Remove default CA from --provider, require explicit choice

Mirrors the library's "no hidden defaults" principle. --provider is now
required; omitting it fails with a descriptive error. Updates README table
and adds a test for the missing-provider case.

Author: bashgeek

README.md

@@ -138,7 +138,7 @@ If a valid certificate already exists and expiry is more than `--days` away, the
 | `--domain` | `-d` | — | Domain to include on the certificate. Repeat for SANs: `--domain example.com --domain www.example.com` |
 | `--email` | `-e` | — | Contact email registered with the ACME account |
 | `--webroot` | `-w` | — | Webroot path for HTTP-01. CoyoteCert writes tokens under `.well-known/acme-challenge/` |
-| `--provider` | `-p` | `letsencrypt` | CA to use. See provider table below |
+| `--provider` | `-p` | — | CA to use. See provider table below. **Required** |
 | `--storage` | `-s` | `./certs` | Directory to read/write certificates and account keys |
 | `--days` | — | `30` | Renew when fewer than this many days remain before expiry |
 | `--key-type` | — | `ec256` | Certificate key type: `ec256`, `ec384`, `rsa2048`, `rsa4096` |

src/Console/Command/IssueCommand.php

@@ -27,7 +27,7 @@ protected function configure(): void
             ->addOption('domain', 'd', InputOption::VALUE_REQUIRED | InputOption::VALUE_IS_ARRAY, 'Domain name(s) to include on the certificate')
             ->addOption('email', 'e', InputOption::VALUE_REQUIRED, 'Contact email for the ACME account')
             ->addOption('webroot', 'w', InputOption::VALUE_REQUIRED, 'Webroot path for HTTP-01 challenge (.well-known/acme-challenge will be written here)')
-            ->addOption('provider', 'p', InputOption::VALUE_REQUIRED, 'CA to use: letsencrypt, letsencrypt-staging, zerossl, google, buypass, buypass-staging, sslcom', 'letsencrypt')
+            ->addOption('provider', 'p', InputOption::VALUE_REQUIRED, 'CA to use: letsencrypt, letsencrypt-staging, zerossl, google, buypass, buypass-staging, sslcom')
             ->addOption('storage', 's', InputOption::VALUE_REQUIRED, 'Directory to store certificates and account keys', './certs')
             ->addOption('days', null, InputOption::VALUE_REQUIRED, 'Days before expiry to trigger renewal', '30')
             ->addOption('key-type', null, InputOption::VALUE_REQUIRED, 'Certificate key type: ec256, ec384, rsa2048, rsa4096', 'ec256')
@@ -57,6 +57,12 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             return Command::FAILURE;
         }
 
+        if ($provider === null) {
+            $this->renderError('--provider is required. Supported: letsencrypt, letsencrypt-staging, zerossl, google, buypass, buypass-staging, sslcom.');
+
+            return Command::FAILURE;
+        }
+
         try {
             $acmeProvider = ProviderResolver::resolve(
                 $provider,

tests/Unit/Console/Command/IssueCommandTest.php

@@ -51,6 +51,16 @@ function runIssue(array $input): array
     expect($output)->toContain('--webroot is required');
 });
 
+it('fails when --provider is not provided', function () {
+    [$code, $output] = runIssue([
+        '--domain'  => ['example.com'],
+        '--webroot' => '/tmp',
+    ]);
+
+    expect($code)->toBe(Command::FAILURE);
+    expect($output)->toContain('--provider is required');
+});
+
 it('fails for an unknown --provider', function () {
     [$code, $output] = runIssue([
         '--domain'   => ['example.com'],
@@ -66,6 +76,7 @@ function runIssue(array $input): array
     [$code, $output] = runIssue([
         '--domain'   => ['example.com'],
         '--webroot'  => '/tmp',
+        '--provider' => 'letsencrypt',
         '--key-type' => 'rsa9999',
     ]);
 
@@ -142,9 +153,10 @@ function runStub(mixed $result, array $input = []): array
 {
     $tester = new CommandTester(new StubIssueCommand($result));
     $tester->execute(array_merge([
-        '--domain'  => ['example.com'],
-        '--webroot' => '/tmp',
-        '--storage' => sys_get_temp_dir(),
+        '--domain'   => ['example.com'],
+        '--webroot'  => '/tmp',
+        '--storage'  => sys_get_temp_dir(),
+        '--provider' => 'letsencrypt',
     ], $input));
 
     return [$tester->getStatusCode(), test()->buffer->fetch()];