The success check only grepped "message" from the response body, but
PVE/PBS auth failures return HTTP 401 with an empty body, so wrong or
unauthorized API tokens were reported as "Certificate successfully
deployed". Also _retval captured the exit code of the message pipeline
instead of _post. Check the HTTP status line from $HTTP_HEADER and
capture _post's exit code directly.
fix https://github.com/acmesh-official/acme.sh/issues/7141
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Has been cancelled
When ACME_PACKAGED is set (e.g. exported by a distro package wrapper):
- --install does not copy the script or the hooks into LE_WORKING_DIR;
the cron job and the shell alias point to the packaged script instead
- --upgrade, --install-online and the cron AUTO_UPGRADE path refuse and
point to the system package manager
- --uninstall does not remove the packaged files
https://github.com/acmesh-official/acme.sh/issues/7135
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Waiting to run
dnsapi/deploy: remove POSIX character classes from sed/grep patterns
Solaris /usr/bin/sed and /usr/bin/grep parse [[:space:]] etc. as a
literal bracket set and silently mis-match. Replace with [ ]* for
JSON matching, a printf-tab bracket for user-input trimming, and
[0-9] for digits; also drop GNU-only sed -r/-E in rage4, selfhost
and selectel, and reuse _strip_blank_lines in byteplus_alb.
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Waiting to run
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Has been cancelled
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Waiting to run
A negative --days is anchored to the expiry, so it composes with a
relative --valid-to: "--valid-to +30d --days -7" renews 7 days before
the expiry instead of the hardcoded 1 day. A positive --days and any
--days with a fixed-date --valid-to are still rejected.
https://github.com/acmesh-official/acme.sh/issues/6570
The OCI DNS plugin cached the tenancy, user, region and signing key into
acme.sh's account.conf at issuance and then, on subsequent runs, read those
cached values before consulting ~/.oci/config. A value cached at issuance
therefore permanently shadowed the config file, so editing ~/.oci/config
afterwards (most visibly rotating the API signing key) had no effect and
renewals kept using stale credentials, failing authentication.
Resolve each field in the order: explicit environment variable, then
~/.oci/config when it exists, then the cached account.conf value as a
fallback for env-only installs that have no config file. The signing key
likewise prefers the key_file resolved from the environment or ~/.oci/config
over any cached key.
Signed-off-by: Avi Miller <me@dje.li>
* Deploy certificate to FortiGate firewall using API
* Refactor FortiGate deployment functions
Prefix private functions and working variables and use a timestamped certificate name.
* Replace grep -o for POSIX compatibility
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Has been cancelled
_egrep_o falls back to a BRE sed expression on shells without egrep -o
(Solaris, DD-WRT busybox). A bare "\{" there is a BRE interval operator
and aborts ("sed: command garbled" / "Invalid content of \{\}"), so the
challenge-status-invalid path extracted an empty error object and the
CA's failure reason was lost. Replace the escaped braces with "[{]"/"[}]"
bracket expressions, unambiguous literal braces in both BRE and ERE, at
all four call sites (challenge type/error extraction and profiles).
When re-registering an already-bound EAB account (HTTP 400 "not
awaiting external account binding"), the else branch restored
ACCOUNT_URL from ca.conf but the following unconditional
`export ACCOUNT_URL="$_accUri"` clobbered it with an empty _accUri
(never set on that path), so later signed requests failed with
"A Key ID MUST be specified" / "account URL is empty". Assign the
restored value to _accUri so the shared export uses it.
https://github.com/acmesh-official/acme.sh/issues/3382
The sed in _get_zone passed the raw JSON through when the response
contained no [{"fqdn":", so an API error turned the zone into "{" and
the failure only surfaced later as POST /2/zones/{/records
"method_not_found". Log the response at debug2, error out on
non-success results, and parse fqdn position-independently.
https://github.com/acmesh-official/acme.sh/issues/6851
The "no crontab" whitelist used multiple -e patterns, but Solaris
/usr/bin/grep honors only a single -e, so a fresh install was
refused there. Use one plain grep per message pattern, which every
grep implementation supports (caught by le_test_installcronjob_no_wipe
on the Solaris CI).
The zone cannot be derived from the record name when the Knot server
is only authoritative for a delegated subdomain; let the user name it
explicitly, like NSUPDATE_ZONE.
fixes https://github.com/acmesh-official/acme.sh/issues/2881
The legacy plain _saveaccountconf copy in account.conf is sourced at
startup and silently overrides a newly exported DNSimple_OAUTH_TOKEN,
so rotated tokens never took effect.
fixes https://github.com/acmesh-official/acme.sh/issues/3422
Piping a failed 'crontab -l' straight back into 'crontab -' replaced
the whole crontab with just the acme.sh entry when the listing failed
while jobs existed (seen on cPanel/CloudLinux jailshell). Capture the
listing first and refuse to write unless the failure is the normal
"no crontab for user" case.
https://github.com/acmesh-official/acme.sh/issues/3079
"--update-account -m new@example.com" updated the contact on the CA but
never saved it locally, so CA_EMAIL kept showing the old address on
every later run. Save it in the success path like _regAccount does.
https://github.com/acmesh-official/acme.sh/issues/4673
* add Baidu Cloud CDN deploy hook
Code generated by GitHub Copilot with Claude Sonnet 4.6. Tested with local environment by human.
* inline functions
Code generated by OpenAI Codex with GPT-5.5 Sol. Tested with local environment by human.
* Add files via upload
* New Banner
Updated README to include responsive images for dark and light modes.
* Add files via upload
Remove usage of jq and curl
should be compliant with acme.sh api dev guide
* Add files via upload
* Add files via upload
change CR LF to LF
* Add files via upload
missing CR
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
correct auth
* Add files via upload
better manage group_id
* Add files via upload
manage wrong / missing domain
* Add files via upload
strip domain to manage subdomain requests
* Add files via upload
fix wrong id selection in get root
* Add files via upload
fix parsing of IDs
* Add files via upload
correct get_root to better handle unexisting domaines (acmetest)
* Add files via upload
correct token incorrect in auth
* Add files via upload
manage case web api reply is empty
* Add files via upload
try to resolve error when adding unexisting subdmain txt entry
* Add files via upload
correct domain parsing
* Add files via upload
revert changes when adding record (name)
change rm to better handle complex urls
* Add files via upload
correct rm function to better manage records deletion
* Add files via upload
ensure auth variable arent lost during calls
* Add files via upload
try to keep autj variables accross executions
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
fix stripping subdomains
* Add files via upload
* Add files via upload
keep auth token instead of requesting it each time
* Add files via upload
debug
* Add files via upload
* Add files via upload
* Add files via upload
better manage record deletion to avoid orphans
added some debug and checks
* Add files via upload
paginated api support for rm function
* Add files via upload
* Add files via upload
delay to manage api 404
* Add files via upload
enhance parsing of records in rm
* Add files via upload
fix incorrect record detection in rm
* Add files via upload
better manage filters on api to limit errors
* Add files via upload
try to handle 404 when requesting API too frequently
* Add files via upload
* Add files via upload
sleep during auth
* Add files via upload
manage 404 errors in get_root
* Add files via upload
correct variable overide
translate comments
prefix all variables
* Add files via upload
correct variable
* Add files via upload
typo
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
correct variable naming (_comlaude prefix missing)
correct rm return code when non existing record
typo
* Add files via upload
log an info instead of an error if no dns record found in RM function.
---------
Co-authored-by: neil <github@neilpang.com>
Co-authored-by: Matthiasvpfr <matthias.dupont@vetpartners.fr>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
The hook is sourced by acme.sh, so the bash shebang never takes
effect: under dash, `[ x == y ]` fails with "unexpected operator",
the 403 branch never triggers and 2FA-OTP login is skipped.
Replace `==` with `=` and use the standard sh shebang.
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Waiting to run
With --signcsr the private key never exists in the cert home, so every
renewal printed ".../domain.key: No such file or directory" from the
shell redirection. Skip the key read in that case; the install_ssl call
already ran with an empty key there and cPanel keeps the installed one.
https://github.com/acmesh-official/acme.sh/issues/6228
Debug logs occasionally contain private keys or tokens (issue 6267);
the code-side leak in the haproxy hook was fixed by #6268, this adds
the missing warning to the auto-comment that asks for logs.
The default schedule was a fixed CertCreateTime + RenewalDays - 1 day,
which passes notAfter entirely for short-lived certs (internal CAs
today, the CA/B SC-081 47-day maximum later) and leaves an expired cert
in place for weeks. Extract the arithmetic into _calc_next_renew_time
and cap it at one day before expiry (one hour for lifetimes of 24h or
less, mirroring --valid-to scheduling). CAs with ARI are unaffected --
the ARI window still overrides afterwards.
https://github.com/acmesh-official/acme.sh/issues/6305
The wiki has documented "21. Set notification for customscript" since
2022 but the implementation (#4193) was never merged, so following the
wiki failed with "Cannot find the hook file". Same interface as
documented: the script gets subject, content and status code as three
arguments. Unlike #4193, the target script is invoked directly instead
of through eval -- the subject/content contain domain names and CA
messages, and eval would allow command injection through them.
https://github.com/acmesh-official/acme.sh/issues/6377
The unfiltered GET /zones lists every zone on the server; with large
installations (100k zones) root-zone detection took minutes per domain.
Probe each walk-up candidate with ?zone=<name> instead (exact match per
the PowerDNS API docs); servers that ignore the parameter return the
full list, which the existing check still handles.
https://github.com/acmesh-official/acme.sh/issues/6382
Ubuntu / Ubuntu (Smallstep Intermediate CA, Smallstep Intermediate CA, , 1, https://localhost:9000/acme/acme/directory, 1, , 172.17.0.1) (push) Has been cancelled
