acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.9.0
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/acmesh-official/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12
  13 _WINDOWS_SCHEDULER_NAME="$PROJECT_NAME.cron"
  14
  15 _SCRIPT_="$0"
  16
  17 _SUB_FOLDER_NOTIFY="notify"
  18 _SUB_FOLDER_DNSAPI="dnsapi"
  19 _SUB_FOLDER_DEPLOY="deploy"
  20
  21 _SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
  22
  23 CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory"
  24 CA_LETSENCRYPT_V2_TEST="https://acme-staging-v02.api.letsencrypt.org/directory"
  25
  26 CA_BUYPASS="https://api.buypass.com/acme/directory"
  27 CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory"
  28
  29 CA_ZEROSSL="https://acme.zerossl.com/v2/DV90"
  30 _ZERO_EAB_ENDPOINT="http://api.zerossl.com/acme/eab-credentials-email"
  31
  32 DEFAULT_CA=$CA_LETSENCRYPT_V2
  33 DEFAULT_STAGING_CA=$CA_LETSENCRYPT_V2_TEST
  34
  35 CA_NAMES="
  36 LetsEncrypt.org,letsencrypt
  37 LetsEncrypt.org_test,letsencrypt_test,letsencrypttest
  38 BuyPass.com,buypass
  39 BuyPass.com_test,buypass_test,buypasstest
  40 ZeroSSL.com,zerossl
  41 "
  42
  43 CA_SERVERS="$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_ZEROSSL"
  44
  45 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  46
  47 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  48 DEFAULT_DOMAIN_KEY_LENGTH=2048
  49
  50 DEFAULT_OPENSSL_BIN="openssl"
  51
  52 VTYPE_HTTP="http-01"
  53 VTYPE_DNS="dns-01"
  54 VTYPE_ALPN="tls-alpn-01"
  55
  56 LOCAL_ANY_ADDRESS="0.0.0.0"
  57
  58 DEFAULT_RENEW=60
  59
  60 NO_VALUE="no"
  61
  62 W_DNS="dns"
  63 W_ALPN="alpn"
  64 DNS_ALIAS_PREFIX="="
  65
  66 MODE_STATELESS="stateless"
  67
  68 STATE_VERIFIED="verified_ok"
  69
  70 NGINX="nginx:"
  71 NGINX_START="#ACME_NGINX_START"
  72 NGINX_END="#ACME_NGINX_END"
  73
  74 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  75 END_CSR="-----END CERTIFICATE REQUEST-----"
  76
  77 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  78 END_CERT="-----END CERTIFICATE-----"
  79
  80 CONTENT_TYPE_JSON="application/jose+json"
  81 RENEW_SKIP=2
  82
  83 B64CONF_START="__ACME_BASE64__START_"
  84 B64CONF_END="__ACME_BASE64__END_"
  85
  86 ECC_SEP="_"
  87 ECC_SUFFIX="${ECC_SEP}ecc"
  88
  89 LOG_LEVEL_1=1
  90 LOG_LEVEL_2=2
  91 LOG_LEVEL_3=3
  92 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  93
  94 DEBUG_LEVEL_1=1
  95 DEBUG_LEVEL_2=2
  96 DEBUG_LEVEL_3=3
  97 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  98 DEBUG_LEVEL_NONE=0
  99
 100 DOH_CLOUDFLARE=1
 101 DOH_GOOGLE=2
 102 DOH_ALI=3
 103 DOH_DP=4
 104
 105 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
 106
 107 SYSLOG_ERROR="user.error"
 108 SYSLOG_INFO="user.info"
 109 SYSLOG_DEBUG="user.debug"
 110
 111 #error
 112 SYSLOG_LEVEL_ERROR=3
 113 #info
 114 SYSLOG_LEVEL_INFO=6
 115 #debug
 116 SYSLOG_LEVEL_DEBUG=7
 117 #debug2
 118 SYSLOG_LEVEL_DEBUG_2=8
 119 #debug3
 120 SYSLOG_LEVEL_DEBUG_3=9
 121
 122 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
 123 #none
 124 SYSLOG_LEVEL_NONE=0
 125
 126 NOTIFY_LEVEL_DISABLE=0
 127 NOTIFY_LEVEL_ERROR=1
 128 NOTIFY_LEVEL_RENEW=2
 129 NOTIFY_LEVEL_SKIP=3
 130
 131 NOTIFY_LEVEL_DEFAULT=$NOTIFY_LEVEL_RENEW
 132
 133 NOTIFY_MODE_BULK=0
 134 NOTIFY_MODE_CERT=1
 135
 136 NOTIFY_MODE_DEFAULT=$NOTIFY_MODE_BULK
 137
 138 _DEBUG_WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh"
 139
 140 _PREPARE_LINK="https://github.com/acmesh-official/acme.sh/wiki/Install-preparations"
 141
 142 _STATELESS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode"
 143
 144 _DNS_ALIAS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode"
 145
 146 _DNS_MANUAL_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode"
 147
 148 _DNS_API_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dnsapi"
 149
 150 _NOTIFY_WIKI="https://github.com/acmesh-official/acme.sh/wiki/notify"
 151
 152 _SUDO_WIKI="https://github.com/acmesh-official/acme.sh/wiki/sudo"
 153
 154 _REVOKE_WIKI="https://github.com/acmesh-official/acme.sh/wiki/revokecert"
 155
 156 _ZEROSSL_WIKI="https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA"
 157
 158 _SERVER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Server"
 159
 160 _PREFERRED_CHAIN_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
 161
 162 _DNSCHECK_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dnscheck"
 163
 164 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 165
 166 _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
 167
 168 _DNS_MANUAL_ERROR="It seems that you are using dns manual mode. Read this link first: $_DNS_MANUAL_WIKI"
 169
 170 __INTERACTIVE=""
 171 if [ -t 1 ]; then
 172   __INTERACTIVE="1"
 173 fi
 174
 175 __green() {
 176   if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
 177     printf '\33[1;32m%b\33[0m' "$1"
 178     return
 179   fi
 180   printf -- "%b" "$1"
 181 }
 182
 183 __red() {
 184   if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
 185     printf '\33[1;31m%b\33[0m' "$1"
 186     return
 187   fi
 188   printf -- "%b" "$1"
 189 }
 190
 191 _printargs() {
 192   _exitstatus="$?"
 193   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 194     printf -- "%s" "[$(date)] "
 195   fi
 196   if [ -z "$2" ]; then
 197     printf -- "%s" "$1"
 198   else
 199     printf -- "%s" "$1='$2'"
 200   fi
 201   printf "\n"
 202   # return the saved exit status
 203   return "$_exitstatus"
 204 }
 205
 206 _dlg_versions() {
 207   echo "Diagnosis versions: "
 208   echo "openssl:$ACME_OPENSSL_BIN"
 209   if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
 210     ${ACME_OPENSSL_BIN:-openssl} version 2>&1
 211   else
 212     echo "$ACME_OPENSSL_BIN doesn't exist."
 213   fi
 214
 215   echo "apache:"
 216   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 217     $_APACHECTL -V 2>&1
 218   else
 219     echo "apache doesn't exist."
 220   fi
 221
 222   echo "nginx:"
 223   if _exists "nginx"; then
 224     nginx -V 2>&1
 225   else
 226     echo "nginx doesn't exist."
 227   fi
 228
 229   echo "socat:"
 230   if _exists "socat"; then
 231     socat -V 2>&1
 232   else
 233     _debug "socat doesn't exist."
 234   fi
 235 }
 236
 237 #class
 238 _syslog() {
 239   _exitstatus="$?"
 240   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 241     return
 242   fi
 243   _logclass="$1"
 244   shift
 245   if [ -z "$__logger_i" ]; then
 246     if _contains "$(logger --help 2>&1)" "-i"; then
 247       __logger_i="logger -i"
 248     else
 249       __logger_i="logger"
 250     fi
 251   fi
 252   $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 253   return "$_exitstatus"
 254 }
 255
 256 _log() {
 257   [ -z "$LOG_FILE" ] && return
 258   _printargs "$@" >>"$LOG_FILE"
 259 }
 260
 261 _info() {
 262   _log "$@"
 263   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 264     _syslog "$SYSLOG_INFO" "$@"
 265   fi
 266   _printargs "$@"
 267 }
 268
 269 _err() {
 270   _syslog "$SYSLOG_ERROR" "$@"
 271   _log "$@"
 272   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 273     printf -- "%s" "[$(date)] " >&2
 274   fi
 275   if [ -z "$2" ]; then
 276     __red "$1" >&2
 277   else
 278     __red "$1='$2'" >&2
 279   fi
 280   printf "\n" >&2
 281   return 1
 282 }
 283
 284 _usage() {
 285   __red "$@" >&2
 286   printf "\n" >&2
 287 }
 288
 289 __debug_bash_helper() {
 290   # At this point only do for --debug 3
 291   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -lt "$DEBUG_LEVEL_3" ]; then
 292     return
 293   fi
 294   # Return extra debug info when running with bash, otherwise return empty
 295   # string.
 296   if [ -z "${BASH_VERSION}" ]; then
 297     return
 298   fi
 299   # We are a bash shell at this point, return the filename, function name, and
 300   # line number as a string
 301   _dbh_saveIFS=$IFS
 302   IFS=" "
 303   # Must use eval or syntax error happens under dash. The eval should use
 304   # single quotes as older versions of busybox had a bug with double quotes and
 305   # eval.
 306   # Use 'caller 1' as we want one level up the stack as we should be called
 307   # by one of the _debug* functions
 308   eval '_dbh_called=($(caller 1))'
 309   IFS=$_dbh_saveIFS
 310   eval '_dbh_file=${_dbh_called[2]}'
 311   if [ -n "${_script_home}" ]; then
 312     # Trim off the _script_home directory name
 313     eval '_dbh_file=${_dbh_file#$_script_home/}'
 314   fi
 315   eval '_dbh_function=${_dbh_called[1]}'
 316   eval '_dbh_lineno=${_dbh_called[0]}'
 317   printf "%-40s " "$_dbh_file:${_dbh_function}:${_dbh_lineno}"
 318 }
 319
 320 _debug() {
 321   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 322     _log "$@"
 323   fi
 324   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 325     _syslog "$SYSLOG_DEBUG" "$@"
 326   fi
 327   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 328     _bash_debug=$(__debug_bash_helper)
 329     _printargs "${_bash_debug}$@" >&2
 330   fi
 331 }
 332
 333 #output the sensitive messages
 334 _secure_debug() {
 335   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 336     if [ "$OUTPUT_INSECURE" = "1" ]; then
 337       _log "$@"
 338     else
 339       _log "$1" "$HIDDEN_VALUE"
 340     fi
 341   fi
 342   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 343     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 344   fi
 345   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 346     if [ "$OUTPUT_INSECURE" = "1" ]; then
 347       _printargs "$@" >&2
 348     else
 349       _printargs "$1" "$HIDDEN_VALUE" >&2
 350     fi
 351   fi
 352 }
 353
 354 _debug2() {
 355   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 356     _log "$@"
 357   fi
 358   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 359     _syslog "$SYSLOG_DEBUG" "$@"
 360   fi
 361   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 362     _bash_debug=$(__debug_bash_helper)
 363     _printargs "${_bash_debug}$@" >&2
 364   fi
 365 }
 366
 367 _secure_debug2() {
 368   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 369     if [ "$OUTPUT_INSECURE" = "1" ]; then
 370       _log "$@"
 371     else
 372       _log "$1" "$HIDDEN_VALUE"
 373     fi
 374   fi
 375   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 376     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 377   fi
 378   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 379     if [ "$OUTPUT_INSECURE" = "1" ]; then
 380       _printargs "$@" >&2
 381     else
 382       _printargs "$1" "$HIDDEN_VALUE" >&2
 383     fi
 384   fi
 385 }
 386
 387 _debug3() {
 388   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 389     _log "$@"
 390   fi
 391   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 392     _syslog "$SYSLOG_DEBUG" "$@"
 393   fi
 394   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 395     _bash_debug=$(__debug_bash_helper)
 396     _printargs "${_bash_debug}$@" >&2
 397   fi
 398 }
 399
 400 _secure_debug3() {
 401   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 402     if [ "$OUTPUT_INSECURE" = "1" ]; then
 403       _log "$@"
 404     else
 405       _log "$1" "$HIDDEN_VALUE"
 406     fi
 407   fi
 408   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 409     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 410   fi
 411   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 412     if [ "$OUTPUT_INSECURE" = "1" ]; then
 413       _printargs "$@" >&2
 414     else
 415       _printargs "$1" "$HIDDEN_VALUE" >&2
 416     fi
 417   fi
 418 }
 419
 420 _upper_case() {
 421   # shellcheck disable=SC2018,SC2019
 422   tr 'a-z' 'A-Z'
 423 }
 424
 425 _lower_case() {
 426   # shellcheck disable=SC2018,SC2019
 427   tr 'A-Z' 'a-z'
 428 }
 429
 430 _startswith() {
 431   _str="$1"
 432   _sub="$2"
 433   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 434 }
 435
 436 _endswith() {
 437   _str="$1"
 438   _sub="$2"
 439   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 440 }
 441
 442 _contains() {
 443   _str="$1"
 444   _sub="$2"
 445   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 446 }
 447
 448 _hasfield() {
 449   _str="$1"
 450   _field="$2"
 451   _sep="$3"
 452   if [ -z "$_field" ]; then
 453     _usage "Usage: str field  [sep]"
 454     return 1
 455   fi
 456
 457   if [ -z "$_sep" ]; then
 458     _sep=","
 459   fi
 460
 461   for f in $(echo "$_str" | tr "$_sep" ' '); do
 462     if [ "$f" = "$_field" ]; then
 463       _debug2 "'$_str' contains '$_field'"
 464       return 0 #contains ok
 465     fi
 466   done
 467   _debug2 "'$_str' does not contain '$_field'"
 468   return 1 #not contains
 469 }
 470
 471 # str index [sep]
 472 _getfield() {
 473   _str="$1"
 474   _findex="$2"
 475   _sep="$3"
 476
 477   if [ -z "$_findex" ]; then
 478     _usage "Usage: str field  [sep]"
 479     return 1
 480   fi
 481
 482   if [ -z "$_sep" ]; then
 483     _sep=","
 484   fi
 485
 486   _ffi="$_findex"
 487   while [ "$_ffi" -gt "0" ]; do
 488     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 489     if [ "$_fv" ]; then
 490       printf -- "%s" "$_fv"
 491       return 0
 492     fi
 493     _ffi="$(_math "$_ffi" - 1)"
 494   done
 495
 496   printf -- "%s" "$_str"
 497
 498 }
 499
 500 _exists() {
 501   cmd="$1"
 502   if [ -z "$cmd" ]; then
 503     _usage "Usage: _exists cmd"
 504     return 1
 505   fi
 506
 507   if eval type type >/dev/null 2>&1; then
 508     eval type "$cmd" >/dev/null 2>&1
 509   elif command >/dev/null 2>&1; then
 510     command -v "$cmd" >/dev/null 2>&1
 511   else
 512     which "$cmd" >/dev/null 2>&1
 513   fi
 514   ret="$?"
 515   _debug3 "$cmd exists=$ret"
 516   return $ret
 517 }
 518
 519 #a + b
 520 _math() {
 521   _m_opts="$@"
 522   printf "%s" "$(($_m_opts))"
 523 }
 524
 525 _h_char_2_dec() {
 526   _ch=$1
 527   case "${_ch}" in
 528   a | A)
 529     printf "10"
 530     ;;
 531   b | B)
 532     printf "11"
 533     ;;
 534   c | C)
 535     printf "12"
 536     ;;
 537   d | D)
 538     printf "13"
 539     ;;
 540   e | E)
 541     printf "14"
 542     ;;
 543   f | F)
 544     printf "15"
 545     ;;
 546   *)
 547     printf "%s" "$_ch"
 548     ;;
 549   esac
 550
 551 }
 552
 553 _URGLY_PRINTF=""
 554 if [ "$(printf '\x41')" != 'A' ]; then
 555   _URGLY_PRINTF=1
 556 fi
 557
 558 _ESCAPE_XARGS=""
 559 if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
 560   _ESCAPE_XARGS=1
 561 fi
 562
 563 _h2b() {
 564   if _exists xxd; then
 565     if _contains "$(xxd --help 2>&1)" "assumes -c30"; then
 566       if xxd -r -p -c 9999 2>/dev/null; then
 567         return
 568       fi
 569     else
 570       if xxd -r -p 2>/dev/null; then
 571         return
 572       fi
 573     fi
 574   fi
 575
 576   hex=$(cat)
 577   ic=""
 578   jc=""
 579   _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
 580   if [ -z "$_URGLY_PRINTF" ]; then
 581     if [ "$_ESCAPE_XARGS" ] && _exists xargs; then
 582       _debug2 "xargs"
 583       echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
 584     else
 585       for h in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
 586         if [ -z "$h" ]; then
 587           break
 588         fi
 589         printf "\x$h%s"
 590       done
 591     fi
 592   else
 593     for c in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
 594       if [ -z "$ic" ]; then
 595         ic=$c
 596         continue
 597       fi
 598       jc=$c
 599       ic="$(_h_char_2_dec "$ic")"
 600       jc="$(_h_char_2_dec "$jc")"
 601       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 602       ic=""
 603       jc=""
 604     done
 605   fi
 606
 607 }
 608
 609 _is_solaris() {
 610   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 611 }
 612
 613 #_ascii_hex str
 614 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 615 _ascii_hex() {
 616   _debug2 "Using _ascii_hex"
 617   _str="$1"
 618   _str_len=${#_str}
 619   _h_i=1
 620   while [ "$_h_i" -le "$_str_len" ]; do
 621     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 622     printf " %02x" "'$_str_c"
 623     _h_i="$(_math "$_h_i" + 1)"
 624   done
 625 }
 626
 627 #stdin  output hexstr splited by one space
 628 #input:"abc"
 629 #output: " 61 62 63"
 630 _hex_dump() {
 631   if _exists od; then
 632     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 633   elif _exists hexdump; then
 634     _debug3 "using hexdump"
 635     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 636   elif _exists xxd; then
 637     _debug3 "using xxd"
 638     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 639   else
 640     _debug3 "using _ascii_hex"
 641     str=$(cat)
 642     _ascii_hex "$str"
 643   fi
 644 }
 645
 646 #url encode, no-preserved chars
 647 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 648 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 649
 650 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 651 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 652
 653 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 654 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 655
 656 #stdin stdout
 657 _url_encode() {
 658   _hex_str=$(_hex_dump)
 659   _debug3 "_url_encode"
 660   _debug3 "_hex_str" "$_hex_str"
 661   for _hex_code in $_hex_str; do
 662     #upper case
 663     case "${_hex_code}" in
 664     "41")
 665       printf "%s" "A"
 666       ;;
 667     "42")
 668       printf "%s" "B"
 669       ;;
 670     "43")
 671       printf "%s" "C"
 672       ;;
 673     "44")
 674       printf "%s" "D"
 675       ;;
 676     "45")
 677       printf "%s" "E"
 678       ;;
 679     "46")
 680       printf "%s" "F"
 681       ;;
 682     "47")
 683       printf "%s" "G"
 684       ;;
 685     "48")
 686       printf "%s" "H"
 687       ;;
 688     "49")
 689       printf "%s" "I"
 690       ;;
 691     "4a")
 692       printf "%s" "J"
 693       ;;
 694     "4b")
 695       printf "%s" "K"
 696       ;;
 697     "4c")
 698       printf "%s" "L"
 699       ;;
 700     "4d")
 701       printf "%s" "M"
 702       ;;
 703     "4e")
 704       printf "%s" "N"
 705       ;;
 706     "4f")
 707       printf "%s" "O"
 708       ;;
 709     "50")
 710       printf "%s" "P"
 711       ;;
 712     "51")
 713       printf "%s" "Q"
 714       ;;
 715     "52")
 716       printf "%s" "R"
 717       ;;
 718     "53")
 719       printf "%s" "S"
 720       ;;
 721     "54")
 722       printf "%s" "T"
 723       ;;
 724     "55")
 725       printf "%s" "U"
 726       ;;
 727     "56")
 728       printf "%s" "V"
 729       ;;
 730     "57")
 731       printf "%s" "W"
 732       ;;
 733     "58")
 734       printf "%s" "X"
 735       ;;
 736     "59")
 737       printf "%s" "Y"
 738       ;;
 739     "5a")
 740       printf "%s" "Z"
 741       ;;
 742
 743       #lower case
 744     "61")
 745       printf "%s" "a"
 746       ;;
 747     "62")
 748       printf "%s" "b"
 749       ;;
 750     "63")
 751       printf "%s" "c"
 752       ;;
 753     "64")
 754       printf "%s" "d"
 755       ;;
 756     "65")
 757       printf "%s" "e"
 758       ;;
 759     "66")
 760       printf "%s" "f"
 761       ;;
 762     "67")
 763       printf "%s" "g"
 764       ;;
 765     "68")
 766       printf "%s" "h"
 767       ;;
 768     "69")
 769       printf "%s" "i"
 770       ;;
 771     "6a")
 772       printf "%s" "j"
 773       ;;
 774     "6b")
 775       printf "%s" "k"
 776       ;;
 777     "6c")
 778       printf "%s" "l"
 779       ;;
 780     "6d")
 781       printf "%s" "m"
 782       ;;
 783     "6e")
 784       printf "%s" "n"
 785       ;;
 786     "6f")
 787       printf "%s" "o"
 788       ;;
 789     "70")
 790       printf "%s" "p"
 791       ;;
 792     "71")
 793       printf "%s" "q"
 794       ;;
 795     "72")
 796       printf "%s" "r"
 797       ;;
 798     "73")
 799       printf "%s" "s"
 800       ;;
 801     "74")
 802       printf "%s" "t"
 803       ;;
 804     "75")
 805       printf "%s" "u"
 806       ;;
 807     "76")
 808       printf "%s" "v"
 809       ;;
 810     "77")
 811       printf "%s" "w"
 812       ;;
 813     "78")
 814       printf "%s" "x"
 815       ;;
 816     "79")
 817       printf "%s" "y"
 818       ;;
 819     "7a")
 820       printf "%s" "z"
 821       ;;
 822       #numbers
 823     "30")
 824       printf "%s" "0"
 825       ;;
 826     "31")
 827       printf "%s" "1"
 828       ;;
 829     "32")
 830       printf "%s" "2"
 831       ;;
 832     "33")
 833       printf "%s" "3"
 834       ;;
 835     "34")
 836       printf "%s" "4"
 837       ;;
 838     "35")
 839       printf "%s" "5"
 840       ;;
 841     "36")
 842       printf "%s" "6"
 843       ;;
 844     "37")
 845       printf "%s" "7"
 846       ;;
 847     "38")
 848       printf "%s" "8"
 849       ;;
 850     "39")
 851       printf "%s" "9"
 852       ;;
 853     "2d")
 854       printf "%s" "-"
 855       ;;
 856     "5f")
 857       printf "%s" "_"
 858       ;;
 859     "2e")
 860       printf "%s" "."
 861       ;;
 862     "7e")
 863       printf "%s" "~"
 864       ;;
 865     #other hex
 866     *)
 867       printf '%%%s' "$_hex_code"
 868       ;;
 869     esac
 870   done
 871 }
 872
 873 _json_encode() {
 874   _j_str="$(sed 's/"/\\"/g' | sed "s/\r/\\r/g")"
 875   _debug3 "_json_encode"
 876   _debug3 "_j_str" "$_j_str"
 877   echo "$_j_str" | _hex_dump | _lower_case | sed 's/0a/5c 6e/g' | tr -d ' ' | _h2b | tr -d "\r\n"
 878 }
 879
 880 #from: http:\/\/  to http://
 881 _json_decode() {
 882   _j_str="$(sed 's#\\/#/#g')"
 883   _debug3 "_json_decode"
 884   _debug3 "_j_str" "$_j_str"
 885   echo "$_j_str"
 886 }
 887
 888 #options file
 889 _sed_i() {
 890   options="$1"
 891   filename="$2"
 892   if [ -z "$filename" ]; then
 893     _usage "Usage:_sed_i options filename"
 894     return 1
 895   fi
 896   _debug2 options "$options"
 897   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 898     _debug "Using sed  -i"
 899     sed -i "$options" "$filename"
 900   else
 901     _debug "No -i support in sed"
 902     text="$(cat "$filename")"
 903     echo "$text" | sed "$options" >"$filename"
 904   fi
 905 }
 906
 907 _egrep_o() {
 908   if ! egrep -o "$1" 2>/dev/null; then
 909     sed -n 's/.*\('"$1"'\).*/\1/p'
 910   fi
 911 }
 912
 913 #Usage: file startline endline
 914 _getfile() {
 915   filename="$1"
 916   startline="$2"
 917   endline="$3"
 918   if [ -z "$endline" ]; then
 919     _usage "Usage: file startline endline"
 920     return 1
 921   fi
 922
 923   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 924   if [ -z "$i" ]; then
 925     _err "Can not find start line: $startline"
 926     return 1
 927   fi
 928   i="$(_math "$i" + 1)"
 929   _debug i "$i"
 930
 931   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 932   if [ -z "$j" ]; then
 933     _err "Can not find end line: $endline"
 934     return 1
 935   fi
 936   j="$(_math "$j" - 1)"
 937   _debug j "$j"
 938
 939   sed -n "$i,${j}p" "$filename"
 940
 941 }
 942
 943 #Usage: multiline
 944 _base64() {
 945   [ "" ] #urgly
 946   if [ "$1" ]; then
 947     _debug3 "base64 multiline:'$1'"
 948     ${ACME_OPENSSL_BIN:-openssl} base64 -e
 949   else
 950     _debug3 "base64 single line."
 951     ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
 952   fi
 953 }
 954
 955 #Usage: multiline
 956 _dbase64() {
 957   if [ "$1" ]; then
 958     ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
 959   else
 960     ${ACME_OPENSSL_BIN:-openssl} base64 -d
 961   fi
 962 }
 963
 964 #file
 965 _checkcert() {
 966   _cf="$1"
 967   if [ "$DEBUG" ]; then
 968     ${ACME_OPENSSL_BIN:-openssl} x509 -noout -text -in "$_cf"
 969   else
 970     ${ACME_OPENSSL_BIN:-openssl} x509 -noout -text -in "$_cf" >/dev/null 2>&1
 971   fi
 972 }
 973
 974 #Usage: hashalg  [outputhex]
 975 #Output Base64-encoded digest
 976 _digest() {
 977   alg="$1"
 978   if [ -z "$alg" ]; then
 979     _usage "Usage: _digest hashalg"
 980     return 1
 981   fi
 982
 983   outputhex="$2"
 984
 985   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 986     if [ "$outputhex" ]; then
 987       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 988     else
 989       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
 990     fi
 991   else
 992     _err "$alg is not supported yet"
 993     return 1
 994   fi
 995
 996 }
 997
 998 #Usage: hashalg  secret_hex  [outputhex]
 999 #Output binary hmac
1000 _hmac() {
1001   alg="$1"
1002   secret_hex="$2"
1003   outputhex="$3"
1004
1005   if [ -z "$secret_hex" ]; then
1006     _usage "Usage: _hmac hashalg secret [outputhex]"
1007     return 1
1008   fi
1009
1010   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
1011     if [ "$outputhex" ]; then
1012       (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
1013     else
1014       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
1015     fi
1016   else
1017     _err "$alg is not supported yet"
1018     return 1
1019   fi
1020
1021 }
1022
1023 #Usage: keyfile hashalg
1024 #Output: Base64-encoded signature value
1025 _sign() {
1026   keyfile="$1"
1027   alg="$2"
1028   if [ -z "$alg" ]; then
1029     _usage "Usage: _sign keyfile hashalg"
1030     return 1
1031   fi
1032
1033   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
1034
1035   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1 || grep "BEGIN PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1036     $_sign_openssl -$alg | _base64
1037   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1038     if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
1039       _err "Sign failed: $_sign_openssl"
1040       _err "Key file: $keyfile"
1041       _err "Key content:$(wc -l <"$keyfile") lines"
1042       return 1
1043     fi
1044     _debug3 "_signedECText" "$_signedECText"
1045     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
1046     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
1047     if [ "$__ECC_KEY_LEN" -eq "256" ]; then
1048       while [ "${#_ec_r}" -lt "64" ]; do
1049         _ec_r="0${_ec_r}"
1050       done
1051       while [ "${#_ec_s}" -lt "64" ]; do
1052         _ec_s="0${_ec_s}"
1053       done
1054     fi
1055     if [ "$__ECC_KEY_LEN" -eq "384" ]; then
1056       while [ "${#_ec_r}" -lt "96" ]; do
1057         _ec_r="0${_ec_r}"
1058       done
1059       while [ "${#_ec_s}" -lt "96" ]; do
1060         _ec_s="0${_ec_s}"
1061       done
1062     fi
1063     if [ "$__ECC_KEY_LEN" -eq "512" ]; then
1064       while [ "${#_ec_r}" -lt "132" ]; do
1065         _ec_r="0${_ec_r}"
1066       done
1067       while [ "${#_ec_s}" -lt "132" ]; do
1068         _ec_s="0${_ec_s}"
1069       done
1070     fi
1071     _debug3 "_ec_r" "$_ec_r"
1072     _debug3 "_ec_s" "$_ec_s"
1073     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
1074   else
1075     _err "Unknown key file format."
1076     return 1
1077   fi
1078
1079 }
1080
1081 #keylength or isEcc flag (empty str => not ecc)
1082 _isEccKey() {
1083   _length="$1"
1084
1085   if [ -z "$_length" ]; then
1086     return 1
1087   fi
1088
1089   [ "$_length" != "1024" ] &&
1090     [ "$_length" != "2048" ] &&
1091     [ "$_length" != "3072" ] &&
1092     [ "$_length" != "4096" ] &&
1093     [ "$_length" != "8192" ]
1094 }
1095
1096 # _createkey  2048|ec-256   file
1097 _createkey() {
1098   length="$1"
1099   f="$2"
1100   _debug2 "_createkey for file:$f"
1101   eccname="$length"
1102   if _startswith "$length" "ec-"; then
1103     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
1104
1105     if [ "$length" = "256" ]; then
1106       eccname="prime256v1"
1107     fi
1108     if [ "$length" = "384" ]; then
1109       eccname="secp384r1"
1110     fi
1111     if [ "$length" = "521" ]; then
1112       eccname="secp521r1"
1113     fi
1114
1115   fi
1116
1117   if [ -z "$length" ]; then
1118     length=2048
1119   fi
1120
1121   _debug "Use length $length"
1122
1123   if ! touch "$f" >/dev/null 2>&1; then
1124     _f_path="$(dirname "$f")"
1125     _debug _f_path "$_f_path"
1126     if ! mkdir -p "$_f_path"; then
1127       _err "Can not create path: $_f_path"
1128       return 1
1129     fi
1130   fi
1131
1132   if _isEccKey "$length"; then
1133     _debug "Using ec name: $eccname"
1134     if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -noout -genkey 2>/dev/null)"; then
1135       echo "$_opkey" >"$f"
1136     else
1137       _err "error ecc key name: $eccname"
1138       return 1
1139     fi
1140   else
1141     _debug "Using RSA: $length"
1142     __traditional=""
1143     if _contains "$(${ACME_OPENSSL_BIN:-openssl} help genrsa 2>&1)" "-traditional"; then
1144       __traditional="-traditional"
1145     fi
1146     if _opkey="$(${ACME_OPENSSL_BIN:-openssl} genrsa $__traditional "$length" 2>/dev/null)"; then
1147       echo "$_opkey" >"$f"
1148     else
1149       _err "error rsa key: $length"
1150       return 1
1151     fi
1152   fi
1153
1154   if [ "$?" != "0" ]; then
1155     _err "Create key error."
1156     return 1
1157   fi
1158 }
1159
1160 #domain
1161 _is_idn() {
1162   _is_idn_d="$1"
1163   _debug2 _is_idn_d "$_is_idn_d"
1164   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '*.,-_')
1165   _debug2 _idn_temp "$_idn_temp"
1166   [ "$_idn_temp" ]
1167 }
1168
1169 #aa.com
1170 #aa.com,bb.com,cc.com
1171 _idn() {
1172   __idn_d="$1"
1173   if ! _is_idn "$__idn_d"; then
1174     printf "%s" "$__idn_d"
1175     return 0
1176   fi
1177
1178   if _exists idn; then
1179     if _contains "$__idn_d" ','; then
1180       _i_first="1"
1181       for f in $(echo "$__idn_d" | tr ',' ' '); do
1182         [ -z "$f" ] && continue
1183         if [ -z "$_i_first" ]; then
1184           printf "%s" ","
1185         else
1186           _i_first=""
1187         fi
1188         idn --quiet "$f" | tr -d "\r\n"
1189       done
1190     else
1191       idn "$__idn_d" | tr -d "\r\n"
1192     fi
1193   else
1194     _err "Please install idn to process IDN names."
1195   fi
1196 }
1197
1198 #_createcsr  cn  san_list  keyfile csrfile conf acmeValidationv1
1199 _createcsr() {
1200   _debug _createcsr
1201   domain="$1"
1202   domainlist="$2"
1203   csrkey="$3"
1204   csr="$4"
1205   csrconf="$5"
1206   acmeValidationv1="$6"
1207   _debug2 domain "$domain"
1208   _debug2 domainlist "$domainlist"
1209   _debug2 csrkey "$csrkey"
1210   _debug2 csr "$csr"
1211   _debug2 csrconf "$csrconf"
1212
1213   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1214
1215   if [ "$acmeValidationv1" ]; then
1216     domainlist="$(_idn "$domainlist")"
1217     printf -- "\nsubjectAltName=DNS:$domainlist" >>"$csrconf"
1218   elif [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1219     #single domain
1220     _info "Single domain" "$domain"
1221     printf -- "\nsubjectAltName=DNS:$(_idn "$domain")" >>"$csrconf"
1222   else
1223     domainlist="$(_idn "$domainlist")"
1224     _debug2 domainlist "$domainlist"
1225     if _contains "$domainlist" ","; then
1226       alt="DNS:$(_idn "$domain"),DNS:$(echo "$domainlist" | sed "s/,,/,/g" | sed "s/,/,DNS:/g")"
1227     else
1228       alt="DNS:$(_idn "$domain"),DNS:$domainlist"
1229     fi
1230     #multi
1231     _info "Multi domain" "$alt"
1232     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1233   fi
1234   if [ "$Le_OCSP_Staple" = "1" ]; then
1235     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1236     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1237   fi
1238
1239   if [ "$acmeValidationv1" ]; then
1240     printf "\n1.3.6.1.5.5.7.1.31=critical,DER:04:20:${acmeValidationv1}" >>"${csrconf}"
1241   fi
1242
1243   _csr_cn="$(_idn "$domain")"
1244   _debug2 _csr_cn "$_csr_cn"
1245   if _contains "$(uname -a)" "MINGW"; then
1246     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1247   else
1248     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1249   fi
1250 }
1251
1252 #_signcsr key  csr  conf cert
1253 _signcsr() {
1254   key="$1"
1255   csr="$2"
1256   conf="$3"
1257   cert="$4"
1258   _debug "_signcsr"
1259
1260   _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1261   _ret="$?"
1262   _debug "$_msg"
1263   return $_ret
1264 }
1265
1266 #_csrfile
1267 _readSubjectFromCSR() {
1268   _csrfile="$1"
1269   if [ -z "$_csrfile" ]; then
1270     _usage "_readSubjectFromCSR mycsr.csr"
1271     return 1
1272   fi
1273   ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | tr ',' "\n" | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
1274 }
1275
1276 #_csrfile
1277 #echo comma separated domain list
1278 _readSubjectAltNamesFromCSR() {
1279   _csrfile="$1"
1280   if [ -z "$_csrfile" ]; then
1281     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1282     return 1
1283   fi
1284
1285   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1286   _debug _csrsubj "$_csrsubj"
1287
1288   _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1289   _debug _dnsAltnames "$_dnsAltnames"
1290
1291   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1292     _debug "AltNames contains subject"
1293     _excapedAlgnames="$(echo "$_dnsAltnames" | tr '*' '#')"
1294     _debug _excapedAlgnames "$_excapedAlgnames"
1295     _escapedSubject="$(echo "$_csrsubj" | tr '*' '#')"
1296     _debug _escapedSubject "$_escapedSubject"
1297     _dnsAltnames="$(echo "$_excapedAlgnames," | sed "s/DNS:$_escapedSubject,//g" | tr '#' '*' | sed "s/,\$//g")"
1298     _debug _dnsAltnames "$_dnsAltnames"
1299   else
1300     _debug "AltNames doesn't contain subject"
1301   fi
1302
1303   echo "$_dnsAltnames" | sed "s/DNS://g"
1304 }
1305
1306 #_csrfile
1307 _readKeyLengthFromCSR() {
1308   _csrfile="$1"
1309   if [ -z "$_csrfile" ]; then
1310     _usage "_readKeyLengthFromCSR mycsr.csr"
1311     return 1
1312   fi
1313
1314   _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
1315   _debug2 _outcsr "$_outcsr"
1316   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1317     _debug "ECC CSR"
1318     echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1319   else
1320     _debug "RSA CSR"
1321     _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
1322     if [ "$_rkl" ]; then
1323       echo "$_rkl"
1324     else
1325       echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1326     fi
1327   fi
1328 }
1329
1330 _ss() {
1331   _port="$1"
1332
1333   if _exists "ss"; then
1334     _debug "Using: ss"
1335     ss -ntpl 2>/dev/null | grep ":$_port "
1336     return 0
1337   fi
1338
1339   if _exists "netstat"; then
1340     _debug "Using: netstat"
1341     if netstat -help 2>&1 | grep "\-p proto" >/dev/null; then
1342       #for windows version netstat tool
1343       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1344     else
1345       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1346         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1347       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1348         #for solaris
1349         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1350       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1351         #for full linux
1352         netstat -ntpl | grep ":$_port "
1353       else
1354         #for busybox (embedded linux; no pid support)
1355         netstat -ntl 2>/dev/null | grep ":$_port "
1356       fi
1357     fi
1358     return 0
1359   fi
1360
1361   return 1
1362 }
1363
1364 #outfile key cert cacert [password [name [caname]]]
1365 _toPkcs() {
1366   _cpfx="$1"
1367   _ckey="$2"
1368   _ccert="$3"
1369   _cca="$4"
1370   pfxPassword="$5"
1371   pfxName="$6"
1372   pfxCaname="$7"
1373
1374   if [ "$pfxCaname" ]; then
1375     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
1376   elif [ "$pfxName" ]; then
1377     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
1378   elif [ "$pfxPassword" ]; then
1379     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
1380   else
1381     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
1382   fi
1383
1384 }
1385
1386 #domain [password] [isEcc]
1387 toPkcs() {
1388   domain="$1"
1389   pfxPassword="$2"
1390   if [ -z "$domain" ]; then
1391     _usage "Usage: $PROJECT_ENTRY --to-pkcs12 --domain <domain.tld> [--password <password>] [--ecc]"
1392     return 1
1393   fi
1394
1395   _isEcc="$3"
1396
1397   _initpath "$domain" "$_isEcc"
1398
1399   _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
1400
1401   if [ "$?" = "0" ]; then
1402     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1403   fi
1404
1405 }
1406
1407 #domain [isEcc]
1408 toPkcs8() {
1409   domain="$1"
1410
1411   if [ -z "$domain" ]; then
1412     _usage "Usage: $PROJECT_ENTRY --to-pkcs8 --domain <domain.tld> [--ecc]"
1413     return 1
1414   fi
1415
1416   _isEcc="$2"
1417
1418   _initpath "$domain" "$_isEcc"
1419
1420   ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1421
1422   if [ "$?" = "0" ]; then
1423     _info "Success, $CERT_PKCS8_PATH"
1424   fi
1425
1426 }
1427
1428 #[2048]
1429 createAccountKey() {
1430   _info "Creating account key"
1431   if [ -z "$1" ]; then
1432     _usage "Usage: $PROJECT_ENTRY --create-account-key [--accountkeylength <bits>]"
1433     return
1434   fi
1435
1436   length=$1
1437   _create_account_key "$length"
1438
1439 }
1440
1441 _create_account_key() {
1442
1443   length=$1
1444
1445   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1446     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1447     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1448   fi
1449
1450   _debug length "$length"
1451   _initpath
1452
1453   mkdir -p "$CA_DIR"
1454   if [ -s "$ACCOUNT_KEY_PATH" ]; then
1455     _info "Account key exists, skip"
1456     return 0
1457   else
1458     #generate account key
1459     if _createkey "$length" "$ACCOUNT_KEY_PATH"; then
1460       chmod 600 "$ACCOUNT_KEY_PATH"
1461       _info "Create account key ok."
1462       return 0
1463     else
1464       _err "Create account key error."
1465       return 1
1466     fi
1467   fi
1468
1469 }
1470
1471 #domain [length]
1472 createDomainKey() {
1473   _info "Creating domain key"
1474   if [ -z "$1" ]; then
1475     _usage "Usage: $PROJECT_ENTRY --create-domain-key --domain <domain.tld> [--keylength <bits>]"
1476     return
1477   fi
1478
1479   domain=$1
1480   _cdl=$2
1481
1482   if [ -z "$_cdl" ]; then
1483     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1484     _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
1485   fi
1486
1487   _initpath "$domain" "$_cdl"
1488
1489   if [ ! -f "$CERT_KEY_PATH" ] || [ ! -s "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$_ACME_IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
1490     if _createkey "$_cdl" "$CERT_KEY_PATH"; then
1491       _savedomainconf Le_Keylength "$_cdl"
1492       _info "The domain key is here: $(__green $CERT_KEY_PATH)"
1493       return 0
1494     else
1495       _err "Can not create domain key"
1496       return 1
1497     fi
1498   else
1499     if [ "$_ACME_IS_RENEW" ]; then
1500       _info "Domain key exists, skip"
1501       return 0
1502     else
1503       _err "Domain key exists, do you want to overwrite the key?"
1504       _err "Add '--force', and try again."
1505       return 1
1506     fi
1507   fi
1508
1509 }
1510
1511 # domain  domainlist isEcc
1512 createCSR() {
1513   _info "Creating csr"
1514   if [ -z "$1" ]; then
1515     _usage "Usage: $PROJECT_ENTRY --create-csr --domain <domain.tld> [--domain <domain2.tld> ...]"
1516     return
1517   fi
1518
1519   domain="$1"
1520   domainlist="$2"
1521   _isEcc="$3"
1522
1523   _initpath "$domain" "$_isEcc"
1524
1525   if [ -f "$CSR_PATH" ] && [ "$_ACME_IS_RENEW" ] && [ -z "$FORCE" ]; then
1526     _info "CSR exists, skip"
1527     return
1528   fi
1529
1530   if [ ! -f "$CERT_KEY_PATH" ]; then
1531     _err "The key file is not found: $CERT_KEY_PATH"
1532     _err "Please create the key file first."
1533     return 1
1534   fi
1535   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1536
1537 }
1538
1539 _url_replace() {
1540   tr '/+' '_-' | tr -d '= '
1541 }
1542
1543 #base64 string
1544 _durl_replace_base64() {
1545   _l=$((${#1} % 4))
1546   if [ $_l -eq 2 ]; then
1547     _s="$1"'=='
1548   elif [ $_l -eq 3 ]; then
1549     _s="$1"'='
1550   else
1551     _s="$1"
1552   fi
1553   echo "$_s" | tr '_-' '/+'
1554 }
1555
1556 _time2str() {
1557   #BSD
1558   if date -u -r "$1" 2>/dev/null; then
1559     return
1560   fi
1561
1562   #Linux
1563   if date -u -d@"$1" 2>/dev/null; then
1564     return
1565   fi
1566
1567   #Solaris
1568   if _exists adb; then
1569     _t_s_a=$(echo "0t${1}=Y" | adb)
1570     echo "$_t_s_a"
1571   fi
1572
1573   #Busybox
1574   if echo "$1" | awk '{ print strftime("%c", $0); }' 2>/dev/null; then
1575     return
1576   fi
1577 }
1578
1579 _normalizeJson() {
1580   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1581 }
1582
1583 _stat() {
1584   #Linux
1585   if stat -c '%U:%G' "$1" 2>/dev/null; then
1586     return
1587   fi
1588
1589   #BSD
1590   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1591     return
1592   fi
1593
1594   return 1 #error, 'stat' not found
1595 }
1596
1597 #keyfile
1598 _calcjwk() {
1599   keyfile="$1"
1600   if [ -z "$keyfile" ]; then
1601     _usage "Usage: _calcjwk keyfile"
1602     return 1
1603   fi
1604
1605   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1606     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1607     return 0
1608   fi
1609
1610   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1611     _debug "RSA key"
1612     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1613     if [ "${#pub_exp}" = "5" ]; then
1614       pub_exp=0$pub_exp
1615     fi
1616     _debug3 pub_exp "$pub_exp"
1617
1618     e=$(echo "$pub_exp" | _h2b | _base64)
1619     _debug3 e "$e"
1620
1621     modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1622     _debug3 modulus "$modulus"
1623     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1624     _debug3 n "$n"
1625
1626     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1627     _debug3 jwk "$jwk"
1628
1629     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1630     JWK_HEADERPLACE_PART1='{"nonce": "'
1631     JWK_HEADERPLACE_PART2='", "alg": "RS256"'
1632   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1633     _debug "EC key"
1634     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1635     _debug3 crv "$crv"
1636     __ECC_KEY_LEN=$(echo "$crv" | cut -d "-" -f 2)
1637     if [ "$__ECC_KEY_LEN" = "521" ]; then
1638       __ECC_KEY_LEN=512
1639     fi
1640     _debug3 __ECC_KEY_LEN "$__ECC_KEY_LEN"
1641     if [ -z "$crv" ]; then
1642       _debug "Let's try ASN1 OID"
1643       crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1644       _debug3 crv_oid "$crv_oid"
1645       case "${crv_oid}" in
1646       "prime256v1")
1647         crv="P-256"
1648         __ECC_KEY_LEN=256
1649         ;;
1650       "secp384r1")
1651         crv="P-384"
1652         __ECC_KEY_LEN=384
1653         ;;
1654       "secp521r1")
1655         crv="P-521"
1656         __ECC_KEY_LEN=512
1657         ;;
1658       *)
1659         _err "ECC oid : $crv_oid"
1660         return 1
1661         ;;
1662       esac
1663       _debug3 crv "$crv"
1664     fi
1665
1666     pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1667     pubi=$(_math "$pubi" + 1)
1668     _debug3 pubi "$pubi"
1669
1670     pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1671     pubj=$(_math "$pubj" - 1)
1672     _debug3 pubj "$pubj"
1673
1674     pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1675     _debug3 pubtext "$pubtext"
1676
1677     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1678     xlen=$(_math "$xlen" / 4)
1679     _debug3 xlen "$xlen"
1680
1681     xend=$(_math "$xlen" + 1)
1682     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1683     _debug3 x "$x"
1684
1685     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1686     _debug3 x64 "$x64"
1687
1688     xend=$(_math "$xend" + 1)
1689     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1690     _debug3 y "$y"
1691
1692     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1693     _debug3 y64 "$y64"
1694
1695     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1696     _debug3 jwk "$jwk"
1697
1698     JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
1699     JWK_HEADERPLACE_PART1='{"nonce": "'
1700     JWK_HEADERPLACE_PART2='", "alg": "ES'$__ECC_KEY_LEN'"'
1701   else
1702     _err "Only RSA or EC key is supported. keyfile=$keyfile"
1703     _debug2 "$(cat "$keyfile")"
1704     return 1
1705   fi
1706
1707   _debug3 JWK_HEADER "$JWK_HEADER"
1708   __CACHED_JWK_KEY_FILE="$keyfile"
1709 }
1710
1711 _time() {
1712   date -u "+%s"
1713 }
1714
1715 _utc_date() {
1716   date -u "+%Y-%m-%d %H:%M:%S"
1717 }
1718
1719 _mktemp() {
1720   if _exists mktemp; then
1721     if mktemp 2>/dev/null; then
1722       return 0
1723     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1724       #for Mac osx
1725       return 0
1726     fi
1727   fi
1728   if [ -d "/tmp" ]; then
1729     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1730     return 0
1731   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1732     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1733     return 0
1734   fi
1735   _err "Can not create temp file."
1736 }
1737
1738 #clear all the https envs to cause _inithttp() to run next time.
1739 _resethttp() {
1740   __HTTP_INITIALIZED=""
1741   _ACME_CURL=""
1742   _ACME_WGET=""
1743   ACME_HTTP_NO_REDIRECTS=""
1744 }
1745
1746 _inithttp() {
1747
1748   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1749     HTTP_HEADER="$(_mktemp)"
1750     _debug2 HTTP_HEADER "$HTTP_HEADER"
1751   fi
1752
1753   if [ "$__HTTP_INITIALIZED" ]; then
1754     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1755       _debug2 "Http already initialized."
1756       return 0
1757     fi
1758   fi
1759
1760   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1761     _ACME_CURL="curl --silent --dump-header $HTTP_HEADER "
1762     if [ -z "$ACME_HTTP_NO_REDIRECTS" ]; then
1763       _ACME_CURL="$_ACME_CURL -L "
1764     fi
1765     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1766       _CURL_DUMP="$(_mktemp)"
1767       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1768     fi
1769
1770     if [ "$CA_PATH" ]; then
1771       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1772     elif [ "$CA_BUNDLE" ]; then
1773       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1774     fi
1775
1776     if _contains "$(curl --help 2>&1)" "--globoff"; then
1777       _ACME_CURL="$_ACME_CURL -g "
1778     fi
1779   fi
1780
1781   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1782     _ACME_WGET="wget -q"
1783     if [ "$ACME_HTTP_NO_REDIRECTS" ]; then
1784       _ACME_WGET="$_ACME_WGET --max-redirect 0 "
1785     fi
1786     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1787       _ACME_WGET="$_ACME_WGET -d "
1788     fi
1789     if [ "$CA_PATH" ]; then
1790       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1791     elif [ "$CA_BUNDLE" ]; then
1792       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1793     fi
1794   fi
1795
1796   #from wget 1.14: do not skip body on 404 error
1797   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1798     _ACME_WGET="$_ACME_WGET --content-on-error "
1799   fi
1800
1801   __HTTP_INITIALIZED=1
1802
1803 }
1804
1805 # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
1806 _post() {
1807   body="$1"
1808   _post_url="$2"
1809   needbase64="$3"
1810   httpmethod="$4"
1811   _postContentType="$5"
1812
1813   if [ -z "$httpmethod" ]; then
1814     httpmethod="POST"
1815   fi
1816   _debug $httpmethod
1817   _debug "_post_url" "$_post_url"
1818   _debug2 "body" "$body"
1819   _debug2 "_postContentType" "$_postContentType"
1820
1821   _inithttp
1822
1823   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1824     _CURL="$_ACME_CURL"
1825     if [ "$HTTPS_INSECURE" ]; then
1826       _CURL="$_CURL --insecure  "
1827     fi
1828     if [ "$httpmethod" = "HEAD" ]; then
1829       _CURL="$_CURL -I  "
1830     fi
1831     _debug "_CURL" "$_CURL"
1832     if [ "$needbase64" ]; then
1833       if [ "$body" ]; then
1834         if [ "$_postContentType" ]; then
1835           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
1836         else
1837           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
1838         fi
1839       else
1840         if [ "$_postContentType" ]; then
1841           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
1842         else
1843           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
1844         fi
1845       fi
1846     else
1847       if [ "$body" ]; then
1848         if [ "$_postContentType" ]; then
1849           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
1850         else
1851           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
1852         fi
1853       else
1854         if [ "$_postContentType" ]; then
1855           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
1856         else
1857           response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
1858         fi
1859       fi
1860     fi
1861     _ret="$?"
1862     if [ "$_ret" != "0" ]; then
1863       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1864       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1865         _err "Here is the curl dump log:"
1866         _err "$(cat "$_CURL_DUMP")"
1867       fi
1868     fi
1869   elif [ "$_ACME_WGET" ]; then
1870     _WGET="$_ACME_WGET"
1871     if [ "$HTTPS_INSECURE" ]; then
1872       _WGET="$_WGET --no-check-certificate "
1873     fi
1874     if [ "$httpmethod" = "HEAD" ]; then
1875       _WGET="$_WGET --read-timeout=3.0  --tries=2  "
1876     fi
1877     _debug "_WGET" "$_WGET"
1878     if [ "$needbase64" ]; then
1879       if [ "$httpmethod" = "POST" ]; then
1880         if [ "$_postContentType" ]; then
1881           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1882         else
1883           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1884         fi
1885       else
1886         if [ "$_postContentType" ]; then
1887           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1888         else
1889           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1890         fi
1891       fi
1892     else
1893       if [ "$httpmethod" = "POST" ]; then
1894         if [ "$_postContentType" ]; then
1895           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1896         else
1897           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1898         fi
1899       elif [ "$httpmethod" = "HEAD" ]; then
1900         if [ "$_postContentType" ]; then
1901           response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1902         else
1903           response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1904         fi
1905       else
1906         if [ "$_postContentType" ]; then
1907           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1908         else
1909           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1910         fi
1911       fi
1912     fi
1913     _ret="$?"
1914     if [ "$_ret" = "8" ]; then
1915       _ret=0
1916       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1917     fi
1918     if [ "$_ret" != "0" ]; then
1919       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1920     fi
1921     _sed_i "s/^ *//g" "$HTTP_HEADER"
1922   else
1923     _ret="$?"
1924     _err "Neither curl nor wget is found, can not do $httpmethod."
1925   fi
1926   _debug "_ret" "$_ret"
1927   printf "%s" "$response"
1928   return $_ret
1929 }
1930
1931 # url getheader timeout
1932 _get() {
1933   _debug GET
1934   url="$1"
1935   onlyheader="$2"
1936   t="$3"
1937   _debug url "$url"
1938   _debug "timeout=$t"
1939
1940   _inithttp
1941
1942   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1943     _CURL="$_ACME_CURL"
1944     if [ "$HTTPS_INSECURE" ]; then
1945       _CURL="$_CURL --insecure  "
1946     fi
1947     if [ "$t" ]; then
1948       _CURL="$_CURL --connect-timeout $t"
1949     fi
1950     _debug "_CURL" "$_CURL"
1951     if [ "$onlyheader" ]; then
1952       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1953     else
1954       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1955     fi
1956     ret=$?
1957     if [ "$ret" != "0" ]; then
1958       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1959       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1960         _err "Here is the curl dump log:"
1961         _err "$(cat "$_CURL_DUMP")"
1962       fi
1963     fi
1964   elif [ "$_ACME_WGET" ]; then
1965     _WGET="$_ACME_WGET"
1966     if [ "$HTTPS_INSECURE" ]; then
1967       _WGET="$_WGET --no-check-certificate "
1968     fi
1969     if [ "$t" ]; then
1970       _WGET="$_WGET --timeout=$t"
1971     fi
1972     _debug "_WGET" "$_WGET"
1973     if [ "$onlyheader" ]; then
1974       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1975     else
1976       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1977     fi
1978     ret=$?
1979     if [ "$ret" = "8" ]; then
1980       ret=0
1981       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1982     fi
1983     if [ "$ret" != "0" ]; then
1984       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1985     fi
1986   else
1987     ret=$?
1988     _err "Neither curl nor wget is found, can not do GET."
1989   fi
1990   _debug "ret" "$ret"
1991   return $ret
1992 }
1993
1994 _head_n() {
1995   head -n "$1"
1996 }
1997
1998 _tail_n() {
1999   if ! tail -n "$1" 2>/dev/null; then
2000     #fix for solaris
2001     tail -"$1"
2002   fi
2003 }
2004
2005 # url  payload needbase64  keyfile
2006 _send_signed_request() {
2007   url=$1
2008   payload=$2
2009   needbase64=$3
2010   keyfile=$4
2011   if [ -z "$keyfile" ]; then
2012     keyfile="$ACCOUNT_KEY_PATH"
2013   fi
2014   _debug url "$url"
2015   _debug payload "$payload"
2016
2017   if ! _calcjwk "$keyfile"; then
2018     return 1
2019   fi
2020
2021   __request_conent_type="$CONTENT_TYPE_JSON"
2022
2023   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
2024   _debug3 payload64 "$payload64"
2025
2026   MAX_REQUEST_RETRY_TIMES=20
2027   _sleep_retry_sec=1
2028   _request_retry_times=0
2029   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
2030     _request_retry_times=$(_math "$_request_retry_times" + 1)
2031     _debug3 _request_retry_times "$_request_retry_times"
2032     if [ -z "$_CACHED_NONCE" ]; then
2033       _headers=""
2034       if [ "$ACME_NEW_NONCE" ]; then
2035         _debug2 "Get nonce with HEAD. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
2036         nonceurl="$ACME_NEW_NONCE"
2037         if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type" >/dev/null; then
2038           _headers="$(cat "$HTTP_HEADER")"
2039           _debug2 _headers "$_headers"
2040           _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2 | cut -d , -f 1)"
2041         fi
2042       fi
2043       if [ -z "$_CACHED_NONCE" ]; then
2044         _debug2 "Get nonce with GET. ACME_DIRECTORY" "$ACME_DIRECTORY"
2045         nonceurl="$ACME_DIRECTORY"
2046         _headers="$(_get "$nonceurl" "onlyheader")"
2047         _debug2 _headers "$_headers"
2048         _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
2049       fi
2050       if [ -z "$_CACHED_NONCE" ] && [ "$ACME_NEW_NONCE" ]; then
2051         _debug2 "Get nonce with GET. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
2052         nonceurl="$ACME_NEW_NONCE"
2053         _headers="$(_get "$nonceurl" "onlyheader")"
2054         _debug2 _headers "$_headers"
2055         _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
2056       fi
2057       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
2058       if [ "$?" != "0" ]; then
2059         _err "Can not connect to $nonceurl to get nonce."
2060         return 1
2061       fi
2062     else
2063       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
2064     fi
2065     nonce="$_CACHED_NONCE"
2066     _debug2 nonce "$nonce"
2067     if [ -z "$nonce" ]; then
2068       _info "Could not get nonce, let's try again."
2069       _sleep 2
2070       continue
2071     fi
2072
2073     if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
2074       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
2075     elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
2076       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
2077     else
2078       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
2079     fi
2080
2081     _debug3 protected "$protected"
2082
2083     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
2084     _debug3 protected64 "$protected64"
2085
2086     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
2087       _err "Sign request failed."
2088       return 1
2089     fi
2090     _debug3 _sig_t "$_sig_t"
2091
2092     sig="$(printf "%s" "$_sig_t" | _url_replace)"
2093     _debug3 sig "$sig"
2094
2095     body="{\"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
2096     _debug3 body "$body"
2097
2098     response="$(_post "$body" "$url" "$needbase64" "POST" "$__request_conent_type")"
2099     _CACHED_NONCE=""
2100
2101     if [ "$?" != "0" ]; then
2102       _err "Can not post to $url"
2103       return 1
2104     fi
2105
2106     responseHeaders="$(cat "$HTTP_HEADER")"
2107     _debug2 responseHeaders "$responseHeaders"
2108
2109     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
2110     _debug code "$code"
2111
2112     _debug2 original "$response"
2113     if echo "$responseHeaders" | grep -i "Content-Type: *application/json" >/dev/null 2>&1; then
2114       response="$(echo "$response" | _json_decode | _normalizeJson)"
2115     fi
2116     _debug2 response "$response"
2117
2118     _CACHED_NONCE="$(echo "$responseHeaders" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2 | cut -d , -f 1)"
2119
2120     if ! _startswith "$code" "2"; then
2121       _body="$response"
2122       if [ "$needbase64" ]; then
2123         _body="$(echo "$_body" | _dbase64 multiline)"
2124         _debug3 _body "$_body"
2125       fi
2126
2127       if _contains "$_body" "JWS has invalid anti-replay nonce" || _contains "$_body" "JWS has an invalid anti-replay nonce"; then
2128         _info "It seems the CA server is busy now, let's wait and retry. Sleeping $_sleep_retry_sec seconds."
2129         _CACHED_NONCE=""
2130         _sleep $_sleep_retry_sec
2131         continue
2132       fi
2133       if _contains "$_body" "The Replay Nonce is not recognized"; then
2134         _info "The replay Nonce is not valid, let's get a new one, Sleeping $_sleep_retry_sec seconds."
2135         _CACHED_NONCE=""
2136         _sleep $_sleep_retry_sec
2137         continue
2138       fi
2139     fi
2140     return 0
2141   done
2142   _info "Giving up sending to CA server after $MAX_REQUEST_RETRY_TIMES retries."
2143   return 1
2144
2145 }
2146
2147 #setopt "file"  "opt"  "="  "value" [";"]
2148 _setopt() {
2149   __conf="$1"
2150   __opt="$2"
2151   __sep="$3"
2152   __val="$4"
2153   __end="$5"
2154   if [ -z "$__opt" ]; then
2155     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
2156     return
2157   fi
2158   if [ ! -f "$__conf" ]; then
2159     touch "$__conf"
2160   fi
2161
2162   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
2163     _debug3 OK
2164     if _contains "$__val" "&"; then
2165       __val="$(echo "$__val" | sed 's/&/\\&/g')"
2166     fi
2167     text="$(cat "$__conf")"
2168     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
2169
2170   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
2171     if _contains "$__val" "&"; then
2172       __val="$(echo "$__val" | sed 's/&/\\&/g')"
2173     fi
2174     text="$(cat "$__conf")"
2175     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
2176
2177   else
2178     _debug3 APP
2179     echo "$__opt$__sep$__val$__end" >>"$__conf"
2180   fi
2181   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
2182 }
2183
2184 #_save_conf  file key  value base64encode
2185 #save to conf
2186 _save_conf() {
2187   _s_c_f="$1"
2188   _sdkey="$2"
2189   _sdvalue="$3"
2190   _b64encode="$4"
2191   if [ "$_sdvalue" ] && [ "$_b64encode" ]; then
2192     _sdvalue="${B64CONF_START}$(printf "%s" "${_sdvalue}" | _base64)${B64CONF_END}"
2193   fi
2194   if [ "$_s_c_f" ]; then
2195     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
2196   else
2197     _err "config file is empty, can not save $_sdkey=$_sdvalue"
2198   fi
2199 }
2200
2201 #_clear_conf file  key
2202 _clear_conf() {
2203   _c_c_f="$1"
2204   _sdkey="$2"
2205   if [ "$_c_c_f" ]; then
2206     _conf_data="$(cat "$_c_c_f")"
2207     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
2208   else
2209     _err "config file is empty, can not clear"
2210   fi
2211 }
2212
2213 #_read_conf file  key
2214 _read_conf() {
2215   _r_c_f="$1"
2216   _sdkey="$2"
2217   if [ -f "$_r_c_f" ]; then
2218     _sdv="$(
2219       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
2220       eval "printf \"%s\" \"\$$_sdkey\""
2221     )"
2222     if _startswith "$_sdv" "${B64CONF_START}" && _endswith "$_sdv" "${B64CONF_END}"; then
2223       _sdv="$(echo "$_sdv" | sed "s/${B64CONF_START}//" | sed "s/${B64CONF_END}//" | _dbase64)"
2224     fi
2225     printf "%s" "$_sdv"
2226   else
2227     _debug "config file is empty, can not read $_sdkey"
2228   fi
2229 }
2230
2231 #_savedomainconf   key  value  base64encode
2232 #save to domain.conf
2233 _savedomainconf() {
2234   _save_conf "$DOMAIN_CONF" "$@"
2235 }
2236
2237 #_cleardomainconf   key
2238 _cleardomainconf() {
2239   _clear_conf "$DOMAIN_CONF" "$1"
2240 }
2241
2242 #_readdomainconf   key
2243 _readdomainconf() {
2244   _read_conf "$DOMAIN_CONF" "$1"
2245 }
2246
2247 #key  value  base64encode
2248 _savedeployconf() {
2249   _savedomainconf "SAVED_$1" "$2" "$3"
2250   #remove later
2251   _cleardomainconf "$1"
2252 }
2253
2254 #key
2255 _getdeployconf() {
2256   _rac_key="$1"
2257   _rac_value="$(eval echo \$"$_rac_key")"
2258   if [ "$_rac_value" ]; then
2259     if _startswith "$_rac_value" '"' && _endswith "$_rac_value" '"'; then
2260       _debug2 "trim quotation marks"
2261       eval "export $_rac_key=$_rac_value"
2262     fi
2263     return 0 # do nothing
2264   fi
2265   _saved=$(_readdomainconf "SAVED_$_rac_key")
2266   eval "export $_rac_key=\"\$_saved\""
2267 }
2268
2269 #_saveaccountconf  key  value  base64encode
2270 _saveaccountconf() {
2271   _save_conf "$ACCOUNT_CONF_PATH" "$@"
2272 }
2273
2274 #key  value base64encode
2275 _saveaccountconf_mutable() {
2276   _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2" "$3"
2277   #remove later
2278   _clearaccountconf "$1"
2279 }
2280
2281 #key
2282 _readaccountconf() {
2283   _read_conf "$ACCOUNT_CONF_PATH" "$1"
2284 }
2285
2286 #key
2287 _readaccountconf_mutable() {
2288   _rac_key="$1"
2289   _readaccountconf "SAVED_$_rac_key"
2290 }
2291
2292 #_clearaccountconf   key
2293 _clearaccountconf() {
2294   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
2295 }
2296
2297 #key
2298 _clearaccountconf_mutable() {
2299   _clearaccountconf "SAVED_$1"
2300   #remove later
2301   _clearaccountconf "$1"
2302 }
2303
2304 #_savecaconf  key  value
2305 _savecaconf() {
2306   _save_conf "$CA_CONF" "$1" "$2"
2307 }
2308
2309 #_readcaconf   key
2310 _readcaconf() {
2311   _read_conf "$CA_CONF" "$1"
2312 }
2313
2314 #_clearaccountconf   key
2315 _clearcaconf() {
2316   _clear_conf "$CA_CONF" "$1"
2317 }
2318
2319 # content localaddress
2320 _startserver() {
2321   content="$1"
2322   ncaddr="$2"
2323   _debug "content" "$content"
2324   _debug "ncaddr" "$ncaddr"
2325
2326   _debug "startserver: $$"
2327
2328   _debug Le_HTTPPort "$Le_HTTPPort"
2329   _debug Le_Listen_V4 "$Le_Listen_V4"
2330   _debug Le_Listen_V6 "$Le_Listen_V6"
2331
2332   _NC="socat"
2333   if [ "$Le_Listen_V4" ]; then
2334     _NC="$_NC -4"
2335   elif [ "$Le_Listen_V6" ]; then
2336     _NC="$_NC -6"
2337   fi
2338
2339   if [ "$DEBUG" ] && [ "$DEBUG" -gt "1" ]; then
2340     _NC="$_NC -d -d -v"
2341   fi
2342
2343   SOCAT_OPTIONS=TCP-LISTEN:$Le_HTTPPort,crlf,reuseaddr,fork
2344
2345   #Adding bind to local-address
2346   if [ "$ncaddr" ]; then
2347     SOCAT_OPTIONS="$SOCAT_OPTIONS,bind=${ncaddr}"
2348   fi
2349
2350   _content_len="$(printf "%s" "$content" | wc -c)"
2351   _debug _content_len "$_content_len"
2352   _debug "_NC" "$_NC $SOCAT_OPTIONS"
2353   $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
2354 echo 'HTTP/1.0 200 OK'; \
2355 echo 'Content-Length\: $_content_len'; \
2356 echo ''; \
2357 printf '%s' '$content';" &
2358   serverproc="$!"
2359 }
2360
2361 _stopserver() {
2362   pid="$1"
2363   _debug "pid" "$pid"
2364   if [ -z "$pid" ]; then
2365     return
2366   fi
2367
2368   kill $pid
2369
2370 }
2371
2372 # sleep sec
2373 _sleep() {
2374   _sleep_sec="$1"
2375   if [ "$__INTERACTIVE" ]; then
2376     _sleep_c="$_sleep_sec"
2377     while [ "$_sleep_c" -ge "0" ]; do
2378       printf "\r      \r"
2379       __green "$_sleep_c"
2380       _sleep_c="$(_math "$_sleep_c" - 1)"
2381       sleep 1
2382     done
2383     printf "\r"
2384   else
2385     sleep "$_sleep_sec"
2386   fi
2387 }
2388
2389 # _starttlsserver  san_a  san_b port content _ncaddr acmeValidationv1
2390 _starttlsserver() {
2391   _info "Starting tls server."
2392   san_a="$1"
2393   san_b="$2"
2394   port="$3"
2395   content="$4"
2396   opaddr="$5"
2397   acmeValidationv1="$6"
2398
2399   _debug san_a "$san_a"
2400   _debug san_b "$san_b"
2401   _debug port "$port"
2402   _debug acmeValidationv1 "$acmeValidationv1"
2403
2404   #create key TLS_KEY
2405   if ! _createkey "2048" "$TLS_KEY"; then
2406     _err "Create tls validation key error."
2407     return 1
2408   fi
2409
2410   #create csr
2411   alt="$san_a"
2412   if [ "$san_b" ]; then
2413     alt="$alt,$san_b"
2414   fi
2415   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$acmeValidationv1"; then
2416     _err "Create tls validation csr error."
2417     return 1
2418   fi
2419
2420   #self signed
2421   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2422     _err "Create tls validation cert error."
2423     return 1
2424   fi
2425
2426   __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -www -cert $TLS_CERT  -key $TLS_KEY "
2427   if [ "$opaddr" ]; then
2428     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2429   else
2430     __S_OPENSSL="$__S_OPENSSL -accept $port"
2431   fi
2432
2433   _debug Le_Listen_V4 "$Le_Listen_V4"
2434   _debug Le_Listen_V6 "$Le_Listen_V6"
2435   if [ "$Le_Listen_V4" ]; then
2436     __S_OPENSSL="$__S_OPENSSL -4"
2437   elif [ "$Le_Listen_V6" ]; then
2438     __S_OPENSSL="$__S_OPENSSL -6"
2439   fi
2440
2441   if [ "$acmeValidationv1" ]; then
2442     __S_OPENSSL="$__S_OPENSSL -alpn acme-tls/1"
2443   fi
2444
2445   _debug "$__S_OPENSSL"
2446   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2447     $__S_OPENSSL -tlsextdebug &
2448   else
2449     $__S_OPENSSL >/dev/null 2>&1 &
2450   fi
2451
2452   serverproc="$!"
2453   sleep 1
2454   _debug serverproc "$serverproc"
2455 }
2456
2457 #file
2458 _readlink() {
2459   _rf="$1"
2460   if ! readlink -f "$_rf" 2>/dev/null; then
2461     if _startswith "$_rf" "/"; then
2462       echo "$_rf"
2463       return 0
2464     fi
2465     echo "$(pwd)/$_rf" | _conapath
2466   fi
2467 }
2468
2469 _conapath() {
2470   sed "s#/\./#/#g"
2471 }
2472
2473 __initHome() {
2474   if [ -z "$_SCRIPT_HOME" ]; then
2475     if _exists readlink && _exists dirname; then
2476       _debug "Lets find script dir."
2477       _debug "_SCRIPT_" "$_SCRIPT_"
2478       _script="$(_readlink "$_SCRIPT_")"
2479       _debug "_script" "$_script"
2480       _script_home="$(dirname "$_script")"
2481       _debug "_script_home" "$_script_home"
2482       if [ -d "$_script_home" ]; then
2483         _SCRIPT_HOME="$_script_home"
2484       else
2485         _err "It seems the script home is not correct:$_script_home"
2486       fi
2487     fi
2488   fi
2489
2490   #  if [ -z "$LE_WORKING_DIR" ]; then
2491   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2492   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2493   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2494   #    else
2495   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2496   #    fi
2497   #  fi
2498
2499   if [ -z "$LE_WORKING_DIR" ]; then
2500     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2501     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2502   fi
2503   export LE_WORKING_DIR
2504
2505   if [ -z "$LE_CONFIG_HOME" ]; then
2506     LE_CONFIG_HOME="$LE_WORKING_DIR"
2507   fi
2508   _debug "Using config home:$LE_CONFIG_HOME"
2509   export LE_CONFIG_HOME
2510
2511   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2512
2513   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2514     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2515       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2516     fi
2517   fi
2518
2519   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2520     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2521   fi
2522   _debug3 ACCOUNT_CONF_PATH "$ACCOUNT_CONF_PATH"
2523   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2524
2525   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2526
2527   if [ -z "$LE_TEMP_DIR" ]; then
2528     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2529   fi
2530 }
2531
2532 #server
2533 _initAPI() {
2534   _api_server="${1:-$ACME_DIRECTORY}"
2535   _debug "_init api for server: $_api_server"
2536
2537   if [ -z "$ACME_NEW_ACCOUNT" ]; then
2538     response=$(_get "$_api_server")
2539     if [ "$?" != "0" ]; then
2540       _debug2 "response" "$response"
2541       _err "Can not init api for: $_api_server."
2542       return 1
2543     fi
2544     response=$(echo "$response" | _json_decode)
2545     _debug2 "response" "$response"
2546
2547     ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
2548     export ACME_KEY_CHANGE
2549
2550     ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
2551     export ACME_NEW_AUTHZ
2552
2553     ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
2554     export ACME_NEW_ORDER
2555
2556     ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
2557     export ACME_NEW_ACCOUNT
2558
2559     ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
2560     export ACME_REVOKE_CERT
2561
2562     ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
2563     export ACME_NEW_NONCE
2564
2565     ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
2566     export ACME_AGREEMENT
2567
2568     _debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
2569     _debug "ACME_NEW_AUTHZ" "$ACME_NEW_AUTHZ"
2570     _debug "ACME_NEW_ORDER" "$ACME_NEW_ORDER"
2571     _debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
2572     _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
2573     _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
2574     _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
2575
2576   fi
2577 }
2578
2579 #[domain]  [keylength or isEcc flag]
2580 _initpath() {
2581   domain="$1"
2582   _ilength="$2"
2583
2584   __initHome
2585
2586   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2587     . "$ACCOUNT_CONF_PATH"
2588   fi
2589
2590   if [ "$_ACME_IN_CRON" ]; then
2591     if [ ! "$_USER_PATH_EXPORTED" ]; then
2592       _USER_PATH_EXPORTED=1
2593       export PATH="$USER_PATH:$PATH"
2594     fi
2595   fi
2596
2597   if [ -z "$CA_HOME" ]; then
2598     CA_HOME="$DEFAULT_CA_HOME"
2599   fi
2600
2601   if [ -z "$ACME_DIRECTORY" ]; then
2602     if [ "$STAGE" ]; then
2603       ACME_DIRECTORY="$DEFAULT_STAGING_CA"
2604       _info "Using ACME_DIRECTORY: $ACME_DIRECTORY"
2605     else
2606       default_acme_server=$(_readaccountconf "DEFAULT_ACME_SERVER")
2607       _debug default_acme_server "$default_acme_server"
2608       if [ "$default_acme_server" ]; then
2609         ACME_DIRECTORY="$default_acme_server"
2610       else
2611         ACME_DIRECTORY="$DEFAULT_CA"
2612       fi
2613     fi
2614   fi
2615
2616   _debug ACME_DIRECTORY "$ACME_DIRECTORY"
2617   _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
2618   _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
2619
2620   CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
2621
2622   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2623
2624   if [ -z "$CA_CONF" ]; then
2625     CA_CONF="$_DEFAULT_CA_CONF"
2626   fi
2627   _debug3 CA_CONF "$CA_CONF"
2628
2629   if [ -f "$CA_CONF" ]; then
2630     . "$CA_CONF"
2631   fi
2632
2633   if [ -z "$ACME_DIR" ]; then
2634     ACME_DIR="/home/.acme"
2635   fi
2636
2637   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2638     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2639   fi
2640
2641   if [ -z "$USER_AGENT" ]; then
2642     USER_AGENT="$DEFAULT_USER_AGENT"
2643   fi
2644
2645   if [ -z "$HTTP_HEADER" ]; then
2646     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2647   fi
2648
2649   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2650   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2651
2652   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2653   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2654   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2655     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2656   fi
2657
2658   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2659     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2660   fi
2661
2662   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2663   if [ -z "$CERT_HOME" ]; then
2664     CERT_HOME="$_DEFAULT_CERT_HOME"
2665   fi
2666
2667   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2668     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2669   fi
2670
2671   if [ -z "$domain" ]; then
2672     return 0
2673   fi
2674
2675   if [ -z "$DOMAIN_PATH" ]; then
2676     domainhome="$CERT_HOME/$domain"
2677     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2678
2679     DOMAIN_PATH="$domainhome"
2680
2681     if _isEccKey "$_ilength"; then
2682       DOMAIN_PATH="$domainhomeecc"
2683     else
2684       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2685         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2686       fi
2687     fi
2688     _debug DOMAIN_PATH "$DOMAIN_PATH"
2689   fi
2690
2691   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2692     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2693   fi
2694
2695   if [ -z "$DOMAIN_CONF" ]; then
2696     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2697   fi
2698
2699   if [ -z "$DOMAIN_SSL_CONF" ]; then
2700     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2701   fi
2702
2703   if [ -z "$CSR_PATH" ]; then
2704     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2705   fi
2706   if [ -z "$CERT_KEY_PATH" ]; then
2707     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2708   fi
2709   if [ -z "$CERT_PATH" ]; then
2710     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2711   fi
2712   if [ -z "$CA_CERT_PATH" ]; then
2713     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2714   fi
2715   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2716     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2717   fi
2718   if [ -z "$CERT_PFX_PATH" ]; then
2719     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2720   fi
2721   if [ -z "$CERT_PKCS8_PATH" ]; then
2722     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2723   fi
2724
2725   if [ -z "$TLS_CONF" ]; then
2726     TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
2727   fi
2728   if [ -z "$TLS_CERT" ]; then
2729     TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
2730   fi
2731   if [ -z "$TLS_KEY" ]; then
2732     TLS_KEY="$DOMAIN_PATH/tls.validation.key"
2733   fi
2734   if [ -z "$TLS_CSR" ]; then
2735     TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
2736   fi
2737
2738 }
2739
2740 _exec() {
2741   if [ -z "$_EXEC_TEMP_ERR" ]; then
2742     _EXEC_TEMP_ERR="$(_mktemp)"
2743   fi
2744
2745   if [ "$_EXEC_TEMP_ERR" ]; then
2746     eval "$@ 2>>$_EXEC_TEMP_ERR"
2747   else
2748     eval "$@"
2749   fi
2750 }
2751
2752 _exec_err() {
2753   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2754 }
2755
2756 _apachePath() {
2757   _APACHECTL="apachectl"
2758   if ! _exists apachectl; then
2759     if _exists apache2ctl; then
2760       _APACHECTL="apache2ctl"
2761     else
2762       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2763       _err "Please use webroot mode to try again."
2764       return 1
2765     fi
2766   fi
2767
2768   if ! _exec $_APACHECTL -V >/dev/null; then
2769     _exec_err
2770     return 1
2771   fi
2772
2773   if [ "$APACHE_HTTPD_CONF" ]; then
2774     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2775     httpdconf="$APACHE_HTTPD_CONF"
2776     httpdconfname="$(basename "$httpdconfname")"
2777   else
2778     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2779     _debug httpdconfname "$httpdconfname"
2780
2781     if [ -z "$httpdconfname" ]; then
2782       _err "Can not read apache config file."
2783       return 1
2784     fi
2785
2786     if _startswith "$httpdconfname" '/'; then
2787       httpdconf="$httpdconfname"
2788       httpdconfname="$(basename "$httpdconfname")"
2789     else
2790       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2791       _debug httpdroot "$httpdroot"
2792       httpdconf="$httpdroot/$httpdconfname"
2793       httpdconfname="$(basename "$httpdconfname")"
2794     fi
2795   fi
2796   _debug httpdconf "$httpdconf"
2797   _debug httpdconfname "$httpdconfname"
2798   if [ ! -f "$httpdconf" ]; then
2799     _err "Apache Config file not found" "$httpdconf"
2800     return 1
2801   fi
2802   return 0
2803 }
2804
2805 _restoreApache() {
2806   if [ -z "$usingApache" ]; then
2807     return 0
2808   fi
2809   _initpath
2810   if ! _apachePath; then
2811     return 1
2812   fi
2813
2814   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2815     _debug "No config file to restore."
2816     return 0
2817   fi
2818
2819   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2820   _debug "Restored: $httpdconf."
2821   if ! _exec $_APACHECTL -t; then
2822     _exec_err
2823     _err "Sorry, restore apache config error, please contact me."
2824     return 1
2825   fi
2826   _debug "Restored successfully."
2827   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2828   return 0
2829 }
2830
2831 _setApache() {
2832   _initpath
2833   if ! _apachePath; then
2834     return 1
2835   fi
2836
2837   #test the conf first
2838   _info "Checking if there is an error in the apache config file before starting."
2839
2840   if ! _exec "$_APACHECTL" -t >/dev/null; then
2841     _exec_err
2842     _err "The apache config file has error, please fix it first, then try again."
2843     _err "Don't worry, there is nothing changed to your system."
2844     return 1
2845   else
2846     _info "OK"
2847   fi
2848
2849   #backup the conf
2850   _debug "Backup apache config file" "$httpdconf"
2851   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2852     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2853     _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
2854     return 1
2855   fi
2856   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2857   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2858   _info "The backup file will be deleted on success, just forget it."
2859
2860   #add alias
2861
2862   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2863   _debug "apacheVer" "$apacheVer"
2864   apacheMajor="$(echo "$apacheVer" | cut -d . -f 1)"
2865   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2866
2867   if [ "$apacheVer" ] && [ "$apacheMajor$apacheMinor" -ge "24" ]; then
2868     echo "
2869 Alias /.well-known/acme-challenge  $ACME_DIR
2870
2871 <Directory $ACME_DIR >
2872 Require all granted
2873 </Directory>
2874   " >>"$httpdconf"
2875   else
2876     echo "
2877 Alias /.well-known/acme-challenge  $ACME_DIR
2878
2879 <Directory $ACME_DIR >
2880 Order allow,deny
2881 Allow from all
2882 </Directory>
2883   " >>"$httpdconf"
2884   fi
2885
2886   _msg="$($_APACHECTL -t 2>&1)"
2887   if [ "$?" != "0" ]; then
2888     _err "Sorry, apache config error"
2889     if _restoreApache; then
2890       _err "The apache config file is restored."
2891     else
2892       _err "Sorry, the apache config file can not be restored, please report bug."
2893     fi
2894     return 1
2895   fi
2896
2897   if [ ! -d "$ACME_DIR" ]; then
2898     mkdir -p "$ACME_DIR"
2899     chmod 755 "$ACME_DIR"
2900   fi
2901
2902   if ! _exec "$_APACHECTL" graceful; then
2903     _exec_err
2904     _err "$_APACHECTL  graceful error, please contact me."
2905     _restoreApache
2906     return 1
2907   fi
2908   usingApache="1"
2909   return 0
2910 }
2911
2912 #find the real nginx conf file
2913 #backup
2914 #set the nginx conf
2915 #returns the real nginx conf file
2916 _setNginx() {
2917   _d="$1"
2918   _croot="$2"
2919   _thumbpt="$3"
2920
2921   FOUND_REAL_NGINX_CONF=""
2922   FOUND_REAL_NGINX_CONF_LN=""
2923   BACKUP_NGINX_CONF=""
2924   _debug _croot "$_croot"
2925   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2926   _debug _start_f "$_start_f"
2927   if [ -z "$_start_f" ]; then
2928     _debug "find start conf from nginx command"
2929     if [ -z "$NGINX_CONF" ]; then
2930       if ! _exists "nginx"; then
2931         _err "nginx command is not found."
2932         return 1
2933       fi
2934       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2935       _debug NGINX_CONF "$NGINX_CONF"
2936       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2937       _debug NGINX_CONF "$NGINX_CONF"
2938       if [ -z "$NGINX_CONF" ]; then
2939         _err "Can not find nginx conf."
2940         NGINX_CONF=""
2941         return 1
2942       fi
2943       if [ ! -f "$NGINX_CONF" ]; then
2944         _err "'$NGINX_CONF' doesn't exist."
2945         NGINX_CONF=""
2946         return 1
2947       fi
2948       _debug "Found nginx conf file:$NGINX_CONF"
2949     fi
2950     _start_f="$NGINX_CONF"
2951   fi
2952   _debug "Start detect nginx conf for $_d from:$_start_f"
2953   if ! _checkConf "$_d" "$_start_f"; then
2954     _err "Can not find conf file for domain $d"
2955     return 1
2956   fi
2957   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2958
2959   _ln=$FOUND_REAL_NGINX_CONF_LN
2960   _debug "_ln" "$_ln"
2961
2962   _lnn=$(_math $_ln + 1)
2963   _debug _lnn "$_lnn"
2964   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2965   _debug "_start_tag" "$_start_tag"
2966   if [ "$_start_tag" = "$NGINX_START" ]; then
2967     _info "The domain $_d is already configured, skip"
2968     FOUND_REAL_NGINX_CONF=""
2969     return 0
2970   fi
2971
2972   mkdir -p "$DOMAIN_BACKUP_PATH"
2973   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2974   _debug _backup_conf "$_backup_conf"
2975   BACKUP_NGINX_CONF="$_backup_conf"
2976   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2977   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2978     _err "backup error."
2979     FOUND_REAL_NGINX_CONF=""
2980     return 1
2981   fi
2982
2983   if ! _exists "nginx"; then
2984     _err "nginx command is not found."
2985     return 1
2986   fi
2987   _info "Check the nginx conf before setting up."
2988   if ! _exec "nginx -t" >/dev/null; then
2989     _exec_err
2990     return 1
2991   fi
2992
2993   _info "OK, Set up nginx config file"
2994
2995   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2996     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2997     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2998     return 1
2999   fi
3000
3001   echo "$NGINX_START
3002 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
3003   default_type text/plain;
3004   return 200 \"\$1.$_thumbpt\";
3005 }
3006 #NGINX_START
3007 " >>"$FOUND_REAL_NGINX_CONF"
3008
3009   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
3010     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
3011     _err "write nginx conf error, but don't worry, the file is restored."
3012     return 1
3013   fi
3014   _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
3015   _info "nginx conf is done, let's check it again."
3016   if ! _exec "nginx -t" >/dev/null; then
3017     _exec_err
3018     _err "It seems that nginx conf was broken, let's restore."
3019     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
3020     return 1
3021   fi
3022
3023   _info "Reload nginx"
3024   if ! _exec "nginx -s reload" >/dev/null; then
3025     _exec_err
3026     _err "It seems that nginx reload error, let's restore."
3027     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
3028     return 1
3029   fi
3030
3031   return 0
3032 }
3033
3034 #d , conf
3035 _checkConf() {
3036   _d="$1"
3037   _c_file="$2"
3038   _debug "Start _checkConf from:$_c_file"
3039   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
3040     _debug "wildcard"
3041     for _w_f in $2; do
3042       if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
3043         return 0
3044       fi
3045     done
3046     #not found
3047     return 1
3048   elif [ -f "$2" ]; then
3049     _debug "single"
3050     if _isRealNginxConf "$1" "$2"; then
3051       _debug "$2 is found."
3052       FOUND_REAL_NGINX_CONF="$2"
3053       return 0
3054     fi
3055     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
3056       _debug "Try include files"
3057       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
3058         _debug "check included $included"
3059         if !_startswith "$included" "/" && _exists dirname; then
3060           _relpath="$(dirname "$_c_file")"
3061           _debug "_relpath" "$_relpath"
3062           included="$_relpath/included"
3063         fi
3064         if _checkConf "$1" "$included"; then
3065           return 0
3066         fi
3067       done
3068     fi
3069     return 1
3070   else
3071     _debug "$2 not found."
3072     return 1
3073   fi
3074   return 1
3075 }
3076
3077 #d , conf
3078 _isRealNginxConf() {
3079   _debug "_isRealNginxConf $1 $2"
3080   if [ -f "$2" ]; then
3081     for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
3082       _debug _fln "$_fln"
3083       if [ "$_fln" ]; then
3084         _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *" | grep -v server_name | _tail_n 1)
3085         _debug "_start" "$_start"
3086         _start_n=$(echo "$_start" | cut -d : -f 1)
3087         _start_nn=$(_math $_start_n + 1)
3088         _debug "_start_n" "$_start_n"
3089         _debug "_start_nn" "$_start_nn"
3090
3091         _left="$(sed -n "${_start_nn},99999p" "$2")"
3092         _debug2 _left "$_left"
3093         _end="$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *" | grep -v server_name | _head_n 1)"
3094         _debug "_end" "$_end"
3095         if [ "$_end" ]; then
3096           _end_n=$(echo "$_end" | cut -d : -f 1)
3097           _debug "_end_n" "$_end_n"
3098           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
3099         else
3100           _seg_n="$_left"
3101         fi
3102
3103         _debug "_seg_n" "$_seg_n"
3104
3105         _skip_ssl=1
3106         for _listen_i in $(echo "$_seg_n" | tr "\t" ' ' | grep "^ *listen" | tr -d " "); do
3107           if [ "$_listen_i" ]; then
3108             if [ "$(echo "$_listen_i" | _egrep_o "listen.*ssl")" ]; then
3109               _debug2 "$_listen_i is ssl"
3110             else
3111               _debug2 "$_listen_i is plain text"
3112               _skip_ssl=""
3113               break
3114             fi
3115           fi
3116         done
3117
3118         if [ "$_skip_ssl" = "1" ]; then
3119           _debug "ssl on, skip"
3120         else
3121           FOUND_REAL_NGINX_CONF_LN=$_fln
3122           _debug3 "found FOUND_REAL_NGINX_CONF_LN" "$FOUND_REAL_NGINX_CONF_LN"
3123           return 0
3124         fi
3125       fi
3126     done
3127   fi
3128   return 1
3129 }
3130
3131 #restore all the nginx conf
3132 _restoreNginx() {
3133   if [ -z "$NGINX_RESTORE_VLIST" ]; then
3134     _debug "No need to restore nginx, skip."
3135     return
3136   fi
3137   _debug "_restoreNginx"
3138   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
3139
3140   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
3141     _debug "ng_entry" "$ng_entry"
3142     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
3143     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
3144     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
3145     _info "Restoring from $_ngbackupconf to $_ngconf"
3146     cat "$_ngbackupconf" >"$_ngconf"
3147   done
3148
3149   _info "Reload nginx"
3150   if ! _exec "nginx -s reload" >/dev/null; then
3151     _exec_err
3152     _err "It seems that nginx reload error, please report bug."
3153     return 1
3154   fi
3155   return 0
3156 }
3157
3158 _clearup() {
3159   _stopserver "$serverproc"
3160   serverproc=""
3161   _restoreApache
3162   _restoreNginx
3163   _clearupdns
3164   if [ -z "$DEBUG" ]; then
3165     rm -f "$TLS_CONF"
3166     rm -f "$TLS_CERT"
3167     rm -f "$TLS_KEY"
3168     rm -f "$TLS_CSR"
3169   fi
3170 }
3171
3172 _clearupdns() {
3173   _debug "_clearupdns"
3174   _debug "dns_entries" "$dns_entries"
3175
3176   if [ -z "$dns_entries" ]; then
3177     _debug "skip dns."
3178     return
3179   fi
3180   _info "Removing DNS records."
3181
3182   for entry in $dns_entries; do
3183     d=$(_getfield "$entry" 1)
3184     txtdomain=$(_getfield "$entry" 2)
3185     aliasDomain=$(_getfield "$entry" 3)
3186     _currentRoot=$(_getfield "$entry" 4)
3187     txt=$(_getfield "$entry" 5)
3188     d_api=$(_getfield "$entry" 6)
3189     _debug "d" "$d"
3190     _debug "txtdomain" "$txtdomain"
3191     _debug "aliasDomain" "$aliasDomain"
3192     _debug "_currentRoot" "$_currentRoot"
3193     _debug "txt" "$txt"
3194     _debug "d_api" "$d_api"
3195     if [ "$d_api" = "$txt" ]; then
3196       d_api=""
3197     fi
3198
3199     if [ -z "$d_api" ]; then
3200       _info "Not Found domain api file: $d_api"
3201       continue
3202     fi
3203
3204     if [ "$aliasDomain" ]; then
3205       txtdomain="$aliasDomain"
3206     fi
3207
3208     (
3209       if ! . "$d_api"; then
3210         _err "Load file $d_api error. Please check your api file and try again."
3211         return 1
3212       fi
3213
3214       rmcommand="${_currentRoot}_rm"
3215       if ! _exists "$rmcommand"; then
3216         _err "It seems that your api file doesn't define $rmcommand"
3217         return 1
3218       fi
3219       _info "Removing txt: $txt for domain: $txtdomain"
3220       if ! $rmcommand "$txtdomain" "$txt"; then
3221         _err "Error removing txt for domain:$txtdomain"
3222         return 1
3223       fi
3224       _info "Removed: Success"
3225     )
3226
3227   done
3228 }
3229
3230 # webroot  removelevel tokenfile
3231 _clearupwebbroot() {
3232   __webroot="$1"
3233   if [ -z "$__webroot" ]; then
3234     _debug "no webroot specified, skip"
3235     return 0
3236   fi
3237
3238   _rmpath=""
3239   if [ "$2" = '1' ]; then
3240     _rmpath="$__webroot/.well-known"
3241   elif [ "$2" = '2' ]; then
3242     _rmpath="$__webroot/.well-known/acme-challenge"
3243   elif [ "$2" = '3' ]; then
3244     _rmpath="$__webroot/.well-known/acme-challenge/$3"
3245   else
3246     _debug "Skip for removelevel:$2"
3247   fi
3248
3249   if [ "$_rmpath" ]; then
3250     if [ "$DEBUG" ]; then
3251       _debug "Debugging, skip removing: $_rmpath"
3252     else
3253       rm -rf "$_rmpath"
3254     fi
3255   fi
3256
3257   return 0
3258
3259 }
3260
3261 _on_before_issue() {
3262   _chk_web_roots="$1"
3263   _chk_main_domain="$2"
3264   _chk_alt_domains="$3"
3265   _chk_pre_hook="$4"
3266   _chk_local_addr="$5"
3267   _debug _on_before_issue
3268   _debug _chk_main_domain "$_chk_main_domain"
3269   _debug _chk_alt_domains "$_chk_alt_domains"
3270   #run pre hook
3271   if [ "$_chk_pre_hook" ]; then
3272     _info "Run pre hook:'$_chk_pre_hook'"
3273     if ! (
3274       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
3275     ); then
3276       _err "Error when run pre hook."
3277       return 1
3278     fi
3279   fi
3280
3281   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
3282     if ! _exists "socat"; then
3283       _err "Please install socat tools first."
3284       return 1
3285     fi
3286   fi
3287
3288   _debug Le_LocalAddress "$_chk_local_addr"
3289
3290   _index=1
3291   _currentRoot=""
3292   _addrIndex=1
3293   _w_index=1
3294   while true; do
3295     d="$(echo "$_chk_main_domain,$_chk_alt_domains," | cut -d , -f "$_w_index")"
3296     _w_index="$(_math "$_w_index" + 1)"
3297     _debug d "$d"
3298     if [ -z "$d" ]; then
3299       break
3300     fi
3301     _debug "Check for domain" "$d"
3302     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
3303     _debug "_currentRoot" "$_currentRoot"
3304     _index=$(_math $_index + 1)
3305     _checkport=""
3306     if [ "$_currentRoot" = "$NO_VALUE" ]; then
3307       _info "Standalone mode."
3308       if [ -z "$Le_HTTPPort" ]; then
3309         Le_HTTPPort=80
3310         _cleardomainconf "Le_HTTPPort"
3311       else
3312         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
3313       fi
3314       _checkport="$Le_HTTPPort"
3315     elif [ "$_currentRoot" = "$W_ALPN" ]; then
3316       _info "Standalone alpn mode."
3317       if [ -z "$Le_TLSPort" ]; then
3318         Le_TLSPort=443
3319       else
3320         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
3321       fi
3322       _checkport="$Le_TLSPort"
3323     fi
3324
3325     if [ "$_checkport" ]; then
3326       _debug _checkport "$_checkport"
3327       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
3328       _debug _checkaddr "$_checkaddr"
3329
3330       _addrIndex="$(_math $_addrIndex + 1)"
3331
3332       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
3333       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
3334       if [ -z "$netprc" ]; then
3335         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
3336       fi
3337       if [ "$netprc" ]; then
3338         _err "$netprc"
3339         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
3340         _err "Please stop it first"
3341         return 1
3342       fi
3343     fi
3344   done
3345
3346   if _hasfield "$_chk_web_roots" "apache"; then
3347     if ! _setApache; then
3348       _err "set up apache error. Report error to me."
3349       return 1
3350     fi
3351   else
3352     usingApache=""
3353   fi
3354
3355 }
3356
3357 _on_issue_err() {
3358   _chk_post_hook="$1"
3359   _chk_vlist="$2"
3360   _debug _on_issue_err
3361
3362   if [ "$LOG_FILE" ]; then
3363     _err "Please check log file for more details: $LOG_FILE"
3364   else
3365     _err "Please add '--debug' or '--log' to check more details."
3366     _err "See: $_DEBUG_WIKI"
3367   fi
3368
3369   #run the post hook
3370   if [ "$_chk_post_hook" ]; then
3371     _info "Run post hook:'$_chk_post_hook'"
3372     if ! (
3373       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3374     ); then
3375       _err "Error when run post hook."
3376       return 1
3377     fi
3378   fi
3379
3380   #trigger the validation to flush the pending authz
3381   _debug2 "_chk_vlist" "$_chk_vlist"
3382   if [ "$_chk_vlist" ]; then
3383     (
3384       _debug2 "start to deactivate authz"
3385       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
3386       for ventry in $ventries; do
3387         d=$(echo "$ventry" | cut -d "$sep" -f 1)
3388         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3389         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3390         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3391         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3392         __trigger_validation "$uri" "$keyauthorization"
3393       done
3394     )
3395   fi
3396
3397   if [ "$_ACME_IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "$W_DNS"; then
3398     _err "$_DNS_MANUAL_ERR"
3399   fi
3400
3401   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
3402     _debug "$(_dlg_versions)"
3403   fi
3404
3405 }
3406
3407 _on_issue_success() {
3408   _chk_post_hook="$1"
3409   _chk_renew_hook="$2"
3410   _debug _on_issue_success
3411
3412   #run the post hook
3413   if [ "$_chk_post_hook" ]; then
3414     _info "Run post hook:'$_chk_post_hook'"
3415     if ! (
3416       export CERT_PATH
3417       export CERT_KEY_PATH
3418       export CA_CERT_PATH
3419       export CERT_FULLCHAIN_PATH
3420       export Le_Domain="$_main_domain"
3421       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3422     ); then
3423       _err "Error when run post hook."
3424       return 1
3425     fi
3426   fi
3427
3428   #run renew hook
3429   if [ "$_ACME_IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
3430     _info "Run renew hook:'$_chk_renew_hook'"
3431     if ! (
3432       export CERT_PATH
3433       export CERT_KEY_PATH
3434       export CA_CERT_PATH
3435       export CERT_FULLCHAIN_PATH
3436       export Le_Domain="$_main_domain"
3437       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
3438     ); then
3439       _err "Error when run renew hook."
3440       return 1
3441     fi
3442   fi
3443
3444   if _hasfield "$Le_Webroot" "$W_DNS" && [ -z "$FORCE_DNS_MANUAL" ]; then
3445     _err "$_DNS_MANUAL_WARN"
3446   fi
3447
3448 }
3449
3450 #account_key_length   eab-kid  eab-hmac-key
3451 registeraccount() {
3452   _account_key_length="$1"
3453   _eab_id="$2"
3454   _eab_hmac_key="$3"
3455   _initpath
3456   _regAccount "$_account_key_length" "$_eab_id" "$_eab_hmac_key"
3457 }
3458
3459 __calcAccountKeyHash() {
3460   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
3461 }
3462
3463 __calc_account_thumbprint() {
3464   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
3465 }
3466
3467 _getAccountEmail() {
3468   if [ "$ACCOUNT_EMAIL" ]; then
3469     echo "$ACCOUNT_EMAIL"
3470     return 0
3471   fi
3472   if [ -z "$CA_EMAIL" ]; then
3473     CA_EMAIL="$(_readcaconf CA_EMAIL)"
3474   fi
3475   if [ "$CA_EMAIL" ]; then
3476     echo "$CA_EMAIL"
3477     return 0
3478   fi
3479   _readaccountconf "ACCOUNT_EMAIL"
3480 }
3481
3482 #keylength
3483 _regAccount() {
3484   _initpath
3485   _reg_length="$1"
3486   _eab_id="$2"
3487   _eab_hmac_key="$3"
3488   _debug3 _regAccount "$_regAccount"
3489   _initAPI
3490
3491   mkdir -p "$CA_DIR"
3492   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3493     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3494     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3495   fi
3496
3497   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3498     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3499     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3500   fi
3501
3502   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3503     if ! _create_account_key "$_reg_length"; then
3504       _err "Create account key error."
3505       return 1
3506     fi
3507   fi
3508
3509   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3510     return 1
3511   fi
3512   if [ "$_eab_id" ] && [ "$_eab_hmac_key" ]; then
3513     _savecaconf CA_EAB_KEY_ID "$_eab_id"
3514     _savecaconf CA_EAB_HMAC_KEY "$_eab_hmac_key"
3515   fi
3516   _eab_id=$(_readcaconf "CA_EAB_KEY_ID")
3517   _eab_hmac_key=$(_readcaconf "CA_EAB_HMAC_KEY")
3518   _secure_debug3 _eab_id "$_eab_id"
3519   _secure_debug3 _eab_hmac_key "$_eab_hmac_key"
3520   _email="$(_getAccountEmail)"
3521   if [ "$_email" ]; then
3522     _savecaconf "CA_EMAIL" "$_email"
3523   fi
3524
3525   if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
3526     if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
3527       _info "No EAB credentials found for ZeroSSL, let's get one"
3528       if [ -z "$_email" ]; then
3529         _err "Please provide a email address for ZeroSSL account."
3530         _err "See ZeroSSL usage: $_ZEROSSL_WIKI"
3531         return 1
3532       fi
3533       _eabresp=$(_post "email=$_email" $_ZERO_EAB_ENDPOINT)
3534       if [ "$?" != "0" ]; then
3535         _debug2 "$_eabresp"
3536         _err "Can not get EAB credentials from ZeroSSL."
3537         return 1
3538       fi
3539       _debug2 "$_eabresp"
3540       _eab_id="$(echo "$_eabresp" | tr ',}' '\n' | grep '"eab_kid"' | cut -d : -f 2 | tr -d '"')"
3541       if [ -z "$_eab_id" ]; then
3542         _err "Can not resolve _eab_id"
3543         return 1
3544       fi
3545       _eab_hmac_key="$(echo "$_eabresp" | tr ',}' '\n' | grep '"eab_hmac_key"' | cut -d : -f 2 | tr -d '"')"
3546       if [ -z "$_eab_hmac_key" ]; then
3547         _err "Can not resolve _eab_hmac_key"
3548         return 1
3549       fi
3550       _savecaconf CA_EAB_KEY_ID "$_eab_id"
3551       _savecaconf CA_EAB_HMAC_KEY "$_eab_hmac_key"
3552     fi
3553   fi
3554   if [ "$_eab_id" ] && [ "$_eab_hmac_key" ]; then
3555     eab_protected="{\"alg\":\"HS256\",\"kid\":\"$_eab_id\",\"url\":\"${ACME_NEW_ACCOUNT}\"}"
3556     _debug3 eab_protected "$eab_protected"
3557
3558     eab_protected64=$(printf "%s" "$eab_protected" | _base64 | _url_replace)
3559     _debug3 eab_protected64 "$eab_protected64"
3560
3561     eab_payload64=$(printf "%s" "$jwk" | _base64 | _url_replace)
3562     _debug3 eab_payload64 "$eab_payload64"
3563
3564     eab_sign_t="$eab_protected64.$eab_payload64"
3565     _debug3 eab_sign_t "$eab_sign_t"
3566
3567     key_hex="$(_durl_replace_base64 "$_eab_hmac_key" | _dbase64 | _hex_dump | tr -d ' ')"
3568     _debug3 key_hex "$key_hex"
3569
3570     eab_signature=$(printf "%s" "$eab_sign_t" | _hmac sha256 $key_hex | _base64 | _url_replace)
3571     _debug3 eab_signature "$eab_signature"
3572
3573     externalBinding=",\"externalAccountBinding\":{\"protected\":\"$eab_protected64\", \"payload\":\"$eab_payload64\", \"signature\":\"$eab_signature\"}"
3574     _debug3 externalBinding "$externalBinding"
3575   fi
3576   if [ "$_email" ]; then
3577     email_sg="\"contact\": [\"mailto:$_email\"], "
3578   fi
3579   regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
3580
3581   _info "Registering account: $ACME_DIRECTORY"
3582
3583   if ! _send_signed_request "${ACME_NEW_ACCOUNT}" "$regjson"; then
3584     _err "Register account Error: $response"
3585     return 1
3586   fi
3587
3588   _eabAlreadyBound=""
3589   if [ "$code" = "" ] || [ "$code" = '201' ]; then
3590     echo "$response" >"$ACCOUNT_JSON_PATH"
3591     _info "Registered"
3592   elif [ "$code" = '409' ] || [ "$code" = '200' ]; then
3593     _info "Already registered"
3594   elif [ "$code" = '400' ] && _contains "$response" 'The account is not awaiting external account binding'; then
3595     _info "Already register EAB."
3596     _eabAlreadyBound=1
3597   else
3598     _err "Register account Error: $response"
3599     return 1
3600   fi
3601
3602   if [ -z "$_eabAlreadyBound" ]; then
3603     _debug2 responseHeaders "$responseHeaders"
3604     _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n ")"
3605     _debug "_accUri" "$_accUri"
3606     if [ -z "$_accUri" ]; then
3607       _err "Can not find account id url."
3608       _err "$responseHeaders"
3609       return 1
3610     fi
3611     _savecaconf "ACCOUNT_URL" "$_accUri"
3612   else
3613     ACCOUNT_URL="$(_readcaconf ACCOUNT_URL)"
3614   fi
3615   export ACCOUNT_URL="$_accUri"
3616
3617   CA_KEY_HASH="$(__calcAccountKeyHash)"
3618   _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3619   _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3620
3621   if [ "$code" = '403' ]; then
3622     _err "It seems that the account key is already deactivated, please use a new account key."
3623     return 1
3624   fi
3625
3626   ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3627   _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3628 }
3629
3630 #implement updateaccount
3631 updateaccount() {
3632   _initpath
3633
3634   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3635     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3636     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3637   fi
3638
3639   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3640     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3641     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3642   fi
3643
3644   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3645     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
3646     return 1
3647   fi
3648
3649   _accUri=$(_readcaconf "ACCOUNT_URL")
3650   _debug _accUri "$_accUri"
3651
3652   if [ -z "$_accUri" ]; then
3653     _err "The account url is empty, please run '--update-account' first to update the account info first,"
3654     _err "Then try again."
3655     return 1
3656   fi
3657
3658   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3659     return 1
3660   fi
3661   _initAPI
3662
3663   _email="$(_getAccountEmail)"
3664
3665   if [ "$ACCOUNT_EMAIL" ]; then
3666     updjson='{"contact": ["mailto:'$_email'"]}'
3667   else
3668     updjson='{"contact": []}'
3669   fi
3670
3671   _send_signed_request "$_accUri" "$updjson"
3672
3673   if [ "$code" = '200' ]; then
3674     echo "$response" >"$ACCOUNT_JSON_PATH"
3675     _info "account update success for $_accUri."
3676   else
3677     _info "Error. The account was not updated."
3678     return 1
3679   fi
3680 }
3681
3682 #Implement deactivate account
3683 deactivateaccount() {
3684   _initpath
3685
3686   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3687     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3688     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3689   fi
3690
3691   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3692     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3693     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3694   fi
3695
3696   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3697     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
3698     return 1
3699   fi
3700
3701   _accUri=$(_readcaconf "ACCOUNT_URL")
3702   _debug _accUri "$_accUri"
3703
3704   if [ -z "$_accUri" ]; then
3705     _err "The account url is empty, please run '--update-account' first to update the account info first,"
3706     _err "Then try again."
3707     return 1
3708   fi
3709
3710   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3711     return 1
3712   fi
3713   _initAPI
3714
3715   _djson="{\"status\":\"deactivated\"}"
3716
3717   if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
3718     _info "Deactivate account success for $_accUri."
3719     _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
3720   elif [ "$code" = "403" ]; then
3721     _info "The account is already deactivated."
3722     _accid=$(_getfield "$_accUri" "999" "/")
3723   else
3724     _err "Deactivate: account failed for $_accUri."
3725     return 1
3726   fi
3727
3728   _debug "Account id: $_accid"
3729   if [ "$_accid" ]; then
3730     _deactivated_account_path="$CA_DIR/deactivated/$_accid"
3731     _debug _deactivated_account_path "$_deactivated_account_path"
3732     if mkdir -p "$_deactivated_account_path"; then
3733       _info "Moving deactivated account info to $_deactivated_account_path/"
3734       mv "$CA_CONF" "$_deactivated_account_path/"
3735       mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
3736       mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
3737     else
3738       _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
3739       rm -f "$CA_CONF"
3740       rm -f "$ACCOUNT_JSON_PATH"
3741       rm -f "$ACCOUNT_KEY_PATH"
3742     fi
3743   fi
3744 }
3745
3746 # domain folder  file
3747 _findHook() {
3748   _hookdomain="$1"
3749   _hookcat="$2"
3750   _hookname="$3"
3751
3752   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3753     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3754   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3755     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3756   elif [ "$_hookdomain" ] && [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3757     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3758   elif [ "$_hookdomain" ] && [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3759     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3760   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3761     d_api="$LE_WORKING_DIR/$_hookname"
3762   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3763     d_api="$LE_WORKING_DIR/$_hookname.sh"
3764   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3765     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3766   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3767     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3768   fi
3769
3770   printf "%s" "$d_api"
3771 }
3772
3773 #domain
3774 __get_domain_new_authz() {
3775   _gdnd="$1"
3776   _info "Getting new-authz for domain" "$_gdnd"
3777   _initAPI
3778   _Max_new_authz_retry_times=5
3779   _authz_i=0
3780   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3781     _debug "Try new-authz for the $_authz_i time."
3782     if ! _send_signed_request "${ACME_NEW_AUTHZ}" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3783       _err "Can not get domain new authz."
3784       return 1
3785     fi
3786     if _contains "$response" "No registration exists matching provided key"; then
3787       _err "It seems there is an error, but it's recovered now, please try again."
3788       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3789       _clearcaconf "CA_KEY_HASH"
3790       break
3791     fi
3792     if ! _contains "$response" "An error occurred while processing your request"; then
3793       _info "The new-authz request is ok."
3794       break
3795     fi
3796     _authz_i="$(_math "$_authz_i" + 1)"
3797     _info "The server is busy, Sleep $_authz_i to retry."
3798     _sleep "$_authz_i"
3799   done
3800
3801   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3802     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3803   fi
3804
3805   if [ "$code" ] && [ "$code" != '201' ]; then
3806     _err "new-authz error: $response"
3807     return 1
3808   fi
3809
3810 }
3811
3812 #uri keyAuthorization
3813 __trigger_validation() {
3814   _debug2 "Trigger domain validation."
3815   _t_url="$1"
3816   _debug2 _t_url "$_t_url"
3817   _t_key_authz="$2"
3818   _debug2 _t_key_authz "$_t_key_authz"
3819   _t_vtype="$3"
3820   _debug2 _t_vtype "$_t_vtype"
3821
3822   _send_signed_request "$_t_url" "{}"
3823
3824 }
3825
3826 #endpoint  domain type
3827 _ns_lookup_impl() {
3828   _ns_ep="$1"
3829   _ns_domain="$2"
3830   _ns_type="$3"
3831   _debug2 "_ns_ep" "$_ns_ep"
3832   _debug2 "_ns_domain" "$_ns_domain"
3833   _debug2 "_ns_type" "$_ns_type"
3834
3835   response="$(_H1="accept: application/dns-json" _get "$_ns_ep?name=$_ns_domain&type=$_ns_type")"
3836   _ret=$?
3837   _debug2 "response" "$response"
3838   if [ "$_ret" != "0" ]; then
3839     return $_ret
3840   fi
3841   _answers="$(echo "$response" | tr '{}' '<>' | _egrep_o '"Answer":\[[^]]*]' | tr '<>' '\n\n')"
3842   _debug2 "_answers" "$_answers"
3843   echo "$_answers"
3844 }
3845
3846 #domain, type
3847 _ns_lookup_cf() {
3848   _cf_ld="$1"
3849   _cf_ld_type="$2"
3850   _cf_ep="https://cloudflare-dns.com/dns-query"
3851   _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
3852 }
3853
3854 #domain, type
3855 _ns_purge_cf() {
3856   _cf_d="$1"
3857   _cf_d_type="$2"
3858   _debug "Cloudflare purge $_cf_d_type record for domain $_cf_d"
3859   _cf_purl="https://cloudflare-dns.com/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
3860   response="$(_post "" "$_cf_purl")"
3861   _debug2 response "$response"
3862 }
3863
3864 #checks if cf server is available
3865 _ns_is_available_cf() {
3866   if _get "https://cloudflare-dns.com" "" 1 >/dev/null 2>&1; then
3867     return 0
3868   else
3869     return 1
3870   fi
3871 }
3872
3873 _ns_is_available_google() {
3874   if _get "https://dns.google" "" 1 >/dev/null 2>&1; then
3875     return 0
3876   else
3877     return 1
3878   fi
3879 }
3880
3881 #domain, type
3882 _ns_lookup_google() {
3883   _cf_ld="$1"
3884   _cf_ld_type="$2"
3885   _cf_ep="https://dns.google/resolve"
3886   _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
3887 }
3888
3889 _ns_is_available_ali() {
3890   if _get "https://dns.alidns.com" "" 1 >/dev/null 2>&1; then
3891     return 0
3892   else
3893     return 1
3894   fi
3895 }
3896
3897 #domain, type
3898 _ns_lookup_ali() {
3899   _cf_ld="$1"
3900   _cf_ld_type="$2"
3901   _cf_ep="https://dns.alidns.com/resolve"
3902   _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
3903 }
3904
3905 _ns_is_available_dp() {
3906   if _get "https://dns.alidns.com" "" 1 >/dev/null 2>&1; then
3907     return 0
3908   else
3909     return 1
3910   fi
3911 }
3912
3913 #dnspod
3914 _ns_lookup_dp() {
3915   _cf_ld="$1"
3916   _cf_ld_type="$2"
3917   _cf_ep="https://doh.pub/dns-query"
3918   _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
3919 }
3920
3921 #domain, type
3922 _ns_lookup() {
3923   if [ -z "$DOH_USE" ]; then
3924     _debug "Detect dns server first."
3925     if _ns_is_available_cf; then
3926       _debug "Use cloudflare doh server"
3927       export DOH_USE=$DOH_CLOUDFLARE
3928     elif _ns_is_available_google; then
3929       _debug "Use google doh server"
3930       export DOH_USE=$DOH_GOOGLE
3931     elif _ns_is_available_ali; then
3932       _debug "Use aliyun doh server"
3933       export DOH_USE=$DOH_ALI
3934     elif _ns_is_available_dp; then
3935       _debug "Use dns pod doh server"
3936       export DOH_USE=$DOH_DP
3937     else
3938       _err "No doh"
3939     fi
3940   fi
3941
3942   if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
3943     _ns_lookup_cf "$@"
3944   elif [ "$DOH_USE" = "$DOH_GOOGLE" ]; then
3945     _ns_lookup_google "$@"
3946   elif [ "$DOH_USE" = "$DOH_ALI" ]; then
3947     _ns_lookup_ali "$@"
3948   elif [ "$DOH_USE" = "$DOH_DP" ]; then
3949     _ns_lookup_dp "$@"
3950   else
3951     _err "Unknown doh provider: DOH_USE=$DOH_USE"
3952   fi
3953
3954 }
3955
3956 #txtdomain, alias, txt
3957 __check_txt() {
3958   _c_txtdomain="$1"
3959   _c_aliasdomain="$2"
3960   _c_txt="$3"
3961   _debug "_c_txtdomain" "$_c_txtdomain"
3962   _debug "_c_aliasdomain" "$_c_aliasdomain"
3963   _debug "_c_txt" "$_c_txt"
3964   _answers="$(_ns_lookup "$_c_aliasdomain" TXT)"
3965   _contains "$_answers" "$_c_txt"
3966
3967 }
3968
3969 #txtdomain
3970 __purge_txt() {
3971   _p_txtdomain="$1"
3972   _debug _p_txtdomain "$_p_txtdomain"
3973   if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
3974     _ns_purge_cf "$_p_txtdomain" "TXT"
3975   else
3976     _debug "no purge api for this doh api, just sleep 5 secs"
3977     _sleep 5
3978   fi
3979
3980 }
3981
3982 #wait and check each dns entries
3983 _check_dns_entries() {
3984   _success_txt=","
3985   _end_time="$(_time)"
3986   _end_time="$(_math "$_end_time" + 1200)" #let's check no more than 20 minutes.
3987
3988   while [ "$(_time)" -le "$_end_time" ]; do
3989     _info "You can use '--dnssleep' to disable public dns checks."
3990     _info "See: $_DNSCHECK_WIKI"
3991     _left=""
3992     for entry in $dns_entries; do
3993       d=$(_getfield "$entry" 1)
3994       txtdomain=$(_getfield "$entry" 2)
3995       txtdomain=$(_idn "$txtdomain")
3996       aliasDomain=$(_getfield "$entry" 3)
3997       aliasDomain=$(_idn "$aliasDomain")
3998       txt=$(_getfield "$entry" 5)
3999       d_api=$(_getfield "$entry" 6)
4000       _debug "d" "$d"
4001       _debug "txtdomain" "$txtdomain"
4002       _debug "aliasDomain" "$aliasDomain"
4003       _debug "txt" "$txt"
4004       _debug "d_api" "$d_api"
4005       _info "Checking $d for $aliasDomain"
4006       if _contains "$_success_txt" ",$txt,"; then
4007         _info "Already success, continue next one."
4008         continue
4009       fi
4010
4011       if __check_txt "$txtdomain" "$aliasDomain" "$txt"; then
4012         _info "Domain $d '$aliasDomain' success."
4013         _success_txt="$_success_txt,$txt,"
4014         continue
4015       fi
4016       _left=1
4017       _info "Not valid yet, let's wait 10 seconds and check next one."
4018       __purge_txt "$txtdomain"
4019       if [ "$txtdomain" != "$aliasDomain" ]; then
4020         __purge_txt "$aliasDomain"
4021       fi
4022       _sleep 10
4023     done
4024     if [ "$_left" ]; then
4025       _info "Let's wait 10 seconds and check again".
4026       _sleep 10
4027     else
4028       _info "All success, let's return"
4029       return 0
4030     fi
4031   done
4032   _info "Timed out waiting for DNS."
4033   return 1
4034
4035 }
4036
4037 #file
4038 _get_chain_issuers() {
4039   _cfile="$1"
4040   if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -help 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
4041     ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep -i 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
4042   else
4043     _cindex=1
4044     for _startn in $(grep -n -- "$BEGIN_CERT" "$_cfile" | cut -d : -f 1); do
4045       _endn="$(grep -n -- "$END_CERT" "$_cfile" | cut -d : -f 1 | _head_n $_cindex | _tail_n 1)"
4046       _debug2 "_startn" "$_startn"
4047       _debug2 "_endn" "$_endn"
4048       if [ "$DEBUG" ]; then
4049         _debug2 "cert$_cindex" "$(sed -n "$_startn,${_endn}p" "$_cfile")"
4050       fi
4051       sed -n "$_startn,${_endn}p" "$_cfile" | ${ACME_OPENSSL_BIN:-openssl} x509 -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2 | sed "s/ *\(.*\)/\1/"
4052       _cindex=$(_math $_cindex + 1)
4053     done
4054   fi
4055 }
4056
4057 #
4058 _get_chain_subjects() {
4059   _cfile="$1"
4060   if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -help 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
4061     ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep -i 'Subject:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
4062   else
4063     _cindex=1
4064     for _startn in $(grep -n -- "$BEGIN_CERT" "$_cfile" | cut -d : -f 1); do
4065       _endn="$(grep -n -- "$END_CERT" "$_cfile" | cut -d : -f 1 | _head_n $_cindex | _tail_n 1)"
4066       _debug2 "_startn" "$_startn"
4067       _debug2 "_endn" "$_endn"
4068       if [ "$DEBUG" ]; then
4069         _debug2 "cert$_cindex" "$(sed -n "$_startn,${_endn}p" "$_cfile")"
4070       fi
4071       sed -n "$_startn,${_endn}p" "$_cfile" | ${ACME_OPENSSL_BIN:-openssl} x509 -text -noout | grep -i 'Subject:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2 | sed "s/ *\(.*\)/\1/"
4072       _cindex=$(_math $_cindex + 1)
4073     done
4074   fi
4075 }
4076
4077 #cert  issuer
4078 _match_issuer() {
4079   _cfile="$1"
4080   _missuer="$2"
4081   _fissuers="$(_get_chain_issuers $_cfile)"
4082   _debug2 _fissuers "$_fissuers"
4083   _rootissuer="$(echo "$_fissuers" | _lower_case | _tail_n 1)"
4084   _debug2 _rootissuer "$_rootissuer"
4085   _missuer="$(echo "$_missuer" | _lower_case)"
4086   _contains "$_rootissuer" "$_missuer"
4087 }
4088
4089 #webroot, domain domainlist  keylength
4090 issue() {
4091   if [ -z "$2" ]; then
4092     _usage "Usage: $PROJECT_ENTRY --issue --domain <domain.tld> --webroot <directory>"
4093     return 1
4094   fi
4095   if [ -z "$1" ]; then
4096     _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
4097     return 1
4098   fi
4099   _web_roots="$1"
4100   _main_domain="$2"
4101   _alt_domains="$3"
4102
4103   if _contains "$_main_domain" ","; then
4104     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
4105     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
4106   fi
4107   _debug _main_domain "$_main_domain"
4108   _debug _alt_domains "$_alt_domains"
4109
4110   _key_length="$4"
4111   _real_cert="$5"
4112   _real_key="$6"
4113   _real_ca="$7"
4114   _reload_cmd="$8"
4115   _real_fullchain="$9"
4116   _pre_hook="${10}"
4117   _post_hook="${11}"
4118   _renew_hook="${12}"
4119   _local_addr="${13}"
4120   _challenge_alias="${14}"
4121   _preferred_chain="${15}"
4122
4123   if [ -z "$_ACME_IS_RENEW" ]; then
4124     _initpath "$_main_domain" "$_key_length"
4125     mkdir -p "$DOMAIN_PATH"
4126   fi
4127
4128   if _hasfield "$_web_roots" "$W_DNS" && [ -z "$FORCE_DNS_MANUAL" ]; then
4129     _err "$_DNS_MANUAL_ERROR"
4130     return 1
4131   fi
4132
4133   _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
4134
4135   if ! _initAPI; then
4136     return 1
4137   fi
4138
4139   if [ -f "$DOMAIN_CONF" ]; then
4140     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
4141     _debug Le_NextRenewTime "$Le_NextRenewTime"
4142     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
4143       _saved_domain=$(_readdomainconf Le_Domain)
4144       _debug _saved_domain "$_saved_domain"
4145       _saved_alt=$(_readdomainconf Le_Alt)
4146       _debug _saved_alt "$_saved_alt"
4147       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
4148         _info "Domains not changed."
4149         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
4150         _info "Add '$(__red '--force')' to force to renew."
4151         return $RENEW_SKIP
4152       else
4153         _info "Domains have changed."
4154       fi
4155     fi
4156   fi
4157
4158   _savedomainconf "Le_Domain" "$_main_domain"
4159   _savedomainconf "Le_Alt" "$_alt_domains"
4160   _savedomainconf "Le_Webroot" "$_web_roots"
4161
4162   _savedomainconf "Le_PreHook" "$_pre_hook" "base64"
4163   _savedomainconf "Le_PostHook" "$_post_hook" "base64"
4164   _savedomainconf "Le_RenewHook" "$_renew_hook" "base64"
4165
4166   if [ "$_local_addr" ]; then
4167     _savedomainconf "Le_LocalAddress" "$_local_addr"
4168   else
4169     _cleardomainconf "Le_LocalAddress"
4170   fi
4171   if [ "$_challenge_alias" ]; then
4172     _savedomainconf "Le_ChallengeAlias" "$_challenge_alias"
4173   else
4174     _cleardomainconf "Le_ChallengeAlias"
4175   fi
4176   if [ "$_preferred_chain" ]; then
4177     _savedomainconf "Le_Preferred_Chain" "$_preferred_chain" "base64"
4178   else
4179     _cleardomainconf "Le_Preferred_Chain"
4180   fi
4181
4182   Le_API="$ACME_DIRECTORY"
4183   _savedomainconf "Le_API" "$Le_API"
4184
4185   _info "Using CA: $ACME_DIRECTORY"
4186   if [ "$_alt_domains" = "$NO_VALUE" ]; then
4187     _alt_domains=""
4188   fi
4189
4190   if [ "$_key_length" = "$NO_VALUE" ]; then
4191     _key_length=""
4192   fi
4193
4194   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
4195     _err "_on_before_issue."
4196     return 1
4197   fi
4198
4199   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
4200   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
4201
4202   if [ -z "$ACCOUNT_URL" ] || [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
4203     if ! _regAccount "$_accountkeylength"; then
4204       _on_issue_err "$_post_hook"
4205       return 1
4206     fi
4207   else
4208     _debug "_saved_account_key_hash is not changed, skip register account."
4209   fi
4210
4211   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
4212     _info "Signing from existing CSR."
4213   else
4214     _key=$(_readdomainconf Le_Keylength)
4215     _debug "Read key length:$_key"
4216     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
4217       if ! createDomainKey "$_main_domain" "$_key_length"; then
4218         _err "Create domain key error."
4219         _clearup
4220         _on_issue_err "$_post_hook"
4221         return 1
4222       fi
4223     fi
4224
4225     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
4226       _err "Create CSR error."
4227       _clearup
4228       _on_issue_err "$_post_hook"
4229       return 1
4230     fi
4231   fi
4232
4233   _savedomainconf "Le_Keylength" "$_key_length"
4234
4235   vlist="$Le_Vlist"
4236   _cleardomainconf "Le_Vlist"
4237   _info "Getting domain auth token for each domain"
4238   sep='#'
4239   dvsep=','
4240   if [ -z "$vlist" ]; then
4241     #make new order request
4242     _identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
4243     _w_index=1
4244     while true; do
4245       d="$(echo "$_alt_domains," | cut -d , -f "$_w_index")"
4246       _w_index="$(_math "$_w_index" + 1)"
4247       _debug d "$d"
4248       if [ -z "$d" ]; then
4249         break
4250       fi
4251       _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$(_idn "$d")\"}"
4252     done
4253     _debug2 _identifiers "$_identifiers"
4254     if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
4255       _err "Create new order error."
4256       _clearup
4257       _on_issue_err "$_post_hook"
4258       return 1
4259     fi
4260     Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n " | cut -d ":" -f 2-)"
4261     _debug Le_LinkOrder "$Le_LinkOrder"
4262     Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
4263     _debug Le_OrderFinalize "$Le_OrderFinalize"
4264     if [ -z "$Le_OrderFinalize" ]; then
4265       _err "Create new order error. Le_OrderFinalize not found. $response"
4266       _clearup
4267       _on_issue_err "$_post_hook"
4268       return 1
4269     fi
4270
4271     #for dns manual mode
4272     _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
4273
4274     _authorizations_seg="$(echo "$response" | _json_decode | _egrep_o '"authorizations" *: *\[[^\[]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
4275     _debug2 _authorizations_seg "$_authorizations_seg"
4276     if [ -z "$_authorizations_seg" ]; then
4277       _err "_authorizations_seg not found."
4278       _clearup
4279       _on_issue_err "$_post_hook"
4280       return 1
4281     fi
4282
4283     #domain and authz map
4284     _authorizations_map=""
4285     for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
4286       _debug2 "_authz_url" "$_authz_url"
4287       if ! _send_signed_request "$_authz_url"; then
4288         _err "get to authz error."
4289         _err "_authorizations_seg" "$_authorizations_seg"
4290         _err "_authz_url" "$_authz_url"
4291         _clearup
4292         _on_issue_err "$_post_hook"
4293         return 1
4294       fi
4295
4296       response="$(echo "$response" | _normalizeJson)"
4297       _debug2 response "$response"
4298       _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
4299       if _contains "$response" "\"wildcard\" *: *true"; then
4300         _d="*.$_d"
4301       fi
4302       _debug2 _d "$_d"
4303       _authorizations_map="$_d,$response
4304 $_authorizations_map"
4305     done
4306     _debug2 _authorizations_map "$_authorizations_map"
4307
4308     _index=0
4309     _currentRoot=""
4310     _w_index=1
4311     while true; do
4312       d="$(echo "$_main_domain,$_alt_domains," | cut -d , -f "$_w_index")"
4313       _w_index="$(_math "$_w_index" + 1)"
4314       _debug d "$d"
4315       if [ -z "$d" ]; then
4316         break
4317       fi
4318       _info "Getting webroot for domain" "$d"
4319       _index=$(_math $_index + 1)
4320       _w="$(echo $_web_roots | cut -d , -f $_index)"
4321       _debug _w "$_w"
4322       if [ "$_w" ]; then
4323         _currentRoot="$_w"
4324       fi
4325       _debug "_currentRoot" "$_currentRoot"
4326
4327       vtype="$VTYPE_HTTP"
4328       #todo, v2 wildcard force to use dns
4329       if _startswith "$_currentRoot" "$W_DNS"; then
4330         vtype="$VTYPE_DNS"
4331       fi
4332
4333       if [ "$_currentRoot" = "$W_ALPN" ]; then
4334         vtype="$VTYPE_ALPN"
4335       fi
4336
4337       _idn_d="$(_idn "$d")"
4338       _candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
4339       _debug2 _candidates "$_candidates"
4340       if [ "$(echo "$_candidates" | wc -l)" -gt 1 ]; then
4341         for _can in $_candidates; do
4342           if _startswith "$(echo "$_can" | tr '.' '|')" "$(echo "$_idn_d" | tr '.' '|'),"; then
4343             _candidates="$_can"
4344             break
4345           fi
4346         done
4347       fi
4348       response="$(echo "$_candidates" | sed "s/$_idn_d,//")"
4349       _debug2 "response" "$response"
4350       if [ -z "$response" ]; then
4351         _err "get to authz error."
4352         _err "_authorizations_map" "$_authorizations_map"
4353         _clearup
4354         _on_issue_err "$_post_hook"
4355         return 1
4356       fi
4357
4358       if [ -z "$thumbprint" ]; then
4359         thumbprint="$(__calc_account_thumbprint)"
4360       fi
4361
4362       entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
4363       _debug entry "$entry"
4364       keyauthorization=""
4365       if [ -z "$entry" ]; then
4366         if ! _startswith "$d" '*.'; then
4367           _debug "Not a wildcard domain, lets check whether the validation is already valid."
4368           if echo "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
4369             _debug "$d is already valid."
4370             keyauthorization="$STATE_VERIFIED"
4371             _debug keyauthorization "$keyauthorization"
4372           fi
4373         fi
4374         if [ -z "$keyauthorization" ]; then
4375           _err "Error, can not get domain token entry $d for $vtype"
4376           _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
4377           if [ "$_supported_vtypes" ]; then
4378             _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
4379           fi
4380           _clearup
4381           _on_issue_err "$_post_hook"
4382           return 1
4383         fi
4384       fi
4385
4386       if [ -z "$keyauthorization" ]; then
4387         token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
4388         _debug token "$token"
4389
4390         if [ -z "$token" ]; then
4391           _err "Error, can not get domain token $entry"
4392           _clearup
4393           _on_issue_err "$_post_hook"
4394           return 1
4395         fi
4396
4397         uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
4398
4399         _debug uri "$uri"
4400
4401         if [ -z "$uri" ]; then
4402           _err "Error, can not get domain uri. $entry"
4403           _clearup
4404           _on_issue_err "$_post_hook"
4405           return 1
4406         fi
4407         keyauthorization="$token.$thumbprint"
4408         _debug keyauthorization "$keyauthorization"
4409
4410         if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
4411           _debug "$d is already verified."
4412           keyauthorization="$STATE_VERIFIED"
4413           _debug keyauthorization "$keyauthorization"
4414         fi
4415       fi
4416
4417       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
4418       _debug dvlist "$dvlist"
4419
4420       vlist="$vlist$dvlist$dvsep"
4421
4422     done
4423     _debug vlist "$vlist"
4424     #add entry
4425     dns_entries=""
4426     dnsadded=""
4427     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
4428     _alias_index=1
4429     for ventry in $ventries; do
4430       d=$(echo "$ventry" | cut -d "$sep" -f 1)
4431       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
4432       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
4433       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
4434       _debug d "$d"
4435       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
4436         _debug "$d is already verified, skip $vtype."
4437         _alias_index="$(_math "$_alias_index" + 1)"
4438         continue
4439       fi
4440
4441       if [ "$vtype" = "$VTYPE_DNS" ]; then
4442         dnsadded='0'
4443         _dns_root_d="$d"
4444         if _startswith "$_dns_root_d" "*."; then
4445           _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
4446         fi
4447         _d_alias="$(_getfield "$_challenge_alias" "$_alias_index")"
4448         _alias_index="$(_math "$_alias_index" + 1)"
4449         _debug "_d_alias" "$_d_alias"
4450         if [ "$_d_alias" ]; then
4451           if _startswith "$_d_alias" "$DNS_ALIAS_PREFIX"; then
4452             txtdomain="$(echo "$_d_alias" | sed "s/$DNS_ALIAS_PREFIX//")"
4453           else
4454             txtdomain="_acme-challenge.$_d_alias"
4455           fi
4456           dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$txtdomain$dvsep$_currentRoot"
4457         else
4458           txtdomain="_acme-challenge.$_dns_root_d"
4459           dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$dvsep$_currentRoot"
4460         fi
4461
4462         _debug txtdomain "$txtdomain"
4463         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
4464         _debug txt "$txt"
4465
4466         d_api="$(_findHook "$_dns_root_d" $_SUB_FOLDER_DNSAPI "$_currentRoot")"
4467         _debug d_api "$d_api"
4468
4469         dns_entry="$dns_entry$dvsep$txt${dvsep}$d_api"
4470         _debug2 dns_entry "$dns_entry"
4471         if [ "$d_api" ]; then
4472           _debug "Found domain api file: $d_api"
4473         else
4474           if [ "$_currentRoot" != "$W_DNS" ]; then
4475             _err "Can not find dns api hook for: $_currentRoot"
4476             _info "You need to add the txt record manually."
4477           fi
4478           _info "$(__red "Add the following TXT record:")"
4479           _info "$(__red "Domain: '$(__green "$txtdomain")'")"
4480           _info "$(__red "TXT value: '$(__green "$txt")'")"
4481           _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
4482           _info "$(__red "so the resulting subdomain will be: $txtdomain")"
4483           continue
4484         fi
4485
4486         (
4487           if ! . "$d_api"; then
4488             _err "Load file $d_api error. Please check your api file and try again."
4489             return 1
4490           fi
4491
4492           addcommand="${_currentRoot}_add"
4493           if ! _exists "$addcommand"; then
4494             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
4495             return 1
4496           fi
4497           _info "Adding txt value: $txt for domain:  $txtdomain"
4498           if ! $addcommand "$txtdomain" "$txt"; then
4499             _err "Error add txt for domain:$txtdomain"
4500             return 1
4501           fi
4502           _info "The txt record is added: Success."
4503         )
4504
4505         if [ "$?" != "0" ]; then
4506           _on_issue_err "$_post_hook" "$vlist"
4507           _clearup
4508           return 1
4509         fi
4510         dns_entries="$dns_entries$dns_entry
4511 "
4512         _debug2 "$dns_entries"
4513         dnsadded='1'
4514       fi
4515     done
4516
4517     if [ "$dnsadded" = '0' ]; then
4518       _savedomainconf "Le_Vlist" "$vlist"
4519       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
4520       _err "Please add the TXT records to the domains, and re-run with --renew."
4521       _on_issue_err "$_post_hook"
4522       _clearup
4523       return 1
4524     fi
4525
4526   fi
4527
4528   if [ "$dns_entries" ]; then
4529     if [ -z "$Le_DNSSleep" ]; then
4530       _info "Let's check each DNS record now. Sleep 20 seconds first."
4531       _sleep 20
4532       if ! _check_dns_entries; then
4533         _err "check dns error."
4534         _on_issue_err "$_post_hook"
4535         _clearup
4536         return 1
4537       fi
4538     else
4539       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
4540       _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
4541       _sleep "$Le_DNSSleep"
4542     fi
4543   fi
4544
4545   NGINX_RESTORE_VLIST=""
4546   _debug "ok, let's start to verify"
4547
4548   _ncIndex=1
4549   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
4550   for ventry in $ventries; do
4551     d=$(echo "$ventry" | cut -d "$sep" -f 1)
4552     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
4553     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
4554     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
4555     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
4556
4557     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
4558       _info "$d is already verified, skip $vtype."
4559       continue
4560     fi
4561
4562     _info "Verifying: $d"
4563     _debug "d" "$d"
4564     _debug "keyauthorization" "$keyauthorization"
4565     _debug "uri" "$uri"
4566     removelevel=""
4567     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
4568
4569     _debug "_currentRoot" "$_currentRoot"
4570
4571     if [ "$vtype" = "$VTYPE_HTTP" ]; then
4572       if [ "$_currentRoot" = "$NO_VALUE" ]; then
4573         _info "Standalone mode server"
4574         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
4575         _ncIndex="$(_math $_ncIndex + 1)"
4576         _startserver "$keyauthorization" "$_ncaddr"
4577         if [ "$?" != "0" ]; then
4578           _clearup
4579           _on_issue_err "$_post_hook" "$vlist"
4580           return 1
4581         fi
4582         sleep 1
4583         _debug serverproc "$serverproc"
4584       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
4585         _info "Stateless mode for domain:$d"
4586         _sleep 1
4587       elif _startswith "$_currentRoot" "$NGINX"; then
4588         _info "Nginx mode for domain:$d"
4589         #set up nginx server
4590         FOUND_REAL_NGINX_CONF=""
4591         BACKUP_NGINX_CONF=""
4592         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
4593           _clearup
4594           _on_issue_err "$_post_hook" "$vlist"
4595           return 1
4596         fi
4597
4598         if [ "$FOUND_REAL_NGINX_CONF" ]; then
4599           _realConf="$FOUND_REAL_NGINX_CONF"
4600           _backup="$BACKUP_NGINX_CONF"
4601           _debug _realConf "$_realConf"
4602           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
4603         fi
4604         _sleep 1
4605       else
4606         if [ "$_currentRoot" = "apache" ]; then
4607           wellknown_path="$ACME_DIR"
4608         else
4609           wellknown_path="$_currentRoot/.well-known/acme-challenge"
4610           if [ ! -d "$_currentRoot/.well-known" ]; then
4611             removelevel='1'
4612           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
4613             removelevel='2'
4614           else
4615             removelevel='3'
4616           fi
4617         fi
4618
4619         _debug wellknown_path "$wellknown_path"
4620
4621         _debug "writing token:$token to $wellknown_path/$token"
4622
4623         mkdir -p "$wellknown_path"
4624
4625         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
4626           _err "$d:Can not write token to file : $wellknown_path/$token"
4627           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4628           _clearup
4629           _on_issue_err "$_post_hook" "$vlist"
4630           return 1
4631         fi
4632
4633         if [ ! "$usingApache" ]; then
4634           if webroot_owner=$(_stat "$_currentRoot"); then
4635             _debug "Changing owner/group of .well-known to $webroot_owner"
4636             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
4637               _debug "$(cat "$_EXEC_TEMP_ERR")"
4638               _exec_err >/dev/null 2>&1
4639             fi
4640           else
4641             _debug "not changing owner/group of webroot"
4642           fi
4643         fi
4644
4645       fi
4646     elif [ "$vtype" = "$VTYPE_ALPN" ]; then
4647       acmevalidationv1="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
4648       _debug acmevalidationv1 "$acmevalidationv1"
4649       if ! _starttlsserver "$d" "" "$Le_TLSPort" "$keyauthorization" "$_ncaddr" "$acmevalidationv1"; then
4650         _err "Start tls server error."
4651         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4652         _clearup
4653         _on_issue_err "$_post_hook" "$vlist"
4654         return 1
4655       fi
4656     fi
4657
4658     if ! __trigger_validation "$uri" "$keyauthorization" "$vtype"; then
4659       _err "$d:Can not get challenge: $response"
4660       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4661       _clearup
4662       _on_issue_err "$_post_hook" "$vlist"
4663       return 1
4664     fi
4665
4666     if [ "$code" ] && [ "$code" != '202' ]; then
4667       if [ "$code" = '200' ]; then
4668         _debug "trigger validation code: $code"
4669       else
4670         _err "$d:Challenge error: $response"
4671         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4672         _clearup
4673         _on_issue_err "$_post_hook" "$vlist"
4674         return 1
4675       fi
4676     fi
4677
4678     waittimes=0
4679     if [ -z "$MAX_RETRY_TIMES" ]; then
4680       MAX_RETRY_TIMES=30
4681     fi
4682
4683     while true; do
4684       waittimes=$(_math "$waittimes" + 1)
4685       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
4686         _err "$d:Timeout"
4687         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4688         _clearup
4689         _on_issue_err "$_post_hook" "$vlist"
4690         return 1
4691       fi
4692
4693       _debug "sleep 2 secs to verify"
4694       sleep 2
4695       _debug "checking"
4696
4697       _send_signed_request "$uri"
4698
4699       if [ "$?" != "0" ]; then
4700         _err "$d:Verify error:$response"
4701         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4702         _clearup
4703         _on_issue_err "$_post_hook" "$vlist"
4704         return 1
4705       fi
4706       _debug2 original "$response"
4707
4708       response="$(echo "$response" | _normalizeJson)"
4709       _debug2 response "$response"
4710
4711       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
4712
4713       if _contains "$status" "invalid"; then
4714         error="$(echo "$response" | _egrep_o '"error":\{[^\}]*')"
4715         _debug2 error "$error"
4716         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
4717         _debug2 errordetail "$errordetail"
4718         if [ "$errordetail" ]; then
4719           _err "$d:Verify error:$errordetail"
4720         else
4721           _err "$d:Verify error:$error"
4722         fi
4723         if [ "$DEBUG" ]; then
4724           if [ "$vtype" = "$VTYPE_HTTP" ]; then
4725             _debug "Debug: get token url."
4726             _get "http://$d/.well-known/acme-challenge/$token" "" 1
4727           fi
4728         fi
4729         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4730         _clearup
4731         _on_issue_err "$_post_hook" "$vlist"
4732         return 1
4733       fi
4734
4735       if _contains "$status" "valid"; then
4736         _info "$(__green Success)"
4737         _stopserver "$serverproc"
4738         serverproc=""
4739         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4740         break
4741       fi
4742
4743       if [ "$status" = "pending" ]; then
4744         _info "Pending"
4745       elif [ "$status" = "processing" ]; then
4746         _info "Processing"
4747       else
4748         _err "$d:Verify error:$response"
4749         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
4750         _clearup
4751         _on_issue_err "$_post_hook" "$vlist"
4752         return 1
4753       fi
4754
4755     done
4756
4757   done
4758
4759   _clearup
4760   _info "Verify finished, start to sign."
4761   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
4762
4763   _info "Lets finalize the order."
4764   _info "Le_OrderFinalize" "$Le_OrderFinalize"
4765   if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
4766     _err "Sign failed."
4767     _on_issue_err "$_post_hook"
4768     return 1
4769   fi
4770   if [ "$code" != "200" ]; then
4771     _err "Sign failed, finalize code is not 200."
4772     _err "$response"
4773     _on_issue_err "$_post_hook"
4774     return 1
4775   fi
4776   if [ -z "$Le_LinkOrder" ]; then
4777     Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n \t" | cut -d ":" -f 2-)"
4778   fi
4779
4780   _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
4781
4782   _link_cert_retry=0
4783   _MAX_CERT_RETRY=30
4784   while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
4785     if _contains "$response" "\"status\":\"valid\""; then
4786       _debug "Order status is valid."
4787       Le_LinkCert="$(echo "$response" | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
4788       _debug Le_LinkCert "$Le_LinkCert"
4789       if [ -z "$Le_LinkCert" ]; then
4790         _err "Sign error, can not find Le_LinkCert"
4791         _err "$response"
4792         _on_issue_err "$_post_hook"
4793         return 1
4794       fi
4795       break
4796     elif _contains "$response" "\"processing\""; then
4797       _info "Order status is processing, lets sleep and retry."
4798       _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
4799       _debug "_retryafter" "$_retryafter"
4800       if [ "$_retryafter" ]; then
4801         _info "Retry after: $_retryafter"
4802         _sleep $_retryafter
4803       else
4804         _sleep 2
4805       fi
4806     else
4807       _err "Sign error, wrong status"
4808       _err "$response"
4809       _on_issue_err "$_post_hook"
4810       return 1
4811     fi
4812     #the order is processing, so we are going to poll order status
4813     if [ -z "$Le_LinkOrder" ]; then
4814       _err "Sign error, can not get order link location header"
4815       _err "responseHeaders" "$responseHeaders"
4816       _on_issue_err "$_post_hook"
4817       return 1
4818     fi
4819     _info "Polling order status: $Le_LinkOrder"
4820     if ! _send_signed_request "$Le_LinkOrder"; then
4821       _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
4822       _err "$response"
4823       _on_issue_err "$_post_hook"
4824       return 1
4825     fi
4826     _link_cert_retry="$(_math $_link_cert_retry + 1)"
4827   done
4828
4829   if [ -z "$Le_LinkCert" ]; then
4830     _err "Sign failed, can not get Le_LinkCert, retry time limit."
4831     _err "$response"
4832     _on_issue_err "$_post_hook"
4833     return 1
4834   fi
4835   _info "Downloading cert."
4836   _info "Le_LinkCert" "$Le_LinkCert"
4837   if ! _send_signed_request "$Le_LinkCert"; then
4838     _err "Sign failed, can not download cert:$Le_LinkCert."
4839     _err "$response"
4840     _on_issue_err "$_post_hook"
4841     return 1
4842   fi
4843
4844   echo "$response" >"$CERT_PATH"
4845   _split_cert_chain "$CERT_PATH" "$CERT_FULLCHAIN_PATH" "$CA_CERT_PATH"
4846
4847   if [ "$_preferred_chain" ] && [ -f "$CERT_FULLCHAIN_PATH" ]; then
4848     if [ "$DEBUG" ]; then
4849       _debug "default chain issuers: " "$(_get_chain_issuers "$CERT_FULLCHAIN_PATH")"
4850     fi
4851     if ! _match_issuer "$CERT_FULLCHAIN_PATH" "$_preferred_chain"; then
4852       rels="$(echo "$responseHeaders" | tr -d ' <>' | grep -i "^link:" | grep -i 'rel="alternate"' | cut -d : -f 2- | cut -d ';' -f 1)"
4853       _debug2 "rels" "$rels"
4854       for rel in $rels; do
4855         _info "Try rel: $rel"
4856         if ! _send_signed_request "$rel"; then
4857           _err "Sign failed, can not download cert:$rel"
4858           _err "$response"
4859           continue
4860         fi
4861         _relcert="$CERT_PATH.alt"
4862         _relfullchain="$CERT_FULLCHAIN_PATH.alt"
4863         _relca="$CA_CERT_PATH.alt"
4864         echo "$response" >"$_relcert"
4865         _split_cert_chain "$_relcert" "$_relfullchain" "$_relca"
4866         if [ "$DEBUG" ]; then
4867           _debug "rel chain issuers: " "$(_get_chain_issuers "$_relfullchain")"
4868         fi
4869         if _match_issuer "$_relfullchain" "$_preferred_chain"; then
4870           _info "Matched issuer in: $rel"
4871           cat $_relcert >"$CERT_PATH"
4872           cat $_relfullchain >"$CERT_FULLCHAIN_PATH"
4873           cat $_relca >"$CA_CERT_PATH"
4874           rm -f "$_relcert"
4875           rm -f "$_relfullchain"
4876           rm -f "$_relca"
4877           break
4878         fi
4879         rm -f "$_relcert"
4880         rm -f "$_relfullchain"
4881         rm -f "$_relca"
4882       done
4883     fi
4884   fi
4885
4886   _debug "Le_LinkCert" "$Le_LinkCert"
4887   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
4888
4889   if [ -z "$Le_LinkCert" ] || ! _checkcert "$CERT_PATH"; then
4890     response="$(echo "$response" | _dbase64 "multiline" | tr -d '\0' | _normalizeJson)"
4891     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
4892     _on_issue_err "$_post_hook"
4893     return 1
4894   fi
4895
4896   if [ "$Le_LinkCert" ]; then
4897     _info "$(__green "Cert success.")"
4898     cat "$CERT_PATH"
4899
4900     _info "Your cert is in $(__green " $CERT_PATH ")"
4901
4902     if [ -f "$CERT_KEY_PATH" ]; then
4903       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
4904     fi
4905
4906     if [ ! "$USER_PATH" ] || [ ! "$_ACME_IN_CRON" ]; then
4907       USER_PATH="$PATH"
4908       _saveaccountconf "USER_PATH" "$USER_PATH"
4909     fi
4910   fi
4911
4912   [ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
4913   [ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
4914
4915   Le_CertCreateTime=$(_time)
4916   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
4917
4918   Le_CertCreateTimeStr=$(date -u)
4919   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
4920
4921   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ]; then
4922     Le_RenewalDays="$DEFAULT_RENEW"
4923   else
4924     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
4925   fi
4926
4927   if [ "$CA_BUNDLE" ]; then
4928     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
4929   else
4930     _clearaccountconf "CA_BUNDLE"
4931   fi
4932
4933   if [ "$CA_PATH" ]; then
4934     _saveaccountconf CA_PATH "$CA_PATH"
4935   else
4936     _clearaccountconf "CA_PATH"
4937   fi
4938
4939   if [ "$HTTPS_INSECURE" ]; then
4940     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
4941   else
4942     _clearaccountconf "HTTPS_INSECURE"
4943   fi
4944
4945   if [ "$Le_Listen_V4" ]; then
4946     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
4947     _cleardomainconf Le_Listen_V6
4948   elif [ "$Le_Listen_V6" ]; then
4949     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
4950     _cleardomainconf Le_Listen_V4
4951   fi
4952
4953   if [ "$Le_ForceNewDomainKey" = "1" ]; then
4954     _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
4955   else
4956     _cleardomainconf Le_ForceNewDomainKey
4957   fi
4958
4959   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
4960
4961   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
4962   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
4963
4964   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
4965   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
4966
4967   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
4968     _savedomainconf "Le_RealCertPath" "$_real_cert"
4969     _savedomainconf "Le_RealCACertPath" "$_real_ca"
4970     _savedomainconf "Le_RealKeyPath" "$_real_key"
4971     _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
4972     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4973     if ! _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"; then
4974       return 1
4975     fi
4976   fi
4977
4978   if ! _on_issue_success "$_post_hook" "$_renew_hook"; then
4979     _err "Call hook error."
4980     return 1
4981   fi
4982 }
4983
4984 #in_out_cert   out_fullchain   out_ca
4985 _split_cert_chain() {
4986   _certf="$1"
4987   _fullchainf="$2"
4988   _caf="$3"
4989   if [ "$(grep -- "$BEGIN_CERT" "$_certf" | wc -l)" -gt "1" ]; then
4990     _debug "Found cert chain"
4991     cat "$_certf" >"$_fullchainf"
4992     _end_n="$(grep -n -- "$END_CERT" "$_fullchainf" | _head_n 1 | cut -d : -f 1)"
4993     _debug _end_n "$_end_n"
4994     sed -n "1,${_end_n}p" "$_fullchainf" >"$_certf"
4995     _end_n="$(_math $_end_n + 1)"
4996     sed -n "${_end_n},9999p" "$_fullchainf" >"$_caf"
4997   fi
4998 }
4999
5000 #domain  [isEcc]
5001 renew() {
5002   Le_Domain="$1"
5003   if [ -z "$Le_Domain" ]; then
5004     _usage "Usage: $PROJECT_ENTRY --renew --domain <domain.tld> [--ecc]"
5005     return 1
5006   fi
5007
5008   _isEcc="$2"
5009
5010   _initpath "$Le_Domain" "$_isEcc"
5011
5012   _info "$(__green "Renew: '$Le_Domain'")"
5013   if [ ! -f "$DOMAIN_CONF" ]; then
5014     _info "'$Le_Domain' is not an issued domain, skip."
5015     return $RENEW_SKIP
5016   fi
5017
5018   if [ "$Le_RenewalDays" ]; then
5019     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
5020   fi
5021
5022   . "$DOMAIN_CONF"
5023   _debug Le_API "$Le_API"
5024
5025   if [ "$Le_API" ]; then
5026     export ACME_DIRECTORY="$Le_API"
5027     #reload ca configs
5028     ACCOUNT_KEY_PATH=""
5029     ACCOUNT_JSON_PATH=""
5030     CA_CONF=""
5031     _debug3 "initpath again."
5032     _initpath "$Le_Domain" "$_isEcc"
5033   fi
5034
5035   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
5036     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
5037     _info "Add '$(__red '--force')' to force to renew."
5038     return "$RENEW_SKIP"
5039   fi
5040
5041   if [ "$_ACME_IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
5042     _info "Skip invalid cert for: $Le_Domain"
5043     return $RENEW_SKIP
5044   fi
5045
5046   _ACME_IS_RENEW="1"
5047   Le_ReloadCmd="$(_readdomainconf Le_ReloadCmd)"
5048   Le_PreHook="$(_readdomainconf Le_PreHook)"
5049   Le_PostHook="$(_readdomainconf Le_PostHook)"
5050   Le_RenewHook="$(_readdomainconf Le_RenewHook)"
5051   Le_Preferred_Chain="$(_readdomainconf Le_Preferred_Chain)"
5052   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias" "$Le_Preferred_Chain"
5053   res="$?"
5054   if [ "$res" != "0" ]; then
5055     return "$res"
5056   fi
5057
5058   if [ "$Le_DeployHook" ]; then
5059     _deploy "$Le_Domain" "$Le_DeployHook"
5060     res="$?"
5061   fi
5062
5063   _ACME_IS_RENEW=""
5064
5065   return "$res"
5066 }
5067
5068 #renewAll  [stopRenewOnError]
5069 renewAll() {
5070   _initpath
5071   _stopRenewOnError="$1"
5072   _debug "_stopRenewOnError" "$_stopRenewOnError"
5073   _ret="0"
5074   _success_msg=""
5075   _error_msg=""
5076   _skipped_msg=""
5077   _error_level=$NOTIFY_LEVEL_SKIP
5078   _notify_code=$RENEW_SKIP
5079   _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
5080   _debug "_set_level" "$_set_level"
5081   for di in "${CERT_HOME}"/*.*/; do
5082     _debug di "$di"
5083     if ! [ -d "$di" ]; then
5084       _debug "Not a directory, skip: $di"
5085       continue
5086     fi
5087     d=$(basename "$di")
5088     _debug d "$d"
5089     (
5090       if _endswith "$d" "$ECC_SUFFIX"; then
5091         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
5092         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
5093       fi
5094       renew "$d" "$_isEcc"
5095     )
5096     rc="$?"
5097     _debug "Return code: $rc"
5098     if [ "$rc" = "0" ]; then
5099       if [ $_error_level -gt $NOTIFY_LEVEL_RENEW ]; then
5100         _error_level="$NOTIFY_LEVEL_RENEW"
5101         _notify_code=0
5102       fi
5103       if [ "$_ACME_IN_CRON" ]; then
5104         if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
5105           if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
5106             _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
5107           fi
5108         fi
5109       fi
5110       _success_msg="${_success_msg}    $d
5111 "
5112     elif [ "$rc" = "$RENEW_SKIP" ]; then
5113       if [ $_error_level -gt $NOTIFY_LEVEL_SKIP ]; then
5114         _error_level="$NOTIFY_LEVEL_SKIP"
5115         _notify_code=$RENEW_SKIP
5116       fi
5117       if [ "$_ACME_IN_CRON" ]; then
5118         if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
5119           if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
5120             _send_notify "Renew $d skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
5121           fi
5122         fi
5123       fi
5124       _info "Skipped $d"
5125       _skipped_msg="${_skipped_msg}    $d
5126 "
5127     else
5128       if [ $_error_level -gt $NOTIFY_LEVEL_ERROR ]; then
5129         _error_level="$NOTIFY_LEVEL_ERROR"
5130         _notify_code=1
5131       fi
5132       if [ "$_ACME_IN_CRON" ]; then
5133         if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
5134           if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
5135             _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
5136           fi
5137         fi
5138       fi
5139       _error_msg="${_error_msg}    $d
5140 "
5141       if [ "$_stopRenewOnError" ]; then
5142         _err "Error renew $d,  stop now."
5143         _ret="$rc"
5144         break
5145       else
5146         _ret="$rc"
5147         _err "Error renew $d."
5148       fi
5149     fi
5150   done
5151   _debug _error_level "$_error_level"
5152   _debug _set_level "$_set_level"
5153   if [ "$_ACME_IN_CRON" ] && [ $_error_level -le $_set_level ]; then
5154     if [ -z "$NOTIFY_MODE" ] || [ "$NOTIFY_MODE" = "$NOTIFY_MODE_BULK" ]; then
5155       _msg_subject="Renew"
5156       if [ "$_error_msg" ]; then
5157         _msg_subject="${_msg_subject} Error"
5158         _msg_data="Error certs:
5159 ${_error_msg}
5160 "
5161       fi
5162       if [ "$_success_msg" ]; then
5163         _msg_subject="${_msg_subject} Success"
5164         _msg_data="${_msg_data}Success certs:
5165 ${_success_msg}
5166 "
5167       fi
5168       if [ "$_skipped_msg" ]; then
5169         _msg_subject="${_msg_subject} Skipped"
5170         _msg_data="${_msg_data}Skipped certs:
5171 ${_skipped_msg}
5172 "
5173       fi
5174
5175       _send_notify "$_msg_subject" "$_msg_data" "$NOTIFY_HOOK" "$_notify_code"
5176     fi
5177   fi
5178
5179   return "$_ret"
5180 }
5181
5182 #csr webroot
5183 signcsr() {
5184   _csrfile="$1"
5185   _csrW="$2"
5186   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
5187     _usage "Usage: $PROJECT_ENTRY --sign-csr --csr <csr-file> --webroot <directory>"
5188     return 1
5189   fi
5190
5191   _real_cert="$3"
5192   _real_key="$4"
5193   _real_ca="$5"
5194   _reload_cmd="$6"
5195   _real_fullchain="$7"
5196   _pre_hook="${8}"
5197   _post_hook="${9}"
5198   _renew_hook="${10}"
5199   _local_addr="${11}"
5200   _challenge_alias="${12}"
5201   _preferred_chain="${13}"
5202
5203   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
5204   if [ "$?" != "0" ]; then
5205     _err "Can not read subject from csr: $_csrfile"
5206     return 1
5207   fi
5208   _debug _csrsubj "$_csrsubj"
5209   if _contains "$_csrsubj" ' ' || ! _contains "$_csrsubj" '.'; then
5210     _info "It seems that the subject: $_csrsubj is not a valid domain name. Drop it."
5211     _csrsubj=""
5212   fi
5213
5214   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
5215   if [ "$?" != "0" ]; then
5216     _err "Can not read domain list from csr: $_csrfile"
5217     return 1
5218   fi
5219   _debug "_csrdomainlist" "$_csrdomainlist"
5220
5221   if [ -z "$_csrsubj" ]; then
5222     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
5223     _debug _csrsubj "$_csrsubj"
5224     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
5225     _debug "_csrdomainlist" "$_csrdomainlist"
5226   fi
5227
5228   if [ -z "$_csrsubj" ]; then
5229     _err "Can not read subject from csr: $_csrfile"
5230     return 1
5231   fi
5232
5233   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
5234   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
5235     _err "Can not read key length from csr: $_csrfile"
5236     return 1
5237   fi
5238
5239   _initpath "$_csrsubj" "$_csrkeylength"
5240   mkdir -p "$DOMAIN_PATH"
5241
5242   _info "Copy csr to: $CSR_PATH"
5243   cp "$_csrfile" "$CSR_PATH"
5244
5245   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias" "$_preferred_chain"
5246
5247 }
5248
5249 showcsr() {
5250   _csrfile="$1"
5251   _csrd="$2"
5252   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
5253     _usage "Usage: $PROJECT_ENTRY --show-csr --csr <csr-file>"
5254     return 1
5255   fi
5256
5257   _initpath
5258
5259   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
5260   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
5261     _err "Can not read subject from csr: $_csrfile"
5262     return 1
5263   fi
5264
5265   _info "Subject=$_csrsubj"
5266
5267   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
5268   if [ "$?" != "0" ]; then
5269     _err "Can not read domain list from csr: $_csrfile"
5270     return 1
5271   fi
5272   _debug "_csrdomainlist" "$_csrdomainlist"
5273
5274   _info "SubjectAltNames=$_csrdomainlist"
5275
5276   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
5277   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
5278     _err "Can not read key length from csr: $_csrfile"
5279     return 1
5280   fi
5281   _info "KeyLength=$_csrkeylength"
5282 }
5283
5284 #listraw  domain
5285 list() {
5286   _raw="$1"
5287   _domain="$2"
5288   _initpath
5289
5290   _sep="|"
5291   if [ "$_raw" ]; then
5292     if [ -z "$_domain" ]; then
5293       printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}CA${_sep}Created${_sep}Renew"
5294     fi
5295     for di in "${CERT_HOME}"/*.*/; do
5296       d=$(basename "$di")
5297       _debug d "$d"
5298       (
5299         if _endswith "$d" "$ECC_SUFFIX"; then
5300           _isEcc="ecc"
5301           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
5302         fi
5303         DOMAIN_CONF="$di/$d.conf"
5304         if [ -f "$DOMAIN_CONF" ]; then
5305           . "$DOMAIN_CONF"
5306           _ca="$(_getCAShortName "$Le_API")"
5307           if [ -z "$_domain" ]; then
5308             printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$_ca${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
5309           else
5310             if [ "$_domain" = "$d" ]; then
5311               cat "$DOMAIN_CONF"
5312             fi
5313           fi
5314         fi
5315       )
5316     done
5317   else
5318     if _exists column; then
5319       list "raw" "$_domain" | column -t -s "$_sep"
5320     else
5321       list "raw" "$_domain" | tr "$_sep" '\t'
5322     fi
5323   fi
5324
5325 }
5326
5327 _deploy() {
5328   _d="$1"
5329   _hooks="$2"
5330
5331   for _d_api in $(echo "$_hooks" | tr ',' " "); do
5332     _deployApi="$(_findHook "$_d" $_SUB_FOLDER_DEPLOY "$_d_api")"
5333     if [ -z "$_deployApi" ]; then
5334       _err "The deploy hook $_d_api is not found."
5335       return 1
5336     fi
5337     _debug _deployApi "$_deployApi"
5338
5339     if ! (
5340       if ! . "$_deployApi"; then
5341         _err "Load file $_deployApi error. Please check your api file and try again."
5342         return 1
5343       fi
5344
5345       d_command="${_d_api}_deploy"
5346       if ! _exists "$d_command"; then
5347         _err "It seems that your api file is not correct, it must have a function named: $d_command"
5348         return 1
5349       fi
5350
5351       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
5352         _err "Error deploy for domain:$_d"
5353         return 1
5354       fi
5355     ); then
5356       _err "Deploy error."
5357       return 1
5358     else
5359       _info "$(__green Success)"
5360     fi
5361   done
5362 }
5363
5364 #domain hooks
5365 deploy() {
5366   _d="$1"
5367   _hooks="$2"
5368   _isEcc="$3"
5369   if [ -z "$_hooks" ]; then
5370     _usage "Usage: $PROJECT_ENTRY --deploy --domain <domain.tld> --deploy-hook <hookname> [--ecc] "
5371     return 1
5372   fi
5373
5374   _initpath "$_d" "$_isEcc"
5375   if [ ! -d "$DOMAIN_PATH" ]; then
5376     _err "The domain '$_d' is not a cert name. You must use the cert name to specify the cert to install."
5377     _err "Can not find path:'$DOMAIN_PATH'"
5378     return 1
5379   fi
5380
5381   . "$DOMAIN_CONF"
5382
5383   _savedomainconf Le_DeployHook "$_hooks"
5384
5385   _deploy "$_d" "$_hooks"
5386 }
5387
5388 installcert() {
5389   _main_domain="$1"
5390   if [ -z "$_main_domain" ]; then
5391     _usage "Usage: $PROJECT_ENTRY --install-cert --domain <domain.tld> [--ecc] [--cert-file <file>] [--key-file <file>] [--ca-file <file>] [ --reloadcmd <command>] [--fullchain-file <file>]"
5392     return 1
5393   fi
5394
5395   _real_cert="$2"
5396   _real_key="$3"
5397   _real_ca="$4"
5398   _reload_cmd="$5"
5399   _real_fullchain="$6"
5400   _isEcc="$7"
5401
5402   _initpath "$_main_domain" "$_isEcc"
5403   if [ ! -d "$DOMAIN_PATH" ]; then
5404     _err "The domain '$_main_domain' is not a cert name. You must use the cert name to specify the cert to install."
5405     _err "Can not find path:'$DOMAIN_PATH'"
5406     return 1
5407   fi
5408
5409   _savedomainconf "Le_RealCertPath" "$_real_cert"
5410   _savedomainconf "Le_RealCACertPath" "$_real_ca"
5411   _savedomainconf "Le_RealKeyPath" "$_real_key"
5412   _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
5413   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
5414
5415   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
5416 }
5417
5418 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
5419 _installcert() {
5420   _main_domain="$1"
5421   _real_cert="$2"
5422   _real_key="$3"
5423   _real_ca="$4"
5424   _real_fullchain="$5"
5425   _reload_cmd="$6"
5426   _backup_prefix="$7"
5427
5428   if [ "$_real_cert" = "$NO_VALUE" ]; then
5429     _real_cert=""
5430   fi
5431   if [ "$_real_key" = "$NO_VALUE" ]; then
5432     _real_key=""
5433   fi
5434   if [ "$_real_ca" = "$NO_VALUE" ]; then
5435     _real_ca=""
5436   fi
5437   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
5438     _reload_cmd=""
5439   fi
5440   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
5441     _real_fullchain=""
5442   fi
5443
5444   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
5445   mkdir -p "$_backup_path"
5446
5447   if [ "$_real_cert" ]; then
5448     _info "Installing cert to:$_real_cert"
5449     if [ -f "$_real_cert" ] && [ ! "$_ACME_IS_RENEW" ]; then
5450       cp "$_real_cert" "$_backup_path/cert.bak"
5451     fi
5452     cat "$CERT_PATH" >"$_real_cert" || return 1
5453   fi
5454
5455   if [ "$_real_ca" ]; then
5456     _info "Installing CA to:$_real_ca"
5457     if [ "$_real_ca" = "$_real_cert" ]; then
5458       echo "" >>"$_real_ca"
5459       cat "$CA_CERT_PATH" >>"$_real_ca" || return 1
5460     else
5461       if [ -f "$_real_ca" ] && [ ! "$_ACME_IS_RENEW" ]; then
5462         cp "$_real_ca" "$_backup_path/ca.bak"
5463       fi
5464       cat "$CA_CERT_PATH" >"$_real_ca" || return 1
5465     fi
5466   fi
5467
5468   if [ "$_real_key" ]; then
5469     _info "Installing key to:$_real_key"
5470     if [ -f "$_real_key" ] && [ ! "$_ACME_IS_RENEW" ]; then
5471       cp "$_real_key" "$_backup_path/key.bak"
5472     fi
5473     if [ -f "$_real_key" ]; then
5474       cat "$CERT_KEY_PATH" >"$_real_key" || return 1
5475     else
5476       cat "$CERT_KEY_PATH" >"$_real_key" || return 1
5477       chmod 600 "$_real_key"
5478     fi
5479   fi
5480
5481   if [ "$_real_fullchain" ]; then
5482     _info "Installing full chain to:$_real_fullchain"
5483     if [ -f "$_real_fullchain" ] && [ ! "$_ACME_IS_RENEW" ]; then
5484       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
5485     fi
5486     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain" || return 1
5487   fi
5488
5489   if [ "$_reload_cmd" ]; then
5490     _info "Run reload cmd: $_reload_cmd"
5491     if (
5492       export CERT_PATH
5493       export CERT_KEY_PATH
5494       export CA_CERT_PATH
5495       export CERT_FULLCHAIN_PATH
5496       export Le_Domain="$_main_domain"
5497       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
5498     ); then
5499       _info "$(__green "Reload success")"
5500     else
5501       _err "Reload error for :$Le_Domain"
5502     fi
5503   fi
5504
5505 }
5506
5507 __read_password() {
5508   unset _pp
5509   prompt="Enter Password:"
5510   while IFS= read -p "$prompt" -r -s -n 1 char; do
5511     if [ "$char" = $'\0' ]; then
5512       break
5513     fi
5514     prompt='*'
5515     _pp="$_pp$char"
5516   done
5517   echo "$_pp"
5518 }
5519
5520 _install_win_taskscheduler() {
5521   _lesh="$1"
5522   _centry="$2"
5523   _randomminute="$3"
5524   if ! _exists cygpath; then
5525     _err "cygpath not found"
5526     return 1
5527   fi
5528   if ! _exists schtasks; then
5529     _err "schtasks.exe is not found, are you on Windows?"
5530     return 1
5531   fi
5532   _winbash="$(cygpath -w $(which bash))"
5533   _debug _winbash "$_winbash"
5534   if [ -z "$_winbash" ]; then
5535     _err "can not find bash path"
5536     return 1
5537   fi
5538   _myname="$(whoami)"
5539   _debug "_myname" "$_myname"
5540   if [ -z "$_myname" ]; then
5541     _err "can not find my user name"
5542     return 1
5543   fi
5544   _debug "_lesh" "$_lesh"
5545
5546   _info "To install scheduler task in your Windows account, you must input your windows password."
5547   _info "$PROJECT_NAME doesn't save your password."
5548   _info "Please input your Windows password for: $(__green "$_myname")"
5549   _password="$(__read_password)"
5550   #SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'" >/dev/null
5551   echo SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "\"$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'\"" | cmd.exe >/dev/null
5552   echo
5553
5554 }
5555
5556 _uninstall_win_taskscheduler() {
5557   if ! _exists schtasks; then
5558     _err "schtasks.exe is not found, are you on Windows?"
5559     return 1
5560   fi
5561   if ! echo SCHTASKS /query /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null; then
5562     _debug "scheduler $_WINDOWS_SCHEDULER_NAME is not found."
5563   else
5564     _info "Removing $_WINDOWS_SCHEDULER_NAME"
5565     echo SCHTASKS /delete /f /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
5566   fi
5567 }
5568
5569 #confighome
5570 installcronjob() {
5571   _c_home="$1"
5572   _initpath
5573   _CRONTAB="crontab"
5574   if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
5575     lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
5576   else
5577     _err "Can not install cronjob, $PROJECT_ENTRY not found."
5578     return 1
5579   fi
5580   if [ "$_c_home" ]; then
5581     _c_entry="--config-home \"$_c_home\" "
5582   fi
5583   _t=$(_time)
5584   random_minute=$(_math $_t % 60)
5585
5586   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
5587     _CRONTAB="fcrontab"
5588   fi
5589
5590   if ! _exists "$_CRONTAB"; then
5591     if _exists cygpath && _exists schtasks.exe; then
5592       _info "It seems you are on Windows,  let's install Windows scheduler task."
5593       if _install_win_taskscheduler "$lesh" "$_c_entry" "$random_minute"; then
5594         _info "Install Windows scheduler task success."
5595         return 0
5596       else
5597         _err "Install Windows scheduler task failed."
5598         return 1
5599       fi
5600     fi
5601     _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
5602     _err "All your certs will not be renewed automatically."
5603     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
5604     return 1
5605   fi
5606   _info "Installing cron job"
5607   if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
5608     if _exists uname && uname -a | grep SunOS >/dev/null; then
5609       $_CRONTAB -l | {
5610         cat
5611         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
5612       } | $_CRONTAB --
5613     else
5614       $_CRONTAB -l | {
5615         cat
5616         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
5617       } | $_CRONTAB -
5618     fi
5619   fi
5620   if [ "$?" != "0" ]; then
5621     _err "Install cron job failed. You need to manually renew your certs."
5622     _err "Or you can add cronjob by yourself:"
5623     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
5624     return 1
5625   fi
5626 }
5627
5628 uninstallcronjob() {
5629   _CRONTAB="crontab"
5630   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
5631     _CRONTAB="fcrontab"
5632   fi
5633
5634   if ! _exists "$_CRONTAB"; then
5635     if _exists cygpath && _exists schtasks.exe; then
5636       _info "It seems you are on Windows,  let's uninstall Windows scheduler task."
5637       if _uninstall_win_taskscheduler; then
5638         _info "Uninstall Windows scheduler task success."
5639         return 0
5640       else
5641         _err "Uninstall Windows scheduler task failed."
5642         return 1
5643       fi
5644     fi
5645     return
5646   fi
5647   _info "Removing cron job"
5648   cr="$($_CRONTAB -l | grep "$PROJECT_ENTRY --cron")"
5649   if [ "$cr" ]; then
5650     if _exists uname && uname -a | grep solaris >/dev/null; then
5651       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB --
5652     else
5653       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB -
5654     fi
5655     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
5656     _info LE_WORKING_DIR "$LE_WORKING_DIR"
5657     if _contains "$cr" "--config-home"; then
5658       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
5659       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
5660     fi
5661   fi
5662   _initpath
5663
5664 }
5665
5666 #domain  isECC  revokeReason
5667 revoke() {
5668   Le_Domain="$1"
5669   if [ -z "$Le_Domain" ]; then
5670     _usage "Usage: $PROJECT_ENTRY --revoke --domain <domain.tld> [--ecc]"
5671     return 1
5672   fi
5673
5674   _isEcc="$2"
5675   _reason="$3"
5676   if [ -z "$_reason" ]; then
5677     _reason="0"
5678   fi
5679   _initpath "$Le_Domain" "$_isEcc"
5680   if [ ! -f "$DOMAIN_CONF" ]; then
5681     _err "$Le_Domain is not a issued domain, skip."
5682     return 1
5683   fi
5684
5685   if [ ! -f "$CERT_PATH" ]; then
5686     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
5687     return 1
5688   fi
5689
5690   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
5691
5692   if [ -z "$cert" ]; then
5693     _err "Cert for $Le_Domain is empty found, skip."
5694     return 1
5695   fi
5696
5697   _initAPI
5698
5699   data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
5700
5701   uri="${ACME_REVOKE_CERT}"
5702
5703   if [ -f "$CERT_KEY_PATH" ]; then
5704     _info "Try domain key first."
5705     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
5706       if [ -z "$response" ]; then
5707         _info "Revoke success."
5708         rm -f "$CERT_PATH"
5709         return 0
5710       else
5711         _err "Revoke error by domain key."
5712         _err "$response"
5713       fi
5714     fi
5715   else
5716     _info "Domain key file doesn't exist."
5717   fi
5718
5719   _info "Try account key."
5720
5721   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
5722     if [ -z "$response" ]; then
5723       _info "Revoke success."
5724       rm -f "$CERT_PATH"
5725       return 0
5726     else
5727       _err "Revoke error."
5728       _debug "$response"
5729     fi
5730   fi
5731   return 1
5732 }
5733
5734 #domain  ecc
5735 remove() {
5736   Le_Domain="$1"
5737   if [ -z "$Le_Domain" ]; then
5738     _usage "Usage: $PROJECT_ENTRY --remove --domain <domain.tld> [--ecc]"
5739     return 1
5740   fi
5741
5742   _isEcc="$2"
5743
5744   _initpath "$Le_Domain" "$_isEcc"
5745   _removed_conf="$DOMAIN_CONF.removed"
5746   if [ ! -f "$DOMAIN_CONF" ]; then
5747     if [ -f "$_removed_conf" ]; then
5748       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
5749     else
5750       _err "$Le_Domain is not a issued domain, skip."
5751     fi
5752     return 1
5753   fi
5754
5755   if mv "$DOMAIN_CONF" "$_removed_conf"; then
5756     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
5757     _info "You can remove them by yourself."
5758     return 0
5759   else
5760     _err "Remove $Le_Domain failed."
5761     return 1
5762   fi
5763 }
5764
5765 #domain vtype
5766 _deactivate() {
5767   _d_domain="$1"
5768   _d_type="$2"
5769   _initpath
5770
5771   _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
5772   if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
5773     _err "Can not get domain new order."
5774     return 1
5775   fi
5776   _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
5777   _debug2 _authorizations_seg "$_authorizations_seg"
5778   if [ -z "$_authorizations_seg" ]; then
5779     _err "_authorizations_seg not found."
5780     _clearup
5781     _on_issue_err "$_post_hook"
5782     return 1
5783   fi
5784
5785   authzUri="$_authorizations_seg"
5786   _debug2 "authzUri" "$authzUri"
5787   if ! _send_signed_request "$authzUri"; then
5788     _err "get to authz error."
5789     _err "_authorizations_seg" "$_authorizations_seg"
5790     _err "authzUri" "$authzUri"
5791     _clearup
5792     _on_issue_err "$_post_hook"
5793     return 1
5794   fi
5795
5796   response="$(echo "$response" | _normalizeJson)"
5797   _debug2 response "$response"
5798   _URL_NAME="url"
5799
5800   entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
5801   if [ -z "$entries" ]; then
5802     _info "No valid entries found."
5803     if [ -z "$thumbprint" ]; then
5804       thumbprint="$(__calc_account_thumbprint)"
5805     fi
5806     _debug "Trigger validation."
5807     vtype="$VTYPE_DNS"
5808     entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
5809     _debug entry "$entry"
5810     if [ -z "$entry" ]; then
5811       _err "Error, can not get domain token $d"
5812       return 1
5813     fi
5814     token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
5815     _debug token "$token"
5816
5817     uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
5818     _debug uri "$uri"
5819
5820     keyauthorization="$token.$thumbprint"
5821     _debug keyauthorization "$keyauthorization"
5822     __trigger_validation "$uri" "$keyauthorization"
5823
5824   fi
5825
5826   _d_i=0
5827   _d_max_retry=$(echo "$entries" | wc -l)
5828   while [ "$_d_i" -lt "$_d_max_retry" ]; do
5829     _info "Deactivate: $_d_domain"
5830     _d_i="$(_math $_d_i + 1)"
5831     entry="$(echo "$entries" | sed -n "${_d_i}p")"
5832     _debug entry "$entry"
5833
5834     if [ -z "$entry" ]; then
5835       _info "No more valid entry found."
5836       break
5837     fi
5838
5839     _vtype="$(echo "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
5840     _debug _vtype "$_vtype"
5841     _info "Found $_vtype"
5842
5843     uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*\"" | tr -d '" ' | cut -d : -f 2-)"
5844     _debug uri "$uri"
5845
5846     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
5847       _info "Skip $_vtype"
5848       continue
5849     fi
5850
5851     _info "Deactivate: $_vtype"
5852
5853     _djson="{\"status\":\"deactivated\"}"
5854
5855     if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
5856       _info "Deactivate: $_vtype success."
5857     else
5858       _err "Can not deactivate $_vtype."
5859       break
5860     fi
5861
5862   done
5863   _debug "$_d_i"
5864   if [ "$_d_i" -eq "$_d_max_retry" ]; then
5865     _info "Deactivated success!"
5866   else
5867     _err "Deactivate failed."
5868   fi
5869
5870 }
5871
5872 deactivate() {
5873   _d_domain_list="$1"
5874   _d_type="$2"
5875   _initpath
5876   _initAPI
5877   _debug _d_domain_list "$_d_domain_list"
5878   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
5879     _usage "Usage: $PROJECT_ENTRY --deactivate --domain <domain.tld> [--domain <domain2.tld> ...]"
5880     return 1
5881   fi
5882   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
5883     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
5884       continue
5885     fi
5886     if ! _deactivate "$_d_dm" "$_d_type"; then
5887       return 1
5888     fi
5889   done
5890 }
5891
5892 # Detect profile file if not specified as environment variable
5893 _detect_profile() {
5894   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
5895     echo "$PROFILE"
5896     return
5897   fi
5898
5899   DETECTED_PROFILE=''
5900   SHELLTYPE="$(basename "/$SHELL")"
5901
5902   if [ "$SHELLTYPE" = "bash" ]; then
5903     if [ -f "$HOME/.bashrc" ]; then
5904       DETECTED_PROFILE="$HOME/.bashrc"
5905     elif [ -f "$HOME/.bash_profile" ]; then
5906       DETECTED_PROFILE="$HOME/.bash_profile"
5907     fi
5908   elif [ "$SHELLTYPE" = "zsh" ]; then
5909     DETECTED_PROFILE="$HOME/.zshrc"
5910   fi
5911
5912   if [ -z "$DETECTED_PROFILE" ]; then
5913     if [ -f "$HOME/.profile" ]; then
5914       DETECTED_PROFILE="$HOME/.profile"
5915     elif [ -f "$HOME/.bashrc" ]; then
5916       DETECTED_PROFILE="$HOME/.bashrc"
5917     elif [ -f "$HOME/.bash_profile" ]; then
5918       DETECTED_PROFILE="$HOME/.bash_profile"
5919     elif [ -f "$HOME/.zshrc" ]; then
5920       DETECTED_PROFILE="$HOME/.zshrc"
5921     fi
5922   fi
5923
5924   echo "$DETECTED_PROFILE"
5925 }
5926
5927 _initconf() {
5928   _initpath
5929   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
5930     echo "
5931
5932 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
5933 #LOG_LEVEL=1
5934
5935 #AUTO_UPGRADE=\"1\"
5936
5937 #NO_TIMESTAMP=1
5938
5939     " >"$ACCOUNT_CONF_PATH"
5940   fi
5941 }
5942
5943 # nocron
5944 _precheck() {
5945   _nocron="$1"
5946
5947   if ! _exists "curl" && ! _exists "wget"; then
5948     _err "Please install curl or wget first, we need to access http resources."
5949     return 1
5950   fi
5951
5952   if [ -z "$_nocron" ]; then
5953     if ! _exists "crontab" && ! _exists "fcrontab"; then
5954       if _exists cygpath && _exists schtasks.exe; then
5955         _info "It seems you are on Windows,  we will install Windows scheduler task."
5956       else
5957         _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
5958         _err "We need to set cron job to renew the certs automatically."
5959         _err "Otherwise, your certs will not be able to be renewed automatically."
5960         if [ -z "$FORCE" ]; then
5961           _err "Please add '--force' and try install again to go without crontab."
5962           _err "./$PROJECT_ENTRY --install --force"
5963           return 1
5964         fi
5965       fi
5966     fi
5967   fi
5968
5969   if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
5970     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
5971     _err "We need openssl to generate keys."
5972     return 1
5973   fi
5974
5975   if ! _exists "socat"; then
5976     _err "It is recommended to install socat first."
5977     _err "We use socat for standalone server if you use standalone mode."
5978     _err "If you don't use standalone mode, just ignore this warning."
5979   fi
5980
5981   return 0
5982 }
5983
5984 _setShebang() {
5985   _file="$1"
5986   _shebang="$2"
5987   if [ -z "$_shebang" ]; then
5988     _usage "Usage: file shebang"
5989     return 1
5990   fi
5991   cp "$_file" "$_file.tmp"
5992   echo "$_shebang" >"$_file"
5993   sed -n 2,99999p "$_file.tmp" >>"$_file"
5994   rm -f "$_file.tmp"
5995 }
5996
5997 #confighome
5998 _installalias() {
5999   _c_home="$1"
6000   _initpath
6001
6002   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
6003   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
6004     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
6005     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
6006     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
6007   fi
6008
6009   if [ "$_c_home" ]; then
6010     _c_entry=" --config-home '$_c_home'"
6011   fi
6012
6013   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
6014   if [ "$_c_home" ]; then
6015     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
6016   else
6017     _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
6018   fi
6019   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
6020
6021   _profile="$(_detect_profile)"
6022   if [ "$_profile" ]; then
6023     _debug "Found profile: $_profile"
6024     _info "Installing alias to '$_profile'"
6025     _setopt "$_profile" ". \"$_envfile\""
6026     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
6027   else
6028     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
6029   fi
6030
6031   #for csh
6032   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
6033   _csh_profile="$HOME/.cshrc"
6034   if [ -f "$_csh_profile" ]; then
6035     _info "Installing alias to '$_csh_profile'"
6036     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
6037     if [ "$_c_home" ]; then
6038       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
6039     else
6040       _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
6041     fi
6042     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
6043     _setopt "$_csh_profile" "source \"$_cshfile\""
6044   fi
6045
6046   #for tcsh
6047   _tcsh_profile="$HOME/.tcshrc"
6048   if [ -f "$_tcsh_profile" ]; then
6049     _info "Installing alias to '$_tcsh_profile'"
6050     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
6051     if [ "$_c_home" ]; then
6052       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
6053     fi
6054     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
6055     _setopt "$_tcsh_profile" "source \"$_cshfile\""
6056   fi
6057
6058 }
6059
6060 # nocron confighome noprofile accountemail
6061 install() {
6062
6063   if [ -z "$LE_WORKING_DIR" ]; then
6064     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
6065   fi
6066
6067   _nocron="$1"
6068   _c_home="$2"
6069   _noprofile="$3"
6070   _accountemail="$4"
6071
6072   if ! _initpath; then
6073     _err "Install failed."
6074     return 1
6075   fi
6076   if [ "$_nocron" ]; then
6077     _debug "Skip install cron job"
6078   fi
6079
6080   if [ "$_ACME_IN_CRON" != "1" ]; then
6081     if ! _precheck "$_nocron"; then
6082       _err "Pre-check failed, can not install."
6083       return 1
6084     fi
6085   fi
6086
6087   if [ -z "$_c_home" ] && [ "$LE_CONFIG_HOME" != "$LE_WORKING_DIR" ]; then
6088     _info "Using config home: $LE_CONFIG_HOME"
6089     _c_home="$LE_CONFIG_HOME"
6090   fi
6091
6092   #convert from le
6093   if [ -d "$HOME/.le" ]; then
6094     for envfile in "le.env" "le.sh.env"; do
6095       if [ -f "$HOME/.le/$envfile" ]; then
6096         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
6097           _upgrading="1"
6098           _info "You are upgrading from le.sh"
6099           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
6100           mv "$HOME/.le" "$LE_WORKING_DIR"
6101           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
6102           break
6103         fi
6104       fi
6105     done
6106   fi
6107
6108   _info "Installing to $LE_WORKING_DIR"
6109
6110   if [ ! -d "$LE_WORKING_DIR" ]; then
6111     if ! mkdir -p "$LE_WORKING_DIR"; then
6112       _err "Can not create working dir: $LE_WORKING_DIR"
6113       return 1
6114     fi
6115
6116     chmod 700 "$LE_WORKING_DIR"
6117   fi
6118
6119   if [ ! -d "$LE_CONFIG_HOME" ]; then
6120     if ! mkdir -p "$LE_CONFIG_HOME"; then
6121       _err "Can not create config dir: $LE_CONFIG_HOME"
6122       return 1
6123     fi
6124
6125     chmod 700 "$LE_CONFIG_HOME"
6126   fi
6127
6128   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
6129
6130   if [ "$?" != "0" ]; then
6131     _err "Install failed, can not copy $PROJECT_ENTRY"
6132     return 1
6133   fi
6134
6135   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
6136
6137   if [ "$_ACME_IN_CRON" != "1" ] && [ -z "$_noprofile" ]; then
6138     _installalias "$_c_home"
6139   fi
6140
6141   for subf in $_SUB_FOLDERS; do
6142     if [ -d "$subf" ]; then
6143       mkdir -p "$LE_WORKING_DIR/$subf"
6144       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
6145     fi
6146   done
6147
6148   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
6149     _initconf
6150   fi
6151
6152   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
6153     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
6154   fi
6155
6156   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
6157     _saveaccountconf "CERT_HOME" "$CERT_HOME"
6158   fi
6159
6160   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
6161     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
6162   fi
6163
6164   if [ -z "$_nocron" ]; then
6165     installcronjob "$_c_home"
6166   fi
6167
6168   if [ -z "$NO_DETECT_SH" ]; then
6169     #Modify shebang
6170     if _exists bash; then
6171       _bash_path="$(bash -c "command -v bash 2>/dev/null")"
6172       if [ -z "$_bash_path" ]; then
6173         _bash_path="$(bash -c 'echo $SHELL')"
6174       fi
6175     fi
6176     if [ "$_bash_path" ]; then
6177       _info "Good, bash is found, so change the shebang to use bash as preferred."
6178       _shebang='#!'"$_bash_path"
6179       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
6180       for subf in $_SUB_FOLDERS; do
6181         if [ -d "$LE_WORKING_DIR/$subf" ]; then
6182           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
6183             _setShebang "$_apifile" "$_shebang"
6184           done
6185         fi
6186       done
6187     fi
6188   fi
6189
6190   if [ "$_accountemail" ]; then
6191     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
6192   fi
6193
6194   _info OK
6195 }
6196
6197 # nocron
6198 uninstall() {
6199   _nocron="$1"
6200   if [ -z "$_nocron" ]; then
6201     uninstallcronjob
6202   fi
6203   _initpath
6204
6205   _uninstallalias
6206
6207   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
6208   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
6209
6210 }
6211
6212 _uninstallalias() {
6213   _initpath
6214
6215   _profile="$(_detect_profile)"
6216   if [ "$_profile" ]; then
6217     _info "Uninstalling alias from: '$_profile'"
6218     text="$(cat "$_profile")"
6219     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
6220   fi
6221
6222   _csh_profile="$HOME/.cshrc"
6223   if [ -f "$_csh_profile" ]; then
6224     _info "Uninstalling alias from: '$_csh_profile'"
6225     text="$(cat "$_csh_profile")"
6226     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
6227   fi
6228
6229   _tcsh_profile="$HOME/.tcshrc"
6230   if [ -f "$_tcsh_profile" ]; then
6231     _info "Uninstalling alias from: '$_csh_profile'"
6232     text="$(cat "$_tcsh_profile")"
6233     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
6234   fi
6235
6236 }
6237
6238 cron() {
6239   export _ACME_IN_CRON=1
6240   _initpath
6241   _info "$(__green "===Starting cron===")"
6242   if [ "$AUTO_UPGRADE" = "1" ]; then
6243     export LE_WORKING_DIR
6244     (
6245       if ! upgrade; then
6246         _err "Cron:Upgrade failed!"
6247         return 1
6248       fi
6249     )
6250     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
6251
6252     if [ -t 1 ]; then
6253       __INTERACTIVE="1"
6254     fi
6255
6256     _info "Auto upgraded to: $VER"
6257   fi
6258   renewAll
6259   _ret="$?"
6260   _ACME_IN_CRON=""
6261   _info "$(__green "===End cron===")"
6262   exit $_ret
6263 }
6264
6265 version() {
6266   echo "$PROJECT"
6267   echo "v$VER"
6268 }
6269
6270 # subject content hooks code
6271 _send_notify() {
6272   _nsubject="$1"
6273   _ncontent="$2"
6274   _nhooks="$3"
6275   _nerror="$4"
6276
6277   if [ "$NOTIFY_LEVEL" = "$NOTIFY_LEVEL_DISABLE" ]; then
6278     _debug "The NOTIFY_LEVEL is $NOTIFY_LEVEL, disabled, just return."
6279     return 0
6280   fi
6281
6282   if [ -z "$_nhooks" ]; then
6283     _debug "The NOTIFY_HOOK is empty, just return."
6284     return 0
6285   fi
6286
6287   _send_err=0
6288   for _n_hook in $(echo "$_nhooks" | tr ',' " "); do
6289     _n_hook_file="$(_findHook "" $_SUB_FOLDER_NOTIFY "$_n_hook")"
6290     _info "Sending via: $_n_hook"
6291     _debug "Found $_n_hook_file for $_n_hook"
6292     if [ -z "$_n_hook_file" ]; then
6293       _err "Can not find the hook file for $_n_hook"
6294       continue
6295     fi
6296     if ! (
6297       if ! . "$_n_hook_file"; then
6298         _err "Load file $_n_hook_file error. Please check your api file and try again."
6299         return 1
6300       fi
6301
6302       d_command="${_n_hook}_send"
6303       if ! _exists "$d_command"; then
6304         _err "It seems that your api file is not correct, it must have a function named: $d_command"
6305         return 1
6306       fi
6307
6308       if ! $d_command "$_nsubject" "$_ncontent" "$_nerror"; then
6309         _err "Error send message by $d_command"
6310         return 1
6311       fi
6312
6313       return 0
6314     ); then
6315       _err "Set $_n_hook_file error."
6316       _send_err=1
6317     else
6318       _info "$_n_hook $(__green Success)"
6319     fi
6320   done
6321   return $_send_err
6322
6323 }
6324
6325 # hook
6326 _set_notify_hook() {
6327   _nhooks="$1"
6328
6329   _test_subject="Hello, this is a notification from $PROJECT_NAME"
6330   _test_content="If you receive this message, your notification works."
6331
6332   _send_notify "$_test_subject" "$_test_content" "$_nhooks" 0
6333
6334 }
6335
6336 #[hook] [level] [mode]
6337 setnotify() {
6338   _nhook="$1"
6339   _nlevel="$2"
6340   _nmode="$3"
6341
6342   _initpath
6343
6344   if [ -z "$_nhook$_nlevel$_nmode" ]; then
6345     _usage "Usage: $PROJECT_ENTRY --set-notify [--notify-hook <hookname>] [--notify-level <0|1|2|3>] [--notify-mode <0|1>]"
6346     _usage "$_NOTIFY_WIKI"
6347     return 1
6348   fi
6349
6350   if [ "$_nlevel" ]; then
6351     _info "Set notify level to: $_nlevel"
6352     export "NOTIFY_LEVEL=$_nlevel"
6353     _saveaccountconf "NOTIFY_LEVEL" "$NOTIFY_LEVEL"
6354   fi
6355
6356   if [ "$_nmode" ]; then
6357     _info "Set notify mode to: $_nmode"
6358     export "NOTIFY_MODE=$_nmode"
6359     _saveaccountconf "NOTIFY_MODE" "$NOTIFY_MODE"
6360   fi
6361
6362   if [ "$_nhook" ]; then
6363     _info "Set notify hook to: $_nhook"
6364     if [ "$_nhook" = "$NO_VALUE" ]; then
6365       _info "Clear notify hook"
6366       _clearaccountconf "NOTIFY_HOOK"
6367     else
6368       if _set_notify_hook "$_nhook"; then
6369         export NOTIFY_HOOK="$_nhook"
6370         _saveaccountconf "NOTIFY_HOOK" "$NOTIFY_HOOK"
6371         return 0
6372       else
6373         _err "Can not set notify hook to: $_nhook"
6374         return 1
6375       fi
6376     fi
6377   fi
6378
6379 }
6380
6381 showhelp() {
6382   _initpath
6383   version
6384   echo "Usage: $PROJECT_ENTRY <command> ... [parameters ...]
6385 Commands:
6386   -h, --help               Show this help message.
6387   -v, --version            Show version info.
6388   --install                Install $PROJECT_NAME to your system.
6389   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
6390   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
6391   --issue                  Issue a cert.
6392   --deploy                 Deploy the cert to your server.
6393   -i, --install-cert       Install the issued cert to apache/nginx or any other server.
6394   -r, --renew              Renew a cert.
6395   --renew-all              Renew all the certs.
6396   --revoke                 Revoke a cert.
6397   --remove                 Remove the cert from list of certs known to $PROJECT_NAME.
6398   --list                   List all the certs.
6399   --to-pkcs12              Export the certificate and key to a pfx file.
6400   --to-pkcs8               Convert to pkcs8 format.
6401   --sign-csr               Issue a cert from an existing csr.
6402   --show-csr               Show the content of a csr.
6403   -ccr, --create-csr       Create CSR, professional use.
6404   --create-domain-key      Create an domain private key, professional use.
6405   --update-account         Update account info.
6406   --register-account       Register account key.
6407   --deactivate-account     Deactivate the account.
6408   --create-account-key     Create an account private key, professional use.
6409   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
6410   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
6411   --cron                   Run cron job to renew all the certs.
6412   --set-notify             Set the cron notification hook, level or mode.
6413   --deactivate             Deactivate the domain authz, professional use.
6414   --set-default-ca         Used with '--server', Set the default CA to use.
6415                            See: $_SERVER_WIKI
6416
6417
6418 Parameters:
6419   -d, --domain <domain.tld>         Specifies a domain, used to issue, renew or revoke etc.
6420   --challenge-alias <domain.tld>    The challenge domain alias for DNS alias mode.
6421                                     See: $_DNS_ALIAS_WIKI
6422
6423   --domain-alias <domain.tld>       The domain alias for DNS alias mode.
6424                                     See: $_DNS_ALIAS_WIKI
6425
6426   --preferred-chain <chain>         If the CA offers multiple certificate chains, prefer the chain with an issuer matching this Subject Common Name.
6427                                     If no match, the default offered chain will be used. (default: empty)
6428                                     See: $_PREFERRED_CHAIN_WIKI
6429
6430   -f, --force                       Force install, force cert renewal or override sudo restrictions.
6431   --staging, --test                 Use staging server, for testing.
6432   --debug [0|1|2|3]                 Output debug info. Defaults to 1 if argument is omitted.
6433   --output-insecure                 Output all the sensitive messages.
6434                                     By default all the credentials/sensitive messages are hidden from the output/debug/log for security.
6435   -w, --webroot <directory>         Specifies the web root folder for web root mode.
6436   --standalone                      Use standalone mode.
6437   --alpn                            Use standalone alpn mode.
6438   --stateless                       Use stateless mode.
6439                                     See: $_STATELESS_WIKI
6440
6441   --apache                          Use apache mode.
6442   --dns [dns_hook]                  Use dns manual mode or dns api. Defaults to manual mode when argument is omitted.
6443                                     See: $_DNS_API_WIKI
6444
6445   --dnssleep <seconds>              The time in seconds to wait for all the txt records to propagate in dns api mode.
6446                                     It's not necessary to use this by default, $PROJECT_NAME polls dns status by DOH automatically.
6447   -k, --keylength <bits>            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
6448   -ak, --accountkeylength <bits>    Specifies the account key length: 2048, 3072, 4096
6449   --log [file]                      Specifies the log file. Defaults to \"$DEFAULT_LOG_FILE\" if argument is omitted.
6450   --log-level <1|2>                 Specifies the log level, default is 1.
6451   --syslog <0|3|6|7>                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
6452   --eab-kid <eab_key_id>            Key Identifier for External Account Binding.
6453   --eab-hmac-key <eab_hmac_key>     HMAC key for External Account Binding.
6454
6455
6456   These parameters are to install the cert to nginx/apache or any other server after issue/renew a cert:
6457
6458   --cert-file <file>                Path to copy the cert file to after issue/renew..
6459   --key-file <file>                 Path to copy the key file to after issue/renew.
6460   --ca-file <file>                  Path to copy the intermediate cert file to after issue/renew.
6461   --fullchain-file <file>           Path to copy the fullchain cert file to after issue/renew.
6462   --reloadcmd <command>             Command to execute after issue/renew to reload the server.
6463
6464   --server <server_uri>             ACME Directory Resource URI. (default: $DEFAULT_CA)
6465                                     See: $_SERVER_WIKI
6466
6467   --accountconf <file>              Specifies a customized account config file.
6468   --home <directory>                Specifies the home dir for $PROJECT_NAME.
6469   --cert-home <directory>           Specifies the home dir to save all the certs, only valid for '--install' command.
6470   --config-home <directory>         Specifies the home dir to save all the configurations.
6471   --useragent <string>              Specifies the user agent string. it will be saved for future use too.
6472   -m, --email <email>               Specifies the account email, only valid for the '--install' and '--update-account' command.
6473   --accountkey <file>               Specifies the account key path, only valid for the '--install' command.
6474   --days <ndays>                    Specifies the days to renew the cert when using '--issue' command. The default value is $DEFAULT_RENEW days.
6475   --httpport <port>                 Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
6476   --tlsport <port>                  Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
6477   --local-address <ip>              Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
6478   --listraw                         Only used for '--list' command, list the certs in raw format.
6479   -se, --stop-renew-on-error        Only valid for '--renew-all' command. Stop if one cert has error in renewal.
6480   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
6481   --ca-bundle <file>                Specifies the path to the CA certificate bundle to verify api server's certificate.
6482   --ca-path <directory>             Specifies directory containing CA certificates in PEM format, used by wget or curl.
6483   --no-cron                         Only valid for '--install' command, which means: do not install the default cron job.
6484                                     In this case, the certs will not be renewed automatically.
6485   --no-profile                      Only valid for '--install' command, which means: do not install aliases to user profile.
6486   --no-color                        Do not output color text.
6487   --force-color                     Force output of color text. Useful for non-interactive use with the aha tool for HTML E-Mails.
6488   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--to-pkcs12' and '--create-csr'
6489   --csr <file>                      Specifies the input csr.
6490   --pre-hook <command>              Command to be run before obtaining any certificates.
6491   --post-hook <command>             Command to be run after attempting to obtain/renew certificates. Runs regardless of whether obtain/renew succeeded or failed.
6492   --renew-hook <command>            Command to be run after each successfully renewed certificate.
6493   --deploy-hook <hookname>          The hook file to deploy cert
6494   --ocsp, --ocsp-must-staple        Generate OCSP-Must-Staple extension.
6495   --always-force-new-domain-key     Generate new domain key on renewal. Otherwise, the domain key is not changed by default.
6496   --auto-upgrade [0|1]              Valid for '--upgrade' command, indicating whether to upgrade automatically in future. Defaults to 1 if argument is omitted.
6497   --listen-v4                       Force standalone/tls server to listen at ipv4.
6498   --listen-v6                       Force standalone/tls server to listen at ipv6.
6499   --openssl-bin <file>              Specifies a custom openssl bin location.
6500   --use-wget                        Force to use wget, if you have both curl and wget installed.
6501   --yes-I-know-dns-manual-mode-enough-go-ahead-please  Force use of dns manual mode.
6502                                     See:  $_DNS_MANUAL_WIKI
6503
6504   -b, --branch <branch>             Only valid for '--upgrade' command, specifies the branch name to upgrade to.
6505   --notify-level <0|1|2|3>          Set the notification level:  Default value is $NOTIFY_LEVEL_DEFAULT.
6506                                     0: disabled, no notification will be sent.
6507                                     1: send notifications only when there is an error.
6508                                     2: send notifications when a cert is successfully renewed, or there is an error.
6509                                     3: send notifications when a cert is skipped, renewed, or error.
6510   --notify-mode <0|1>               Set notification mode. Default value is $NOTIFY_MODE_DEFAULT.
6511                                     0: Bulk mode. Send all the domain's notifications in one message(mail).
6512                                     1: Cert mode. Send a message for every single cert.
6513   --notify-hook <hookname>          Set the notify hook
6514   --revoke-reason <0-10>            The reason for revocation, can be used in conjunction with the '--revoke' command.
6515                                     See: $_REVOKE_WIKI
6516
6517   --password <password>             Add a password to exported pfx file. Use with --to-pkcs12.
6518
6519
6520 "
6521 }
6522
6523 installOnline() {
6524   _info "Installing from online archive."
6525
6526   _branch="$BRANCH"
6527   if [ -z "$_branch" ]; then
6528     _branch="master"
6529   fi
6530
6531   target="$PROJECT/archive/$_branch.tar.gz"
6532   _info "Downloading $target"
6533   localname="$_branch.tar.gz"
6534   if ! _get "$target" >$localname; then
6535     _err "Download error."
6536     return 1
6537   fi
6538   (
6539     _info "Extracting $localname"
6540     if ! (tar xzf $localname || gtar xzf $localname); then
6541       _err "Extraction error."
6542       exit 1
6543     fi
6544
6545     cd "$PROJECT_NAME-$_branch"
6546     chmod +x $PROJECT_ENTRY
6547     if ./$PROJECT_ENTRY --install "$@"; then
6548       _info "Install success!"
6549       _initpath
6550       _saveaccountconf "UPGRADE_HASH" "$(_getUpgradeHash)"
6551     fi
6552
6553     cd ..
6554
6555     rm -rf "$PROJECT_NAME-$_branch"
6556     rm -f "$localname"
6557   )
6558 }
6559
6560 _getRepoHash() {
6561   _hash_path=$1
6562   shift
6563   _hash_url="https://api.github.com/repos/acmesh-official/$PROJECT_NAME/git/refs/$_hash_path"
6564   _get $_hash_url | tr -d "\r\n" | tr '{},' '\n' | grep '"sha":' | cut -d '"' -f 4
6565 }
6566
6567 _getUpgradeHash() {
6568   _b="$BRANCH"
6569   if [ -z "$_b" ]; then
6570     _b="master"
6571   fi
6572   _hash=$(_getRepoHash "heads/$_b")
6573   if [ -z "$_hash" ]; then _hash=$(_getRepoHash "tags/$_b"); fi
6574   echo $_hash
6575 }
6576
6577 upgrade() {
6578   if (
6579     _initpath
6580     [ -z "$FORCE" ] && [ "$(_getUpgradeHash)" = "$(_readaccountconf "UPGRADE_HASH")" ] && _info "Already uptodate!" && exit 0
6581     export LE_WORKING_DIR
6582     cd "$LE_WORKING_DIR"
6583     installOnline "--nocron" "--noprofile"
6584   ); then
6585     _info "Upgrade success!"
6586     exit 0
6587   else
6588     _err "Upgrade failed!"
6589     exit 1
6590   fi
6591 }
6592
6593 _processAccountConf() {
6594   if [ "$_useragent" ]; then
6595     _saveaccountconf "USER_AGENT" "$_useragent"
6596   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
6597     _saveaccountconf "USER_AGENT" "$USER_AGENT"
6598   fi
6599
6600   if [ "$_openssl_bin" ]; then
6601     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
6602   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
6603     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
6604   fi
6605
6606   if [ "$_auto_upgrade" ]; then
6607     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
6608   elif [ "$AUTO_UPGRADE" ]; then
6609     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
6610   fi
6611
6612   if [ "$_use_wget" ]; then
6613     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
6614   elif [ "$ACME_USE_WGET" ]; then
6615     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
6616   fi
6617
6618 }
6619
6620 _checkSudo() {
6621   if [ "$SUDO_GID" ] && [ "$SUDO_COMMAND" ] && [ "$SUDO_USER" ] && [ "$SUDO_UID" ]; then
6622     if [ "$SUDO_USER" = "root" ] && [ "$SUDO_UID" = "0" ]; then
6623       #it's root using sudo, no matter it's using sudo or not, just fine
6624       return 0
6625     fi
6626     if [ -n "$SUDO_COMMAND" ]; then
6627       #it's a normal user doing "sudo su", or `sudo -i` or `sudo -s`, or `sudo su acmeuser1`
6628       _endswith "$SUDO_COMMAND" /bin/su || _contains "$SUDO_COMMAND" "/bin/su " || grep "^$SUDO_COMMAND\$" /etc/shells >/dev/null 2>&1
6629       return $?
6630     fi
6631     #otherwise
6632     return 1
6633   fi
6634   return 0
6635 }
6636
6637 #server
6638 _selectServer() {
6639   _server="$1"
6640   _server_lower="$(echo "$_server" | _lower_case)"
6641   _sindex=0
6642   for snames in $CA_NAMES; do
6643     snames="$(echo "$snames" | _lower_case)"
6644     _sindex="$(_math $_sindex + 1)"
6645     _debug2 "_selectServer try snames" "$snames"
6646     for sname in $(echo "$snames" | tr ',' ' '); do
6647       if [ "$_server_lower" = "$sname" ]; then
6648         _debug2 "_selectServer match $sname"
6649         _serverdir="$(_getfield "$CA_SERVERS" $_sindex)"
6650         _debug "Selected server: $_serverdir"
6651         ACME_DIRECTORY="$_serverdir"
6652         export ACME_DIRECTORY
6653         return
6654       fi
6655     done
6656   done
6657   ACME_DIRECTORY="$_server"
6658   export ACME_DIRECTORY
6659 }
6660
6661 #url
6662 _getCAShortName() {
6663   caurl="$1"
6664   if [ -z "$caurl" ]; then
6665     caurl="$DEFAULT_CA"
6666   fi
6667   caurl_lower="$(echo $caurl | _lower_case)"
6668   _sindex=0
6669   for surl in $(echo "$CA_SERVERS" | _lower_case | tr , ' '); do
6670     _sindex="$(_math $_sindex + 1)"
6671     if [ "$caurl_lower" = "$surl" ]; then
6672       _nindex=0
6673       for snames in $CA_NAMES; do
6674         _nindex="$(_math $_nindex + 1)"
6675         if [ $_nindex -ge $_sindex ]; then
6676           _getfield "$snames" 1
6677           return
6678         fi
6679       done
6680     fi
6681   done
6682   echo "$caurl"
6683 }
6684
6685 #set default ca to $ACME_DIRECTORY
6686 setdefaultca() {
6687   if [ -z "$ACME_DIRECTORY" ]; then
6688     _err "Please give a --server parameter."
6689     return 1
6690   fi
6691   _saveaccountconf "DEFAULT_ACME_SERVER" "$ACME_DIRECTORY"
6692   _info "Changed default CA to: $(__green "$ACME_DIRECTORY")"
6693 }
6694
6695 _process() {
6696   _CMD=""
6697   _domain=""
6698   _altdomains="$NO_VALUE"
6699   _webroot=""
6700   _challenge_alias=""
6701   _keylength=""
6702   _accountkeylength=""
6703   _cert_file=""
6704   _key_file=""
6705   _ca_file=""
6706   _fullchain_file=""
6707   _reloadcmd=""
6708   _password=""
6709   _accountconf=""
6710   _useragent=""
6711   _accountemail=""
6712   _accountkey=""
6713   _certhome=""
6714   _confighome=""
6715   _httpport=""
6716   _tlsport=""
6717   _dnssleep=""
6718   _listraw=""
6719   _stopRenewOnError=""
6720   #_insecure=""
6721   _ca_bundle=""
6722   _ca_path=""
6723   _nocron=""
6724   _noprofile=""
6725   _ecc=""
6726   _csr=""
6727   _pre_hook=""
6728   _post_hook=""
6729   _renew_hook=""
6730   _deploy_hook=""
6731   _logfile=""
6732   _log=""
6733   _local_address=""
6734   _log_level=""
6735   _auto_upgrade=""
6736   _listen_v4=""
6737   _listen_v6=""
6738   _openssl_bin=""
6739   _syslog=""
6740   _use_wget=""
6741   _server=""
6742   _notify_hook=""
6743   _notify_level=""
6744   _notify_mode=""
6745   _revoke_reason=""
6746   _eab_kid=""
6747   _eab_hmac_key=""
6748   _preferred_chain=""
6749   while [ ${#} -gt 0 ]; do
6750     case "${1}" in
6751
6752     --help | -h)
6753       showhelp
6754       return
6755       ;;
6756     --version | -v)
6757       version
6758       return
6759       ;;
6760     --install)
6761       _CMD="install"
6762       ;;
6763     --install-online)
6764       shift
6765       installOnline "$@"
6766       return
6767       ;;
6768     --uninstall)
6769       _CMD="uninstall"
6770       ;;
6771     --upgrade)
6772       _CMD="upgrade"
6773       ;;
6774     --issue)
6775       _CMD="issue"
6776       ;;
6777     --deploy)
6778       _CMD="deploy"
6779       ;;
6780     --sign-csr | --signcsr)
6781       _CMD="signcsr"
6782       ;;
6783     --show-csr | --showcsr)
6784       _CMD="showcsr"
6785       ;;
6786     -i | --install-cert | --installcert)
6787       _CMD="installcert"
6788       ;;
6789     --renew | -r)
6790       _CMD="renew"
6791       ;;
6792     --renew-all | --renewAll | --renewall)
6793       _CMD="renewAll"
6794       ;;
6795     --revoke)
6796       _CMD="revoke"
6797       ;;
6798     --remove)
6799       _CMD="remove"
6800       ;;
6801     --list)
6802       _CMD="list"
6803       ;;
6804     --install-cronjob | --installcronjob)
6805       _CMD="installcronjob"
6806       ;;
6807     --uninstall-cronjob | --uninstallcronjob)
6808       _CMD="uninstallcronjob"
6809       ;;
6810     --cron)
6811       _CMD="cron"
6812       ;;
6813     --to-pkcs12 | --to-pkcs | --toPkcs)
6814       _CMD="toPkcs"
6815       ;;
6816     --to-pkcs8 | --toPkcs8)
6817       _CMD="toPkcs8"
6818       ;;
6819     --create-account-key | --createAccountKey | --createaccountkey | -cak)
6820       _CMD="createAccountKey"
6821       ;;
6822     --create-domain-key | --createDomainKey | --createdomainkey | -cdk)
6823       _CMD="createDomainKey"
6824       ;;
6825     -ccr | --create-csr | --createCSR | --createcsr)
6826       _CMD="createCSR"
6827       ;;
6828     --deactivate)
6829       _CMD="deactivate"
6830       ;;
6831     --update-account | --updateaccount)
6832       _CMD="updateaccount"
6833       ;;
6834     --register-account | --registeraccount)
6835       _CMD="registeraccount"
6836       ;;
6837     --deactivate-account)
6838       _CMD="deactivateaccount"
6839       ;;
6840     --set-notify)
6841       _CMD="setnotify"
6842       ;;
6843     --set-default-ca)
6844       _CMD="setdefaultca"
6845       ;;
6846     -d | --domain)
6847       _dvalue="$2"
6848
6849       if [ "$_dvalue" ]; then
6850         if _startswith "$_dvalue" "-"; then
6851           _err "'$_dvalue' is not a valid domain for parameter '$1'"
6852           return 1
6853         fi
6854         if _is_idn "$_dvalue" && ! _exists idn; then
6855           _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
6856           return 1
6857         fi
6858
6859         if [ -z "$_domain" ]; then
6860           _domain="$_dvalue"
6861         else
6862           if [ "$_altdomains" = "$NO_VALUE" ]; then
6863             _altdomains="$_dvalue"
6864           else
6865             _altdomains="$_altdomains,$_dvalue"
6866           fi
6867         fi
6868       fi
6869
6870       shift
6871       ;;
6872
6873     -f | --force)
6874       FORCE="1"
6875       ;;
6876     --staging | --test)
6877       STAGE="1"
6878       ;;
6879     --server)
6880       _server="$2"
6881       _selectServer "$_server"
6882       shift
6883       ;;
6884     --debug)
6885       if [ -z "$2" ] || _startswith "$2" "-"; then
6886         DEBUG="$DEBUG_LEVEL_DEFAULT"
6887       else
6888         DEBUG="$2"
6889         shift
6890       fi
6891       ;;
6892     --output-insecure)
6893       export OUTPUT_INSECURE=1
6894       ;;
6895     -w | --webroot)
6896       wvalue="$2"
6897       if [ -z "$_webroot" ]; then
6898         _webroot="$wvalue"
6899       else
6900         _webroot="$_webroot,$wvalue"
6901       fi
6902       shift
6903       ;;
6904     --challenge-alias)
6905       cvalue="$2"
6906       _challenge_alias="$_challenge_alias$cvalue,"
6907       shift
6908       ;;
6909     --domain-alias)
6910       cvalue="$DNS_ALIAS_PREFIX$2"
6911       _challenge_alias="$_challenge_alias$cvalue,"
6912       shift
6913       ;;
6914     --standalone)
6915       wvalue="$NO_VALUE"
6916       if [ -z "$_webroot" ]; then
6917         _webroot="$wvalue"
6918       else
6919         _webroot="$_webroot,$wvalue"
6920       fi
6921       ;;
6922     --alpn)
6923       wvalue="$W_ALPN"
6924       if [ -z "$_webroot" ]; then
6925         _webroot="$wvalue"
6926       else
6927         _webroot="$_webroot,$wvalue"
6928       fi
6929       ;;
6930     --stateless)
6931       wvalue="$MODE_STATELESS"
6932       if [ -z "$_webroot" ]; then
6933         _webroot="$wvalue"
6934       else
6935         _webroot="$_webroot,$wvalue"
6936       fi
6937       ;;
6938     --local-address)
6939       lvalue="$2"
6940       _local_address="$_local_address$lvalue,"
6941       shift
6942       ;;
6943     --apache)
6944       wvalue="apache"
6945       if [ -z "$_webroot" ]; then
6946         _webroot="$wvalue"
6947       else
6948         _webroot="$_webroot,$wvalue"
6949       fi
6950       ;;
6951     --nginx)
6952       wvalue="$NGINX"
6953       if [ "$2" ] && ! _startswith "$2" "-"; then
6954         wvalue="$NGINX$2"
6955         shift
6956       fi
6957       if [ -z "$_webroot" ]; then
6958         _webroot="$wvalue"
6959       else
6960         _webroot="$_webroot,$wvalue"
6961       fi
6962       ;;
6963     --dns)
6964       wvalue="$W_DNS"
6965       if [ "$2" ] && ! _startswith "$2" "-"; then
6966         wvalue="$2"
6967         shift
6968       fi
6969       if [ -z "$_webroot" ]; then
6970         _webroot="$wvalue"
6971       else
6972         _webroot="$_webroot,$wvalue"
6973       fi
6974       ;;
6975     --dnssleep)
6976       _dnssleep="$2"
6977       Le_DNSSleep="$_dnssleep"
6978       shift
6979       ;;
6980
6981     --keylength | -k)
6982       _keylength="$2"
6983       shift
6984       ;;
6985     -ak | --accountkeylength)
6986       _accountkeylength="$2"
6987       shift
6988       ;;
6989
6990     --cert-file | --certpath)
6991       _cert_file="$2"
6992       shift
6993       ;;
6994     --key-file | --keypath)
6995       _key_file="$2"
6996       shift
6997       ;;
6998     --ca-file | --capath)
6999       _ca_file="$2"
7000       shift
7001       ;;
7002     --fullchain-file | --fullchainpath)
7003       _fullchain_file="$2"
7004       shift
7005       ;;
7006     --reloadcmd | --reloadCmd)
7007       _reloadcmd="$2"
7008       shift
7009       ;;
7010     --password)
7011       _password="$2"
7012       shift
7013       ;;
7014     --accountconf)
7015       _accountconf="$2"
7016       ACCOUNT_CONF_PATH="$_accountconf"
7017       shift
7018       ;;
7019     --home)
7020       LE_WORKING_DIR="$2"
7021       shift
7022       ;;
7023     --cert-home | --certhome)
7024       _certhome="$2"
7025       CERT_HOME="$_certhome"
7026       shift
7027       ;;
7028     --config-home)
7029       _confighome="$2"
7030       LE_CONFIG_HOME="$_confighome"
7031       shift
7032       ;;
7033     --useragent)
7034       _useragent="$2"
7035       USER_AGENT="$_useragent"
7036       shift
7037       ;;
7038     -m | --email | --accountemail)
7039       _accountemail="$2"
7040       export ACCOUNT_EMAIL="$_accountemail"
7041       shift
7042       ;;
7043     --accountkey)
7044       _accountkey="$2"
7045       ACCOUNT_KEY_PATH="$_accountkey"
7046       shift
7047       ;;
7048     --days)
7049       _days="$2"
7050       Le_RenewalDays="$_days"
7051       shift
7052       ;;
7053     --httpport)
7054       _httpport="$2"
7055       Le_HTTPPort="$_httpport"
7056       shift
7057       ;;
7058     --tlsport)
7059       _tlsport="$2"
7060       Le_TLSPort="$_tlsport"
7061       shift
7062       ;;
7063     --listraw)
7064       _listraw="raw"
7065       ;;
7066     -se | --stop-renew-on-error | --stopRenewOnError | --stoprenewonerror)
7067       _stopRenewOnError="1"
7068       ;;
7069     --insecure)
7070       #_insecure="1"
7071       HTTPS_INSECURE="1"
7072       ;;
7073     --ca-bundle)
7074       _ca_bundle="$(_readlink "$2")"
7075       CA_BUNDLE="$_ca_bundle"
7076       shift
7077       ;;
7078     --ca-path)
7079       _ca_path="$2"
7080       CA_PATH="$_ca_path"
7081       shift
7082       ;;
7083     --no-cron | --nocron)
7084       _nocron="1"
7085       ;;
7086     --no-profile | --noprofile)
7087       _noprofile="1"
7088       ;;
7089     --no-color)
7090       export ACME_NO_COLOR=1
7091       ;;
7092     --force-color)
7093       export ACME_FORCE_COLOR=1
7094       ;;
7095     --ecc)
7096       _ecc="isEcc"
7097       ;;
7098     --csr)
7099       _csr="$2"
7100       shift
7101       ;;
7102     --pre-hook)
7103       _pre_hook="$2"
7104       shift
7105       ;;
7106     --post-hook)
7107       _post_hook="$2"
7108       shift
7109       ;;
7110     --renew-hook)
7111       _renew_hook="$2"
7112       shift
7113       ;;
7114     --deploy-hook)
7115       if [ -z "$2" ] || _startswith "$2" "-"; then
7116         _usage "Please specify a value for '--deploy-hook'"
7117         return 1
7118       fi
7119       _deploy_hook="$_deploy_hook$2,"
7120       shift
7121       ;;
7122     --ocsp-must-staple | --ocsp)
7123       Le_OCSP_Staple="1"
7124       ;;
7125     --always-force-new-domain-key)
7126       if [ -z "$2" ] || _startswith "$2" "-"; then
7127         Le_ForceNewDomainKey=1
7128       else
7129         Le_ForceNewDomainKey="$2"
7130         shift
7131       fi
7132       ;;
7133     --yes-I-know-dns-manual-mode-enough-go-ahead-please)
7134       export FORCE_DNS_MANUAL=1
7135       ;;
7136     --log | --logfile)
7137       _log="1"
7138       _logfile="$2"
7139       if _startswith "$_logfile" '-'; then
7140         _logfile=""
7141       else
7142         shift
7143       fi
7144       LOG_FILE="$_logfile"
7145       if [ -z "$LOG_LEVEL" ]; then
7146         LOG_LEVEL="$DEFAULT_LOG_LEVEL"
7147       fi
7148       ;;
7149     --log-level)
7150       _log_level="$2"
7151       LOG_LEVEL="$_log_level"
7152       shift
7153       ;;
7154     --syslog)
7155       if ! _startswith "$2" '-'; then
7156         _syslog="$2"
7157         shift
7158       fi
7159       if [ -z "$_syslog" ]; then
7160         _syslog="$SYSLOG_LEVEL_DEFAULT"
7161       fi
7162       ;;
7163     --auto-upgrade)
7164       _auto_upgrade="$2"
7165       if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
7166         _auto_upgrade="1"
7167       else
7168         shift
7169       fi
7170       AUTO_UPGRADE="$_auto_upgrade"
7171       ;;
7172     --listen-v4)
7173       _listen_v4="1"
7174       Le_Listen_V4="$_listen_v4"
7175       ;;
7176     --listen-v6)
7177       _listen_v6="1"
7178       Le_Listen_V6="$_listen_v6"
7179       ;;
7180     --openssl-bin)
7181       _openssl_bin="$2"
7182       ACME_OPENSSL_BIN="$_openssl_bin"
7183       shift
7184       ;;
7185     --use-wget)
7186       _use_wget="1"
7187       ACME_USE_WGET="1"
7188       ;;
7189     --branch | -b)
7190       export BRANCH="$2"
7191       shift
7192       ;;
7193     --notify-hook)
7194       _nhook="$2"
7195       if _startswith "$_nhook" "-"; then
7196         _err "'$_nhook' is not a hook name for '$1'"
7197         return 1
7198       fi
7199       if [ "$_notify_hook" ]; then
7200         _notify_hook="$_notify_hook,$_nhook"
7201       else
7202         _notify_hook="$_nhook"
7203       fi
7204       shift
7205       ;;
7206     --notify-level)
7207       _nlevel="$2"
7208       if _startswith "$_nlevel" "-"; then
7209         _err "'$_nlevel' is not a integer for '$1'"
7210         return 1
7211       fi
7212       _notify_level="$_nlevel"
7213       shift
7214       ;;
7215     --notify-mode)
7216       _nmode="$2"
7217       if _startswith "$_nmode" "-"; then
7218         _err "'$_nmode' is not a integer for '$1'"
7219         return 1
7220       fi
7221       _notify_mode="$_nmode"
7222       shift
7223       ;;
7224     --revoke-reason)
7225       _revoke_reason="$2"
7226       if _startswith "$_revoke_reason" "-"; then
7227         _err "'$_revoke_reason' is not a integer for '$1'"
7228         return 1
7229       fi
7230       shift
7231       ;;
7232     --eab-kid)
7233       _eab_kid="$2"
7234       shift
7235       ;;
7236     --eab-hmac-key)
7237       _eab_hmac_key="$2"
7238       shift
7239       ;;
7240     --preferred-chain)
7241       _preferred_chain="$2"
7242       shift
7243       ;;
7244     *)
7245       _err "Unknown parameter : $1"
7246       return 1
7247       ;;
7248     esac
7249
7250     shift 1
7251   done
7252
7253   if [ "${_CMD}" != "install" ]; then
7254     if [ "$__INTERACTIVE" ] && ! _checkSudo; then
7255       if [ -z "$FORCE" ]; then
7256         #Use "echo" here, instead of _info. it's too early
7257         echo "It seems that you are using sudo, please read this link first:"
7258         echo "$_SUDO_WIKI"
7259         return 1
7260       fi
7261     fi
7262     __initHome
7263     if [ "$_log" ]; then
7264       if [ -z "$_logfile" ]; then
7265         _logfile="$DEFAULT_LOG_FILE"
7266       fi
7267     fi
7268     if [ "$_logfile" ]; then
7269       _saveaccountconf "LOG_FILE" "$_logfile"
7270       LOG_FILE="$_logfile"
7271     fi
7272
7273     if [ "$_log_level" ]; then
7274       _saveaccountconf "LOG_LEVEL" "$_log_level"
7275       LOG_LEVEL="$_log_level"
7276     fi
7277
7278     if [ "$_syslog" ]; then
7279       if _exists logger; then
7280         if [ "$_syslog" = "0" ]; then
7281           _clearaccountconf "SYS_LOG"
7282         else
7283           _saveaccountconf "SYS_LOG" "$_syslog"
7284         fi
7285         SYS_LOG="$_syslog"
7286       else
7287         _err "The 'logger' command is not found, can not enable syslog."
7288         _clearaccountconf "SYS_LOG"
7289         SYS_LOG=""
7290       fi
7291     fi
7292
7293     _processAccountConf
7294   fi
7295
7296   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
7297
7298   if [ "$DEBUG" ]; then
7299     version
7300     if [ "$_server" ]; then
7301       _debug "Using server: $_server"
7302     fi
7303   fi
7304   _debug "Running cmd: ${_CMD}"
7305   case "${_CMD}" in
7306   install) install "$_nocron" "$_confighome" "$_noprofile" "$_accountemail" ;;
7307   uninstall) uninstall "$_nocron" ;;
7308   upgrade) upgrade ;;
7309   issue)
7310     issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain"
7311     ;;
7312   deploy)
7313     deploy "$_domain" "$_deploy_hook" "$_ecc"
7314     ;;
7315   signcsr)
7316     signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain"
7317     ;;
7318   showcsr)
7319     showcsr "$_csr" "$_domain"
7320     ;;
7321   installcert)
7322     installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
7323     ;;
7324   renew)
7325     renew "$_domain" "$_ecc"
7326     ;;
7327   renewAll)
7328     renewAll "$_stopRenewOnError"
7329     ;;
7330   revoke)
7331     revoke "$_domain" "$_ecc" "$_revoke_reason"
7332     ;;
7333   remove)
7334     remove "$_domain" "$_ecc"
7335     ;;
7336   deactivate)
7337     deactivate "$_domain,$_altdomains"
7338     ;;
7339   registeraccount)
7340     registeraccount "$_accountkeylength" "$_eab_kid" "$_eab_hmac_key"
7341     ;;
7342   updateaccount)
7343     updateaccount
7344     ;;
7345   deactivateaccount)
7346     deactivateaccount
7347     ;;
7348   list)
7349     list "$_listraw" "$_domain"
7350     ;;
7351   installcronjob) installcronjob "$_confighome" ;;
7352   uninstallcronjob) uninstallcronjob ;;
7353   cron) cron ;;
7354   toPkcs)
7355     toPkcs "$_domain" "$_password" "$_ecc"
7356     ;;
7357   toPkcs8)
7358     toPkcs8 "$_domain" "$_ecc"
7359     ;;
7360   createAccountKey)
7361     createAccountKey "$_accountkeylength"
7362     ;;
7363   createDomainKey)
7364     createDomainKey "$_domain" "$_keylength"
7365     ;;
7366   createCSR)
7367     createCSR "$_domain" "$_altdomains" "$_ecc"
7368     ;;
7369   setnotify)
7370     setnotify "$_notify_hook" "$_notify_level" "$_notify_mode"
7371     ;;
7372   setdefaultca)
7373     setdefaultca
7374     ;;
7375   *)
7376     if [ "$_CMD" ]; then
7377       _err "Invalid command: $_CMD"
7378     fi
7379     showhelp
7380     return 1
7381     ;;
7382   esac
7383   _ret="$?"
7384   if [ "$_ret" != "0" ]; then
7385     return $_ret
7386   fi
7387
7388   if [ "${_CMD}" = "install" ]; then
7389     if [ "$_log" ]; then
7390       if [ -z "$LOG_FILE" ]; then
7391         LOG_FILE="$DEFAULT_LOG_FILE"
7392       fi
7393       _saveaccountconf "LOG_FILE" "$LOG_FILE"
7394     fi
7395
7396     if [ "$_log_level" ]; then
7397       _saveaccountconf "LOG_LEVEL" "$_log_level"
7398     fi
7399
7400     if [ "$_syslog" ]; then
7401       if _exists logger; then
7402         if [ "$_syslog" = "0" ]; then
7403           _clearaccountconf "SYS_LOG"
7404         else
7405           _saveaccountconf "SYS_LOG" "$_syslog"
7406         fi
7407       else
7408         _err "The 'logger' command is not found, can not enable syslog."
7409         _clearaccountconf "SYS_LOG"
7410         SYS_LOG=""
7411       fi
7412     fi
7413
7414     _processAccountConf
7415   fi
7416
7417 }
7418
7419 main() {
7420   [ -z "$1" ] && showhelp && return
7421   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
7422 }
7423
7424 main "$@"