acme.sh

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

Accept both 401 and 403 for deactivated account detection

RFC 8555 sec 7.3.6 requires 401 (Unauthorized) when a request is
signed by a deactivated account, which ZeroSSL follows, while
Boulder (Let's Encrypt) historically returns 403. Check both codes
in _regAccount and deactivateaccount.

fix https://github.com/acmesh-official/acme.sh/issues/5138

neil

2026-07-04 20:21:27 +08:00

ede9a86d46

fix(gcore_cdn): renew login api url (#5143 )

https://api.gcore.com/docs/iam#tag/Account

xiaopc

2026-07-04 20:14:32 +08:00

843a7efa7d

fix "identifiers are duplicated" when signing a CSR with a wildcard CN also present in SAN

_contains matches with grep regex, so the '*' in "DNS:*.example.com," never
matched and the subject was appended to the identifiers a second time.
Escape the wildcard before the check, the same way the sed removal already does.

fix https://github.com/acmesh-official/acme.sh/issues/5251

neil

2026-07-04 19:56:37 +08:00

d3e12694b9

_date2time: pass date via argv to python to prevent code injection (#6463 )

https://github.com/acmesh-official/acme.sh/issues/6463

neil

2026-07-04 19:14:36 +08:00

a105126063

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

Allow creation of ACME account with EAB directly from --issue command (#5087 )

* formalized _eab_id and _eab_kid and added EAB parameters to _regAccount on --issue

* Update acme.sh

* Update acme.sh

Clément Gouin

2026-07-04 18:54:07 +08:00

33704fc274

haproxy.sh: use two-argument -header form for LibreSSL (#3438 )

neil

2026-07-04 18:50:29 +08:00

bcbfe25d08

deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

fix https://github.com/acmesh-official/acme.sh/issues/6115

neil

2026-07-04 18:46:59 +08:00

bbfb6f50ae

dns_da: document that special characters in DA_Api credentials must be percent-encoded

https://github.com/acmesh-official/acme.sh/issues/3468

neil

2026-07-04 18:19:45 +08:00

6df2d9e451

https://github.com/acmesh-official/acme.sh/issues/3201

neil

2026-07-04 16:55:49 +08:00

1a36823461

Add Calrissia.be API (#6811 )

Co-authored-by: Ward <ward.hus@calrissia.com>

wardhusandWard

2026-07-04 16:54:05 +08:00

8f2a476d21

ARI - Add support for Mass Revocation (#6953 )

* ARI - Add support for Mass Revocation

* feat: update ARI each time NextRenewTime is not within the suggestedWindow

* Remove _ari_should_renew and add condition on Le_NextRenewTime

* Add support for ARI explanationURL

* Fix debug variable _d_ari

* New Banner

Updated README to include responsive images for dark and light modes.

* multiple fix

* fix

* fix shfmt

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-04 16:50:55 +08:00

e64529ab50

fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895

neil

2026-07-04 11:44:32 +08:00

7653eaab31

extract authorizations parsing into _authorizations_from_order, fix IPv6 urls (#6326 )

neil

2026-07-04 11:23:11 +08:00

6cd0c00a21

fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977 )

neil

2026-07-04 10:49:32 +08:00

b4de9e8621

fix https://github.com/acmesh-official/acme.sh/issues/6388

neil

2026-07-04 00:39:52 +08:00

0a6abaf8a1

haproxy.sh: allows certificate deployment to multiple hosts (#5180 )

* haproxy.sh: allows certificate deployment to multiple hosts

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

---------

Co-authored-by: Matt Simerson <matt@tnpi.net>

Laurent GrawetandMatt Simerson

2026-07-04 00:35:02 +08:00

f4dc9fd9d1

Fix typo in synology_dsm.sh (#6406 )

Fix typo in an error message.

Artur Klauser

2026-07-04 00:32:45 +08:00

2229330c48

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-04 00:06:26 +08:00

0df051577c

fix https://github.com/acmesh-official/acme.sh/issues/6609

neil

2026-07-03 23:55:23 +08:00

7fb40f0ccf

dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272

neil

2026-07-03 23:44:22 +08:00

780f2ad5dc

dns_aws: Fix invalid domain logging: _error => _err (#6430 )

acme.sh defines _err, not _error.

szakharchenko

2026-07-03 23:40:39 +08:00

adf69c4e7e

dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487

neil

2026-07-03 23:34:27 +08:00

ac5624536b

fix upgrade with a relative --home path https://github.com/acmesh-official/acme.sh/issues/6477

neil

2026-07-03 23:34:27 +08:00

b974bbd6d6

dev_mythic_beasts: Fix header name: Accepts => Accept (#6428 )

szakharchenko

2026-07-03 23:25:38 +08:00

0ce8c24736

dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491

neil

2026-07-03 23:02:35 +08:00

20254cbaf0

dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517

neil

2026-07-03 22:49:40 +08:00

f4d2db64ef

Suppress 'signal process started' message when nginx config is restored (related to issue #4995 ) (#6747 )

Trekky12

2026-07-03 22:31:31 +08:00

61400500e2

forbid spaces in the --home/--config-home path https://github.com/acmesh-official/acme.sh/issues/2163

neil

2026-07-03 22:26:50 +08:00

92a1b47108

forbid using --days together with --valid-to https://github.com/acmesh-official/acme.sh/pull/6572

neil

2026-07-03 21:55:37 +08:00

5038d12d62

Merge pull request #6720 from magyarsz/dev

Fix a logical error in the `renew` function

magyarsz

2026-07-03 21:42:52 +08:00

7e7c0ee984

fix https://github.com/acmesh-official/acme.sh/issues/6914

neil

2026-07-03 20:07:42 +08:00

92bd80c07d

fix https://github.com/acmesh-official/acme.sh/issues/6917

neil

2026-07-03 20:04:32 +08:00

ad99628e50

fix https://github.com/acmesh-official/acme.sh/issues/6963

neil

2026-07-03 19:38:42 +08:00

eabd23a551

fix https://github.com/acmesh-official/acme.sh/issues/7009

neil

2026-07-03 19:38:21 +08:00

1241649501

fix https://github.com/acmesh-official/acme.sh/issues/4756

neil

2026-07-03 19:01:10 +08:00

9900adb007

New Banner

Updated README to include responsive images for dark and light modes.

ZeroSSL-Andreas

2026-07-03 18:33:44 +08:00

01d6d46914

fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077 )

_normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
any positional argument. dns_czechia_add() called it as
`_normalizeJson "$_res"`, so the response was discarded and the inner
sed blocked reading from stdin.

When issuing for a single domain, or for a record that already exists,
the "already exists" branch returns early and never reaches this call,
which is why the bug stayed hidden. With multiple domains, the first
record often short-circuits on "already exists" while the next,
freshly-added record reaches the broken call and hangs on interactive
runs (or consumes unrelated stdin non-interactively).

Pipe the response into _normalizeJson via stdin, matching
dns_czechia_rm() and every other dnsapi plugin.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CZECHIA-COMandClaude Opus 4.8

2026-07-03 18:12:25 +08:00

f038958192

feat: Add Volcano Engine DNS API (#7069 )

* feat: add volcengine dns api

* fix(volcengine): address review findings and fix record matching

Code review fixes:
- fix format string usage in signature computation (use printf %b / %s)
- clear _H1.._H5 header state at start of request to avoid leaking
  conditionally-set headers into subsequent requests
- check ListZones return status in _get_root
- document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
- fix Docs and Issues sections
- remove and update some code comments

Functional fixes:
- stop matching ListRecords results by FQDN string: Volcengine lowercases
  the Host/FQDN in responses, so a case-sensitive compare against
  $fulldomain failed for mixed-case names, making rm silently skip
  deletion and add lose idempotency. ListRecords is already filtered by
  ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
  result instead.
- reset _record_id at the start of add/rm to avoid stale state leaking
  across calls within the same process
- tag created records with Remark "acme.sh" for easier identification
- adjust debug levels: hide Authorization header behind _debug2, surface
  response at _debug

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: wenxuan70 <t736660416@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 10:09:32 +00:00

fdf528c26c

ARI - Run cron job more frequently (#6939 )

* ARI - Run cron job more frequently

With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
"For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."

More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.

* Fix cron job schedule for certificate renewal

* Fix random_hour syntax in cron job installation

* Update Windows task scheduler to run more frequently

Add support for randomized hour and update frequency

Ref:
* [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
* [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)

* Add padding for StartTime (/ST) in SCHTASKS.exe

* New Banner

Updated README to include responsive images for dark and light modes.

* rebase

* Reset README

---------

Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

Simon V.andZeroSSL-Andreas

2026-07-03 15:12:32 +08:00

ced8d72808

fix https://github.com/acmesh-official/acme.sh/issues/6400

neil

2026-07-02 23:30:56 +08:00

116c05fbff

fix https://github.com/acmesh-official/acme.sh/issues/6851

neil

2026-07-02 23:18:26 +08:00

42e13fa797

fix https://github.com/acmesh-official/acme.sh/issues/6986

neil

2026-07-02 23:15:41 +08:00

ccd2f04c33

DNS_IONOS double sending content type & case sensitive mismatch (#7028 )

* double sending content type results in error from ionos

* Normalize fulldomain to lowercase in the _ionos_get_record function.

MarFri

2026-07-02 23:08:59 +08:00

a50fad865f

Add Glesys dnsapi provider (#7059 )

* Add Glesys dnsapi provider

* Fix typo in error message for dns_glesys_add

* Use API to get record id in Glesys provider

* Use listrecords API endpoint to find root domain

* Remove record id parsin from add function

Toni Karppi

2026-07-02 13:10:29 +08:00

5433ea86c8

fix https://github.com/acmesh-official/acme.sh/issues/7062

neil

2026-07-02 13:09:59 +08:00

e52d75d762

Implemented support for Aruba Business DNS API (#7042 )

* Add support for arubabusiness api

* Fix formatting

* record names are always converted to lowercase

* Docs

* remove leftover unconditional authentication call
lowercase
urlencoded body + x-www-form-urlencoded content-type
cleanup header variables
cleanup typos
grammar

* Strengthen _ab_rest failure checks
Properly process parallel lists in _ab_dns_record_id
Remove hard fails when a txt record already exists

* fix json parsing

* Fix formatting

---------

Co-authored-by: Manwe-Sulimo <blarghonaut@gmail.com>

Manwe SulimoandManwe-Sulimo

2026-07-02 13:06:41 +08:00

cb40b47a4e

fix(dns_baidu): prefer new Baidu DNS API with legacy BCD fallback (#6992 )

* fix(acme): prefer new Baidu DNS API with legacy BCD fallback

Keep the existing BCD implementation and add fallback support for the newer Baidu DNS record API. Prefer the new API by default, then fall back to the legacy BCD API to reduce compatibility risk.

* fix(dns_baidu): route through _get/_post + restore legacy BCD auth headers

Per review: _baidu_dns_call now uses _get/_post with _H1.._H5 (no raw curl, no __HTTP_STATUS__ parsing); _baidu_bcd_post restores _H1.._H5 so the legacy BCD path sends the Authorization signature again (fixes 401).

---------

Co-authored-by: neil <github@neilpang.com>

pxMan79andneil

2026-07-02 13:02:30 +08:00

b039ff3087

dns_inwx: fix IDN zone detection without python dependency (#7056 )

* dns_inwx: fix IDN zone detection without python dependency

INWX returns zone names in Unicode form (e.g. lünenschloß.de) even when
the domain was registered as an IDN. When acme.sh passes the SAN in
punycode (xn--lnenschlo-o1a42a.de), _contains never matches and
_get_root falls through to the TLD, placing the TXT record in the wrong
zone.

Previous fix used python3 which is not available in all environments
(BusyBox, BSD, minimal containers). Replace with _idn()-based approach:
extract <string> values from the nameserver.list XML response, encode
each via _idn(), and compare to $h. When a match is found, use the
original Unicode zone name for createRecord.

Fixes #7038

* dns_inwx: fix shebang, use _egrep_o, shfmt cleanup

- Revert shebang to #!/usr/bin/env sh (POSIX sh, fixes ShellCheck)
- Replace grep -o with _egrep_o for portability
- shfmt -i 2: drop backslash continuation after pipe, fix indentation

Requested by @neilpang

* fix: drop closing </string> from _egrep_o pattern to avoid sed delimiter collision

---------

Co-authored-by: bluenenschloss <bernd.luenenschloss@7p-group.com>

bluenenschlossandbluenenschloss

2026-07-02 13:00:49 +08:00

c83eed4994