acme.sh

Merge pull request #7132 from acmesh-official/dev

sync

neil

2026-07-17 10:01:37 +08:00

3.1.4 3661fd86b6

minor

neil

2026-07-16 20:09:10 +08:00

745a42f193

fix https://github.com/acmesh-official/acme.sh/issues/1940#issuecomment-4971257867

neil

2026-07-15 20:41:35 +08:00

3faf65c46d

Merge pull request #7126 from acmesh-official/dev

sync

neil

2026-07-14 22:35:07 +08:00

7cc16cd09a

valid-to: allow a negative --days to set the renewal margin

A negative --days is anchored to the expiry, so it composes with a
relative --valid-to: "--valid-to +30d --days -7" renews 7 days before
the expiry instead of the hardcoded 1 day. A positive --days and any
--days with a fixed-date --valid-to are still rejected.

https://github.com/acmesh-official/acme.sh/issues/6570

neil

2026-07-14 21:12:55 +08:00

1dbabf0da9

fix(dns_oci): read ~/.oci/config before cached account.conf values (#7124 )

The OCI DNS plugin cached the tenancy, user, region and signing key into
acme.sh's account.conf at issuance and then, on subsequent runs, read those
cached values before consulting ~/.oci/config. A value cached at issuance
therefore permanently shadowed the config file, so editing ~/.oci/config
afterwards (most visibly rotating the API signing key) had no effect and
renewals kept using stale credentials, failing authentication.

Resolve each field in the order: explicit environment variable, then
~/.oci/config when it exists, then the cached account.conf value as a
fallback for env-only installs that have no config file. The signing key
likewise prefers the key_file resolved from the environment or ~/.oci/config
over any cached key.

Signed-off-by: Avi Miller <me@dje.li>

Avi Miller

2026-07-14 20:58:47 +08:00

2499ee1ab9

Deploy certificate to FortiGate firewall using API (#6236 )

* Deploy certificate to FortiGate firewall using API

* Refactor FortiGate deployment functions

Prefix private functions and working variables and use a timestamped certificate name.

* Replace grep -o for POSIX compatibility

NotAnotherHelloWorld

2026-07-14 09:02:34 +08:00

1a746d98b8

challenge: use portable [{] literal-brace in _egrep_o patterns (#968 )

_egrep_o falls back to a BRE sed expression on shells without egrep -o
(Solaris, DD-WRT busybox). A bare "\{" there is a BRE interval operator
and aborts ("sed: command garbled" / "Invalid content of \{\}"), so the
challenge-status-invalid path extracted an empty error object and the
CA's failure reason was lost. Replace the escaped braces with "[{]"/"[}]"
bracket expressions, unambiguous literal braces in both BRE and ERE, at
all four call sites (challenge type/error extraction and profiles).

neil

2026-07-13 11:59:35 +08:00

4558a8aa98

account: keep restored ACCOUNT_URL in the EAB-already-bound path

When re-registering an already-bound EAB account (HTTP 400 "not
awaiting external account binding"), the else branch restored
ACCOUNT_URL from ca.conf but the following unconditional
`export ACCOUNT_URL="$_accUri"` clobbered it with an empty _accUri
(never set on that path), so later signed requests failed with
"A Key ID MUST be specified" / "account URL is empty". Assign the
restored value to _accUri so the shared export uses it.
https://github.com/acmesh-official/acme.sh/issues/3382

neil

2026-07-13 10:43:08 +08:00

1a54307dbf

dns_infomaniak: log zones response and fail early in _get_zone

The sed in _get_zone passed the raw JSON through when the response
contained no [{"fqdn":", so an API error turned the zone into "{" and
the failure only surfaced later as POST /2/zones/{/records
"method_not_found". Log the response at debug2, error out on
non-success results, and parse fqdn position-independently.

https://github.com/acmesh-official/acme.sh/issues/6851

neil

2026-07-13 08:30:43 +08:00

020123d812

installcronjob: Solaris grep takes only one -e, use separate greps

The "no crontab" whitelist used multiple -e patterns, but Solaris
/usr/bin/grep honors only a single -e, so a fresh install was
refused there. Use one plain grep per message pattern, which every
grep implementation supports (caught by le_test_installcronjob_no_wipe
on the Solaris CI).

neil

2026-07-12 22:28:56 +08:00

17964cfd6e

fix

neil

2026-07-12 20:18:36 +08:00

d621d6952a

dns_knot: add KNOT_ZONE for delegated subdomain zones

The zone cannot be derived from the record name when the Knot server
is only authoritative for a delegated subdomain; let the user name it
explicitly, like NSUPDATE_ZONE.

fixes https://github.com/acmesh-official/acme.sh/issues/2881

neil

2026-07-12 19:22:03 +08:00

5e33e9f5f1

dns_dynu: use mutable conf storage so newly exported credentials win

Same stale-account.conf override as dns_dnsimple: the sourced plain
copy shadowed newly exported Dynu_ClientId/Dynu_Secret.

https://github.com/acmesh-official/acme.sh/issues/3216

neil

2026-07-12 19:21:56 +08:00

3fddea2962

dns_dnsimple: use mutable conf storage so a newly exported token wins

The legacy plain _saveaccountconf copy in account.conf is sourced at
startup and silently overrides a newly exported DNSimple_OAUTH_TOKEN,
so rotated tokens never took effect.

fixes https://github.com/acmesh-official/acme.sh/issues/3422

neil

2026-07-12 19:21:48 +08:00

a6766d4186

installcronjob: never wipe existing cron jobs when crontab -l fails

Piping a failed 'crontab -l' straight back into 'crontab -' replaced
the whole crontab with just the acme.sh entry when the listing failed
while jobs existed (seen on cPanel/CloudLinux jailshell). Capture the
listing first and refuse to write unless the failure is the normal
"no crontab for user" case.

https://github.com/acmesh-official/acme.sh/issues/3079

neil

2026-07-12 19:21:40 +08:00

b9ce911eb1

update-account: persist the new email into the CA conf

"--update-account -m new@example.com" updated the contact on the CA but
never saved it locally, so CA_EMAIL kept showing the old address on
every later run. Save it in the success path like _regAccount does.

https://github.com/acmesh-official/acme.sh/issues/4673

neil

2026-07-12 17:34:37 +08:00

15a1067f1b

dns_ali: convert IDN domains to punycode

The Aliyun API only accepts punycode domain names, and a raw UTF-8
domain also breaks the request signature. Same _idn pattern as
dns_namecom.

https://github.com/acmesh-official/acme.sh/issues/4733

neil

2026-07-12 17:21:19 +08:00

447dc3c7e7

fix: dnsexit api rejects a TTL of zero, changed to 1 (minute) (#7107 )

Kat Crichton-Seager

2026-07-12 16:37:21 +08:00

5a8c685fd3

dns_ovh specific permission for record removal (#6386 )

Co-authored-by: amk <amk@medlin.mikus.sk>

amk1969andamk

2026-07-12 16:21:00 +08:00

dd6540ce46

Add Baidu Cloud CDN deploy hook (#6951 )

* add Baidu Cloud CDN deploy hook

Code generated by GitHub Copilot with Claude Sonnet 4.6. Tested with local environment by human.

* inline functions

Code generated by OpenAI Codex with GPT-5.5 Sol. Tested with local environment by human.

Steven Qiu

2026-07-12 16:15:59 +08:00

cd486cfbb9

Matthiasvpfr patch 1 (#7108 )

* Add files via upload

* New Banner

Updated README to include responsive images for dark and light modes.

* Add files via upload

Remove usage of jq and curl
should be compliant with acme.sh api dev guide

* Add files via upload

* Add files via upload

change CR LF to LF

* Add files via upload

missing CR

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct auth

* Add files via upload

better manage group_id

* Add files via upload

manage wrong / missing domain

* Add files via upload

strip domain to manage subdomain requests

* Add files via upload

fix wrong id selection in get root

* Add files via upload

fix parsing of IDs

* Add files via upload

correct get_root to better handle unexisting domaines (acmetest)

* Add files via upload

correct token incorrect in auth

* Add files via upload

manage case web api reply is empty

* Add files via upload

try to resolve error when adding unexisting subdmain txt entry

* Add files via upload

correct domain parsing

* Add files via upload

revert changes when adding record (name)
change rm to better handle complex urls

* Add files via upload

correct rm function to better manage records deletion

* Add files via upload

ensure auth variable arent lost during calls

* Add files via upload

try to keep autj variables accross executions

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

fix stripping subdomains

* Add files via upload

* Add files via upload

keep auth token instead of requesting it each time

* Add files via upload

debug

* Add files via upload

* Add files via upload

* Add files via upload

better manage record deletion to avoid orphans
added some debug and checks

* Add files via upload

paginated api support for rm function

* Add files via upload

* Add files via upload

delay to manage api 404

* Add files via upload

enhance parsing of records in rm

* Add files via upload

fix incorrect record detection in rm

* Add files via upload

better manage filters on api to limit errors

* Add files via upload

try to handle 404 when requesting API too frequently

* Add files via upload

* Add files via upload

sleep during auth

* Add files via upload

manage 404 errors in get_root

* Add files via upload

correct variable overide
translate comments
prefix all variables

* Add files via upload

correct variable

* Add files via upload

typo

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct variable naming (_comlaude prefix missing)
correct rm return code when non existing record
typo

* Add files via upload

log an info instead of an error if no dns record found in RM function.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: Matthiasvpfr <matthias.dupont@vetpartners.fr>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

2026-07-12 16:13:42 +08:00

e828b285ad

Merge pull request #7114 from achmadalifn4/master

Add notify waha support

ACHMAD ALIF NASRULLOH

2026-07-12 16:10:21 +08:00

f5e7e6b225

deploy/synology_dsm.sh: remove bashisms, keep the hook POSIX sh

The hook is sourced by acme.sh, so the bash shebang never takes
effect: under dash, `[ x == y ]` fails with "unexpected operator",
the 403 branch never triggers and 2FA-OTP login is skipped.
Replace `==` with `=` and use the standard sh shebang.

neil

2026-07-12 16:04:44 +08:00

ebb5cc4981

cpanel_uapi: don't spill a redirection error when the key file is absent

With --signcsr the private key never exists in the cert home, so every
renewal printed ".../domain.key: No such file or directory" from the
shell redirection. Skip the key read in that case; the install_ssl call
already ran with an empty key there and cPanel keeps the installed one.

https://github.com/acmesh-official/acme.sh/issues/6228

neil

2026-07-12 13:00:12 +08:00

3989eef5e2

dns_dynu: include the server response in the authentication error

Same as the dns_cloudns change: a bare "Authentication failed" hides
the actual API error and makes reports undiagnosable.

neil

2026-07-12 12:45:10 +08:00

2c51ac1c27

issue bot: tell reporters to redact secrets before posting logs

Debug logs occasionally contain private keys or tokens (issue 6267);
the code-side leak in the haproxy hook was fixed by #6268, this adds
the missing warning to the auto-comment that asks for logs.

neil

2026-07-12 12:32:54 +08:00

eacf0d6a87

dns_knot: KNOT_KEY takes the TSIG key data, not a file path

The knsupdate "key" statement wants "[alg:]name secret"; the info block
wrongly described the option as a file path.

https://github.com/acmesh-official/acme.sh/issues/6293

neil

2026-07-12 12:22:28 +08:00

099d88e6a9

issue: never schedule the default renewal past the cert expiry

The default schedule was a fixed CertCreateTime + RenewalDays - 1 day,
which passes notAfter entirely for short-lived certs (internal CAs
today, the CA/B SC-081 47-day maximum later) and leaves an expired cert
in place for weeks. Extract the arithmetic into _calc_next_renew_time
and cap it at one day before expiry (one hour for lifetimes of 24h or
less, mirroring --valid-to scheduling). CAs with ARI are unaffected --
the ARI window still overrides afterwards.

https://github.com/acmesh-official/acme.sh/issues/6305

neil

2026-07-12 12:12:18 +08:00

897e219743

workflows: run issue/wiki automation only in the upstream repo

neil

2026-07-12 11:49:53 +08:00

a9590c5bd7

wiki-guard: skip on forks (no <fork>.wiki repo to check out)

neil

2026-07-12 11:43:07 +08:00

c0d62eb934

notify: add the customscript hook

The wiki has documented "21. Set notification for customscript" since
2022 but the implementation (#4193) was never merged, so following the
wiki failed with "Cannot find the hook file". Same interface as
documented: the script gets subject, content and status code as three
arguments. Unlike #4193, the target script is invoked directly instead
of through eval -- the subject/content contain domain names and CA
messages, and eval would allow command injection through them.

https://github.com/acmesh-official/acme.sh/issues/6377

neil

2026-07-12 11:36:45 +08:00

44c045b056

dns_pdns: probe zones with the server-side name filter in _get_root

The unfiltered GET /zones lists every zone on the server; with large
installations (100k zones) root-zone detection took minutes per domain.
Probe each walk-up candidate with ?zone=<name> instead (exact match per
the PowerDNS API docs); servers that ignore the parameter return the
full list, which the existing check still handles.

https://github.com/acmesh-official/acme.sh/issues/6382

neil

2026-07-12 11:20:53 +08:00

e94631de44

mydevil: replace BSD-only cut -w with tr + plain cut

cut -w (split on whitespace) is a FreeBSD extension unknown to GNU
coreutils; squeeze blanks into tabs with tr first so the field
extraction is POSIX.

https://github.com/acmesh-official/acme.sh/issues/6452

neil

2026-07-12 10:49:49 +08:00

a49f8c1992

dns_zonomi: make the API endpoint configurable via ZM_Api

RimuHosting (which owns zonomi) exposes the identical API at
https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
both providers with one hook. The default stays zonomi.com and is not
written to the account conf.

https://github.com/acmesh-official/acme.sh/issues/6475

neil

2026-07-12 10:26:40 +08:00

7d0283ca2c

Merge pull request #7119 from acmesh-official/dev

sync

neil

2026-07-12 10:11:32 +08:00

3e64b5e6f5

dns_cpanel: quote inner expansion in suffix strip (SC2295)

neil

2026-07-12 09:35:22 +08:00

76811857a0

dns_cloudns: include the server response in the login error

https://github.com/acmesh-official/acme.sh/issues/6520

neil

2026-07-12 09:34:59 +08:00

22a5ae3ceb

precheck: log the socat recommendation with _info instead of _err

Missing socat only matters for standalone mode; the text even says the
warning can be ignored. Printing it to stderr made every --upgrade in a
cron noisy for DNS-only users who redirect stdout.

https://github.com/acmesh-official/acme.sh/issues/6525

neil

2026-07-12 09:30:46 +08:00

04e0422526

notify: clear inherited _H1.._H5 before running each notify hook

The dns/deploy hooks export _H1.._H5 in the main process, and the
notify hooks run in a subshell that inherits them. A hook that does
not overwrite every slot (ntfy without NTFY_TOKEN, slack, telegram,
etc.) sent the stale headers with its request, leaking another
service's Authorization credentials to the notify endpoint.

https://github.com/acmesh-official/acme.sh/issues/6801

neil

2026-07-11 11:56:58 +08:00

2215f1b988

dns_cpanel: resolve the most specific zone in _get_root

With both domain.tld and sub.domain.tld zones on the account, the first
endswith hit could pick the parent zone while cPanel stores the record
in the most specific one, so the cleanup never found the record and
left an orphaned _acme-challenge TXT entry. Pick the longest matching
zone with an exact literal suffix match (_endswith treats the needle as
a regex, letting xdomain.tld wrongly match zone domain.tld).

https://github.com/acmesh-official/acme.sh/issues/6807

neil

2026-07-11 11:42:32 +08:00

9366c2e065

Microwavenby dns hostinger (#6843 )

* [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com

* [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled

* [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?

* [Microwavenby-dns-hostinger] Responding to comments from Neil

* [dns-hostinger] SHfmt and Shellcheck

* [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

Sasha Reid

2026-07-11 10:04:49 +08:00

2e4acba105

Fix name.com DNS API for processing IDNs (#4381 )

Mike Lei

2026-07-10 21:56:54 +08:00

fef90e15e1

Feature: Support other shells then sh (#4877 )

* Add support for DEPLOY_SSH_REMOTE_SHELL

* allow to configure quoting of  remote cmd string

* shell check and shellfmt fixes

Roman Lumetsberger

2026-07-10 21:02:06 +08:00

50e5e771d5

dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999 )

Getting client_id failed due to incorrect extraction!

At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
{"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

CV

2026-07-10 20:55:23 +08:00

ebde8345ae

dns_njalla.sh: accept string record ids when removing records

The Njalla API returns record ids as JSON strings now; the numeric-only
pattern matched nothing, so the removal never found the record id.
Match both quoted and bare ids.

from https://github.com/acmesh-official/acme.sh/pull/5121

neil

2026-07-10 20:47:31 +08:00

58cd667d65

2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171 )

Andrew V.

2026-07-10 20:36:42 +08:00

98c30912fb

acme.sh: fix variable name typo _excapedAlgnames -> _escapedAltnames

from https://github.com/acmesh-official/acme.sh/pull/6547

neil

2026-07-10 19:37:36 +08:00

2058a77d83

deploy/synology_dsm.sh: use grep -Eo '[0-9]+' when extracting error codes

grep -o '[0-9]*' can match the empty string; GNU grep skips empty
matches but BSD greps handle them differently, breaking the 2FA
login flow on OpenBSD. Force a non-empty match at all three sites.

from https://github.com/acmesh-official/acme.sh/pull/6725

neil

2026-07-10 18:37:32 +08:00

660a5e322c

Fix typo (#6924 )

Jan Pieper

2026-07-10 14:42:57 +08:00

2af543a358