From bc2b14f1f2800f7408a9c458119c417ce077de17 Mon Sep 17 00:00:00 2001
From: Maurus Decimus <11444311+mdecimus@users.noreply.github.com>
Date: Thu, 7 May 2026 15:40:23 +0200
Subject: [PATCH] Fix ACME: Include apex domains when requesting certificates
 for subdomains

---
 CHANGELOG.md                            |  1 +
 crates/common/src/network/acme/order.rs | 10 ++++++----
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 439513a9..03f98757 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,7 @@ If you are upgrading from v0.16.x, replace the binary (or run `docker pull`). If
 - SQL directory: Return `Failed` instead of `Error` when the query returns no results.
 - Network: Attempt binding to IPv4 when binding to IPv6 fails with `EAFNOSUPPORT` error.
 - Bootstrap: Timeout after 30 seconds when probing the data store.
+- ACME: Include apex domains when requesting certificates for subdomains.
 
 ## [0.16.4] - 2026-05-05
 
diff --git a/crates/common/src/network/acme/order.rs b/crates/common/src/network/acme/order.rs
index 3e72ddcb..2a2c35d8 100644
--- a/crates/common/src/network/acme/order.rs
+++ b/crates/common/src/network/acme/order.rs
@@ -43,6 +43,8 @@ impl AcmeRequestBuilder {
             } else {
                 let server_name = server.core.network.server_name.as_str();
                 let domain_suffix = format!(".{domain}");
+                let matches_zone =
+                    |name: &str| name == domain || name.ends_with(&domain_suffix);
 
                 // Add technical domains
                 let mut domains = HOSTNAMES
@@ -50,15 +52,15 @@ impl AcmeRequestBuilder {
                     .map(|hostname| format!("{hostname}.{domain}"))
                     .collect::<BTreeSet<_>>();
 
-                // Add server name if it matches the domain
-                if server_name.ends_with(&domain_suffix) {
+                // Add server name if it matches the domain (including the apex itself)
+                if matches_zone(server_name) {
                     domains.insert(server_name.to_string());
                 }
 
                 // Add mail exchangers
                 for exchanger in &server.core.network.info.mxs {
                     if let Some(exchanger) = &exchanger.hostname
-                        && exchanger.ends_with(&domain_suffix)
+                        && matches_zone(exchanger)
                     {
                         domains.insert(exchanger.to_string());
                     }
@@ -67,7 +69,7 @@ impl AcmeRequestBuilder {
                 // Add service hosts
                 for (_, service) in &server.core.network.info.services {
                     if let Some(service) = &service.hostname
-                        && service.ends_with(&domain_suffix)
+                        && matches_zone(service)
                     {
                         domains.insert(service.to_string());
                     }