A trailing dot in --domain-alias/--challenge-alias was passed through
to the dnsapi hook verbatim. Providers with exact-match record-name
lookups (e.g. Cloudflare's name= filter) then never find the record,
so rm never deletes it and relic TXT records accumulate on every issue.
Stripping in issue() also fixes certs with a dotted alias already
saved in domain.conf.
fix https://github.com/acmesh-official/acme.sh/issues/4636
LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
alone still produced localized day/month names on non-English systems
and DNS Made Easy rejected the request date header. An LC_ALL=C
command prefix beats every locale variable (same pattern as
dns_oci.sh).
Fixes#4272. Closes#4271. Thanks to @Nickinthebox.
Mirrors _clearaccountconf_mutable: clears the SAVED_ prefixed key and
the legacy unprefixed key. Replaces the local copy in synology_dsm.sh
and the direct _cleardomainconf call in multideploy.sh.
Closes#4722. Thanks to @sg1888.
Postfix with smtpd_forbid_bare_newline (default hardening since 3.9,
after SMTP smuggling) rejects the message with
"521 5.5.2 Error: bare <LF> received". RFC 5321 requires CRLF.
The python sender is unaffected (smtplib already emits CRLF).
fix https://github.com/acmesh-official/acme.sh/issues/7104
OpenBSD grep treats \| in a BRE as a literal | character, so
_freedns_domain_id never matched any row and every domain lookup
failed with "Domain not found". Switch to ERE with -E, keeping the
parens escaped so the (.*) suffix branch still requires literal
parentheses and does not widen the match (e.g. searching example.com
must not match example.company).
Reported-by: @katiekloss @boretom
Ref: https://github.com/acmesh-official/acme.sh/issues/2305
* New Banner
Updated README to include responsive images for dark and light modes.
* acme-sh-creoline-as-dns-provider
* acme-sh-creoline-as-dns-provider - Review changes implemented according code review
* acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron
* acme-sh-creoline-as-dns-provider - Remove debug code
* acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct
---------
Co-authored-by: neil <github@neilpang.com>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>
* add wiki
* feat: add support for account key rollover
* Place --update-account-key next to --update-account
* fix shfmt
* fix shfmt
* fix shfmt
* Fix from review
* fix shfmt
* fix from review
* fix review
---------
Co-authored-by: neil <gitpc@neilpang.com>
ssh_deploy() ignored the result of _ssh_deploy and always returned
success, so a failed transfer to one (or all) of the servers in
DEPLOY_SSH_SERVER was silently swallowed. Track the return code across
the loop and return non-zero if any server failed, letting the caller
handle notification.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* Added LaoDC API Module
* Cleaned up debug and info
revised get subdomain to filter by TXT records.
* Added commet to _get_root
* Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.
Revised rm() function to do explicit record matching.
* Revised _get_root() to handle different scenarios.
Fixed _laodc_api() function to check if query failed to run.
added basic json sanitation to handle \ and " in $value
unset _H2 _H3 after call as per request from copilot.
* fixed indentation of case statement block
* fixed condition checking.
_get_root should start at 1 so full fqdn can be tested
$? was being reference after export command failing response checks
removed export txtvalue
fixed docs link and issues link
* Verify key for both add and rm
* fixed dns alias condition check
validate key returns 1 if failed.
---------
Co-authored-by: neil <github@neilpang.com>
Co-authored-by: LaoDC <git@laodc.com>
ACCOUNT_EMAIL / --email now accepts a comma- or space-separated list
and registers all of them as ACME contact entries. The ZeroSSL EAB
endpoint takes a single address, so the first one is used there.
Committing after a failed import leaves a mismatched cert/key pair on
the firewall (PAN-OS does not validate the pair at commit time), which
can lock the admin out of the https management interface.
aws_ses_send calls `_use_container_role || _use_instance_role` when no
static AWS keys are set, but those functions were never defined -- only
_use_metadata was -- so role-based auth silently fell through to the
"no api key" error. Add both, using the current IMDSv2-capable versions
from dns_aws.sh, and set the IMDSv2 token header in _use_metadata so the
credential fetch works on IMDSv2-only instances.
Closes#4742
_get_root matched a registered domain anywhere as a substring of the
challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
account, issuing for subtest.com.ru wrongly picked test.com.ru as the
root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
boundary so a shorter domain no longer matches a longer subdomain label.
Fixes the issue reported in #5036 (thanks @koledas)
Closes#5036
The domain list is paginated at 1000 entries per page and only the
first page was fetched, so accounts with more than 1000 domains never
found the root zone.
fix https://github.com/acmesh-official/acme.sh/issues/5051
An undecodable key (e.g. broken LibreSSL base64 -d -A) used to produce
the cryptic "Usage: _hmac hashalg secret [outputhex]" and an empty EAB
signature that the CA rejects with 403.
https://github.com/acmesh-official/acme.sh/issues/4082
The docker deploy hook copied the key file preserving the source mode
(root:root 0600), so a non-root container service (uid >= 1000) could not
read it. Add DEPLOY_DOCKER_CONTAINER_KEY_MODE and
DEPLOY_DOCKER_CONTAINER_KEY_OWNER, applied via chmod/chown inside the
container after the key is copied and before the reload command.
Closes#5333
Runs le_test_nginx from acmetest against Pebble: nginx listens on
Pebble's HTTP-01 validation port with an aaPanel/BT style
"location ^~ /" reverse proxy block, the regression case of #6125.
* Add dns_muumuu: muumuu-domain.com DNS API
* Fix: remove local keyword for POSIX sh compatibility
* Fix: lowercase fulldomain for API compatibility
* Style: use echo instead of printf for lower_case (consistent with other plugins)
* Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL
- replace deprecated set-output with GITHUB_OUTPUT
- untap aws/tap before brew install to silence tap trust warning
- inject safe.directory=* for cygwin git so the checkout post step
no longer fails with dubious ownership (exit 128)
dash's echo has no -e flag and sends a literal "-e " prefix to the
socket, so haproxy rejects the command and the hot update always fails
on Debian/Ubuntu (/bin/sh = dash). Also accept "Transaction updated",
which haproxy replies when an uncommitted transaction already exists.
fix https://github.com/acmesh-official/acme.sh/issues/6165
