packages/net/acme-acmesh/files, branch master

acme-common: move nftables rule to hook

2026-07-04T15:27:50Z

The nftables rule in acme-common partially works, but it races against the acme.sh and uacme client. While the client is performing the renew the rule is being deleted because the client is run in the background. This change moves the rule management to the hook instead. While duplicate rules could be created, the benefits outway the potential costs. It is unknown how many installations issue/renew multiple certificates. Signed-off-by: Michael A Cassaniti

acme-acmesh: remove duplicated notification on certificate renewal

2026-07-01T12:50:15Z

fix #29703 Signed-off-by: Juanyong Dong

acme-acme.sh: support --cert-profile option

2026-01-03T14:19:18Z

acme 3.1.2 added a new --cert-profile option to request specific certificates. This makes it possible to request shortlived six day certificates from Letsencrypt. Signed-off-by: Norman Gehrsitz

acme.sh: add `abort` service command and improve interactive messages

2025-10-08T18:27:32Z

For runs started interactively, improve messaging and allow a run to be aborted with `service acme abort`. Signed-off-by: Aditya Bhargava

acme.sh: move to procd to ensure logging gets to syslog

2025-10-08T18:27:32Z

acme.sh error output never made it to the syslog, so: * Add procd setup to catch stderr * Make sure a message goes to syslog if acme.sh dies due to SIGINT Signed-off-by: Aditya Bhargava

acme-acme.sh: support listen_port option

2025-10-02T11:14:11Z

acme.sh supports --httpport and --tlsport options to be used together with --standalone and --alpn modes respectively. This is useful if we're behind a reverse proxy or smth like that or if we cannot bind to standard 80 or 443 port for some other reason. This change makes listen_port from configuration to be passed as either --httpport or --tlsport Signed-off-by: Vladimir Kochnev

acme-acme.sh: declare staging_moved variable

2025-10-02T11:14:11Z

It's possible that staging_moved variable is undeclared while being accessed. Lets explicitly declare it. Signed-off-by: Vladimir Kochnev

acme-acmesh: support TLS-ALPN-01 challenge

2025-09-26T13:45:56Z

This change adds an ability to invoke acme.sh with --alpn option invoking a TLS-ALPN-01 challenge on the 443 port. Signed-off-by: Vladimir Kochnev

acme-acmesh: use validation_method option instead of guessing

2024-03-01T16:01:40Z

The new validation_method option can be: dns, webroot or standalone. Previously we guessed the challenge type: 1. if the DNS provider is specified then it's dns 2. if standalone=1 3. fallback to webroot The logic is preserved and if the validation_method wasn't set explicitly we'll guess it in old manner. Signed-off-by: Sergey Ponomarev

acme: standardize key_type

2023-05-18T04:48:47Z

keylength, being an acme.sh value type, uses pure numbers for rsa keys. This can be disorienting for other acme clients. This change introduces a new option "key_type" that aims to remove this ambiguity, and makes all key type names follow the same pattern, making acme-common more client agnostic. Signed-off-by: Glen Huang