security/acme-client: Fix DNS validation failures - missing prepare() call #4834
+3
−0
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a critical bug in the ACME client where DNS validations fail because environment variables (API credentials) are not being passed to acme.sh.
The Problem
The
prepare()method in DNS validation classes (likeDnsCf.phpfor Cloudflare) sets environment variables with API credentials:However, the
Base::run()method never callsprepare(), so these environment variables are never set, causing DNS validations to fail with exit code 3.The Solution
Add a call to
$this->prepare();in therun()method before the environment variables are used.Testing
Tested with Cloudflare DNS validation on OPNsense 25.1:
Impact
This bug affects ALL DNS validation providers (Cloudflare, Route53, Azure DNS, etc.) as none of them can pass their credentials to acme.sh.