Understanding domain.com.conf Le_Webroot value set

[centminmod]

Been using acme.sh tool for ages now and still learning :)

Originally my acme.sh wrapper used web root authentication for SSL issuances but now started switching to Cloudflare DNS API TXT record based authentication. I'm inspecting the /root/.acme.sh/domain.com/domain.com.conf config file's Le_Webroot value that gets set.

If I issue on a fresh domain with web root authentication the value is the public web root as expected:

Le_Webroot='/home/nginx/domains/domain.com/public'

If I issue on a fresh domain with Cloudflare DNS API TXT validation, the value is dns_cf as expected

Le_Webroot='dns_cf'

But I issued original on web root authentication, then deleted directory /root/.acme.sh/domain.com and use Cloudflare DNS API TXT validation, the value in /root/.acme.sh/domain.com/domain.com.conf ends up as:

Le_Webroot='dns_cf,/home/nginx/domains/domain.com/public'

1. Does that mean acme.sh on renewal will first try CF DNS API validation and if it fails, it will try web root validation?
2. Why isn't this 3rd example just Le_Webroot='dns_cf' as I already deleted the directory /root/.acme.sh/domain.com?

[Neilpang]

Does that mean acme.sh on renewal will first try CF DNS API validation and if it fails, it will try web root validation?

No.

It should be only Le_Webroot='dns_cf'

Thanks

[centminmod]

Ah so a possible bug?

[Neilpang]

yes