Skip to content

sync#6948

Merged
neilpang merged 6 commits intomasterfrom
dev
May 6, 2026
Merged

sync#6948
neilpang merged 6 commits intomasterfrom
dev

Conversation

@neilpang
Copy link
Copy Markdown
Member

@neilpang neilpang commented May 6, 2026

sync

Copilot AI review requested due to automatic review settings May 6, 2026 18:51
@neilpang neilpang merged commit d2780eb into master May 6, 2026
5 of 18 checks passed
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates acme.sh and the README in a small “sync” pass: it bumps the script version, improves ARI (RFC 9773) behavior (including an opt-out), and adds/updates relevant wiki links in the documentation.

Changes:

  • Bump acme.sh version to 3.1.4.
  • Add NO_ARI=1 opt-out behavior to skip ARI replaces and suggestedWindow logic.
  • Adjust ARI certID computation to handle DER serial sign-byte requirements; refresh README links (DNS persist mode + ARI wiki).

Critical Issues (Must Fix Before Merge)

  • Non-portable grep -A usage in _getAKI() (impacts cross-platform support).

Suggestions (Improvements to Consider)

  • Document NO_ARI=1 in the README ARI section so users can discover the opt-out.
  • Quote ACME_OPENSSL_BIN when invoking OpenSSL to avoid word-splitting/metacharacter issues.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
README.md Adds wiki links for DNS persist mode and ARI, and links “DNS persist mode” in the supported modes table.
acme.sh Version bump; introduces NO_ARI opt-out in ARI paths; fixes ARI serial handling; switches AKI/serial helpers to use ACME_OPENSSL_BIN.

Comment thread README.md
Comment on lines 505 to 510
#### 📡 ACME Renewal Information (ARI) — RFC 9773

📖 Wiki: https://github.com/acmesh-official/acme.sh/wiki/ARI

If the CA exposes a `renewalInfo` endpoint in its ACME directory (Let's Encrypt, ZeroSSL, etc.), `acme.sh` follows [RFC 9773](https://www.rfc-editor.org/rfc/rfc9773.html) automatically — **no flag needed, no opt-in**:

Comment thread acme.sh
_getAKI() {
_cert="$1"
openssl x509 -in "$_cert" -text -noout | grep "X509v3 Authority Key Identifier" -A 1 | _tail_n 1 | tr -d ' :'
${ACME_OPENSSL_BIN:-openssl} x509 -in "$_cert" -text -noout | grep "X509v3 Authority Key Identifier" -A 1 | _tail_n 1 | tr -d ': ' | sed "s/keyid//"
Comment thread acme.sh
Comment on lines 6866 to 6875
_getAKI() {
_cert="$1"
openssl x509 -in "$_cert" -text -noout | grep "X509v3 Authority Key Identifier" -A 1 | _tail_n 1 | tr -d ' :'
${ACME_OPENSSL_BIN:-openssl} x509 -in "$_cert" -text -noout | grep "X509v3 Authority Key Identifier" -A 1 | _tail_n 1 | tr -d ': ' | sed "s/keyid//"
}

#cert
_getSerial() {
_cert="$1"
openssl x509 -in "$_cert" -serial -noout | cut -d = -f 2
${ACME_OPENSSL_BIN:-openssl} x509 -in "$_cert" -serial -noout | cut -d = -f 2
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants