diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml
index 00e9ddc5..a25cd4ef 100644
--- a/.github/workflows/issue.yml
+++ b/.github/workflows/issue.yml
@@ -2,6 +2,8 @@ name: "Update issues"
 on:
   issues:
     types: [opened]
+  issue_comment:
+    types: [created]
   pull_request_target:
     types: [opened]
 
@@ -32,6 +34,32 @@ jobs:
             } catch (e) {
               core.warning(`Failed to fetch the blacklist: ${e}`);
             }
+            // A comment on a closed tracking issue reopens it (the standard
+            // closing note promises this). Bots, blacklisted users and the
+            // maintainer's own comments don't reopen.
+            if (context.eventName === "issue_comment") {
+              const issue = context.payload.issue;
+              const commenter = context.payload.comment.user;
+              if (issue.pull_request || issue.state !== "closed") {
+                return;
+              }
+              if (!/^report\s+(bugs?|issues?)\b/i.test(issue.title)) {
+                return;
+              }
+              if (commenter.type === "Bot" ||
+                  commenter.login.toLowerCase() === "neilpang" ||
+                  blacklist.includes(commenter.login.toLowerCase())) {
+                return;
+              }
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: "open"
+              });
+              return;
+            }
+
             if (blacklist.includes(item.user.login.toLowerCase())) {
               if (context.payload.pull_request) {
                 await github.rest.pulls.update({
@@ -63,7 +91,9 @@ jobs:
             }
             if (/^report\s+(bugs?|issues?)\b/i.test(issue.title)) {
               // Tracking issue for a third-party dns/deploy/notify api:
-              // no upgrade boilerplate; assign it to the opener and label it.
+              // no upgrade boilerplate; assign it to the opener, label it,
+              // then close it right away to keep the issue list clean. Any
+              // later comment reopens it (see the issue_comment handler).
               await github.rest.issues.addAssignees({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
@@ -76,6 +106,19 @@ jobs:
                 issue_number: issue.number,
                 labels: ["3rd party api"]
               });
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: "Closing this tracking issue for now to keep the issue list clean. It remains the place to report problems with this provider -- if you hit a bug, comment here and the issue will be reopened."
+              });
+              await github.rest.issues.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                state: "closed",
+                state_reason: "completed"
+              });
               return;
             }
             await github.rest.issues.createComment({
diff --git a/acme.sh b/acme.sh
index 3a73cd77..a5f53469 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5838,7 +5838,7 @@ $_authorizations_map"
     return 1
   fi
 
-  echo "$response" >"$CERT_PATH"
+  echo "$response" | _strip_blank_lines >"$CERT_PATH"
   _split_cert_chain "$CERT_PATH" "$CERT_FULLCHAIN_PATH" "$CA_CERT_PATH"
   if [ -z "$_preferred_chain" ]; then
     _preferred_chain=$(_readcaconf DEFAULT_PREFERRED_CHAIN)
@@ -5865,7 +5865,7 @@ $_authorizations_map"
         _relcert="$CERT_PATH.alt"
         _relfullchain="$CERT_FULLCHAIN_PATH.alt"
         _relca="$CA_CERT_PATH.alt"
-        echo "$response" >"$_relcert"
+        echo "$response" | _strip_blank_lines >"$_relcert"
         _split_cert_chain "$_relcert" "$_relfullchain" "$_relca"
         if [ "$DEBUG" ]; then
           _debug "rel chain issuers: " "$(_get_chain_issuers "$_relfullchain")"
@@ -6072,6 +6072,15 @@ $_authorizations_map"
 }
 
 #in_out_cert   out_fullchain   out_ca
+#Reads a PEM chain from stdin, prints it without the blank lines.
+#Some CAs (Let's Encrypt) separate the certificates of a chain with a blank
+#line, others (ZeroSSL) don't. The blank lines are valid PEM (RFC 7468), but
+#some devices and APIs reject them, so the certs are stored back to back.
+#https://github.com/acmesh-official/acme.sh/issues/1940
+_strip_blank_lines() {
+  sed '/^[[:space:]]*$/d'
+}
+
 _split_cert_chain() {
   _certf="$1"
   _fullchainf="$2"