nowhere7.1

1. Replace “Skip if the certificate already exists” with four pre-issuance checks: the certificate file exists, the private key matches the certificate, the SAN contains the domain, and the certificate has more than 30 days remaining before expiration. Skip issuance only if all checks pass.
2. Replace the lack of post-issuance validation with immediate OpenSSL verification after issuance. If verification fails, report an error and abort immediately, preventing an invalid certificate from reaching Step 11.
3. Add a DNS preflight check for HTTP-01, which currently has no preflight validation. Before issuance, resolve the domain and compare the resolved IP address against the server’s public IP address, issuing an early warning if they do not match.
4. Fix the renewal workflow:
   • In the Certbot branch, explicitly run enable --now certbot.timer and verify that the timer is active. On systems without a systemd timer, fall back to cron.
   • In the acme.sh branch, verify that the renewal cron job exists.
5. Add an optional one-click renewal rehearsal during installation using certbot renew --dry-run. This does not consume Let’s Encrypt issuance quotas and allows the renewal workflow to be validated immediately, helping ensure that renewal will work when the certificate approaches its 90-day expiration.
6. Redesign the acme.sh branch: explicitly reject manual DNS mode and instruct users to select an alternative supported validation method.
7. Add Menu Item 16: Check Certificate Status / Renew Manually. Allow users to check the remaining validity period and renewal mechanism health at any time, and manually trigger a renewal check.
8. Apply general hardening:
   • Enable set -o pipefail.
   • Download files into a dedicated temporary directory created with mktemp.
   • Perform SHA-256 checksum verification of release packages when a checksum is available.
   • Remove renewal hooks during uninstallation.