_normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
any positional argument. dns_czechia_add() called it as
`_normalizeJson "$_res"`, so the response was discarded and the inner
sed blocked reading from stdin.
When issuing for a single domain, or for a record that already exists,
the "already exists" branch returns early and never reaches this call,
which is why the bug stayed hidden. With multiple domains, the first
record often short-circuits on "already exists" while the next,
freshly-added record reaches the broken call and hangs on interactive
runs (or consumes unrelated stdin non-interactively).
Pipe the response into _normalizeJson via stdin, matching
dns_czechia_rm() and every other dnsapi plugin.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat: add volcengine dns api
* fix(volcengine): address review findings and fix record matching
Code review fixes:
- fix format string usage in signature computation (use printf %b / %s)
- clear _H1.._H5 header state at start of request to avoid leaking
conditionally-set headers into subsequent requests
- check ListZones return status in _get_root
- document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
- fix Docs and Issues sections
- remove and update some code comments
Functional fixes:
- stop matching ListRecords results by FQDN string: Volcengine lowercases
the Host/FQDN in responses, so a case-sensitive compare against
$fulldomain failed for mixed-case names, making rm silently skip
deletion and add lose idempotency. ListRecords is already filtered by
ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
result instead.
- reset _record_id at the start of add/rm to avoid stale state leaking
across calls within the same process
- tag created records with Remark "acme.sh" for easier identification
- adjust debug levels: hide Authorization header behind _debug2, surface
response at _debug
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: wenxuan70 <t736660416@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* ARI - Run cron job more frequently
With ACME Renewal Info (RFC9773 §4.3), fetching renewal window should be more frequent, e.g. in case of revocation incident.
"For instance, a server that needs to revoke certificates within 24 hours of notification of a problem might choose to reserve twelve hours for investigation, six hours for clients to fetch updated RenewalInfo objects, and six hours for clients to perform a renewal."
More flexible option is to run the cron job every hour and only refresh ARI when the last one + Retry-After header is in the past.
* Fix cron job schedule for certificate renewal
* Fix random_hour syntax in cron job installation
* Update Windows task scheduler to run more frequently
Add support for randomized hour and update frequency
Ref:
* [/mo](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#to-schedule-a-task-to-run-every-n-hours)
* [/SC HOURLY](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create#parameters)
* Add padding for StartTime (/ST) in SCHTASKS.exe
* New Banner
Updated README to include responsive images for dark and light modes.
* rebase
* Reset README
---------
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
* Add Glesys dnsapi provider
* Fix typo in error message for dns_glesys_add
* Use API to get record id in Glesys provider
* Use listrecords API endpoint to find root domain
* Remove record id parsin from add function
* fix(acme): prefer new Baidu DNS API with legacy BCD fallback
Keep the existing BCD implementation and add fallback support for the newer Baidu DNS record API. Prefer the new API by default, then fall back to the legacy BCD API to reduce compatibility risk.
* fix(dns_baidu): route through _get/_post + restore legacy BCD auth headers
Per review: _baidu_dns_call now uses _get/_post with _H1.._H5 (no raw curl, no __HTTP_STATUS__ parsing); _baidu_bcd_post restores _H1.._H5 so the legacy BCD path sends the Authorization signature again (fixes 401).
---------
Co-authored-by: neil <github@neilpang.com>
* dns_inwx: fix IDN zone detection without python dependency
INWX returns zone names in Unicode form (e.g. lünenschloß.de) even when
the domain was registered as an IDN. When acme.sh passes the SAN in
punycode (xn--lnenschlo-o1a42a.de), _contains never matches and
_get_root falls through to the TLD, placing the TXT record in the wrong
zone.
Previous fix used python3 which is not available in all environments
(BusyBox, BSD, minimal containers). Replace with _idn()-based approach:
extract <string> values from the nameserver.list XML response, encode
each via _idn(), and compare to $h. When a match is found, use the
original Unicode zone name for createRecord.
Fixes#7038
* dns_inwx: fix shebang, use _egrep_o, shfmt cleanup
- Revert shebang to #!/usr/bin/env sh (POSIX sh, fixes ShellCheck)
- Replace grep -o with _egrep_o for portability
- shfmt -i 2: drop backslash continuation after pipe, fix indentation
Requested by @neilpang
* fix: drop closing </string> from _egrep_o pattern to avoid sed delimiter collision
---------
Co-authored-by: bluenenschloss <bernd.luenenschloss@7p-group.com>
The add/rm success check never rejected anything: for any non-empty API
response it always reported "Record added"/"Record deleted" and returned
0, so the _err branch was dead code. A valid key looked fine only because
the API call genuinely created the record; an invalid key returning
{"result":"error"} produced the same "Record added" output even though
nothing was created.
Root cause, in:
if [ -n "$response" ]; then
if [ ! "$(echo "$response" | _contains '"result":"success"')" ]; then
- _contains() ignores stdin (it reads only $1 and $2), so the piped
"$response" was discarded.
- The pattern '"result":"success"' was passed as $1 (the haystack),
leaving $2 (the needle) empty, so it ran:
echo '"result":"success"' | grep -- "" >/dev/null 2>&1
grep with an empty pattern always matches.
- That grep output is redirected to /dev/null, so the command
substitution always captured "", making [ ! "" ] always true.
Fix: call _contains "$response" '"result":"success"' directly and branch
on its exit code, so error responses now correctly fail (return 1).
Co-authored-by: neil <github@neilpang.com>
* fix(dns_desec): sleep after DNS record change to prevent rate limit issues
Also: make sure the subname is lowercase to fix tests where
the acmetestXyzRandomName subdomain is used.
* fix: make regexes POSIX-compatible (for OpenBSD)
* chore: use _sleep instead of sleep to follow acme.sh standards
* Add Level27 DNS API support
Implements dns_level27_add and dns_level27_rm for the Level27 (level27.eu) DNS API, used for ACME dns-01 challenges.
- Authenticates with a persistent API key via the Authorization header.
- Resolves the registered zone with domains?filter and exact fullname match (supports DNS alias mode).
- Removes the challenge record by its exact TXT value, leaving other records intact (wildcard-safe).
- Optional LEVEL27_API override for non-default/staging endpoints.
* A little better documentation
---------
Co-authored-by: Jeroen Moors <jeroen.moors@level27.be>
neil
neil
ZeroSSL-Andreas
CZECHIA-COMandClaude Opus 4.8
Simon V.andZeroSSL-Andreas
MarFri
Toni Karppi
Manwe SulimoandManwe-Sulimo
pxMan79andneil
bluenenschlossandbluenenschloss
Jonas Zürcherandneil
SirNomad49andneil
hostup
Alexander Stehlik
Jeroen MoorsandJeroen Moors
Jakub Kołodziejczak
regisvidal-bitmapz
SpeedGriffon
neil
Bill
aitor422
rajcz
Adrian Fedoreanu
terafin
Thomas
Jakob Næss
Markus Ebner
Tom Sommer