From 3e6d4835e5fc3b1c940e6a45300c4df0c37e0099 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Mon, 12 Oct 2026 16:58:32 +0800
Subject: [PATCH] Retry signed requests on transport errors

_send_signed_request tested $? after _CACHED_NONCE="" had reset it, so a
POST that never got an answer (curl 7, 28, 35) returned success with a
stale or empty code, and callers blamed the CA ("Finalize code was not
200"). Keep the _post status and retry with backoff and a new nonce, like
a gateway error. Drop the nonce-fetch $? check, which was dead the same
way.

Fixes #7320
---
 acme.sh | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/acme.sh b/acme.sh
index 3b093b03..ccd34b18 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2738,10 +2738,6 @@ _send_signed_request() {
         _debug2 _headers "$_headers"
         _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
       fi
-      if [ "$?" != "0" ]; then
-        _err "Cannot connect to $nonceurl to get nonce."
-        return 1
-      fi
     else
       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
     fi
@@ -2780,11 +2776,19 @@ _send_signed_request() {
     _debug3 body "$body"
 
     response="$(_post "$body" "$url" "$needbase64" "POST" "$__request_conent_type")"
+    _post_ret="$?"
     _CACHED_NONCE=""
 
-    if [ "$?" != "0" ]; then
-      _err "Cannot make POST request to $url"
-      return 1
+    #A transport failure (curl 7, 28, 35, ...) brings no answer at all. Issue
+    #7320: the status was tested only after the line above had reset it, so
+    #such a failure went on as a success, the code read from whatever
+    #$HTTP_HEADER still held, and the caller blamed the CA ("Finalize code was
+    #not 200"). Retry it the way a gateway error is retried, with a new nonce.
+    if [ "$_post_ret" != "0" ]; then
+      _sleep_post_retry_sec="$(_retry_backoff_sec "$_request_retry_times")"
+      _info "Cannot make POST request to $url, let's try again. Sleeping for $_sleep_post_retry_sec seconds. ($_request_retry_times/$MAX_REQUEST_RETRY_TIMES)"
+      _sleep "$_sleep_post_retry_sec"
+      continue
     fi
 
     responseHeaders="$(cat "$HTTP_HEADER")"