_Vlist, and always clear Le_LinkCert, which is per-run
  state that is never read back from the saved domain conf.
  
  Fixes #7177

  neil 2026-08-05 19:53:52 +08:00
  5e6c263211
• Fix dns_cyon cleanup failing on FreeBSD

  _cyon_delete_txt relied on `printf "%b"` to convert a sed-injected literal
  `\n` into a real newline, but `%b` also processes the `\"` escapes that the
  JSON response is full of. glibc/bash/dash keep the backslash of such an
  undefined escape, FreeBSD's printf (sh builtin and /usr/bin/printf alike)
  drops it -- so `data-hash=\"..\"` became `data-hash=".."`, the extraction
  regex matched nothing, _dns_entries stayed empty and no TXT record was ever
  deleted.
  
  Drop the newline injection and use _egrep_o, which already yields one match
  per line, then parse each line with sed.
  
  Also feed the read loop a newline-terminated list: `printf "%s"` left the
  last line unterminated, so `read` returned non-zero at EOF and the loop
  skipped the final entry on every platform.
  
  Verified identical output on FreeBSD 14.3, Linux/bash and Linux/dash.
  
  Fixes #7169

  neil 2026-08-02 21:55:52 +08:00
  b4925052dd
• Fix --make-dns-persist-value printing a wildcard TXT record name

  For -d '*.example.com' the printed record name kept the literal '*' label
  (_validation-persist.*.example.com). The CA never queries that name, so
  issuance fails with "No TXT record found for DNS-PERSIST-01 challenge".
  
  Per draft-ietf-acme-dns-persist-01 sec 4 and 10.2 the record is published at
  the base domain's Validation Domain Name; the wildcard scope comes from
  'policy=wildcard' in the record value (sec 5.1), not from a '*' label in the
  record name. Strip the leading "*." in a new _dns_persist_txt_name helper,
  and imply --dns-persist-wildcard for a wildcard -d, since without
  policy=wildcard the printed record can never authorize the wildcard.
  
  Fixes #7168

  neil 2026-08-02 21:47:51 +08:00
  ea5e70564d
• Refactor dns_freemyip.sh for enhanced compatibility (#7166)

  * Refactor dns_freemyip.sh for clarity and compatibility
  
  Updated dns_freemyip.sh for better readability and compatibility with ASUSWRT-Merlin. Improved error handling and response logging.
  
  * Update author information in dns_freemyip.sh
  
  * replace both loops with POSIX shell counters
  
  replace both loops with POSIX shell counters
  
  * Typo
  
  Typo
  
  * Fix error message for freemyip API request failure
  
  Remove existing token leak. Not my regression.
  
  * Refactor retry logic and improve error handling
  
  * Remove unnecessary blank lines in dns_freemyip.sh
  
  * Clean up dns_freemyip.sh by removing blank lines
  
  Removed unnecessary blank lines in the script to improve readability.

  Joel Samson 2026-08-02 21:34:41 +08:00
  bf90b845b2
• dns_yc: fix TXT record removal failing with "Unknown key file format" (#7150)

  * dns_yc: restore YC_SA_Key_File in dns_yc_rm before signing the JWT
  
  dns_yc_rm() never rebuilt YC_SA_Key_File from YC_SA_Key_File_PEM_b64 /
  YC_SA_Key_File_Path like dns_yc_add() does. Per the DNS API dev guide,
  add()/rm() run in separate subshells, so rm() must repeat add()'s setup
  steps rather than rely on variables set during add().
  
  Without it, when _yc_login() needs a fresh JWT during removal (the IAM
  token from the add phase isn't available), it signs with an empty/unset
  key path, and openssl fails with "Unknown key file format". The
  resulting auth failure then surfaces misleadingly as "invalid domain" in
  _get_root, and the TXT record is never deleted.
  
  Verified against a real Yandex Cloud account/zone with --staging: before
  the fix, removal failed with the same errors reported in the issue;
  after adding the missing key-restoration block, add + remove both
  succeed and the TXT record is actually deleted.
  
  * dns_yc: preserve other TXT values when removing one at the same name
  
  dns_yc_rm previously sent the full current data array (all existing
  TXT values at the name) to the deletions API, wiping out the whole
  rrset instead of only the value being removed. This breaks wildcard +
  base domain issuance, where both share the same _acme-challenge name
  with two different values: removing the first one deleted both,
  leaving nothing for the second removal to find.
  
  * dns_yc: read persisted config from domain conf before account conf
  
  YC_Zone_ID, YC_Folder_ID, YC_SA_ID, YC_SA_Key_ID (zone-ID mode) and
  YC_SA_Key_File_PEM_b64/Path were always saved via _savedomainconf
  (domain.conf), but only ever read back via _readaccountconf_mutable
  (account.conf). Once the env vars were unset, none of these could be
  recovered from the saved config, so dns_yc_add/dns_yc_rm failed with
  "You didn't specify a YC_SA_ID or YC_SA_Key_ID or YC_SA_Key_File."
  even though the values had been persisted correctly on the prior run.
  
  * dns_yc: replace grep -Fxv/sed with a portable loop in dns_yc_rm
  
  Solaris's /usr/bin/grep supports neither -F nor -x, so
  _remaining_txtvalue was always empty there and the preserve-other-
  values logic silently fell back to deleting the whole rrset (with a
  grep usage error on stderr on every rm). The sed trailing-comma strip
  had a matching issue on Solaris, whose sed drops an unterminated last
  line. CI didn't catch this because the fallback path also returns
  "done: true". Use a plain for-loop with word splitting instead.
  
  * dns_yc: use upsertRecordSets.deletions to remove a single TXT value
  
  updateRecordSets has no "merges" field (only deletions/additions), so
  the previous preserve-other-values logic silently did nothing -- the
  TXT record was never actually removed, a regression from before that
  change (which at least deleted the whole rrset). CI didn't catch it
  because _clearupdns runs dns_yc_rm in a subshell and ignores its exit
  code.
  
  upsertRecordSets.deletions removes only the specified value from the
  rrset directly, so the getRecordSet read and the remaining-value
  recomputation are no longer needed at all.
  
  Verified against a real zone (base + wildcard domain sharing one
  _acme-challenge name): adding both values then removing one leaves
  the other in place, and removing the second cleans up fully.
  
  * dns_yc: don't delete the user's own key file in YC_SA_Key_File_Path mode
  
  _yc_login unconditionally rm'd $YC_SA_Key_File after signing. That's
  fine for the PEM_b64 path, where it's a decoded temp file, but in
  YC_SA_Key_File_Path mode it's the user's own persistent key file --
  the first successful login permanently deleted it, so every
  subsequent dns_yc_rm/renewal hit "Unknown key file format" (the exact
  symptom this PR is about, just from a different cause). Track whether
  the key file is our own temp copy and only delete it in that case.
  
  Verified with a stubbed _yc_login: a temp-mode key gets removed after
  login, a path-mode key survives.
  
  * dns_yc: clear both domain and account conf on invalid config
  
  The failure branch in dns_yc_add only ever called _clearaccountconf,
  but YC_Zone_ID/YC_Folder_ID/YC_SA_Key_File_PEM_b64/Path are persisted
  via _savedomainconf, and YC_SA_ID/YC_SA_Key_ID may have been saved via
  _saveaccountconf_mutable (Folder_ID mode, which stores under a
  SAVED_ prefix read back by _readaccountconf_mutable). Clearing only
  one store left stale values behind in whichever one wasn't touched.
  
  Verified by seeding both domain.conf and account.conf with leftover
  values, then triggering this branch and confirming both config files
  end up empty.

  Goncharenko Alexander 2026-07-28 10:04:20 +08:00
  0565443622
• add OpenEuler
  neil 2026-07-26 15:01:41 +08:00
  057c940895
• fix: grep -A is not portable, breaks ARI on Solaris

  Solaris /usr/bin/grep has no -A ("illegal option -- A"), so _getAKI
  printed an error to stderr on every cron renewal and returned empty.
  The empty AKI silently corrupts the RFC 9773 ARI certID, so ARI is
  never available and renewal falls back to the fixed schedule.
  
  Split the pipeline into a testable stdin filter _extractAKI and select
  the value line with a portable sed range instead.
  
  Same fix for the two hooks that still used grep -A: dns_world4you.sh
  (also replaces the GNU-only "\s" in the same expression) and
  deploy/keyhelp.sh (the -A 2 window could truncate the div range that
  follows it, so it is just dropped).
  
  https://github.com/acmesh-official/acme.sh/issues/7159

  neil 2026-07-25 16:00:03 +08:00
  7c12deb7ef
• fix dns_yc: avoid empty-matchable _egrep_o pattern that hangs OmniOS

  OmniOS native egrep -o infinite-loops emitting empty lines when the
  pattern can match the empty string, so `_egrep_o "[^:]*$"` never lets
  the pipeline finish and dns_yc hangs until the CI timeout. Require at
  least one character instead. `+` is not usable because the sed fallback
  in _egrep_o parses BRE.

  neil 2026-07-25 13:34:06 +08:00
  830782fd1d
• Feat: Shelly deploy hook for firmware 2.0.0+ (#7145)

  * feat: add Shelly Gen3+ deploy hook with RFC 7616 HTTP Digest auth
  
  Adds deploy/shelly.sh for deploying Let's Encrypt HTTPS server certificates
  to Shelly Gen3+ devices (Gen4 tested) via JSON-RPC over HTTP.
  
  - RFC 7616 SHA-256 HTTP Digest authentication (Authorization header)
  - Uploads fullchain.pem and private key via Shelly.PutHTTPServerCert / PutHTTPServerKey
  - Auto-reboot support (SHELLY_REBOOT to disable)
  - Auth auto-detection: no password = no auth, password = Digest
  - Nonce counter (nc) increments per request per RFC 7616
  - Tested against Shelly 2PM Gen4 (firmware 2.0.0)
  
  Also adds deploy/test_shelly.sh for self-testing the hook logic without
  a real device (mocked _post).
  
  * fix: address review feedback on shelly deploy hook
  
  - Fix _secure_debug calls to use two arguments (label + value)
  - Remove bash-only $RANDOM cnonce fallback; openssl always available
  - Parse $HTTP_HEADER directly instead of raw curl re-request
  - Detect auth via HTTP 401 status line, not empty response body
  - Route reboot through _shelly_rpc to rebuild auth header with correct nc
  - Remove export HTTPS_INSECURE=1 (no-op for http://, leaks to other hooks)
  - Clear _H1 before returning from shelly_deploy
  - Prefix all helper variables with _shelly_ to avoid namespace collisions
  - Delete deploy/test_shelly.sh (deploy/ files become hook names)
  - Fix missing trailing newline
  
  * fix: validate shelly JSON-RPC responses are valid JSON
  
  Non-JSON responses like HTTP 429 'Too Many Requests' would pass
  the empty-response and '"error"' checks and be reported as success.
  Now reject any response that doesn't start with '{' and contain '"id"'.
  
  * fix: add 1s delay between shelly cert/key clear and upload calls
  
  The Shelly device has a race condition where uploading data immediately
  after clearing the existing cert/key returns -103 'Missing required
  argument data!'. A 1-second delay fixes this.
  
  * fix: remove clear-before-upload in shelly deploy hook
  
  Shelly auto-removes all three TLS files (cert, key, CA bundle) when any
  single one is cleared. The old sequence clear-cert → upload-cert →
  clear-key → upload-key resulted in the key clear wiping the newly
  uploaded cert, leaving only the key at boot time. The mbedtls
  pk_check_pair then silently skipped the HTTPS listener.
  
  Fix: just upload directly (overwrite in place). No clearing needed.
  
  * Fix ShellCheck SC2090 and shfmt in shelly deploy hook
  
  SC2090: false positive on export _H1 (used quoted in _post)
  shfmt: no space after "<" in _json_encode redirects
  
  * moved  two lines to cover the whole if block
  
  ---------
  
  Co-authored-by: neil <github@neilpang.com>
  Co-authored-by: cysimons <cysimons@cisco.com>

  3 people 2026-07-25 13:03:56 +08:00
  698f6c7329
• feat: added realtoxmedia dnsapi (#7156)
  Alec Höfler 2026-07-24 13:55:17 +08:00
  749fa2487e
• Merge pull request #7140 from radumalica/dns_hestiacp

  feat: add dnsapi for HestiaCP

  Radu 2026-07-23 11:50:20 +08:00
  24d573b6d3
• add GNU hurd
  neil 2026-07-22 20:42:14 +08:00
  1774d838ca
• fix proxmoxve/proxmoxbs deploy: fail on non-2xx API response

  The success check only grepped "message" from the response body, but
  PVE/PBS auth failures return HTTP 401 with an empty body, so wrong or
  unauthorized API tokens were reported as "Certificate successfully
  deployed". Also _retval captured the exit code of the message pipeline
  instead of _post. Check the HTTP status line from $HTTP_HEADER and
  capture _post's exit code directly.
  
  fix https://github.com/acmesh-official/acme.sh/issues/7141

  neil 2026-07-20 10:02:54 +08:00
  4c8a143086
• fix cpanel_uapi: pass --user to DomainInfo list_domains when run as root

  The auto mode sitelist query was missing the --user branch that the
  install_ssl calls already have, so deploy always failed under root.
  fix https://github.com/acmesh-official/acme.sh/issues/7139

  neil 2026-07-19 10:20:58 +08:00
  6feb1df83c
• add cache-after-prepare: true
  neil 2026-07-18 09:32:26 +08:00
  97c5aca136
• feat: add ACME_PACKAGED for distro-packaged installs

  When ACME_PACKAGED is set (e.g. exported by a distro package wrapper):
  - --install does not copy the script or the hooks into LE_WORKING_DIR;
    the cron job and the shell alias point to the packaged script instead
  - --upgrade, --install-online and the cron AUTO_UPGRADE path refuse and
    point to the system package manager
  - --uninstall does not remove the packaged files
  
  https://github.com/acmesh-official/acme.sh/issues/7135

  neil 2026-07-17 22:03:14 +08:00
  7fa3018219
• Merge pull request #7128 from achmadalifn4/master

  Fix Notify Waha

  neil 2026-07-17 21:58:41 +08:00
  9bfcf2cf1a
• fix bug for solaris.

  dnsapi/deploy: remove POSIX character classes from sed/grep patterns
  
  Solaris /usr/bin/sed and /usr/bin/grep parse [[:space:]] etc. as a
  literal bracket set and silently mis-match. Replace with [ ]* for
  JSON matching, a printf-tab bracket for user-input trimming, and
  [0-9] for digits; also drop GNU-only sed -r/-E in rage4, selfhost
  and selectel, and reuse _strip_blank_lines in byteplus_alb.

  neil 2026-07-17 12:38:14 +08:00
  59a97d7f8b
• start 3.1.5
  neil 2026-07-17 10:10:07 +08:00
  a836e747d1
• minor
  neil 2026-07-16 20:09:10 +08:00
  745a42f193
• Merge branch 'acmesh-official:master' into master
  ACHMAD ALIF NASRULLOH 2026-07-16 11:29:49 +07:00
  8f98786d93
• Add newline at end of waha.sh

  Fix missing newline at end of file.

  ACHMAD ALIF NASRULLOH 2026-07-16 11:29:39 +07:00
  6d559ae69f
• Merge branch 'dev' into master
  ACHMAD ALIF NASRULLOH 2026-07-16 11:27:57 +07:00
  24501ac0ca
• fix(notify): remove duplicate Content-Type header in waha hook
  Achmad Alif Nasrulloh 2026-07-16 11:23:18 +07:00
  a82cf763cf
• fix https://github.com/acmesh-official/acme.sh/issues/1940#issuecomment-4971257867
  neil 2026-07-15 20:41:35 +08:00
  3faf65c46d
• Merge pull request #7126 from acmesh-official/dev

  sync

  neil 2026-07-14 22:35:07 +08:00
  7cc16cd09a
• valid-to: allow a negative --days to set the renewal margin

  A negative --days is anchored to the expiry, so it composes with a
  relative --valid-to: "--valid-to +30d --days -7" renews 7 days before
  the expiry instead of the hardcoded 1 day. A positive --days and any
  --days with a fixed-date --valid-to are still rejected.
  
  https://github.com/acmesh-official/acme.sh/issues/6570

  neil 2026-07-14 21:12:55 +08:00
  1dbabf0da9
• fix(dns_oci): read ~/.oci/config before cached account.conf values (#7124)

  The OCI DNS plugin cached the tenancy, user, region and signing key into
  acme.sh's account.conf at issuance and then, on subsequent runs, read those
  cached values before consulting ~/.oci/config. A value cached at issuance
  therefore permanently shadowed the config file, so editing ~/.oci/config
  afterwards (most visibly rotating the API signing key) had no effect and
  renewals kept using stale credentials, failing authentication.
  
  Resolve each field in the order: explicit environment variable, then
  ~/.oci/config when it exists, then the cached account.conf value as a
  fallback for env-only installs that have no config file. The signing key
  likewise prefers the key_file resolved from the environment or ~/.oci/config
  over any cached key.
  
  Signed-off-by: Avi Miller <me@dje.li>

  Avi Miller 2026-07-14 20:58:47 +08:00
  2499ee1ab9
• Deploy certificate to FortiGate firewall using API (#6236)

  * Deploy certificate to FortiGate firewall using API
  
  * Refactor FortiGate deployment functions
  
  Prefix private functions and working variables and use a timestamped certificate name.
  
  * Replace grep -o for POSIX compatibility

  NotAnotherHelloWorld 2026-07-14 09:02:34 +08:00
  1a746d98b8
• challenge: use portable [{] literal-brace in _egrep_o patterns (#968)

  _egrep_o falls back to a BRE sed expression on shells without egrep -o
  (Solaris, DD-WRT busybox). A bare "\{" there is a BRE interval operator
  and aborts ("sed: command garbled" / "Invalid content of \{\}"), so the
  challenge-status-invalid path extracted an empty error object and the
  CA's failure reason was lost. Replace the escaped braces with "[{]"/"[}]"
  bracket expressions, unambiguous literal braces in both BRE and ERE, at
  all four call sites (challenge type/error extraction and profiles).

  neil 2026-07-13 11:59:35 +08:00
  4558a8aa98
• account: keep restored ACCOUNT_URL in the EAB-already-bound path

  When re-registering an already-bound EAB account (HTTP 400 "not
  awaiting external account binding"), the else branch restored
  ACCOUNT_URL from ca.conf but the following unconditional
  `export ACCOUNT_URL="$_accUri"` clobbered it with an empty _accUri
  (never set on that path), so later signed requests failed with
  "A Key ID MUST be specified" / "account URL is empty". Assign the
  restored value to _accUri so the shared export uses it.
  https://github.com/acmesh-official/acme.sh/issues/3382

  neil 2026-07-13 10:43:08 +08:00
  1a54307dbf
• dns_infomaniak: log zones response and fail early in _get_zone

  The sed in _get_zone passed the raw JSON through when the response
  contained no [{"fqdn":", so an API error turned the zone into "{" and
  the failure only surfaced later as POST /2/zones/{/records
  "method_not_found". Log the response at debug2, error out on
  non-success results, and parse fqdn position-independently.
  
  https://github.com/acmesh-official/acme.sh/issues/6851

  neil 2026-07-13 08:30:43 +08:00
  020123d812
• installcronjob: Solaris grep takes only one -e, use separate greps

  The "no crontab" whitelist used multiple -e patterns, but Solaris
  /usr/bin/grep honors only a single -e, so a fresh install was
  refused there. Use one plain grep per message pattern, which every
  grep implementation supports (caught by le_test_installcronjob_no_wipe
  on the Solaris CI).

  neil 2026-07-12 22:28:56 +08:00
  17964cfd6e