3 ms·

This means that acme.sh has an RCE. Once the patch is in I'm rotating all my certs, even though I use ZeroSSL. I do wonder if what HiCA did gave possibilities

This means that acme.sh has an RCE. Once the patch is in I'm rotating all my certs, even though I use ZeroSSL. I do wonder if what HiCA did gave possibilities to post the private key somewhere else?

mholt 3y ago
If the executed script transmits the key, then yes. (But the script we observed does not.)