spotify · gijzelaerr · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026 · Jul 7, 2026
diff --git a/lemur/acme_providers/__init__.py b/lemur/acme_providers/__init__.py
diff --git a/lemur/acme_providers/cli.py b/lemur/acme_providers/cli.py
diff --git a/lemur/authorities/service.py b/lemur/authorities/service.py
@@ -25,20 +25,6 @@
 from lemur.certificates.service import upload
 
 
-def _validate_acme_url_in_options(options_json: str) -> None:
-    # Imported here, rather than at module scope, to avoid a circular import:
-    # lemur.plugins.lemur_acme.acme_handlers imports lemur.authorities.service.
-    from lemur.plugins.lemur_acme.plugin import validate_acme_url
-
-    try:
-        options = json.loads(options_json)
-    except (json.JSONDecodeError, TypeError):
-        return
-    for option in options:
-        if isinstance(option, dict) and option.get("name") == "acme_url":
-            validate_acme_url(option.get("value", ""))
-
-
 def update(authority_id, description, owner, active, roles, options: Optional[str] = None):
     """
     Update an authority with new values.
@@ -54,7 +40,6 @@ def update(authority_id, description, owner, active, roles, options: Optional[st
     authority.description = description
     authority.owner = owner
     if options:
-        _validate_acme_url_in_options(options)
         authority.options = options
 
     log_service.audit_log("update_authority", authority.name, "Updating authority")  # check ui what can be updated
@@ -71,7 +56,6 @@ def update_options(authority_id, options):
     """
     authority = get(authority_id)
 
-    _validate_acme_url_in_options(options)
     authority.options = options
 
     return database.update(authority)

diff --git a/lemur/common/celery.py b/lemur/common/celery.py
@@ -23,7 +23,6 @@
 from lemur.certificates import cli as cli_certificate
 from lemur.certificates import service as certificate_service
 from lemur.common.redis import RedisHandler
-from lemur.constants import ACME_ADDITIONAL_ATTEMPTS
 from lemur.dns_providers import cli as cli_dns_providers
 from lemur.extensions import metrics
 from lemur.factory import create_app
@@ -311,7 +310,7 @@ def fetch_acme_cert(id, notify_reissue_cert_id=None):
             error_log["last_error"] = cert.get("last_error")
             error_log["cn"] = pending_cert.cn
 
-            if pending_cert.number_attempts > ACME_ADDITIONAL_ATTEMPTS:
+            if pending_cert.number_attempts > 2:
                 error_log["message"] = "Deleting pending certificate"
                 send_pending_failure_notification(
                     pending_cert, notify_owner=pending_cert.notify

diff --git a/lemur/common/utils.py b/lemur/common/utils.py
@@ -176,16 +176,6 @@ def get_key_type_from_ec_curve(curve_name):
         ec.SECP384R1().name: "ECCSECP384R1",
         ec.SECP521R1().name: "ECCSECP521R1",
         ec.SECP256K1().name: "ECCSECP256K1",
-        ec.SECT163K1().name: "ECCSECT163K1",
-        ec.SECT233K1().name: "ECCSECT233K1",
-        ec.SECT283K1().name: "ECCSECT283K1",
-        ec.SECT409K1().name: "ECCSECT409K1",
-        ec.SECT571K1().name: "ECCSECT571K1",
-        ec.SECT163R2().name: "ECCSECT163R2",
-        ec.SECT233R1().name: "ECCSECT233R1",
-        ec.SECT283R1().name: "ECCSECT283R1",
-        ec.SECT409R1().name: "ECCSECT409R1",
-        ec.SECT571R1().name: "ECCSECT571R2",
     }
 
     if curve_name in _CURVE_TYPES.keys():
@@ -198,10 +188,8 @@ def generate_private_key(key_type):
     """
     Generates a new private key based on key_type.
 
-    Valid key types: RSA2048, RSA4096', 'ECCPRIME192V1', 'ECCPRIME256V1', 'ECCSECP192R1',
-        'ECCSECP224R1', 'ECCSECP256R1', 'ECCSECP384R1', 'ECCSECP521R1', 'ECCSECP256K1',
-        'ECCSECT163K1', 'ECCSECT233K1', 'ECCSECT283K1', 'ECCSECT409K1', 'ECCSECT571K1',
-        'ECCSECT163R2', 'ECCSECT233R1', 'ECCSECT283R1', 'ECCSECT409R1', 'ECCSECT571R2'
+    Valid key types: RSA2048, RSA4096, ECCPRIME192V1, ECCPRIME256V1, ECCSECP192R1,
+        ECCSECP224R1, ECCSECP256R1, ECCSECP384R1, ECCSECP521R1, ECCSECP256K1
 
     :param key_type:
     :return:
@@ -216,16 +204,6 @@ def generate_private_key(key_type):
         "ECCSECP384R1": ec.SECP384R1(),
         "ECCSECP521R1": ec.SECP521R1(),
         "ECCSECP256K1": ec.SECP256K1(),
-        "ECCSECT163K1": ec.SECT163K1(),
-        "ECCSECT233K1": ec.SECT233K1(),
-        "ECCSECT283K1": ec.SECT283K1(),
-        "ECCSECT409K1": ec.SECT409K1(),
-        "ECCSECT571K1": ec.SECT571K1(),
-        "ECCSECT163R2": ec.SECT163R2(),
-        "ECCSECT233R1": ec.SECT233R1(),
-        "ECCSECT283R1": ec.SECT283R1(),
-        "ECCSECT409R1": ec.SECT409R1(),
-        "ECCSECT571R2": ec.SECT571R1(),
     }
 
     if key_type not in CERTIFICATE_KEY_TYPES:

diff --git a/lemur/constants.py b/lemur/constants.py
@@ -14,9 +14,6 @@
 FAILURE_METRIC_STATUS = "failure"
 
 
-# when ACME attempts to resolve a certificate try in total 3 times
-ACME_ADDITIONAL_ATTEMPTS = 2
-
 CERTIFICATE_KEY_TYPES = [
     "RSA2048",
     "RSA4096",
@@ -28,16 +25,6 @@
     "ECCSECP384R1",
     "ECCSECP521R1",
     "ECCSECP256K1",
-    "ECCSECT163K1",
-    "ECCSECT233K1",
-    "ECCSECT283K1",
-    "ECCSECT409K1",
-    "ECCSECT571K1",
-    "ECCSECT163R2",
-    "ECCSECT233R1",
-    "ECCSECT283R1",
-    "ECCSECT409R1",
-    "ECCSECT571R2",
 ]
 
 # For commonly reused regexes used by plugins

diff --git a/lemur/dns_providers/cli.py b/lemur/dns_providers/cli.py
@@ -1,50 +1,8 @@
-import sys
-
 import click
 from flask.cli import with_appcontext
-from sentry_sdk import capture_exception
-
-from lemur.constants import SUCCESS_METRIC_STATUS
-from lemur.dns_providers.service import get_all_dns_providers, set_domains
-from lemur.extensions import metrics
-from lemur.plugins.lemur_acme.acme_handlers import AcmeDnsHandler
 
 
-@click.group(name="dns_providers", help="Iterates through all DNS providers and sets DNS zones in the database.")
+@click.group(name="dns_providers", help="DNS provider zone management (ACME removed).")
 @with_appcontext
 def cli():
     pass
-
-
-@cli.command("get_all_zones")
-def get_all_zones_command():
-    get_all_zones()
-
-
-def get_all_zones():
-    """
-    Retrieves all DNS providers from the database. Refreshes the zones associated with each DNS provider
-    """
-    click.echo("[+] Starting dns provider zone lookup and configuration.")
-    dns_providers = get_all_dns_providers()
-    acme_dns_handler = AcmeDnsHandler()
-
-    function = f"{__name__}.{sys._getframe().f_code.co_name}"
-    log_data = {
-        "function": function,
-        "message": "",
-    }
-
-    for dns_provider in dns_providers:
-        try:
-            zones = acme_dns_handler.get_all_zones(dns_provider)
-            set_domains(dns_provider, zones)
-        except Exception as e:
-            click.echo(f"[+] Error with DNS Provider {dns_provider.name}: {e}")
-            log_data["message"] = f"get all zones failed for {dns_provider} {e}."
-            capture_exception(extra=log_data)
-
-    status = SUCCESS_METRIC_STATUS
-
-    metrics.send("get_all_zones", "counter", 1, metric_tags={"status": status})
-    click.echo("[+] Done with dns provider zone lookup and configuration.")