1.16.1 — UTF-8-safe TLS lineage convergence

2026-08-22

Repository vhosts with ordinary UTF-8 comments now deploy without losing an issued Certbot lineage, while malformed UTF-8 and Unicode-confusable server names remain fail-closed.

• Preserve valid UTF-8 repository vhost text while overlaying only the proven certificate and private-key paths.
• Keep certificate-path replacement character-safe when multibyte text appears before TLS directives.
• Reject malformed UTF-8 and non-ASCII semantic server_name values, including Unicode hostname confusables.
• Extend the TLS convergence harness for UTF-8 preservation, malformed input, confusable names, idempotence, metadata safety, and snapshot races.