acmesh-official / acme.sh

A pure Unix shell script implementing ACME client protocol
https://acme.sh
GNU General Public License v3.0
39.54k stars 4.98k forks source link

DNS provider incorrectly inherited from verified domains in multi-provider setup #6092

Open ferranbonas opened 2 weeks ago

ferranbonas commented 2 weeks ago

Issue Description: When using multiple DNS providers (e.g. GoDaddy and Cloudflare) in a single certificate request, if the first domain is already verified, its DNS provider incorrectly "cascades" to the next unverified domain.

Steps to reproduce:

  1. Have a valid cert with multiple domains using different DNS providers:

    • domain1.com using dns_gd (GoDaddy)
    • domain2.com using dns_cf (Cloudflare) [etc]
  2. When the cert is renewed:

    • domain1.com is marked as "verified_ok"
    • The code skips validation for domain1.com
    • But domain2.com incorrectly inherits dns_gd provider instead of using its dns_cf

Current behavior:

Expected behavior:

Suggested fixes:

  1. Maintain DNS provider mapping separately from verification state

  2. Don't increment alias_index when skipping verified domains

Neilpang commented 1 week ago

I tried with 2 of my domains with 2 different dns providers, but it works for me as expected.

Can you please provide with --debug 2 log?

first generate a cert with 2 domains:

acme.sh --issue  -d domain1.com  --dns dns_1   -d domain2.com  --dns dns_2  

second generate a cert with the second domain only:

acme.sh --issue -d  domain2.com  --dns dns_2

It should be passing without any validation, because the domain2.com was just verified.

third deacivate the second domain, so that the second domain will be verified next time.

acme.sh --deactivae  -d domain2.com

OK, renew the first cert:

acme.sh  --renew -d domain1.com  --force  --debug 2