From a82948318aea50b0e61fd14e8ddc420cd1e2d3bf Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 23 Apr 2026 17:35:41 +0200
Subject: [PATCH] ACME: Allow requesting apex domain certificates

---
 CHANGELOG.md                            |  1 +
 crates/common/src/network/acme/order.rs | 15 +++++++++++----
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f3d6b479..3f80c543 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,7 @@ This version includes **multiple breaking changes**. If you are upgrading from v
 - JMAP:
   - Invalid `receivedAt` headers after importing (#2939).
   - Sorting order issues when emails lack `receivedAt` headers.
+- ACME: Allow requesting apex domain certificates.
 - Reverse proxy issues.
 - OSS builds.
 - DNS Updater:
diff --git a/crates/common/src/network/acme/order.rs b/crates/common/src/network/acme/order.rs
index 5195786c..3e72ddcb 100644
--- a/crates/common/src/network/acme/order.rs
+++ b/crates/common/src/network/acme/order.rs
@@ -39,7 +39,7 @@ impl AcmeRequestBuilder {
                 self.challenge,
                 ChallengeType::Dns01 | ChallengeType::DnsPersist01
             ) {
-                vec![format!("*.{domain}")]
+                vec![format!("*.{domain}"), domain.to_string()]
             } else {
                 let server_name = server.core.network.server_name.as_str();
                 let domain_suffix = format!(".{domain}");
@@ -78,12 +78,19 @@ impl AcmeRequestBuilder {
         } else {
             hostnames
                 .iter()
-                .map(|hostname| format!("{hostname}.{domain}"))
+                .map(|h| {
+                    if h.contains('.') {
+                        h.clone()
+                    } else {
+                        format!("{h}.{domain}")
+                    }
+                })
                 .collect()
         };
 
-        let mut params = CertificateParams::new(domains.clone())
-            .map_err(|err| AcmeError::Crypto(format!("Failed to create certificate params: {}", err)))?;
+        let mut params = CertificateParams::new(domains.clone()).map_err(|err| {
+            AcmeError::Crypto(format!("Failed to create certificate params: {}", err))
+        })?;
         params.distinguished_name = DistinguishedName::new();
         let key_pair = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
             .map_err(|err| AcmeError::Crypto(format!("Failed to generate key pair: {}", err)))?;