Version | Supported |
---|---|
1.1.x | ✅ |
1.0.x | ✅ |
< 1.0 | ❌ |
If you discover a security vulnerability within AcmeshWrapper, please:
- DO NOT open a public issue
- Send an email to the maintainer with details
- Include steps to reproduce if possible
- Wait for confirmation before disclosing publicly
When using AcmeshWrapper:
- Protect Private Keys: Never commit private keys or certificates to source control
- Secure API Tokens: Store Cloudflare/DNS provider tokens securely
- File Permissions: Ensure certificate files have appropriate permissions
- Use Environment Variables: Store sensitive configuration in environment variables
- Regular Updates: Keep both AcmeshWrapper and acme.sh updated
AcmeshWrapper does not store certificates. It relies on acme.sh's storage mechanism. Ensure:
- Certificate directory has restricted permissions (e.g., 700)
- Private keys are readable only by necessary services
- Regular backups of certificate directory
This project depends on:
- ProcessX - for process execution
- acme.sh - the underlying ACME client
Please ensure these dependencies are kept up to date.