diff --git a/dyntls.sh b/dyntls.sh
index 8aa0376..2caa31c 100644
--- a/dyntls.sh
+++ b/dyntls.sh
@@ -260,7 +260,7 @@ cleanup() {
     [ -n "$DYNTLS_LE_TMP_DIR_session" ] && rm -rf "$DYNTLS_LE_TMP_DIR_session"
 
     # Terminal-Zustand wiederherstellen
-    (stty echo 2>/dev/null) || { (set -o echo 2>/dev/null) && set -o echo; }
+    stty echo 2>/dev/null || true
 
     printf '\n'
 
@@ -422,6 +422,8 @@ _vars_setup() {
 
     if [ -z "$DYNTLS_NO_VARS" ] && [ -n "$vars" ]; then
         DYNTLS_CALLER=1
+        export DYNTLS_CALLER
+        # shellcheck source=/dev/null
         . "$vars"
         notice "Note: using dynTLS configuration from: $vars"
     fi
@@ -784,10 +786,13 @@ _SetupDomainSANList()
 
     # Initialize positional parameters safely
     # Temporarily set IFS to ':' and use set -- to create positional parameters (POSIX compatible)
-    old_ifs="$IFS"
-    IFS=":"
+    old_ifs=$IFS
+    set -f
+    IFS=:
+    # shellcheck disable=SC2086 # Intentional field splitting of DomainAry on ':'
     set -- $DomainAry
-    IFS="$old_ifs"
+    IFS=$old_ifs
+    set +f
 
     # The CN (Common Name) is always the first and added to the SAN list first
     CN="$DYNTLS_MEMBER_HOSTNAME"
@@ -1131,7 +1136,8 @@ _create_cert() {
         rm -f "$out_file_tmp"
     elif [ -f "$out_file_tmp" ]; then
         _log "Temporary certificate file exists, starting validation." 1
-        if openssl x509 -checkend $(($DYNTLS_PKI_CERT_EXPIRE*86400)) -noout -in "$out_file_tmp"; then
+        checkend_seconds=$((DYNTLS_PKI_CERT_EXPIRE * 86400))
+        if openssl x509 -checkend "$checkend_seconds" -noout -in "$out_file_tmp"; then
             _log "The verification of the new certificate was successful. The certificate seems to be valid and it is moved to its destination folder." 2
             _log "New certificate meets minimum validity window (${DYNTLS_PKI_CERT_EXPIRE} days)." 1
             if [ "$DYNTLS_PRODUCTIVE" -eq 1 ]; then
@@ -1153,7 +1159,8 @@ _create_cert() {
                 # Clean old backups if enabled
                 if [ -n "$DYNTLS_BACKUP_EXPIRATION" ] && [ "$DYNTLS_BACKUP_EXPIRATION" -gt 0 ]; then
                     _log "Removing backup files older than $DYNTLS_BACKUP_EXPIRATION days in $BackupDir" 2
-                    find "$BackupDir" -type f -name "*.$DYNTLS_PKI_CERT_SUFFIX-*" -mtime +$DYNTLS_BACKUP_EXPIRATION -exec rm -f {} \;
+                    mtime_arg="+$DYNTLS_BACKUP_EXPIRATION"
+                    find "$BackupDir" -type f -name "*.$DYNTLS_PKI_CERT_SUFFIX-*" -mtime "$mtime_arg" -exec rm -f {} \;
                     if [ -d "$BackupDir" ] && [ -z "$(find "$BackupDir" -type f -name "*.$DYNTLS_PKI_CERT_SUFFIX-*")" ]; then
                         _log "Backup directory $BackupDir is empty; removing it." 2
                         rmdir "$BackupDir"
@@ -1476,9 +1483,9 @@ _update_cert() {
     ###########################
     # 1. Calculate expiration window
     ###########################
-    MyExpSeconds=$((DYNTLS_PKI_CERT_EXPIRE*86400))
+    MyExpSeconds=$((DYNTLS_PKI_CERT_EXPIRE * 86400))
     MyNowDate=$(date +%s)
-    let MyTestTime=$MyNowDate+$MyExpSeconds
+    MyTestTime=$((MyNowDate + MyExpSeconds))
 
     _log "Expiration threshold: ${DYNTLS_PKI_CERT_EXPIRE} days (~until $(date --date="@$MyTestTime" '+%Y-%m-%d'))" 2
     _log "Domain list: $DYNTLS_DOMAIN_LIST" 1
@@ -1575,9 +1582,18 @@ _update_cert() {
     # 5. Mail notification if enabled
     ###########################
     if $DYNTLS_SEND_MAIL; then
-        Subject="Certificate check on $HOSTNAME"
+        : "${MyMailText:=}"
+        : "${MyMailFrom:=}"
+        : "${MyMailAddresses:=}"
+
+        Subject="Certificate check on $(hostname)"
         $MyIsError && Subject="ERROR: $Subject"
-        echo -e "$MyMailText" | mail -s "$Subject" -r "$MyMailFrom" "$MyMailAddresses"
+
+        if [ -n "$MyMailText" ] && [ -n "$MyMailFrom" ] && [ -n "$MyMailAddresses" ]; then
+            printf '%b' "$MyMailText" | mail -s "$Subject" -r "$MyMailFrom" "$MyMailAddresses"
+        else
+            _log "Mail notification enabled, but mail variables are incomplete; skipping mail send." 3
+        fi
     fi
 
     _log "Leave the function '_update_cert()'..." 1
@@ -1635,9 +1651,9 @@ while :; do
                 fi
             fi
             # Normalize domain string
-            # Replace whitespaces with ':' to keep structured domain list
-            # export DYNTLS_DOMAINS=$(echo "$DYNTLS_DOMAINS" | sed -e 's/ */:/g')
-            export DYNTLS_DOMAINS=$(echo "$DYNTLS_DOMAINS" | tr -s ' ' ':')
+            # Replace consecutive spaces with ':' to keep a structured domain list
+            DYNTLS_DOMAINS=$(printf '%s\n' "$DYNTLS_DOMAINS" | tr -s ' ' ':') || _die "Failed to normalize DYNTLS_DOMAINS" 5
+            export DYNTLS_DOMAINS
             ;;
         --key|-K)
             # Accept --key=VAL or --key VAL
@@ -1747,7 +1763,7 @@ trap "exit 14" 15
 #
 # @param1: Command string (e.g., "add-cert")
 _validate_command_params() {
-    local cmd="$1"
+    cmd="$1"
 
     case "$cmd" in
         add-cert)