From 52f366454b3c29d2575f26bcef35f26f57d87715 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 7 May 2026 15:55:13 +0200
Subject: [PATCH] Fix ACME: Use the public suffix list to determine the zone
 name when no origin is provided

---
 CHANGELOG.md                            | 6 ++++--
 crates/common/src/network/acme/order.rs | 8 +++++++-
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 03f98757..566aab6b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,12 +13,14 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 
 ## Fixed
 - JMAP: 
-  - Patching ids containing digits in JSON Pointers failes.
+  - Patching ids containing digits in JSON Pointers fails.
   - Patching nested objects with `null` values fails.
 - SQL directory: Return `Failed` instead of `Error` when the query returns no results.
 - Network: Attempt binding to IPv4 when binding to IPv6 fails with `EAFNOSUPPORT` error.
 - Bootstrap: Timeout after 30 seconds when probing the data store.
-- ACME: Include apex domains when requesting certificates for subdomains.
+- ACME: 
+  - Include apex domains when requesting certificates for subdomains.
+  - Use the public suffix list to determine the zone name when no origin is provided.
 
 ## [0.16.4] - 2026-05-05
 
diff --git a/crates/common/src/network/acme/order.rs b/crates/common/src/network/acme/order.rs
index 2a2c35d8..8ed44ee1 100644
--- a/crates/common/src/network/acme/order.rs
+++ b/crates/common/src/network/acme/order.rs
@@ -256,10 +256,16 @@ impl AcmeRequestBuilder {
                         let dns_parameters = dns_parameters.unwrap();
                         let domain = domain.strip_prefix("*.").unwrap_or(&domain);
 
+                        let zone = dns_parameters
+                            .origin
+                            .as_deref()
+                            .or_else(|| psl::domain_str(domain))
+                            .unwrap_or(domain);
+
                         dns_parameters
                             .updater
                             .create(
-                                dns_parameters.origin.as_deref().unwrap_or(domain),
+                                zone,
                                 &format!("_acme-challenge.{}", domain),
                                 DnsRecord::TXT(self.dns_proof(challenge)?),
                                 true,