acme.sh

Deploy certificate to FortiGate firewall using API (#6236 )

* Deploy certificate to FortiGate firewall using API

* Refactor FortiGate deployment functions

Prefix private functions and working variables and use a timestamped certificate name.

* Replace grep -o for POSIX compatibility

NotAnotherHelloWorld

2026-07-14 09:02:34 +08:00

1a746d98b8

Add Baidu Cloud CDN deploy hook (#6951 )

* add Baidu Cloud CDN deploy hook

Code generated by GitHub Copilot with Claude Sonnet 4.6. Tested with local environment by human.

* inline functions

Code generated by OpenAI Codex with GPT-5.5 Sol. Tested with local environment by human.

Steven Qiu

2026-07-12 16:15:59 +08:00

cd486cfbb9

deploy/synology_dsm.sh: remove bashisms, keep the hook POSIX sh

The hook is sourced by acme.sh, so the bash shebang never takes
effect: under dash, `[ x == y ]` fails with "unexpected operator",
the 403 branch never triggers and 2FA-OTP login is skipped.
Replace `==` with `=` and use the standard sh shebang.

neil

2026-07-12 16:04:44 +08:00

ebb5cc4981

cpanel_uapi: don't spill a redirection error when the key file is absent

With --signcsr the private key never exists in the cert home, so every
renewal printed ".../domain.key: No such file or directory" from the
shell redirection. Skip the key read in that case; the install_ssl call
already ran with an empty key there and cPanel keeps the installed one.

https://github.com/acmesh-official/acme.sh/issues/6228

neil

2026-07-12 13:00:12 +08:00

3989eef5e2

mydevil: replace BSD-only cut -w with tr + plain cut

cut -w (split on whitespace) is a FreeBSD extension unknown to GNU
coreutils; squeeze blanks into tabs with tr first so the field
extraction is POSIX.

https://github.com/acmesh-official/acme.sh/issues/6452

neil

2026-07-12 10:49:49 +08:00

a49f8c1992

Feature: Support other shells then sh (#4877 )

* Add support for DEPLOY_SSH_REMOTE_SHELL

* allow to configure quoting of  remote cmd string

* shell check and shellfmt fixes

Roman Lumetsberger

2026-07-10 21:02:06 +08:00

50e5e771d5

deploy/synology_dsm.sh: use grep -Eo '[0-9]+' when extracting error codes

grep -o '[0-9]*' can match the empty string; GNU grep skips empty
matches but BSD greps handle them differently, breaking the 2FA
login flow on OpenBSD. Force a non-empty match at all three sites.

from https://github.com/acmesh-official/acme.sh/pull/6725

neil

2026-07-10 18:37:32 +08:00

660a5e322c

Fix typo (#6924 )

Jan Pieper

2026-07-10 14:42:57 +08:00

2af543a358

Add _cleardeployconf to clear deploy hook keys from domain conf

Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
and the direct _cleardomainconf call in multideploy.sh.

Closes #4722. Thanks to @sg1888.

neil

2026-07-10 11:05:40 +08:00

45c0ad4112

deploy/ssh: return non-zero when a server deployment fails (#6795 )

ssh_deploy() ignored the result of _ssh_deploy and always returned
success, so a failed transfer to one (or all) of the servers in
DEPLOY_SSH_SERVER was silently swallowed. Track the return code across
the loop and return non-zero if any server failed, letting the caller
handle notification.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Oliver MuellerandClaude Opus 4.8

2026-07-06 10:11:58 +08:00

1f778e6ef1

deploy/panos: do not commit when the cert or key import failed (#4716 )

Committing after a failed import leaves a mismatched cert/key pair on
the firewall (PAN-OS does not validate the pair at commit time), which
can lock the admin out of the https management interface.

neil

2026-07-05 17:13:59 +08:00

d2b3772631

deploy/docker: allow setting key file mode and owner in the container

The docker deploy hook copied the key file preserving the source mode
(root:root 0600), so a non-root container service (uid >= 1000) could not
read it. Add DEPLOY_DOCKER_CONTAINER_KEY_MODE and
DEPLOY_DOCKER_CONTAINER_KEY_OWNER, applied via chmod/chown inside the
container after the key is copied and before the reload command.

Closes #5333

neil

2026-07-05 16:30:46 +08:00

507baff2ef

deploy/haproxy: use printf instead of "echo -e" for the stats socket payload

dash's echo has no -e flag and sends a literal "-e " prefix to the
socket, so haproxy rejects the command and the hot update always fails
on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
which haproxy replies when an uncommitted transaction already exists.

fix https://github.com/acmesh-official/acme.sh/issues/6165

neil

2026-07-05 15:44:26 +08:00

1e2cd50fc9

fix(gcore_cdn): renew login api url (#5143 )

https://api.gcore.com/docs/iam#tag/Account

xiaopc

2026-07-04 20:14:32 +08:00

843a7efa7d

haproxy.sh: use two-argument -header form for LibreSSL (#3438 )

neil

2026-07-04 18:50:29 +08:00

bcbfe25d08

deploy/cpanel_uapi: strip YAML double quotes around wildcard domains in list_domains output

fix https://github.com/acmesh-official/acme.sh/issues/6115

neil

2026-07-04 18:46:59 +08:00

bbfb6f50ae

https://github.com/acmesh-official/acme.sh/issues/3201

neil

2026-07-04 16:55:49 +08:00

1a36823461

fix docker deploy hook on podman, check exec ExitCode instead of response body (#4977 )

neil

2026-07-04 10:49:32 +08:00

b4de9e8621

haproxy.sh: allows certificate deployment to multiple hosts (#5180 )

* haproxy.sh: allows certificate deployment to multiple hosts

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

* Update deploy/haproxy.sh

Co-authored-by: Matt Simerson <matt@tnpi.net>

---------

Co-authored-by: Matt Simerson <matt@tnpi.net>

Laurent GrawetandMatt Simerson

2026-07-04 00:35:02 +08:00

f4dc9fd9d1

Fix typo in synology_dsm.sh (#6406 )

Fix typo in an error message.

Artur Klauser

2026-07-04 00:32:45 +08:00

2229330c48

Adding custom Port definitions for truenas (#7033 )

* closing bracket and adding port for customer installations

* adding savedeployconfig

* fixing shfmt

* changeing

---------

Co-authored-by: neil <github@neilpang.com>

SirNomad49andneil

2026-07-01 20:55:55 +08:00

0925d5c522

Fix RouterOS deploy (#7034 )

* routeros: save ROUTER_OS_ADDITIONAL_SERVICES as base64

* routeros: remove cer_3

SpeedGriffon

2026-06-19 14:23:03 +02:00

db098055de

Add deployment plugin for Windows RDP via OpenSSH (#6925 )

* Add deployment plugin for Windows RDP via OpenSSH

Curd Becker

2026-05-02 10:56:13 +02:00

355b121c79

Merge pull request #6889 from achmadalifn4/dev

Add BytePlus ALB deployment script

neil

2026-04-24 21:46:10 +02:00

d00b2722ee

Fix byteplus_alb.sh

Achmad Alif Nasrulloh

2026-04-24 11:21:43 +07:00

e9b0cafac5

fix: commit overhaul (#6915 )

- Removed scope exclusion for "standard commit".
  - If 'device-and-networks' is excluded (previous behaviour), a certificate for Panorama (always outside of a template) will not be committed (imported to the config but never applied to Panorama). Therefore, panos.sh was only working for certificates used in templates and applied to devices, but not for the Panorama certificate itself.
  - According to the official documentation and the XML API Browser, there is no 'policy-and-objects' that can be excluded.
  - Although it is not mandatory that the user account is solely dedicated to replace certificates and to perform no other type of operations, it is recommended. If such recommendation is applied, the only changes being committed would be in relation to certificates. Therefore, it should be safe not to exclude any scopes.
- Changed the order for "force commit" from '<commit><partial><force>' (unofficial) to '<commit><force><partial>' (official). Both work, but it is recommended to use what is part of the official documentation and/or XML API Browser.
- Removed unofficial 'policy-and-objects' from commented out code (see above).
- Replaced 'exclude' with 'excluded' from commented out code, as per the official documentation. Both work, but see above.
- Replaced 'acmekeytest' with $_panos_user in the commented out code.

Official documentation: https://docs.paloaltonetworks.com/ngfw/api/pan-os-xml-api-request-types-and-actions/commit
XML API Browser: https://<PANOS HOST>/api

Antoni Company

2026-04-20 11:28:17 +02:00

9882d534af

Add new header variable _H5 in byteplus_alb.sh

Added a new header variable _H5 to the byteplus_alb.sh script.

ACHMAD ALIF NASRULLOH

2026-04-14 21:04:48 +08:00

f89a9a5de3

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

00090d24b8

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

73a682e561

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

a1b94db94d

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

5c94af86f3

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

3843495397

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

a739bf3e3a

Update bteplus_alb.sh

Achmad Alif Nasrulloh

2026-04-14 21:04:48 +08:00

75642a1252

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

668427f285

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

d0e123cb02

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

8587c3e744

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

934870fc77

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

8eea7ca307

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

28f1f07f49

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

ad71a785ec

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

d5c8060a65

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

4178c33524

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

044371b00a

Update deploy/byteplus_alb.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

ACHMAD ALIF NASRULLOHandCopilot

2026-04-14 21:04:48 +08:00

86d98b0461

Add BytePlus ALB deployment script

This script deploys SSL/TLS certificates issued by acme.sh to BytePlus Application Load Balancer (ALB), supporting automatic renewal with zero-downtime certificate rotation.

ACHMAD ALIF NASRULLOH

2026-04-14 21:04:48 +08:00

6efd6d5b5a

Don't mark restart http as failed if json returns false because it was not restarted (#6906 )

Mitchell van Bijleveld

2026-04-14 20:37:50 +08:00

f3e61a8ef4

Update synology_dsm.sh (#6894 )

quote variable name so message isn't missing the variable that needs to be fixed.
this was reported in #2727  (feedback for hook)

Florian Heigl

2026-04-03 11:38:21 +08:00

ef49a9fd23

Merge pull request #6793 from ecm75/fix_kemplm

fixed checking for existing domain on loadmaster

neil

2026-02-23 19:37:06 +08:00

89c86efc56

Fixed missing error return value when certificate upload fails.

Eike-Christian Müller

2026-02-23 09:24:06 +01:00

8ca1c83b95