acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.6.7
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12 _SCRIPT_="$0"
  13
  14 _SUB_FOLDERS="dnsapi deploy"
  15
  16 DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  17 DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
  18
  19 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  20 DEFAULT_ACCOUNT_EMAIL=""
  21
  22 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  23 DEFAULT_DOMAIN_KEY_LENGTH=2048
  24
  25 DEFAULT_OPENSSL_BIN="openssl"
  26
  27 STAGE_CA="https://acme-staging.api.letsencrypt.org"
  28
  29 VTYPE_HTTP="http-01"
  30 VTYPE_DNS="dns-01"
  31 VTYPE_TLS="tls-sni-01"
  32 #VTYPE_TLS2="tls-sni-02"
  33
  34 LOCAL_ANY_ADDRESS="0.0.0.0"
  35
  36 MAX_RENEW=60
  37
  38 DEFAULT_DNS_SLEEP=120
  39
  40 NO_VALUE="no"
  41
  42 W_TLS="tls"
  43
  44 MODE_STATELESS="stateless"
  45
  46 STATE_VERIFIED="verified_ok"
  47
  48 NGINX="nginx:"
  49 NGINX_START="#ACME_NGINX_START"
  50 NGINX_END="#ACME_NGINX_END"
  51
  52 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  53 END_CSR="-----END CERTIFICATE REQUEST-----"
  54
  55 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  56 END_CERT="-----END CERTIFICATE-----"
  57
  58 RENEW_SKIP=2
  59
  60 ECC_SEP="_"
  61 ECC_SUFFIX="${ECC_SEP}ecc"
  62
  63 LOG_LEVEL_1=1
  64 LOG_LEVEL_2=2
  65 LOG_LEVEL_3=3
  66 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  67
  68 DEBUG_LEVEL_1=1
  69 DEBUG_LEVEL_2=2
  70 DEBUG_LEVEL_3=3
  71 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  72 DEBUG_LEVEL_NONE=0
  73
  74 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  75
  76 SYSLOG_ERROR="user.error"
  77 SYSLOG_INFO="user.info"
  78 SYSLOG_DEBUG="user.debug"
  79
  80 #error
  81 SYSLOG_LEVEL_ERROR=3
  82 #info
  83 SYSLOG_LEVEL_INFO=6
  84 #debug
  85 SYSLOG_LEVEL_DEBUG=7
  86 #debug2
  87 SYSLOG_LEVEL_DEBUG_2=8
  88 #debug3
  89 SYSLOG_LEVEL_DEBUG_3=9
  90
  91 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  92 #none
  93 SYSLOG_LEVEL_NONE=0
  94
  95 _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
  96
  97 _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
  98
  99 _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
 100
 101 __INTERACTIVE=""
 102 if [ -t 1 ]; then
 103   __INTERACTIVE="1"
 104 fi
 105
 106 __green() {
 107   if [ "$__INTERACTIVE" ]; then
 108     printf '\033[1;31;32m'
 109   fi
 110   printf -- "$1"
 111   if [ "$__INTERACTIVE" ]; then
 112     printf '\033[0m'
 113   fi
 114 }
 115
 116 __red() {
 117   if [ "$__INTERACTIVE" ]; then
 118     printf '\033[1;31;40m'
 119   fi
 120   printf -- "$1"
 121   if [ "$__INTERACTIVE" ]; then
 122     printf '\033[0m'
 123   fi
 124 }
 125
 126 _printargs() {
 127   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 128     printf -- "%s" "[$(date)] "
 129   fi
 130   if [ -z "$2" ]; then
 131     printf -- "%s" "$1"
 132   else
 133     printf -- "%s" "$1='$2'"
 134   fi
 135   printf "\n"
 136 }
 137
 138 _dlg_versions() {
 139   echo "Diagnosis versions: "
 140   echo "openssl:$ACME_OPENSSL_BIN"
 141   if _exists "$ACME_OPENSSL_BIN"; then
 142     $ACME_OPENSSL_BIN version 2>&1
 143   else
 144     echo "$ACME_OPENSSL_BIN doesn't exists."
 145   fi
 146
 147   echo "apache:"
 148   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 149     $_APACHECTL -V 2>&1
 150   else
 151     echo "apache doesn't exists."
 152   fi
 153
 154   echo "nc:"
 155   if _exists "nc"; then
 156     nc -h 2>&1
 157   else
 158     _debug "nc doesn't exists."
 159   fi
 160 }
 161
 162 #class
 163 _syslog() {
 164   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 165     return
 166   fi
 167   _logclass="$1"
 168   shift
 169   logger -i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 170 }
 171
 172 _log() {
 173   [ -z "$LOG_FILE" ] && return
 174   _printargs "$@" >>"$LOG_FILE"
 175 }
 176
 177 _info() {
 178   _log "$@"
 179   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 180     _syslog "$SYSLOG_INFO" "$@"
 181   fi
 182   _printargs "$@"
 183 }
 184
 185 _err() {
 186   _syslog "$SYSLOG_ERROR" "$@"
 187   _log "$@"
 188   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 189     printf -- "%s" "[$(date)] " >&2
 190   fi
 191   if [ -z "$2" ]; then
 192     __red "$1" >&2
 193   else
 194     __red "$1='$2'" >&2
 195   fi
 196   printf "\n" >&2
 197   return 1
 198 }
 199
 200 _usage() {
 201   __red "$@" >&2
 202   printf "\n" >&2
 203 }
 204
 205 _debug() {
 206   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 207     _log "$@"
 208   fi
 209   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 210     _syslog "$SYSLOG_DEBUG" "$@"
 211   fi
 212   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 213     _printargs "$@" >&2
 214   fi
 215 }
 216
 217 #output the sensitive messages
 218 _secure_debug() {
 219   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 220     if [ "$OUTPUT_INSECURE" = "1" ]; then
 221       _log "$@"
 222     else
 223       _log "$1" "$HIDDEN_VALUE"
 224     fi
 225   fi
 226   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 227     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 228   fi
 229   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 230     if [ "$OUTPUT_INSECURE" = "1" ]; then
 231       _printargs "$@" >&2
 232     else
 233       _printargs "$1" "$HIDDEN_VALUE" >&2
 234     fi
 235   fi
 236 }
 237
 238 _debug2() {
 239   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 240     _log "$@"
 241   fi
 242   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 243     _syslog "$SYSLOG_DEBUG" "$@"
 244   fi
 245   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 246     _printargs "$@" >&2
 247   fi
 248 }
 249
 250 _secure_debug2() {
 251   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 252     if [ "$OUTPUT_INSECURE" = "1" ]; then
 253       _log "$@"
 254     else
 255       _log "$1" "$HIDDEN_VALUE"
 256     fi
 257   fi
 258   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 259     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 260   fi
 261   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 262     if [ "$OUTPUT_INSECURE" = "1" ]; then
 263       _printargs "$@" >&2
 264     else
 265       _printargs "$1" "$HIDDEN_VALUE" >&2
 266     fi
 267   fi
 268 }
 269
 270 _debug3() {
 271   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 272     _log "$@"
 273   fi
 274   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 275     _syslog "$SYSLOG_DEBUG" "$@"
 276   fi
 277   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 278     _printargs "$@" >&2
 279   fi
 280 }
 281
 282 _secure_debug3() {
 283   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 284     if [ "$OUTPUT_INSECURE" = "1" ]; then
 285       _log "$@"
 286     else
 287       _log "$1" "$HIDDEN_VALUE"
 288     fi
 289   fi
 290   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 291     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 292   fi
 293   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 294     if [ "$OUTPUT_INSECURE" = "1" ]; then
 295       _printargs "$@" >&2
 296     else
 297       _printargs "$1" "$HIDDEN_VALUE" >&2
 298     fi
 299   fi
 300 }
 301
 302 _upper_case() {
 303   # shellcheck disable=SC2018,SC2019
 304   tr 'a-z' 'A-Z'
 305 }
 306
 307 _lower_case() {
 308   # shellcheck disable=SC2018,SC2019
 309   tr 'A-Z' 'a-z'
 310 }
 311
 312 _startswith() {
 313   _str="$1"
 314   _sub="$2"
 315   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 316 }
 317
 318 _endswith() {
 319   _str="$1"
 320   _sub="$2"
 321   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 322 }
 323
 324 _contains() {
 325   _str="$1"
 326   _sub="$2"
 327   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 328 }
 329
 330 _hasfield() {
 331   _str="$1"
 332   _field="$2"
 333   _sep="$3"
 334   if [ -z "$_field" ]; then
 335     _usage "Usage: str field  [sep]"
 336     return 1
 337   fi
 338
 339   if [ -z "$_sep" ]; then
 340     _sep=","
 341   fi
 342
 343   for f in $(echo "$_str" | tr ',' ' '); do
 344     if [ "$f" = "$_field" ]; then
 345       _debug2 "'$_str' contains '$_field'"
 346       return 0 #contains ok
 347     fi
 348   done
 349   _debug2 "'$_str' does not contain '$_field'"
 350   return 1 #not contains
 351 }
 352
 353 _getfield() {
 354   _str="$1"
 355   _findex="$2"
 356   _sep="$3"
 357
 358   if [ -z "$_findex" ]; then
 359     _usage "Usage: str field  [sep]"
 360     return 1
 361   fi
 362
 363   if [ -z "$_sep" ]; then
 364     _sep=","
 365   fi
 366
 367   _ffi="$_findex"
 368   while [ "$_ffi" -gt "0" ]; do
 369     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 370     if [ "$_fv" ]; then
 371       printf -- "%s" "$_fv"
 372       return 0
 373     fi
 374     _ffi="$(_math "$_ffi" - 1)"
 375   done
 376
 377   printf -- "%s" "$_str"
 378
 379 }
 380
 381 _exists() {
 382   cmd="$1"
 383   if [ -z "$cmd" ]; then
 384     _usage "Usage: _exists cmd"
 385     return 1
 386   fi
 387
 388   if eval type type >/dev/null 2>&1; then
 389     eval type "$cmd" >/dev/null 2>&1
 390   elif command >/dev/null 2>&1; then
 391     command -v "$cmd" >/dev/null 2>&1
 392   else
 393     which "$cmd" >/dev/null 2>&1
 394   fi
 395   ret="$?"
 396   _debug3 "$cmd exists=$ret"
 397   return $ret
 398 }
 399
 400 #a + b
 401 _math() {
 402   _m_opts="$@"
 403   printf "%s" "$(($_m_opts))"
 404 }
 405
 406 _h_char_2_dec() {
 407   _ch=$1
 408   case "${_ch}" in
 409     a | A)
 410       printf "10"
 411       ;;
 412     b | B)
 413       printf "11"
 414       ;;
 415     c | C)
 416       printf "12"
 417       ;;
 418     d | D)
 419       printf "13"
 420       ;;
 421     e | E)
 422       printf "14"
 423       ;;
 424     f | F)
 425       printf "15"
 426       ;;
 427     *)
 428       printf "%s" "$_ch"
 429       ;;
 430   esac
 431
 432 }
 433
 434 _URGLY_PRINTF=""
 435 if [ "$(printf '\x41')" != 'A' ]; then
 436   _URGLY_PRINTF=1
 437 fi
 438
 439 _h2b() {
 440   hex=$(cat)
 441   i=1
 442   j=2
 443
 444   _debug3 _URGLY_PRINTF "$_URGLY_PRINTF"
 445   while true; do
 446     if [ -z "$_URGLY_PRINTF" ]; then
 447       h="$(printf "%s" "$hex" | cut -c $i-$j)"
 448       if [ -z "$h" ]; then
 449         break
 450       fi
 451       printf "\x$h%s"
 452     else
 453       ic="$(printf "%s" "$hex" | cut -c $i)"
 454       jc="$(printf "%s" "$hex" | cut -c $j)"
 455       if [ -z "$ic$jc" ]; then
 456         break
 457       fi
 458       ic="$(_h_char_2_dec "$ic")"
 459       jc="$(_h_char_2_dec "$jc")"
 460       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 461     fi
 462
 463     i="$(_math "$i" + 2)"
 464     j="$(_math "$j" + 2)"
 465
 466   done
 467 }
 468
 469 _is_solaris() {
 470   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 471 }
 472
 473 #_ascii_hex str
 474 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 475 _ascii_hex() {
 476   _debug2 "Using _ascii_hex"
 477   _str="$1"
 478   _str_len=${#_str}
 479   _h_i=1
 480   while [ "$_h_i" -le "$_str_len" ]; do
 481     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 482     printf " %02x" "'$_str_c"
 483     _h_i="$(_math "$_h_i" + 1)"
 484   done
 485 }
 486
 487 #stdin  output hexstr splited by one space
 488 #input:"abc"
 489 #output: " 61 62 63"
 490 _hex_dump() {
 491   if _exists od; then
 492     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 493   elif _exists hexdump; then
 494     _debug3 "using hexdump"
 495     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 496   elif _exists xxd; then
 497     _debug3 "using xxd"
 498     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 499   else
 500     _debug3 "using _ascii_hex"
 501     str=$(cat)
 502     _ascii_hex "$str"
 503   fi
 504 }
 505
 506 #url encode, no-preserved chars
 507 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 508 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 509
 510 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 511 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 512
 513 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 514 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 515
 516 #stdin stdout
 517 _url_encode() {
 518   _hex_str=$(_hex_dump)
 519   _debug3 "_url_encode"
 520   _debug3 "_hex_str" "$_hex_str"
 521   for _hex_code in $_hex_str; do
 522     #upper case
 523     case "${_hex_code}" in
 524       "41")
 525         printf "%s" "A"
 526         ;;
 527       "42")
 528         printf "%s" "B"
 529         ;;
 530       "43")
 531         printf "%s" "C"
 532         ;;
 533       "44")
 534         printf "%s" "D"
 535         ;;
 536       "45")
 537         printf "%s" "E"
 538         ;;
 539       "46")
 540         printf "%s" "F"
 541         ;;
 542       "47")
 543         printf "%s" "G"
 544         ;;
 545       "48")
 546         printf "%s" "H"
 547         ;;
 548       "49")
 549         printf "%s" "I"
 550         ;;
 551       "4a")
 552         printf "%s" "J"
 553         ;;
 554       "4b")
 555         printf "%s" "K"
 556         ;;
 557       "4c")
 558         printf "%s" "L"
 559         ;;
 560       "4d")
 561         printf "%s" "M"
 562         ;;
 563       "4e")
 564         printf "%s" "N"
 565         ;;
 566       "4f")
 567         printf "%s" "O"
 568         ;;
 569       "50")
 570         printf "%s" "P"
 571         ;;
 572       "51")
 573         printf "%s" "Q"
 574         ;;
 575       "52")
 576         printf "%s" "R"
 577         ;;
 578       "53")
 579         printf "%s" "S"
 580         ;;
 581       "54")
 582         printf "%s" "T"
 583         ;;
 584       "55")
 585         printf "%s" "U"
 586         ;;
 587       "56")
 588         printf "%s" "V"
 589         ;;
 590       "57")
 591         printf "%s" "W"
 592         ;;
 593       "58")
 594         printf "%s" "X"
 595         ;;
 596       "59")
 597         printf "%s" "Y"
 598         ;;
 599       "5a")
 600         printf "%s" "Z"
 601         ;;
 602
 603       #lower case
 604       "61")
 605         printf "%s" "a"
 606         ;;
 607       "62")
 608         printf "%s" "b"
 609         ;;
 610       "63")
 611         printf "%s" "c"
 612         ;;
 613       "64")
 614         printf "%s" "d"
 615         ;;
 616       "65")
 617         printf "%s" "e"
 618         ;;
 619       "66")
 620         printf "%s" "f"
 621         ;;
 622       "67")
 623         printf "%s" "g"
 624         ;;
 625       "68")
 626         printf "%s" "h"
 627         ;;
 628       "69")
 629         printf "%s" "i"
 630         ;;
 631       "6a")
 632         printf "%s" "j"
 633         ;;
 634       "6b")
 635         printf "%s" "k"
 636         ;;
 637       "6c")
 638         printf "%s" "l"
 639         ;;
 640       "6d")
 641         printf "%s" "m"
 642         ;;
 643       "6e")
 644         printf "%s" "n"
 645         ;;
 646       "6f")
 647         printf "%s" "o"
 648         ;;
 649       "70")
 650         printf "%s" "p"
 651         ;;
 652       "71")
 653         printf "%s" "q"
 654         ;;
 655       "72")
 656         printf "%s" "r"
 657         ;;
 658       "73")
 659         printf "%s" "s"
 660         ;;
 661       "74")
 662         printf "%s" "t"
 663         ;;
 664       "75")
 665         printf "%s" "u"
 666         ;;
 667       "76")
 668         printf "%s" "v"
 669         ;;
 670       "77")
 671         printf "%s" "w"
 672         ;;
 673       "78")
 674         printf "%s" "x"
 675         ;;
 676       "79")
 677         printf "%s" "y"
 678         ;;
 679       "7a")
 680         printf "%s" "z"
 681         ;;
 682       #numbers
 683       "30")
 684         printf "%s" "0"
 685         ;;
 686       "31")
 687         printf "%s" "1"
 688         ;;
 689       "32")
 690         printf "%s" "2"
 691         ;;
 692       "33")
 693         printf "%s" "3"
 694         ;;
 695       "34")
 696         printf "%s" "4"
 697         ;;
 698       "35")
 699         printf "%s" "5"
 700         ;;
 701       "36")
 702         printf "%s" "6"
 703         ;;
 704       "37")
 705         printf "%s" "7"
 706         ;;
 707       "38")
 708         printf "%s" "8"
 709         ;;
 710       "39")
 711         printf "%s" "9"
 712         ;;
 713       "2d")
 714         printf "%s" "-"
 715         ;;
 716       "5f")
 717         printf "%s" "_"
 718         ;;
 719       "2e")
 720         printf "%s" "."
 721         ;;
 722       "7e")
 723         printf "%s" "~"
 724         ;;
 725       #other hex
 726       *)
 727         printf '%%%s' "$_hex_code"
 728         ;;
 729     esac
 730   done
 731 }
 732
 733 #options file
 734 _sed_i() {
 735   options="$1"
 736   filename="$2"
 737   if [ -z "$filename" ]; then
 738     _usage "Usage:_sed_i options filename"
 739     return 1
 740   fi
 741   _debug2 options "$options"
 742   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 743     _debug "Using sed  -i"
 744     sed -i "$options" "$filename"
 745   else
 746     _debug "No -i support in sed"
 747     text="$(cat "$filename")"
 748     echo "$text" | sed "$options" >"$filename"
 749   fi
 750 }
 751
 752 _egrep_o() {
 753   if ! egrep -o "$1" 2>/dev/null; then
 754     sed -n 's/.*\('"$1"'\).*/\1/p'
 755   fi
 756 }
 757
 758 #Usage: file startline endline
 759 _getfile() {
 760   filename="$1"
 761   startline="$2"
 762   endline="$3"
 763   if [ -z "$endline" ]; then
 764     _usage "Usage: file startline endline"
 765     return 1
 766   fi
 767
 768   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 769   if [ -z "$i" ]; then
 770     _err "Can not find start line: $startline"
 771     return 1
 772   fi
 773   i="$(_math "$i" + 1)"
 774   _debug i "$i"
 775
 776   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 777   if [ -z "$j" ]; then
 778     _err "Can not find end line: $endline"
 779     return 1
 780   fi
 781   j="$(_math "$j" - 1)"
 782   _debug j "$j"
 783
 784   sed -n "$i,${j}p" "$filename"
 785
 786 }
 787
 788 #Usage: multiline
 789 _base64() {
 790   [ "" ] #urgly
 791   if [ "$1" ]; then
 792     _debug3 "base64 multiline:'$1'"
 793     $ACME_OPENSSL_BIN base64 -e
 794   else
 795     _debug3 "base64 single line."
 796     $ACME_OPENSSL_BIN base64 -e | tr -d '\r\n'
 797   fi
 798 }
 799
 800 #Usage: multiline
 801 _dbase64() {
 802   if [ "$1" ]; then
 803     $ACME_OPENSSL_BIN base64 -d -A
 804   else
 805     $ACME_OPENSSL_BIN base64 -d
 806   fi
 807 }
 808
 809 #Usage: hashalg  [outputhex]
 810 #Output Base64-encoded digest
 811 _digest() {
 812   alg="$1"
 813   if [ -z "$alg" ]; then
 814     _usage "Usage: _digest hashalg"
 815     return 1
 816   fi
 817
 818   outputhex="$2"
 819
 820   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 821     if [ "$outputhex" ]; then
 822       $ACME_OPENSSL_BIN dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 823     else
 824       $ACME_OPENSSL_BIN dgst -"$alg" -binary | _base64
 825     fi
 826   else
 827     _err "$alg is not supported yet"
 828     return 1
 829   fi
 830
 831 }
 832
 833 #Usage: hashalg  secret_hex  [outputhex]
 834 #Output binary hmac
 835 _hmac() {
 836   alg="$1"
 837   secret_hex="$2"
 838   outputhex="$3"
 839
 840   if [ -z "$secret_hex" ]; then
 841     _usage "Usage: _hmac hashalg secret [outputhex]"
 842     return 1
 843   fi
 844
 845   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
 846     if [ "$outputhex" ]; then
 847       ($ACME_OPENSSL_BIN dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || $ACME_OPENSSL_BIN dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
 848     else
 849       $ACME_OPENSSL_BIN dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || $ACME_OPENSSL_BIN dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
 850     fi
 851   else
 852     _err "$alg is not supported yet"
 853     return 1
 854   fi
 855
 856 }
 857
 858 #Usage: keyfile hashalg
 859 #Output: Base64-encoded signature value
 860 _sign() {
 861   keyfile="$1"
 862   alg="$2"
 863   if [ -z "$alg" ]; then
 864     _usage "Usage: _sign keyfile hashalg"
 865     return 1
 866   fi
 867
 868   _sign_openssl="$ACME_OPENSSL_BIN   dgst -sign $keyfile "
 869   if [ "$alg" = "sha256" ]; then
 870     _sign_openssl="$_sign_openssl -$alg"
 871   else
 872     _err "$alg is not supported yet"
 873     return 1
 874   fi
 875
 876   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 877     $_sign_openssl | _base64
 878   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 879     if ! _signedECText="$($_sign_openssl | $ACME_OPENSSL_BIN asn1parse -inform DER)"; then
 880       _err "Sign failed: $_sign_openssl"
 881       _err "Key file: $keyfile"
 882       _err "Key content:$(wc -l <"$keyfile") lises"
 883       return 1
 884     fi
 885     _debug3 "_signedECText" "$_signedECText"
 886     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 887     _debug3 "_ec_r" "$_ec_r"
 888     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 889     _debug3 "_ec_s" "$_ec_s"
 890     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
 891   else
 892     _err "Unknown key file format."
 893     return 1
 894   fi
 895
 896 }
 897
 898 #keylength
 899 _isEccKey() {
 900   _length="$1"
 901
 902   if [ -z "$_length" ]; then
 903     return 1
 904   fi
 905
 906   [ "$_length" != "1024" ] \
 907     && [ "$_length" != "2048" ] \
 908     && [ "$_length" != "3072" ] \
 909     && [ "$_length" != "4096" ] \
 910     && [ "$_length" != "8192" ]
 911 }
 912
 913 # _createkey  2048|ec-256   file
 914 _createkey() {
 915   length="$1"
 916   f="$2"
 917   _debug2 "_createkey for file:$f"
 918   eccname="$length"
 919   if _startswith "$length" "ec-"; then
 920     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
 921
 922     if [ "$length" = "256" ]; then
 923       eccname="prime256v1"
 924     fi
 925     if [ "$length" = "384" ]; then
 926       eccname="secp384r1"
 927     fi
 928     if [ "$length" = "521" ]; then
 929       eccname="secp521r1"
 930     fi
 931
 932   fi
 933
 934   if [ -z "$length" ]; then
 935     length=2048
 936   fi
 937
 938   _debug "Use length $length"
 939
 940   if ! touch "$f" >/dev/null 2>&1; then
 941     _f_path="$(dirname "$f")"
 942     _debug _f_path "$_f_path"
 943     if ! mkdir -p "$_f_path"; then
 944       _err "Can not create path: $_f_path"
 945       return 1
 946     fi
 947   fi
 948
 949   if _isEccKey "$length"; then
 950     _debug "Using ec name: $eccname"
 951     $ACME_OPENSSL_BIN ecparam -name "$eccname" -genkey 2>/dev/null >"$f"
 952   else
 953     _debug "Using RSA: $length"
 954     $ACME_OPENSSL_BIN genrsa "$length" 2>/dev/null >"$f"
 955   fi
 956
 957   if [ "$?" != "0" ]; then
 958     _err "Create key error."
 959     return 1
 960   fi
 961 }
 962
 963 #domain
 964 _is_idn() {
 965   _is_idn_d="$1"
 966   _debug2 _is_idn_d "$_is_idn_d"
 967   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '.,-')
 968   _debug2 _idn_temp "$_idn_temp"
 969   [ "$_idn_temp" ]
 970 }
 971
 972 #aa.com
 973 #aa.com,bb.com,cc.com
 974 _idn() {
 975   __idn_d="$1"
 976   if ! _is_idn "$__idn_d"; then
 977     printf "%s" "$__idn_d"
 978     return 0
 979   fi
 980
 981   if _exists idn; then
 982     if _contains "$__idn_d" ','; then
 983       _i_first="1"
 984       for f in $(echo "$__idn_d" | tr ',' ' '); do
 985         [ -z "$f" ] && continue
 986         if [ -z "$_i_first" ]; then
 987           printf "%s" ","
 988         else
 989           _i_first=""
 990         fi
 991         idn --quiet "$f" | tr -d "\r\n"
 992       done
 993     else
 994       idn "$__idn_d" | tr -d "\r\n"
 995     fi
 996   else
 997     _err "Please install idn to process IDN names."
 998   fi
 999 }
1000
1001 #_createcsr  cn  san_list  keyfile csrfile conf
1002 _createcsr() {
1003   _debug _createcsr
1004   domain="$1"
1005   domainlist="$2"
1006   csrkey="$3"
1007   csr="$4"
1008   csrconf="$5"
1009   _debug2 domain "$domain"
1010   _debug2 domainlist "$domainlist"
1011   _debug2 csrkey "$csrkey"
1012   _debug2 csr "$csr"
1013   _debug2 csrconf "$csrconf"
1014
1015   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1016
1017   if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1018     #single domain
1019     _info "Single domain" "$domain"
1020   else
1021     domainlist="$(_idn "$domainlist")"
1022     _debug2 domainlist "$domainlist"
1023     if _contains "$domainlist" ","; then
1024       alt="DNS:$(echo "$domainlist" | sed "s/,/,DNS:/g")"
1025     else
1026       alt="DNS:$domainlist"
1027     fi
1028     #multi
1029     _info "Multi domain" "$alt"
1030     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1031   fi
1032   if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
1033     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1034     _cleardomainconf Le_OCSP_Stable
1035     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1036   fi
1037
1038   _csr_cn="$(_idn "$domain")"
1039   _debug2 _csr_cn "$_csr_cn"
1040   if _contains "$(uname -a)" "MINGW"; then
1041     $ACME_OPENSSL_BIN req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1042   else
1043     $ACME_OPENSSL_BIN req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1044   fi
1045 }
1046
1047 #_signcsr key  csr  conf cert
1048 _signcsr() {
1049   key="$1"
1050   csr="$2"
1051   conf="$3"
1052   cert="$4"
1053   _debug "_signcsr"
1054
1055   _msg="$($ACME_OPENSSL_BIN x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1056   _ret="$?"
1057   _debug "$_msg"
1058   return $_ret
1059 }
1060
1061 #_csrfile
1062 _readSubjectFromCSR() {
1063   _csrfile="$1"
1064   if [ -z "$_csrfile" ]; then
1065     _usage "_readSubjectFromCSR mycsr.csr"
1066     return 1
1067   fi
1068   $ACME_OPENSSL_BIN req -noout -in "$_csrfile" -subject | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d '\n'
1069 }
1070
1071 #_csrfile
1072 #echo comma separated domain list
1073 _readSubjectAltNamesFromCSR() {
1074   _csrfile="$1"
1075   if [ -z "$_csrfile" ]; then
1076     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1077     return 1
1078   fi
1079
1080   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1081   _debug _csrsubj "$_csrsubj"
1082
1083   _dnsAltnames="$($ACME_OPENSSL_BIN req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1084   _debug _dnsAltnames "$_dnsAltnames"
1085
1086   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1087     _debug "AltNames contains subject"
1088     _dnsAltnames="$(printf "%s" "$_dnsAltnames," | sed "s/DNS:$_csrsubj,//g")"
1089   else
1090     _debug "AltNames doesn't contain subject"
1091   fi
1092
1093   printf "%s" "$_dnsAltnames" | sed "s/DNS://g"
1094 }
1095
1096 #_csrfile
1097 _readKeyLengthFromCSR() {
1098   _csrfile="$1"
1099   if [ -z "$_csrfile" ]; then
1100     _usage "_readKeyLengthFromCSR mycsr.csr"
1101     return 1
1102   fi
1103
1104   _outcsr="$($ACME_OPENSSL_BIN req -noout -text -in "$_csrfile")"
1105   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1106     _debug "ECC CSR"
1107     echo "$_outcsr" | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1108   else
1109     _debug "RSA CSR"
1110     echo "$_outcsr" | _egrep_o "(^ *|^RSA )Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1111   fi
1112 }
1113
1114 _ss() {
1115   _port="$1"
1116
1117   if _exists "ss"; then
1118     _debug "Using: ss"
1119     ss -ntpl | grep ":$_port "
1120     return 0
1121   fi
1122
1123   if _exists "netstat"; then
1124     _debug "Using: netstat"
1125     if netstat -h 2>&1 | grep "\-p proto" >/dev/null; then
1126       #for windows version netstat tool
1127       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1128     else
1129       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1130         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1131       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1132         #for solaris
1133         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1134       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1135         #for full linux
1136         netstat -ntpl | grep ":$_port "
1137       else
1138         #for busybox (embedded linux; no pid support)
1139         netstat -ntl 2>/dev/null | grep ":$_port "
1140       fi
1141     fi
1142     return 0
1143   fi
1144
1145   return 1
1146 }
1147
1148 #domain [password] [isEcc]
1149 toPkcs() {
1150   domain="$1"
1151   pfxPassword="$2"
1152   if [ -z "$domain" ]; then
1153     _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
1154     return 1
1155   fi
1156
1157   _isEcc="$3"
1158
1159   _initpath "$domain" "$_isEcc"
1160
1161   if [ "$pfxPassword" ]; then
1162     $ACME_OPENSSL_BIN pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
1163   else
1164     $ACME_OPENSSL_BIN pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
1165   fi
1166
1167   if [ "$?" = "0" ]; then
1168     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1169   fi
1170
1171 }
1172
1173 #domain [isEcc]
1174 toPkcs8() {
1175   domain="$1"
1176
1177   if [ -z "$domain" ]; then
1178     _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
1179     return 1
1180   fi
1181
1182   _isEcc="$2"
1183
1184   _initpath "$domain" "$_isEcc"
1185
1186   $ACME_OPENSSL_BIN pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1187
1188   if [ "$?" = "0" ]; then
1189     _info "Success, $CERT_PKCS8_PATH"
1190   fi
1191
1192 }
1193
1194 #[2048]
1195 createAccountKey() {
1196   _info "Creating account key"
1197   if [ -z "$1" ]; then
1198     _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
1199     return
1200   fi
1201
1202   length=$1
1203   _create_account_key "$length"
1204
1205 }
1206
1207 _create_account_key() {
1208
1209   length=$1
1210
1211   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1212     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1213     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1214   fi
1215
1216   _debug length "$length"
1217   _initpath
1218
1219   mkdir -p "$CA_DIR"
1220   if [ -f "$ACCOUNT_KEY_PATH" ]; then
1221     _info "Account key exists, skip"
1222     return
1223   else
1224     #generate account key
1225     _createkey "$length" "$ACCOUNT_KEY_PATH"
1226   fi
1227
1228 }
1229
1230 #domain [length]
1231 createDomainKey() {
1232   _info "Creating domain key"
1233   if [ -z "$1" ]; then
1234     _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]"
1235     return
1236   fi
1237
1238   domain=$1
1239   length=$2
1240
1241   if [ -z "$length" ]; then
1242     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1243     length="$DEFAULT_DOMAIN_KEY_LENGTH"
1244   fi
1245
1246   _initpath "$domain" "$length"
1247
1248   if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]); then
1249     _createkey "$length" "$CERT_KEY_PATH"
1250   else
1251     if [ "$IS_RENEW" ]; then
1252       _info "Domain key exists, skip"
1253       return 0
1254     else
1255       _err "Domain key exists, do you want to overwrite the key?"
1256       _err "Add '--force', and try again."
1257       return 1
1258     fi
1259   fi
1260
1261 }
1262
1263 # domain  domainlist isEcc
1264 createCSR() {
1265   _info "Creating csr"
1266   if [ -z "$1" ]; then
1267     _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]"
1268     return
1269   fi
1270
1271   domain="$1"
1272   domainlist="$2"
1273   _isEcc="$3"
1274
1275   _initpath "$domain" "$_isEcc"
1276
1277   if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
1278     _info "CSR exists, skip"
1279     return
1280   fi
1281
1282   if [ ! -f "$CERT_KEY_PATH" ]; then
1283     _err "The key file is not found: $CERT_KEY_PATH"
1284     _err "Please create the key file first."
1285     return 1
1286   fi
1287   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1288
1289 }
1290
1291 _url_replace() {
1292   tr '/+' '_-' | tr -d '= '
1293 }
1294
1295 _time2str() {
1296   #Linux
1297   if date -u -d@"$1" 2>/dev/null; then
1298     return
1299   fi
1300
1301   #BSD
1302   if date -u -r "$1" 2>/dev/null; then
1303     return
1304   fi
1305
1306   #Soaris
1307   if _exists adb; then
1308     _t_s_a=$(echo "0t${1}=Y" | adb)
1309     echo "$_t_s_a"
1310   fi
1311
1312 }
1313
1314 _normalizeJson() {
1315   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1316 }
1317
1318 _stat() {
1319   #Linux
1320   if stat -c '%U:%G' "$1" 2>/dev/null; then
1321     return
1322   fi
1323
1324   #BSD
1325   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1326     return
1327   fi
1328
1329   return 1 #error, 'stat' not found
1330 }
1331
1332 #keyfile
1333 _calcjwk() {
1334   keyfile="$1"
1335   if [ -z "$keyfile" ]; then
1336     _usage "Usage: _calcjwk keyfile"
1337     return 1
1338   fi
1339
1340   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1341     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1342     return 0
1343   fi
1344
1345   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1346     _debug "RSA key"
1347     pub_exp=$($ACME_OPENSSL_BIN rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1348     if [ "${#pub_exp}" = "5" ]; then
1349       pub_exp=0$pub_exp
1350     fi
1351     _debug3 pub_exp "$pub_exp"
1352
1353     e=$(echo "$pub_exp" | _h2b | _base64)
1354     _debug3 e "$e"
1355
1356     modulus=$($ACME_OPENSSL_BIN rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1357     _debug3 modulus "$modulus"
1358     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1359     _debug3 n "$n"
1360
1361     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1362     _debug3 jwk "$jwk"
1363
1364     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1365     JWK_HEADERPLACE_PART1='{"nonce": "'
1366     JWK_HEADERPLACE_PART2='", "alg": "RS256", "jwk": '$jwk'}'
1367   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1368     _debug "EC key"
1369     crv="$($ACME_OPENSSL_BIN ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1370     _debug3 crv "$crv"
1371
1372     if [ -z "$crv" ]; then
1373       _debug "Let's try ASN1 OID"
1374       crv_oid="$($ACME_OPENSSL_BIN ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1375       _debug3 crv_oid "$crv_oid"
1376       case "${crv_oid}" in
1377         "prime256v1")
1378           crv="P-256"
1379           ;;
1380         "secp384r1")
1381           crv="P-384"
1382           ;;
1383         "secp521r1")
1384           crv="P-521"
1385           ;;
1386         *)
1387           _err "ECC oid : $crv_oid"
1388           return 1
1389           ;;
1390       esac
1391       _debug3 crv "$crv"
1392     fi
1393
1394     pubi="$($ACME_OPENSSL_BIN ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1395     pubi=$(_math "$pubi" + 1)
1396     _debug3 pubi "$pubi"
1397
1398     pubj="$($ACME_OPENSSL_BIN ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1399     pubj=$(_math "$pubj" - 1)
1400     _debug3 pubj "$pubj"
1401
1402     pubtext="$($ACME_OPENSSL_BIN ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1403     _debug3 pubtext "$pubtext"
1404
1405     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1406     xlen=$(_math "$xlen" / 4)
1407     _debug3 xlen "$xlen"
1408
1409     xend=$(_math "$xlen" + 1)
1410     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1411     _debug3 x "$x"
1412
1413     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1414     _debug3 x64 "$x64"
1415
1416     xend=$(_math "$xend" + 1)
1417     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1418     _debug3 y "$y"
1419
1420     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1421     _debug3 y64 "$y64"
1422
1423     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1424     _debug3 jwk "$jwk"
1425
1426     JWK_HEADER='{"alg": "ES256", "jwk": '$jwk'}'
1427     JWK_HEADERPLACE_PART1='{"nonce": "'
1428     JWK_HEADERPLACE_PART2='", "alg": "ES256", "jwk": '$jwk'}'
1429   else
1430     _err "Only RSA or EC key is supported."
1431     return 1
1432   fi
1433
1434   _debug3 JWK_HEADER "$JWK_HEADER"
1435   __CACHED_JWK_KEY_FILE="$keyfile"
1436 }
1437
1438 _time() {
1439   date -u "+%s"
1440 }
1441
1442 _utc_date() {
1443   date -u "+%Y-%m-%d %H:%M:%S"
1444 }
1445
1446 _mktemp() {
1447   if _exists mktemp; then
1448     if mktemp 2>/dev/null; then
1449       return 0
1450     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1451       #for Mac osx
1452       return 0
1453     fi
1454   fi
1455   if [ -d "/tmp" ]; then
1456     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1457     return 0
1458   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1459     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1460     return 0
1461   fi
1462   _err "Can not create temp file."
1463 }
1464
1465 _inithttp() {
1466
1467   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1468     HTTP_HEADER="$(_mktemp)"
1469     _debug2 HTTP_HEADER "$HTTP_HEADER"
1470   fi
1471
1472   if [ "$__HTTP_INITIALIZED" ]; then
1473     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1474       _debug2 "Http already initialized."
1475       return 0
1476     fi
1477   fi
1478
1479   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1480     _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
1481     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1482       _CURL_DUMP="$(_mktemp)"
1483       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1484     fi
1485
1486     if [ "$CA_PATH" ]; then
1487       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1488     elif [ "$CA_BUNDLE" ]; then
1489       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1490     fi
1491
1492   fi
1493
1494   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1495     _ACME_WGET="wget -q"
1496     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1497       _ACME_WGET="$_ACME_WGET -d "
1498     fi
1499     if [ "$CA_PATH" ]; then
1500       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1501     elif [ "$CA_BUNDLE" ]; then
1502       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1503     fi
1504   fi
1505
1506   #from wget 1.14: do not skip body on 404 error
1507   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1508     _ACME_WGET="$_ACME_WGET --content-on-error "
1509   fi
1510
1511   __HTTP_INITIALIZED=1
1512
1513 }
1514
1515 # body  url [needbase64] [POST|PUT]
1516 _post() {
1517   body="$1"
1518   url="$2"
1519   needbase64="$3"
1520   httpmethod="$4"
1521
1522   if [ -z "$httpmethod" ]; then
1523     httpmethod="POST"
1524   fi
1525   _debug $httpmethod
1526   _debug "url" "$url"
1527   _debug2 "body" "$body"
1528
1529   _inithttp
1530
1531   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1532     _CURL="$_ACME_CURL"
1533     if [ "$HTTPS_INSECURE" ]; then
1534       _CURL="$_CURL --insecure  "
1535     fi
1536     _debug "_CURL" "$_CURL"
1537     if [ "$needbase64" ]; then
1538       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url" | _base64)"
1539     else
1540       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url")"
1541     fi
1542     _ret="$?"
1543     if [ "$_ret" != "0" ]; then
1544       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1545       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1546         _err "Here is the curl dump log:"
1547         _err "$(cat "$_CURL_DUMP")"
1548       fi
1549     fi
1550   elif [ "$_ACME_WGET" ]; then
1551     _WGET="$_ACME_WGET"
1552     if [ "$HTTPS_INSECURE" ]; then
1553       _WGET="$_WGET --no-check-certificate "
1554     fi
1555     _debug "_WGET" "$_WGET"
1556     if [ "$needbase64" ]; then
1557       if [ "$httpmethod" = "POST" ]; then
1558         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1559       else
1560         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1561       fi
1562     else
1563       if [ "$httpmethod" = "POST" ]; then
1564         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER")"
1565       else
1566         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER")"
1567       fi
1568     fi
1569     _ret="$?"
1570     if [ "$_ret" = "8" ]; then
1571       _ret=0
1572       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1573     fi
1574     if [ "$_ret" != "0" ]; then
1575       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1576     fi
1577     _sed_i "s/^ *//g" "$HTTP_HEADER"
1578   else
1579     _ret="$?"
1580     _err "Neither curl nor wget is found, can not do $httpmethod."
1581   fi
1582   _debug "_ret" "$_ret"
1583   printf "%s" "$response"
1584   return $_ret
1585 }
1586
1587 # url getheader timeout
1588 _get() {
1589   _debug GET
1590   url="$1"
1591   onlyheader="$2"
1592   t="$3"
1593   _debug url "$url"
1594   _debug "timeout" "$t"
1595
1596   _inithttp
1597
1598   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1599     _CURL="$_ACME_CURL"
1600     if [ "$HTTPS_INSECURE" ]; then
1601       _CURL="$_CURL --insecure  "
1602     fi
1603     if [ "$t" ]; then
1604       _CURL="$_CURL --connect-timeout $t"
1605     fi
1606     _debug "_CURL" "$_CURL"
1607     if [ "$onlyheader" ]; then
1608       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1609     else
1610       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1611     fi
1612     ret=$?
1613     if [ "$ret" != "0" ]; then
1614       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1615       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1616         _err "Here is the curl dump log:"
1617         _err "$(cat "$_CURL_DUMP")"
1618       fi
1619     fi
1620   elif [ "$_ACME_WGET" ]; then
1621     _WGET="$_ACME_WGET"
1622     if [ "$HTTPS_INSECURE" ]; then
1623       _WGET="$_WGET --no-check-certificate "
1624     fi
1625     if [ "$t" ]; then
1626       _WGET="$_WGET --timeout=$t"
1627     fi
1628     _debug "_WGET" "$_WGET"
1629     if [ "$onlyheader" ]; then
1630       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1631     else
1632       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1633     fi
1634     ret=$?
1635     if [ "$ret" = "8" ]; then
1636       ret=0
1637       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1638     fi
1639     if [ "$ret" != "0" ]; then
1640       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1641     fi
1642   else
1643     ret=$?
1644     _err "Neither curl nor wget is found, can not do GET."
1645   fi
1646   _debug "ret" "$ret"
1647   return $ret
1648 }
1649
1650 _head_n() {
1651   head -n "$1"
1652 }
1653
1654 _tail_n() {
1655   if ! tail -n "$1" 2>/dev/null; then
1656     #fix for solaris
1657     tail -"$1"
1658   fi
1659 }
1660
1661 # url  payload needbase64  keyfile
1662 _send_signed_request() {
1663   url=$1
1664   payload=$2
1665   needbase64=$3
1666   keyfile=$4
1667   if [ -z "$keyfile" ]; then
1668     keyfile="$ACCOUNT_KEY_PATH"
1669   fi
1670   _debug url "$url"
1671   _debug payload "$payload"
1672
1673   if ! _calcjwk "$keyfile"; then
1674     return 1
1675   fi
1676
1677   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
1678   _debug3 payload64 "$payload64"
1679
1680   MAX_REQUEST_RETRY_TIMES=5
1681   _request_retry_times=0
1682   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
1683     _debug3 _request_retry_times "$_request_retry_times"
1684     if [ -z "$_CACHED_NONCE" ]; then
1685       _debug2 "Get nonce."
1686       nonceurl="$API/directory"
1687       _headers="$(_get "$nonceurl" "onlyheader")"
1688
1689       if [ "$?" != "0" ]; then
1690         _err "Can not connect to $nonceurl to get nonce."
1691         return 1
1692       fi
1693
1694       _debug2 _headers "$_headers"
1695
1696       _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1697       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
1698     else
1699       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
1700     fi
1701     nonce="$_CACHED_NONCE"
1702     _debug2 nonce "$nonce"
1703
1704     protected="$JWK_HEADERPLACE_PART1$nonce$JWK_HEADERPLACE_PART2"
1705     _debug3 protected "$protected"
1706
1707     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
1708     _debug3 protected64 "$protected64"
1709
1710     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
1711       _err "Sign request failed."
1712       return 1
1713     fi
1714     _debug3 _sig_t "$_sig_t"
1715
1716     sig="$(printf "%s" "$_sig_t" | _url_replace)"
1717     _debug3 sig "$sig"
1718
1719     body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1720     _debug3 body "$body"
1721
1722     response="$(_post "$body" "$url" "$needbase64")"
1723     _CACHED_NONCE=""
1724
1725     if [ "$?" != "0" ]; then
1726       _err "Can not post to $url"
1727       return 1
1728     fi
1729     _debug2 original "$response"
1730     response="$(echo "$response" | _normalizeJson)"
1731
1732     responseHeaders="$(cat "$HTTP_HEADER")"
1733
1734     _debug2 responseHeaders "$responseHeaders"
1735     _debug2 response "$response"
1736     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
1737     _debug code "$code"
1738
1739     _CACHED_NONCE="$(echo "$responseHeaders" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1740
1741     if _contains "$response" "JWS has invalid anti-replay nonce"; then
1742       _info "It seems the CA server is busy now, let's wait and retry."
1743       _request_retry_times=$(_math "$_request_retry_times" + 1)
1744       _sleep 5
1745       continue
1746     fi
1747     break
1748   done
1749
1750 }
1751
1752 #setopt "file"  "opt"  "="  "value" [";"]
1753 _setopt() {
1754   __conf="$1"
1755   __opt="$2"
1756   __sep="$3"
1757   __val="$4"
1758   __end="$5"
1759   if [ -z "$__opt" ]; then
1760     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
1761     return
1762   fi
1763   if [ ! -f "$__conf" ]; then
1764     touch "$__conf"
1765   fi
1766
1767   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
1768     _debug3 OK
1769     if _contains "$__val" "&"; then
1770       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1771     fi
1772     text="$(cat "$__conf")"
1773     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1774
1775   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
1776     if _contains "$__val" "&"; then
1777       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1778     fi
1779     text="$(cat "$__conf")"
1780     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1781
1782   else
1783     _debug3 APP
1784     echo "$__opt$__sep$__val$__end" >>"$__conf"
1785   fi
1786   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
1787 }
1788
1789 #_save_conf  file key  value
1790 #save to conf
1791 _save_conf() {
1792   _s_c_f="$1"
1793   _sdkey="$2"
1794   _sdvalue="$3"
1795   if [ "$_s_c_f" ]; then
1796     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
1797   else
1798     _err "config file is empty, can not save $_sdkey=$_sdvalue"
1799   fi
1800 }
1801
1802 #_clear_conf file  key
1803 _clear_conf() {
1804   _c_c_f="$1"
1805   _sdkey="$2"
1806   if [ "$_c_c_f" ]; then
1807     _conf_data="$(cat "$_c_c_f")"
1808     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
1809   else
1810     _err "config file is empty, can not clear"
1811   fi
1812 }
1813
1814 #_read_conf file  key
1815 _read_conf() {
1816   _r_c_f="$1"
1817   _sdkey="$2"
1818   if [ -f "$_r_c_f" ]; then
1819     (
1820       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
1821       eval "printf \"%s\" \"\$$_sdkey\""
1822     )
1823   else
1824     _debug "config file is empty, can not read $_sdkey"
1825   fi
1826 }
1827
1828 #_savedomainconf   key  value
1829 #save to domain.conf
1830 _savedomainconf() {
1831   _save_conf "$DOMAIN_CONF" "$1" "$2"
1832 }
1833
1834 #_cleardomainconf   key
1835 _cleardomainconf() {
1836   _clear_conf "$DOMAIN_CONF" "$1"
1837 }
1838
1839 #_readdomainconf   key
1840 _readdomainconf() {
1841   _read_conf "$DOMAIN_CONF" "$1"
1842 }
1843
1844 #_saveaccountconf  key  value
1845 _saveaccountconf() {
1846   _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
1847 }
1848
1849 #_clearaccountconf   key
1850 _clearaccountconf() {
1851   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
1852 }
1853
1854 #_savecaconf  key  value
1855 _savecaconf() {
1856   _save_conf "$CA_CONF" "$1" "$2"
1857 }
1858
1859 #_readcaconf   key
1860 _readcaconf() {
1861   _read_conf "$CA_CONF" "$1"
1862 }
1863
1864 #_clearaccountconf   key
1865 _clearcaconf() {
1866   _clear_conf "$CA_CONF" "$1"
1867 }
1868
1869 # content localaddress
1870 _startserver() {
1871   content="$1"
1872   ncaddr="$2"
1873   _debug "ncaddr" "$ncaddr"
1874
1875   _debug "startserver: $$"
1876   nchelp="$(nc -h 2>&1)"
1877
1878   _debug Le_HTTPPort "$Le_HTTPPort"
1879   _debug Le_Listen_V4 "$Le_Listen_V4"
1880   _debug Le_Listen_V6 "$Le_Listen_V6"
1881   _NC="nc"
1882
1883   if [ "$Le_Listen_V4" ]; then
1884     _NC="$_NC -4"
1885   elif [ "$Le_Listen_V6" ]; then
1886     _NC="$_NC -6"
1887   fi
1888
1889   if [ "$Le_Listen_V4$Le_Listen_V6$ncaddr" ]; then
1890     if ! _contains "$nchelp" "-4"; then
1891       _err "The nc doesn't support '-4', '-6' or local-address, please install 'netcat-openbsd' and try again."
1892       _err "See $(__green $_PREPARE_LINK)"
1893       return 1
1894     fi
1895   fi
1896
1897   if echo "$nchelp" | grep "\-q[ ,]" >/dev/null; then
1898     _NC="$_NC -q 1 -l $ncaddr"
1899   else
1900     if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null; then
1901       _NC="$_NC -c -l $ncaddr"
1902     elif echo "$nchelp" | grep "\-N" | grep "Shutdown the network socket after EOF on stdin" >/dev/null; then
1903       _NC="$_NC -N -l $ncaddr"
1904     else
1905       _NC="$_NC -l $ncaddr"
1906     fi
1907   fi
1908
1909   _debug "_NC" "$_NC"
1910
1911   #for centos ncat
1912   if _contains "$nchelp" "nmap.org"; then
1913     _debug "Using ncat: nmap.org"
1914     if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"; then
1915       _exec_err
1916       return 1
1917     fi
1918     if [ "$DEBUG" ]; then
1919       _exec_err
1920     fi
1921     return
1922   fi
1923
1924   #  while true ; do
1925   if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC -p \"$Le_HTTPPort\" >&2"; then
1926     _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"
1927   fi
1928
1929   if [ "$?" != "0" ]; then
1930     _err "nc listen error."
1931     _exec_err
1932     exit 1
1933   fi
1934   if [ "$DEBUG" ]; then
1935     _exec_err
1936   fi
1937   #  done
1938 }
1939
1940 _stopserver() {
1941   pid="$1"
1942   _debug "pid" "$pid"
1943   if [ -z "$pid" ]; then
1944     return
1945   fi
1946
1947   _debug2 "Le_HTTPPort" "$Le_HTTPPort"
1948   if [ "$Le_HTTPPort" ]; then
1949     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
1950       _get "http://localhost:$Le_HTTPPort" "" 1
1951     else
1952       _get "http://localhost:$Le_HTTPPort" "" 1 >/dev/null 2>&1
1953     fi
1954   fi
1955
1956   _debug2 "Le_TLSPort" "$Le_TLSPort"
1957   if [ "$Le_TLSPort" ]; then
1958     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
1959       _get "https://localhost:$Le_TLSPort" "" 1
1960       _get "https://localhost:$Le_TLSPort" "" 1
1961     else
1962       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
1963       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
1964     fi
1965   fi
1966 }
1967
1968 # sleep sec
1969 _sleep() {
1970   _sleep_sec="$1"
1971   if [ "$__INTERACTIVE" ]; then
1972     _sleep_c="$_sleep_sec"
1973     while [ "$_sleep_c" -ge "0" ]; do
1974       printf "\r      \r"
1975       __green "$_sleep_c"
1976       _sleep_c="$(_math "$_sleep_c" - 1)"
1977       sleep 1
1978     done
1979     printf "\r"
1980   else
1981     sleep "$_sleep_sec"
1982   fi
1983 }
1984
1985 # _starttlsserver  san_a  san_b port content _ncaddr
1986 _starttlsserver() {
1987   _info "Starting tls server."
1988   san_a="$1"
1989   san_b="$2"
1990   port="$3"
1991   content="$4"
1992   opaddr="$5"
1993
1994   _debug san_a "$san_a"
1995   _debug san_b "$san_b"
1996   _debug port "$port"
1997
1998   #create key TLS_KEY
1999   if ! _createkey "2048" "$TLS_KEY"; then
2000     _err "Create tls validation key error."
2001     return 1
2002   fi
2003
2004   #create csr
2005   alt="$san_a"
2006   if [ "$san_b" ]; then
2007     alt="$alt,$san_b"
2008   fi
2009   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF"; then
2010     _err "Create tls validation csr error."
2011     return 1
2012   fi
2013
2014   #self signed
2015   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2016     _err "Create tls validation cert error."
2017     return 1
2018   fi
2019
2020   __S_OPENSSL="$ACME_OPENSSL_BIN s_server -cert $TLS_CERT  -key $TLS_KEY "
2021   if [ "$opaddr" ]; then
2022     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2023   else
2024     __S_OPENSSL="$__S_OPENSSL -accept $port"
2025   fi
2026
2027   _debug Le_Listen_V4 "$Le_Listen_V4"
2028   _debug Le_Listen_V6 "$Le_Listen_V6"
2029   if [ "$Le_Listen_V4" ]; then
2030     __S_OPENSSL="$__S_OPENSSL -4"
2031   elif [ "$Le_Listen_V6" ]; then
2032     __S_OPENSSL="$__S_OPENSSL -6"
2033   fi
2034
2035   _debug "$__S_OPENSSL"
2036   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2037     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL -tlsextdebug) &
2038   else
2039     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL >/dev/null 2>&1) &
2040   fi
2041
2042   serverproc="$!"
2043   sleep 1
2044   _debug serverproc "$serverproc"
2045 }
2046
2047 #file
2048 _readlink() {
2049   _rf="$1"
2050   if ! readlink -f "$_rf" 2>/dev/null; then
2051     if _startswith "$_rf" "/"; then
2052       echo "$_rf"
2053       return 0
2054     fi
2055     echo "$(pwd)/$_rf" | _conapath
2056   fi
2057 }
2058
2059 _conapath() {
2060   sed "s#/\./#/#g"
2061 }
2062
2063 __initHome() {
2064   if [ -z "$_SCRIPT_HOME" ]; then
2065     if _exists readlink && _exists dirname; then
2066       _debug "Lets find script dir."
2067       _debug "_SCRIPT_" "$_SCRIPT_"
2068       _script="$(_readlink "$_SCRIPT_")"
2069       _debug "_script" "$_script"
2070       _script_home="$(dirname "$_script")"
2071       _debug "_script_home" "$_script_home"
2072       if [ -d "$_script_home" ]; then
2073         _SCRIPT_HOME="$_script_home"
2074       else
2075         _err "It seems the script home is not correct:$_script_home"
2076       fi
2077     fi
2078   fi
2079
2080   #  if [ -z "$LE_WORKING_DIR" ]; then
2081   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2082   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2083   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2084   #    else
2085   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2086   #    fi
2087   #  fi
2088
2089   if [ -z "$LE_WORKING_DIR" ]; then
2090     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2091     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2092   fi
2093   export LE_WORKING_DIR
2094
2095   if [ -z "$LE_CONFIG_HOME" ]; then
2096     LE_CONFIG_HOME="$LE_WORKING_DIR"
2097   fi
2098   _debug "Using config home:$LE_CONFIG_HOME"
2099   export LE_CONFIG_HOME
2100
2101   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2102
2103   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2104     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2105       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2106     fi
2107   fi
2108
2109   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2110     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2111   fi
2112
2113   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2114
2115   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2116
2117   if [ -z "$LE_TEMP_DIR" ]; then
2118     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2119   fi
2120 }
2121
2122 #[domain]  [keylength]
2123 _initpath() {
2124
2125   __initHome
2126
2127   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2128     . "$ACCOUNT_CONF_PATH"
2129   fi
2130
2131   if [ "$IN_CRON" ]; then
2132     if [ ! "$_USER_PATH_EXPORTED" ]; then
2133       _USER_PATH_EXPORTED=1
2134       export PATH="$USER_PATH:$PATH"
2135     fi
2136   fi
2137
2138   if [ -z "$CA_HOME" ]; then
2139     CA_HOME="$DEFAULT_CA_HOME"
2140   fi
2141
2142   if [ -z "$API" ]; then
2143     if [ -z "$STAGE" ]; then
2144       API="$DEFAULT_CA"
2145     else
2146       API="$STAGE_CA"
2147       _info "Using stage api:$API"
2148     fi
2149   fi
2150
2151   _API_HOST="$(echo "$API" | cut -d : -f 2 | tr -d '/')"
2152   CA_DIR="$CA_HOME/$_API_HOST"
2153
2154   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2155
2156   if [ -z "$CA_CONF" ]; then
2157     CA_CONF="$_DEFAULT_CA_CONF"
2158   fi
2159   _debug3 CA_CONF "$CA_CONF"
2160
2161   if [ -f "$CA_CONF" ]; then
2162     . "$CA_CONF"
2163   fi
2164
2165   if [ -z "$ACME_DIR" ]; then
2166     ACME_DIR="/home/.acme"
2167   fi
2168
2169   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2170     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2171   fi
2172
2173   if [ -z "$USER_AGENT" ]; then
2174     USER_AGENT="$DEFAULT_USER_AGENT"
2175   fi
2176
2177   if [ -z "$HTTP_HEADER" ]; then
2178     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2179   fi
2180
2181   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2182   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2183
2184   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2185   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2186   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2187     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2188   fi
2189
2190   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2191     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2192   fi
2193
2194   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2195   if [ -z "$CERT_HOME" ]; then
2196     CERT_HOME="$_DEFAULT_CERT_HOME"
2197   fi
2198
2199   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2200     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2201   fi
2202
2203   if [ -z "$1" ]; then
2204     return 0
2205   fi
2206
2207   domain="$1"
2208   _ilength="$2"
2209
2210   if [ -z "$DOMAIN_PATH" ]; then
2211     domainhome="$CERT_HOME/$domain"
2212     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2213
2214     DOMAIN_PATH="$domainhome"
2215
2216     if _isEccKey "$_ilength"; then
2217       DOMAIN_PATH="$domainhomeecc"
2218     else
2219       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2220         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2221       fi
2222     fi
2223     _debug DOMAIN_PATH "$DOMAIN_PATH"
2224   fi
2225
2226   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2227     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2228   fi
2229
2230   if [ -z "$DOMAIN_CONF" ]; then
2231     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2232   fi
2233
2234   if [ -z "$DOMAIN_SSL_CONF" ]; then
2235     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2236   fi
2237
2238   if [ -z "$CSR_PATH" ]; then
2239     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2240   fi
2241   if [ -z "$CERT_KEY_PATH" ]; then
2242     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2243   fi
2244   if [ -z "$CERT_PATH" ]; then
2245     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2246   fi
2247   if [ -z "$CA_CERT_PATH" ]; then
2248     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2249   fi
2250   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2251     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2252   fi
2253   if [ -z "$CERT_PFX_PATH" ]; then
2254     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2255   fi
2256   if [ -z "$CERT_PKCS8_PATH" ]; then
2257     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2258   fi
2259
2260   if [ -z "$TLS_CONF" ]; then
2261     TLS_CONF="$DOMAIN_PATH/tls.valdation.conf"
2262   fi
2263   if [ -z "$TLS_CERT" ]; then
2264     TLS_CERT="$DOMAIN_PATH/tls.valdation.cert"
2265   fi
2266   if [ -z "$TLS_KEY" ]; then
2267     TLS_KEY="$DOMAIN_PATH/tls.valdation.key"
2268   fi
2269   if [ -z "$TLS_CSR" ]; then
2270     TLS_CSR="$DOMAIN_PATH/tls.valdation.csr"
2271   fi
2272
2273 }
2274
2275 _exec() {
2276   if [ -z "$_EXEC_TEMP_ERR" ]; then
2277     _EXEC_TEMP_ERR="$(_mktemp)"
2278   fi
2279
2280   if [ "$_EXEC_TEMP_ERR" ]; then
2281     eval "$@ 2>>$_EXEC_TEMP_ERR"
2282   else
2283     eval "$@"
2284   fi
2285 }
2286
2287 _exec_err() {
2288   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2289 }
2290
2291 _apachePath() {
2292   _APACHECTL="apachectl"
2293   if ! _exists apachectl; then
2294     if _exists apache2ctl; then
2295       _APACHECTL="apache2ctl"
2296     else
2297       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2298       _err "Please use webroot mode to try again."
2299       return 1
2300     fi
2301   fi
2302
2303   if ! _exec $_APACHECTL -V >/dev/null; then
2304     _exec_err
2305     return 1
2306   fi
2307
2308   if [ "$APACHE_HTTPD_CONF" ]; then
2309     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2310     httpdconf="$APACHE_HTTPD_CONF"
2311     httpdconfname="$(basename "$httpdconfname")"
2312   else
2313     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2314     _debug httpdconfname "$httpdconfname"
2315
2316     if [ -z "$httpdconfname" ]; then
2317       _err "Can not read apache config file."
2318       return 1
2319     fi
2320
2321     if _startswith "$httpdconfname" '/'; then
2322       httpdconf="$httpdconfname"
2323       httpdconfname="$(basename "$httpdconfname")"
2324     else
2325       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2326       _debug httpdroot "$httpdroot"
2327       httpdconf="$httpdroot/$httpdconfname"
2328       httpdconfname="$(basename "$httpdconfname")"
2329     fi
2330   fi
2331   _debug httpdconf "$httpdconf"
2332   _debug httpdconfname "$httpdconfname"
2333   if [ ! -f "$httpdconf" ]; then
2334     _err "Apache Config file not found" "$httpdconf"
2335     return 1
2336   fi
2337   return 0
2338 }
2339
2340 _restoreApache() {
2341   if [ -z "$usingApache" ]; then
2342     return 0
2343   fi
2344   _initpath
2345   if ! _apachePath; then
2346     return 1
2347   fi
2348
2349   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2350     _debug "No config file to restore."
2351     return 0
2352   fi
2353
2354   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2355   _debug "Restored: $httpdconf."
2356   if ! _exec $_APACHECTL -t; then
2357     _exec_err
2358     _err "Sorry, restore apache config error, please contact me."
2359     return 1
2360   fi
2361   _debug "Restored successfully."
2362   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2363   return 0
2364 }
2365
2366 _setApache() {
2367   _initpath
2368   if ! _apachePath; then
2369     return 1
2370   fi
2371
2372   #test the conf first
2373   _info "Checking if there is an error in the apache config file before starting."
2374
2375   if ! _exec "$_APACHECTL" -t >/dev/null; then
2376     _exec_err
2377     _err "The apache config file has error, please fix it first, then try again."
2378     _err "Don't worry, there is nothing changed to your system."
2379     return 1
2380   else
2381     _info "OK"
2382   fi
2383
2384   #backup the conf
2385   _debug "Backup apache config file" "$httpdconf"
2386   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2387     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2388     _err "This might be a bug of $PROJECT_NAME , pleae report issue: $PROJECT"
2389     return 1
2390   fi
2391   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2392   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2393   _info "The backup file will be deleted on success, just forget it."
2394
2395   #add alias
2396
2397   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2398   _debug "apacheVer" "$apacheVer"
2399   apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
2400   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2401
2402   if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
2403     echo "
2404 Alias /.well-known/acme-challenge  $ACME_DIR
2405
2406 <Directory $ACME_DIR >
2407 Require all granted
2408 </Directory>
2409   " >>"$httpdconf"
2410   else
2411     echo "
2412 Alias /.well-known/acme-challenge  $ACME_DIR
2413
2414 <Directory $ACME_DIR >
2415 Order allow,deny
2416 Allow from all
2417 </Directory>
2418   " >>"$httpdconf"
2419   fi
2420
2421   _msg="$($_APACHECTL -t 2>&1)"
2422   if [ "$?" != "0" ]; then
2423     _err "Sorry, apache config error"
2424     if _restoreApache; then
2425       _err "The apache config file is restored."
2426     else
2427       _err "Sorry, The apache config file can not be restored, please report bug."
2428     fi
2429     return 1
2430   fi
2431
2432   if [ ! -d "$ACME_DIR" ]; then
2433     mkdir -p "$ACME_DIR"
2434     chmod 755 "$ACME_DIR"
2435   fi
2436
2437   if ! _exec "$_APACHECTL" graceful; then
2438     _exec_err
2439     _err "$_APACHECTL  graceful error, please contact me."
2440     _restoreApache
2441     return 1
2442   fi
2443   usingApache="1"
2444   return 0
2445 }
2446
2447 #find the real nginx conf file
2448 #backup
2449 #set the nginx conf
2450 #returns the real nginx conf file
2451 _setNginx() {
2452   _d="$1"
2453   _croot="$2"
2454   _thumbpt="$3"
2455   if ! _exists "nginx"; then
2456     _err "nginx command is not found."
2457     return 1
2458   fi
2459   FOUND_REAL_NGINX_CONF=""
2460   FOUND_REAL_NGINX_CONF_LN=""
2461   BACKUP_NGINX_CONF=""
2462   _debug _croot "$_croot"
2463   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2464   _debug _start_f "$_start_f"
2465   if [ -z "$_start_f" ]; then
2466     _debug "find start conf from nginx command"
2467     if [ -z "$NGINX_CONF" ]; then
2468       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2469       _debug NGINX_CONF "$NGINX_CONF"
2470       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2471       _debug NGINX_CONF "$NGINX_CONF"
2472       if [ ! -f "$NGINX_CONF" ]; then
2473         _err "'$NGINX_CONF' doesn't exist."
2474         NGINX_CONF=""
2475         return 1
2476       fi
2477       _debug "Found nginx conf file:$NGINX_CONF"
2478     fi
2479     _start_f="$NGINX_CONF"
2480   fi
2481   _debug "Start detect nginx conf for $_d from:$_start_f"
2482   if ! _checkConf "$_d" "$_start_f"; then
2483     _err "Can not find conf file for domain $d"
2484     return 1
2485   fi
2486   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2487
2488   _ln=$FOUND_REAL_NGINX_CONF_LN
2489   _debug "_ln" "$_ln"
2490
2491   _lnn=$(_math $_ln + 1)
2492   _debug _lnn "$_lnn"
2493   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2494   _debug "_start_tag" "$_start_tag"
2495   if [ "$_start_tag" = "$NGINX_START" ]; then
2496     _info "The domain $_d is already configured, skip"
2497     FOUND_REAL_NGINX_CONF=""
2498     return 0
2499   fi
2500
2501   mkdir -p "$DOMAIN_BACKUP_PATH"
2502   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2503   _debug _backup_conf "$_backup_conf"
2504   BACKUP_NGINX_CONF="$_backup_conf"
2505   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2506   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2507     _err "backup error."
2508     FOUND_REAL_NGINX_CONF=""
2509     return 1
2510   fi
2511
2512   _info "Check the nginx conf before setting up."
2513   if ! _exec "nginx -t" >/dev/null; then
2514     _exec_err
2515     return 1
2516   fi
2517
2518   _info "OK, Set up nginx config file"
2519
2520   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2521     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2522     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2523     return 1
2524   fi
2525
2526   echo "$NGINX_START
2527 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
2528   default_type text/plain;
2529   return 200 \"\$1.$_thumbpt\";
2530 }
2531 #NGINX_START
2532 " >>"$FOUND_REAL_NGINX_CONF"
2533
2534   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
2535     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2536     _err "write nginx conf error, but don't worry, the file is restored."
2537     return 1
2538   fi
2539
2540   _info "nginx conf is done, let's check it again."
2541   if ! _exec "nginx -t" >/dev/null; then
2542     _exec_err
2543     _err "It seems that nginx conf was broken, let's restore."
2544     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2545     return 1
2546   fi
2547
2548   _info "Reload nginx"
2549   if ! _exec "nginx -s reload" >/dev/null; then
2550     _exec_err
2551     _err "It seems that nginx reload error, let's restore."
2552     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2553     return 1
2554   fi
2555
2556   return 0
2557 }
2558
2559 #d , conf
2560 _checkConf() {
2561   _d="$1"
2562   _c_file="$2"
2563   _debug "Start _checkConf from:$_c_file"
2564   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
2565     _debug "wildcard"
2566     for _w_f in $2; do
2567       if [ -f "$_w_f"] && _checkConf "$1" "$_w_f"; then
2568         return 0
2569       fi
2570     done
2571     #not found
2572     return 1
2573   elif [ -f "$2" ]; then
2574     _debug "single"
2575     if _isRealNginxConf "$1" "$2"; then
2576       _debug "$2 is found."
2577       FOUND_REAL_NGINX_CONF="$2"
2578       return 0
2579     fi
2580     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
2581       _debug "Try include files"
2582       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
2583         _debug "check included $included"
2584         if _checkConf "$1" "$included"; then
2585           return 0
2586         fi
2587       done
2588     fi
2589     return 1
2590   else
2591     _debug "$2 not found."
2592     return 1
2593   fi
2594   return 1
2595 }
2596
2597 #d , conf
2598 _isRealNginxConf() {
2599   _debug "_isRealNginxConf $1 $2"
2600   if [ -f "$2" ]; then
2601     for _fln in $(grep -n "^ *server_name.* $1" "$2" | cut -d : -f 1); do
2602       _debug _fln "$_fln"
2603       if [ "$_fln" ]; then
2604         _start=$(cat "$2" | _head_n "$_fln" | grep -n "^ *server *{" | _tail_n 1)
2605         _debug "_start" "$_start"
2606         _start_n=$(echo "$_start" | cut -d : -f 1)
2607         _start_nn=$(_math $_start_n + 1)
2608         _debug "_start_n" "$_start_n"
2609         _debug "_start_nn" "$_start_nn"
2610
2611         _left="$(sed -n "${_start_nn},99999p" "$2")"
2612         _debug2 _left "$_left"
2613         if echo "$_left" | grep -n "^ *server *{" >/dev/null; then
2614           _end=$(echo "$_left" | grep -n "^ *server *{" | _head_n 1)
2615           _debug "_end" "$_end"
2616           _end_n=$(echo "$_end" | cut -d : -f 1)
2617           _debug "_end_n" "$_end_n"
2618           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
2619         else
2620           _seg_n="$_left"
2621         fi
2622
2623         _debug "_seg_n" "$_seg_n"
2624
2625         if [ "$(echo "$_seg_n" | _egrep_o "^ *ssl  *on *;")" ]; then
2626           _debug "ssl on, skip"
2627           return 1
2628         fi
2629         FOUND_REAL_NGINX_CONF_LN=$_fln
2630         return 0
2631       fi
2632     done
2633   fi
2634   return 1
2635 }
2636
2637 #restore all the nginx conf
2638 _restoreNginx() {
2639   if [ -z "$NGINX_RESTORE_VLIST" ]; then
2640     _debug "No need to restore nginx, skip."
2641     return
2642   fi
2643   _debug "_restoreNginx"
2644   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
2645
2646   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
2647     _debug "ng_entry" "$ng_entry"
2648     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
2649     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
2650     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
2651     _info "Restoring from $_ngbackupconf to $_ngconf"
2652     cat "$_ngbackupconf" >"$_ngconf"
2653   done
2654
2655   _info "Reload nginx"
2656   if ! _exec "nginx -s reload" >/dev/null; then
2657     _exec_err
2658     _err "It seems that nginx reload error, please report bug."
2659     return 1
2660   fi
2661   return 0
2662 }
2663
2664 _clearup() {
2665   _stopserver "$serverproc"
2666   serverproc=""
2667   _restoreApache
2668   _restoreNginx
2669   _clearupdns
2670   if [ -z "$DEBUG" ]; then
2671     rm -f "$TLS_CONF"
2672     rm -f "$TLS_CERT"
2673     rm -f "$TLS_KEY"
2674     rm -f "$TLS_CSR"
2675   fi
2676 }
2677
2678 _clearupdns() {
2679   _debug "_clearupdns"
2680   if [ "$dnsadded" != 1 ] || [ -z "$vlist" ]; then
2681     _debug "Dns not added, skip."
2682     return
2683   fi
2684
2685   ventries=$(echo "$vlist" | tr ',' ' ')
2686   for ventry in $ventries; do
2687     d=$(echo "$ventry" | cut -d "$sep" -f 1)
2688     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2689     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2690     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2691     txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
2692     _debug txt "$txt"
2693     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
2694       _debug "$d is already verified, skip $vtype."
2695       continue
2696     fi
2697
2698     if [ "$vtype" != "$VTYPE_DNS" ]; then
2699       _info "Skip $d for $vtype"
2700       continue
2701     fi
2702
2703     d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
2704     _debug d_api "$d_api"
2705
2706     if [ -z "$d_api" ]; then
2707       _info "Not Found domain api file: $d_api"
2708       continue
2709     fi
2710
2711     (
2712       if ! . "$d_api"; then
2713         _err "Load file $d_api error. Please check your api file and try again."
2714         return 1
2715       fi
2716
2717       rmcommand="${_currentRoot}_rm"
2718       if ! _exists "$rmcommand"; then
2719         _err "It seems that your api file doesn't define $rmcommand"
2720         return 1
2721       fi
2722
2723       txtdomain="_acme-challenge.$d"
2724
2725       if ! $rmcommand "$txtdomain" "$txt"; then
2726         _err "Error removing txt for domain:$txtdomain"
2727         return 1
2728       fi
2729     )
2730
2731   done
2732 }
2733
2734 # webroot  removelevel tokenfile
2735 _clearupwebbroot() {
2736   __webroot="$1"
2737   if [ -z "$__webroot" ]; then
2738     _debug "no webroot specified, skip"
2739     return 0
2740   fi
2741
2742   _rmpath=""
2743   if [ "$2" = '1' ]; then
2744     _rmpath="$__webroot/.well-known"
2745   elif [ "$2" = '2' ]; then
2746     _rmpath="$__webroot/.well-known/acme-challenge"
2747   elif [ "$2" = '3' ]; then
2748     _rmpath="$__webroot/.well-known/acme-challenge/$3"
2749   else
2750     _debug "Skip for removelevel:$2"
2751   fi
2752
2753   if [ "$_rmpath" ]; then
2754     if [ "$DEBUG" ]; then
2755       _debug "Debugging, skip removing: $_rmpath"
2756     else
2757       rm -rf "$_rmpath"
2758     fi
2759   fi
2760
2761   return 0
2762
2763 }
2764
2765 _on_before_issue() {
2766   _chk_web_roots="$1"
2767   _chk_main_domain="$2"
2768   _chk_alt_domains="$3"
2769   _chk_pre_hook="$4"
2770   _chk_local_addr="$5"
2771   _debug _on_before_issue
2772   #run pre hook
2773   if [ "$_chk_pre_hook" ]; then
2774     _info "Run pre hook:'$_chk_pre_hook'"
2775     if ! (
2776       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
2777     ); then
2778       _err "Error when run pre hook."
2779       return 1
2780     fi
2781   fi
2782
2783   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
2784     if ! _exists "nc"; then
2785       _err "Please install netcat(nc) tools first."
2786       return 1
2787     fi
2788   fi
2789
2790   _debug Le_LocalAddress "$_chk_local_addr"
2791
2792   alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
2793   _index=1
2794   _currentRoot=""
2795   _addrIndex=1
2796   for d in $alldomains; do
2797     _debug "Check for domain" "$d"
2798     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
2799     _debug "_currentRoot" "$_currentRoot"
2800     _index=$(_math $_index + 1)
2801     _checkport=""
2802     if [ "$_currentRoot" = "$NO_VALUE" ]; then
2803       _info "Standalone mode."
2804       if [ -z "$Le_HTTPPort" ]; then
2805         Le_HTTPPort=80
2806       else
2807         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
2808       fi
2809       _checkport="$Le_HTTPPort"
2810     elif [ "$_currentRoot" = "$W_TLS" ]; then
2811       _info "Standalone tls mode."
2812       if [ -z "$Le_TLSPort" ]; then
2813         Le_TLSPort=443
2814       else
2815         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
2816       fi
2817       _checkport="$Le_TLSPort"
2818     fi
2819
2820     if [ "$_checkport" ]; then
2821       _debug _checkport "$_checkport"
2822       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
2823       _debug _checkaddr "$_checkaddr"
2824
2825       _addrIndex="$(_math $_addrIndex + 1)"
2826
2827       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
2828       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
2829       if [ -z "$netprc" ]; then
2830         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
2831       fi
2832       if [ "$netprc" ]; then
2833         _err "$netprc"
2834         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
2835         _err "Please stop it first"
2836         return 1
2837       fi
2838     fi
2839   done
2840
2841   if _hasfield "$_chk_web_roots" "apache"; then
2842     if ! _setApache; then
2843       _err "set up apache error. Report error to me."
2844       return 1
2845     fi
2846   else
2847     usingApache=""
2848   fi
2849
2850 }
2851
2852 _on_issue_err() {
2853   _chk_post_hook="$1"
2854   _chk_vlist="$2"
2855   _debug _on_issue_err
2856   if [ "$LOG_FILE" ]; then
2857     _err "Please check log file for more details: $LOG_FILE"
2858   else
2859     _err "Please add '--debug' or '--log' to check more details."
2860     _err "See: $_DEBUG_WIKI"
2861   fi
2862
2863   #run the post hook
2864   if [ "$_chk_post_hook" ]; then
2865     _info "Run post hook:'$_chk_post_hook'"
2866     if ! (
2867       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
2868     ); then
2869       _err "Error when run post hook."
2870       return 1
2871     fi
2872   fi
2873
2874   #trigger the validation to flush the pending authz
2875   if [ "$_chk_vlist" ]; then
2876     (
2877       _debug2 "_chk_vlist" "$_chk_vlist"
2878       _debug2 "start to deactivate authz"
2879       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
2880       for ventry in $ventries; do
2881         d=$(echo "$ventry" | cut -d "$sep" -f 1)
2882         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2883         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
2884         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2885         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2886         __trigger_validaton "$uri" "$keyauthorization"
2887       done
2888     )
2889   fi
2890
2891   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
2892     _debug "$(_dlg_versions)"
2893   fi
2894
2895 }
2896
2897 _on_issue_success() {
2898   _chk_post_hook="$1"
2899   _chk_renew_hook="$2"
2900   _debug _on_issue_success
2901   #run the post hook
2902   if [ "$_chk_post_hook" ]; then
2903     _info "Run post hook:'$_chk_post_hook'"
2904     if ! (
2905       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
2906     ); then
2907       _err "Error when run post hook."
2908       return 1
2909     fi
2910   fi
2911
2912   #run renew hook
2913   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
2914     _info "Run renew hook:'$_chk_renew_hook'"
2915     if ! (
2916       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
2917     ); then
2918       _err "Error when run renew hook."
2919       return 1
2920     fi
2921   fi
2922
2923 }
2924
2925 updateaccount() {
2926   _initpath
2927   _regAccount
2928 }
2929
2930 registeraccount() {
2931   _reg_length="$1"
2932   _initpath
2933   _regAccount "$_reg_length"
2934 }
2935
2936 __calcAccountKeyHash() {
2937   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
2938 }
2939
2940 __calc_account_thumbprint() {
2941   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
2942 }
2943
2944 #keylength
2945 _regAccount() {
2946   _initpath
2947   _reg_length="$1"
2948
2949   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
2950     mkdir -p "$CA_DIR"
2951     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
2952     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
2953   fi
2954
2955   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
2956     mkdir -p "$CA_DIR"
2957     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
2958     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
2959   fi
2960
2961   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
2962     if ! _create_account_key "$_reg_length"; then
2963       _err "Create account key error."
2964       return 1
2965     fi
2966   fi
2967
2968   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
2969     return 1
2970   fi
2971
2972   _updateTos=""
2973   _reg_res="new-reg"
2974   while true; do
2975     _debug AGREEMENT "$AGREEMENT"
2976
2977     regjson='{"resource": "'$_reg_res'", "agreement": "'$AGREEMENT'"}'
2978
2979     if [ "$ACCOUNT_EMAIL" ]; then
2980       regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
2981     fi
2982
2983     if [ -z "$_updateTos" ]; then
2984       _info "Registering account"
2985
2986       if ! _send_signed_request "$API/acme/new-reg" "$regjson"; then
2987         _err "Register account Error: $response"
2988         return 1
2989       fi
2990
2991       if [ "$code" = "" ] || [ "$code" = '201' ]; then
2992         echo "$response" >"$ACCOUNT_JSON_PATH"
2993         _info "Registered"
2994       elif [ "$code" = '409' ]; then
2995         _info "Already registered"
2996       else
2997         _err "Register account Error: $response"
2998         return 1
2999       fi
3000
3001       _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
3002       _debug "_accUri" "$_accUri"
3003
3004       _tos="$(echo "$responseHeaders" | grep "^Link:.*rel=\"terms-of-service\"" | _head_n 1 | _egrep_o "<.*>" | tr -d '<>')"
3005       _debug "_tos" "$_tos"
3006       if [ -z "$_tos" ]; then
3007         _debug "Use default tos: $DEFAULT_AGREEMENT"
3008         _tos="$DEFAULT_AGREEMENT"
3009       fi
3010       if [ "$_tos" != "$AGREEMENT" ]; then
3011         _updateTos=1
3012         AGREEMENT="$_tos"
3013         _reg_res="reg"
3014         continue
3015       fi
3016
3017     else
3018       _debug "Update tos: $_tos"
3019       if ! _send_signed_request "$_accUri" "$regjson"; then
3020         _err "Update tos error."
3021         return 1
3022       fi
3023       if [ "$code" = '202' ]; then
3024         _info "Update success."
3025
3026         CA_KEY_HASH="$(__calcAccountKeyHash)"
3027         _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3028         _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3029       else
3030         _err "Update account error."
3031         return 1
3032       fi
3033     fi
3034     ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3035     _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3036     return 0
3037   done
3038
3039 }
3040
3041 # domain folder  file
3042 _findHook() {
3043   _hookdomain="$1"
3044   _hookcat="$2"
3045   _hookname="$3"
3046
3047   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3048     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3049   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3050     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3051   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3052     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3053   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3054     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3055   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3056     d_api="$LE_WORKING_DIR/$_hookname"
3057   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3058     d_api="$LE_WORKING_DIR/$_hookname.sh"
3059   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3060     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3061   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3062     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3063   fi
3064
3065   printf "%s" "$d_api"
3066 }
3067
3068 #domain
3069 __get_domain_new_authz() {
3070   _gdnd="$1"
3071   _info "Getting new-authz for domain" "$_gdnd"
3072
3073   _Max_new_authz_retry_times=5
3074   _authz_i=0
3075   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3076     _debug "Try new-authz for the $_authz_i time."
3077     if ! _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3078       _err "Can not get domain new authz."
3079       return 1
3080     fi
3081     if _contains "$response" "No registration exists matching provided key"; then
3082       _err "It seems there is an error, but it's recovered now, please try again."
3083       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3084       _clearcaconf "CA_KEY_HASH"
3085       break
3086     fi
3087     if ! _contains "$response" "An error occurred while processing your request"; then
3088       _info "The new-authz request is ok."
3089       break
3090     fi
3091     _authz_i="$(_math "$_authz_i" + 1)"
3092     _info "The server is busy, Sleep $_authz_i to retry."
3093     _sleep "$_authz_i"
3094   done
3095
3096   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3097     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3098   fi
3099
3100   if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
3101     _err "new-authz error: $response"
3102     return 1
3103   fi
3104
3105 }
3106
3107 #uri keyAuthorization
3108 __trigger_validaton() {
3109   _debug2 "tigger domain validation."
3110   _t_url="$1"
3111   _debug2 _t_url "$_t_url"
3112   _t_key_authz="$2"
3113   _debug2 _t_key_authz "$_t_key_authz"
3114   _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
3115 }
3116
3117 #webroot, domain domainlist  keylength
3118 issue() {
3119   if [ -z "$2" ]; then
3120     _usage "Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ "
3121     return 1
3122   fi
3123   _web_roots="$1"
3124   _main_domain="$2"
3125   _alt_domains="$3"
3126   if _contains "$_main_domain" ","; then
3127     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
3128     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
3129   fi
3130   _key_length="$4"
3131   _real_cert="$5"
3132   _real_key="$6"
3133   _real_ca="$7"
3134   _reload_cmd="$8"
3135   _real_fullchain="$9"
3136   _pre_hook="${10}"
3137   _post_hook="${11}"
3138   _renew_hook="${12}"
3139   _local_addr="${13}"
3140
3141   #remove these later.
3142   if [ "$_web_roots" = "dns-cf" ]; then
3143     _web_roots="dns_cf"
3144   fi
3145   if [ "$_web_roots" = "dns-dp" ]; then
3146     _web_roots="dns_dp"
3147   fi
3148   if [ "$_web_roots" = "dns-cx" ]; then
3149     _web_roots="dns_cx"
3150   fi
3151   _debug "Using api: $API"
3152
3153   if [ ! "$IS_RENEW" ]; then
3154     _initpath "$_main_domain" "$_key_length"
3155     mkdir -p "$DOMAIN_PATH"
3156   fi
3157
3158   if [ -f "$DOMAIN_CONF" ]; then
3159     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
3160     _debug Le_NextRenewTime "$Le_NextRenewTime"
3161     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3162       _saved_domain=$(_readdomainconf Le_Domain)
3163       _debug _saved_domain "$_saved_domain"
3164       _saved_alt=$(_readdomainconf Le_Alt)
3165       _debug _saved_alt "$_saved_alt"
3166       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
3167         _info "Domains not changed."
3168         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
3169         _info "Add '$(__red '--force')' to force to renew."
3170         return $RENEW_SKIP
3171       else
3172         _info "Domains have changed."
3173       fi
3174     fi
3175   fi
3176
3177   _savedomainconf "Le_Domain" "$_main_domain"
3178   _savedomainconf "Le_Alt" "$_alt_domains"
3179   _savedomainconf "Le_Webroot" "$_web_roots"
3180
3181   _savedomainconf "Le_PreHook" "$_pre_hook"
3182   _savedomainconf "Le_PostHook" "$_post_hook"
3183   _savedomainconf "Le_RenewHook" "$_renew_hook"
3184
3185   if [ "$_local_addr" ]; then
3186     _savedomainconf "Le_LocalAddress" "$_local_addr"
3187   else
3188     _cleardomainconf "Le_LocalAddress"
3189   fi
3190
3191   Le_API="$API"
3192   _savedomainconf "Le_API" "$Le_API"
3193
3194   if [ "$_alt_domains" = "$NO_VALUE" ]; then
3195     _alt_domains=""
3196   fi
3197
3198   if [ "$_key_length" = "$NO_VALUE" ]; then
3199     _key_length=""
3200   fi
3201
3202   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
3203     _err "_on_before_issue."
3204     return 1
3205   fi
3206
3207   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
3208   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
3209
3210   if [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
3211     if ! _regAccount "$_accountkeylength"; then
3212       _on_issue_err "$_post_hook"
3213       return 1
3214     fi
3215   else
3216     _debug "_saved_account_key_hash is not changed, skip register account."
3217   fi
3218
3219   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
3220     _info "Signing from existing CSR."
3221   else
3222     _key=$(_readdomainconf Le_Keylength)
3223     _debug "Read key length:$_key"
3224     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ]; then
3225       if ! createDomainKey "$_main_domain" "$_key_length"; then
3226         _err "Create domain key error."
3227         _clearup
3228         _on_issue_err "$_post_hook"
3229         return 1
3230       fi
3231     fi
3232
3233     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
3234       _err "Create CSR error."
3235       _clearup
3236       _on_issue_err "$_post_hook"
3237       return 1
3238     fi
3239   fi
3240
3241   _savedomainconf "Le_Keylength" "$_key_length"
3242
3243   vlist="$Le_Vlist"
3244
3245   _info "Getting domain auth token for each domain"
3246   sep='#'
3247   dvsep=','
3248   if [ -z "$vlist" ]; then
3249     alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
3250     _index=1
3251     _currentRoot=""
3252     for d in $alldomains; do
3253       _info "Getting webroot for domain" "$d"
3254       _w="$(echo $_web_roots | cut -d , -f $_index)"
3255       _debug _w "$_w"
3256       if [ "$_w" ]; then
3257         _currentRoot="$_w"
3258       fi
3259       _debug "_currentRoot" "$_currentRoot"
3260       _index=$(_math $_index + 1)
3261
3262       vtype="$VTYPE_HTTP"
3263       if _startswith "$_currentRoot" "dns"; then
3264         vtype="$VTYPE_DNS"
3265       fi
3266
3267       if [ "$_currentRoot" = "$W_TLS" ]; then
3268         vtype="$VTYPE_TLS"
3269       fi
3270
3271       if ! __get_domain_new_authz "$d"; then
3272         _clearup
3273         _on_issue_err "$_post_hook"
3274         return 1
3275       fi
3276
3277       if [ -z "$thumbprint" ]; then
3278         thumbprint="$(__calc_account_thumbprint)"
3279       fi
3280
3281       entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
3282       _debug entry "$entry"
3283       if [ -z "$entry" ]; then
3284         _err "Error, can not get domain token $d"
3285         _clearup
3286         _on_issue_err "$_post_hook"
3287         return 1
3288       fi
3289       token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
3290       _debug token "$token"
3291
3292       uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
3293       _debug uri "$uri"
3294
3295       keyauthorization="$token.$thumbprint"
3296       _debug keyauthorization "$keyauthorization"
3297
3298       if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
3299         _debug "$d is already verified, skip."
3300         keyauthorization="$STATE_VERIFIED"
3301         _debug keyauthorization "$keyauthorization"
3302       fi
3303
3304       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
3305       _debug dvlist "$dvlist"
3306
3307       vlist="$vlist$dvlist$dvsep"
3308
3309     done
3310     _debug vlist "$vlist"
3311     #add entry
3312     dnsadded=""
3313     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3314     for ventry in $ventries; do
3315       d=$(echo "$ventry" | cut -d "$sep" -f 1)
3316       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3317       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3318       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3319
3320       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3321         _debug "$d is already verified, skip $vtype."
3322         continue
3323       fi
3324
3325       if [ "$vtype" = "$VTYPE_DNS" ]; then
3326         dnsadded='0'
3327         txtdomain="_acme-challenge.$d"
3328         _debug txtdomain "$txtdomain"
3329         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
3330         _debug txt "$txt"
3331
3332         d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
3333
3334         _debug d_api "$d_api"
3335
3336         if [ "$d_api" ]; then
3337           _info "Found domain api file: $d_api"
3338         else
3339           _err "Add the following TXT record:"
3340           _err "Domain: '$(__green "$txtdomain")'"
3341           _err "TXT value: '$(__green "$txt")'"
3342           _err "Please be aware that you prepend _acme-challenge. before your domain"
3343           _err "so the resulting subdomain will be: $txtdomain"
3344           continue
3345         fi
3346
3347         (
3348           if ! . "$d_api"; then
3349             _err "Load file $d_api error. Please check your api file and try again."
3350             return 1
3351           fi
3352
3353           addcommand="${_currentRoot}_add"
3354           if ! _exists "$addcommand"; then
3355             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
3356             return 1
3357           fi
3358
3359           if ! $addcommand "$txtdomain" "$txt"; then
3360             _err "Error add txt for domain:$txtdomain"
3361             return 1
3362           fi
3363         )
3364
3365         if [ "$?" != "0" ]; then
3366           _clearup
3367           _on_issue_err "$_post_hook"
3368           return 1
3369         fi
3370         dnsadded='1'
3371       fi
3372     done
3373
3374     if [ "$dnsadded" = '0' ]; then
3375       _savedomainconf "Le_Vlist" "$vlist"
3376       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
3377       _err "Please add the TXT records to the domains, and retry again."
3378       _clearup
3379       _on_issue_err "$_post_hook"
3380       return 1
3381     fi
3382
3383   fi
3384
3385   if [ "$dnsadded" = '1' ]; then
3386     if [ -z "$Le_DNSSleep" ]; then
3387       Le_DNSSleep="$DEFAULT_DNS_SLEEP"
3388     else
3389       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
3390     fi
3391
3392     _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
3393     _sleep "$Le_DNSSleep"
3394   fi
3395
3396   NGINX_RESTORE_VLIST=""
3397   _debug "ok, let's start to verify"
3398
3399   _ncIndex=1
3400   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3401   for ventry in $ventries; do
3402     d=$(echo "$ventry" | cut -d "$sep" -f 1)
3403     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3404     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3405     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3406     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3407
3408     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3409       _info "$d is already verified, skip $vtype."
3410       continue
3411     fi
3412
3413     _info "Verifying:$d"
3414     _debug "d" "$d"
3415     _debug "keyauthorization" "$keyauthorization"
3416     _debug "uri" "$uri"
3417     removelevel=""
3418     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
3419
3420     _debug "_currentRoot" "$_currentRoot"
3421
3422     if [ "$vtype" = "$VTYPE_HTTP" ]; then
3423       if [ "$_currentRoot" = "$NO_VALUE" ]; then
3424         _info "Standalone mode server"
3425         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3426         _ncIndex="$(_math $_ncIndex + 1)"
3427         _startserver "$keyauthorization" "$_ncaddr" &
3428         if [ "$?" != "0" ]; then
3429           _clearup
3430           _on_issue_err "$_post_hook" "$vlist"
3431           return 1
3432         fi
3433         serverproc="$!"
3434         sleep 1
3435         _debug serverproc "$serverproc"
3436       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
3437         _info "Stateless mode for domain:$d"
3438         _sleep 1
3439       elif _startswith "$_currentRoot" "$NGINX"; then
3440         _info "Nginx mode for domain:$d"
3441         #set up nginx server
3442         FOUND_REAL_NGINX_CONF=""
3443         BACKUP_NGINX_CONF=""
3444         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
3445           _clearup
3446           _on_issue_err "$_post_hook" "$vlist"
3447           return 1
3448         fi
3449
3450         if [ "$FOUND_REAL_NGINX_CONF" ]; then
3451           _realConf="$FOUND_REAL_NGINX_CONF"
3452           _backup="$BACKUP_NGINX_CONF"
3453           _debug _realConf "$_realConf"
3454           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
3455         fi
3456         _sleep 1
3457       else
3458         if [ "$_currentRoot" = "apache" ]; then
3459           wellknown_path="$ACME_DIR"
3460         else
3461           wellknown_path="$_currentRoot/.well-known/acme-challenge"
3462           if [ ! -d "$_currentRoot/.well-known" ]; then
3463             removelevel='1'
3464           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
3465             removelevel='2'
3466           else
3467             removelevel='3'
3468           fi
3469         fi
3470
3471         _debug wellknown_path "$wellknown_path"
3472
3473         _debug "writing token:$token to $wellknown_path/$token"
3474
3475         mkdir -p "$wellknown_path"
3476
3477         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
3478           _err "$d:Can not write token to file : $wellknown_path/$token"
3479           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3480           _clearup
3481           _on_issue_err "$_post_hook" "$vlist"
3482           return 1
3483         fi
3484
3485         if [ ! "$usingApache" ]; then
3486           if webroot_owner=$(_stat "$_currentRoot"); then
3487             _debug "Changing owner/group of .well-known to $webroot_owner"
3488             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
3489               _debug "$(cat "$_EXEC_TEMP_ERR")"
3490               _exec_err >/dev/null 2>&1
3491             fi
3492           else
3493             _debug "not changing owner/group of webroot"
3494           fi
3495         fi
3496
3497       fi
3498
3499     elif [ "$vtype" = "$VTYPE_TLS" ]; then
3500       #create A
3501       #_hash_A="$(printf "%s" $token | _digest "sha256" "hex" )"
3502       #_debug2 _hash_A "$_hash_A"
3503       #_x="$(echo $_hash_A | cut -c 1-32)"
3504       #_debug2 _x "$_x"
3505       #_y="$(echo $_hash_A | cut -c 33-64)"
3506       #_debug2 _y "$_y"
3507       #_SAN_A="$_x.$_y.token.acme.invalid"
3508       #_debug2 _SAN_A "$_SAN_A"
3509
3510       #create B
3511       _hash_B="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
3512       _debug2 _hash_B "$_hash_B"
3513       _x="$(echo "$_hash_B" | cut -c 1-32)"
3514       _debug2 _x "$_x"
3515       _y="$(echo "$_hash_B" | cut -c 33-64)"
3516       _debug2 _y "$_y"
3517
3518       #_SAN_B="$_x.$_y.ka.acme.invalid"
3519
3520       _SAN_B="$_x.$_y.acme.invalid"
3521       _debug2 _SAN_B "$_SAN_B"
3522
3523       _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3524       _ncIndex="$(_math "$_ncIndex" + 1)"
3525       if ! _starttlsserver "$_SAN_B" "$_SAN_A" "$Le_TLSPort" "$keyauthorization" "$_ncaddr"; then
3526         _err "Start tls server error."
3527         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3528         _clearup
3529         _on_issue_err "$_post_hook" "$vlist"
3530         return 1
3531       fi
3532     fi
3533
3534     if ! __trigger_validaton "$uri" "$keyauthorization"; then
3535       _err "$d:Can not get challenge: $response"
3536       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3537       _clearup
3538       _on_issue_err "$_post_hook" "$vlist"
3539       return 1
3540     fi
3541
3542     if [ ! -z "$code" ] && [ ! "$code" = '202' ]; then
3543       _err "$d:Challenge error: $response"
3544       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3545       _clearup
3546       _on_issue_err "$_post_hook" "$vlist"
3547       return 1
3548     fi
3549
3550     waittimes=0
3551     if [ -z "$MAX_RETRY_TIMES" ]; then
3552       MAX_RETRY_TIMES=30
3553     fi
3554
3555     while true; do
3556       waittimes=$(_math "$waittimes" + 1)
3557       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
3558         _err "$d:Timeout"
3559         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3560         _clearup
3561         _on_issue_err "$_post_hook" "$vlist"
3562         return 1
3563       fi
3564
3565       _debug "sleep 2 secs to verify"
3566       sleep 2
3567       _debug "checking"
3568       response="$(_get "$uri")"
3569       if [ "$?" != "0" ]; then
3570         _err "$d:Verify error:$response"
3571         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3572         _clearup
3573         _on_issue_err "$_post_hook" "$vlist"
3574         return 1
3575       fi
3576       _debug2 original "$response"
3577
3578       response="$(echo "$response" | _normalizeJson)"
3579       _debug2 response "$response"
3580
3581       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
3582       if [ "$status" = "valid" ]; then
3583         _info "$(__green Success)"
3584         _stopserver "$serverproc"
3585         serverproc=""
3586         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3587         break
3588       fi
3589
3590       if [ "$status" = "invalid" ]; then
3591         error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
3592         _debug2 error "$error"
3593         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
3594         _debug2 errordetail "$errordetail"
3595         if [ "$errordetail" ]; then
3596           _err "$d:Verify error:$errordetail"
3597         else
3598           _err "$d:Verify error:$error"
3599         fi
3600         if [ "$DEBUG" ]; then
3601           if [ "$vtype" = "$VTYPE_HTTP" ]; then
3602             _debug "Debug: get token url."
3603             _get "http://$d/.well-known/acme-challenge/$token" "" 1
3604           fi
3605         fi
3606         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3607         _clearup
3608         _on_issue_err "$_post_hook" "$vlist"
3609         return 1
3610       fi
3611
3612       if [ "$status" = "pending" ]; then
3613         _info "Pending"
3614       else
3615         _err "$d:Verify error:$response"
3616         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3617         _clearup
3618         _on_issue_err "$_post_hook" "$vlist"
3619         return 1
3620       fi
3621
3622     done
3623
3624   done
3625
3626   _clearup
3627   _info "Verify finished, start to sign."
3628   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
3629
3630   if ! _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"; then
3631     _err "Sign failed."
3632     _on_issue_err "$_post_hook"
3633     return 1
3634   fi
3635
3636   _rcert="$response"
3637   Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
3638   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
3639
3640   if [ "$Le_LinkCert" ]; then
3641     echo "$BEGIN_CERT" >"$CERT_PATH"
3642
3643     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
3644     #  _debug "Get cert failed. Let's try last response."
3645     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
3646     #fi
3647
3648     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
3649       _debug "Try cert link."
3650       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
3651     fi
3652
3653     echo "$END_CERT" >>"$CERT_PATH"
3654     _info "$(__green "Cert success.")"
3655     cat "$CERT_PATH"
3656
3657     _info "Your cert is in $(__green " $CERT_PATH ")"
3658
3659     if [ -f "$CERT_KEY_PATH" ]; then
3660       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
3661     fi
3662
3663     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
3664
3665     if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
3666       USER_PATH="$PATH"
3667       _saveaccountconf "USER_PATH" "$USER_PATH"
3668     fi
3669   fi
3670
3671   if [ -z "$Le_LinkCert" ]; then
3672     response="$(echo "$response" | _dbase64 "multiline" | _normalizeJson)"
3673     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
3674     _on_issue_err "$_post_hook"
3675     return 1
3676   fi
3677
3678   _cleardomainconf "Le_Vlist"
3679
3680   Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
3681   if ! _contains "$Le_LinkIssuer" ":"; then
3682     Le_LinkIssuer="$API$Le_LinkIssuer"
3683   fi
3684
3685   _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
3686
3687   if [ "$Le_LinkIssuer" ]; then
3688     echo "$BEGIN_CERT" >"$CA_CERT_PATH"
3689     _get "$Le_LinkIssuer" | _base64 "multiline" >>"$CA_CERT_PATH"
3690     echo "$END_CERT" >>"$CA_CERT_PATH"
3691     _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
3692     cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
3693     _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
3694   fi
3695
3696   Le_CertCreateTime=$(_time)
3697   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
3698
3699   Le_CertCreateTimeStr=$(date -u)
3700   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
3701
3702   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "$MAX_RENEW" ]; then
3703     Le_RenewalDays="$MAX_RENEW"
3704   else
3705     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
3706   fi
3707
3708   if [ "$CA_BUNDLE" ]; then
3709     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
3710   else
3711     _clearaccountconf "CA_BUNDLE"
3712   fi
3713
3714   if [ "$CA_PATH" ]; then
3715     _saveaccountconf CA_PATH "$CA_PATH"
3716   else
3717     _clearaccountconf "CA_PATH"
3718   fi
3719
3720   if [ "$HTTPS_INSECURE" ]; then
3721     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
3722   else
3723     _clearaccountconf "HTTPS_INSECURE"
3724   fi
3725
3726   if [ "$Le_Listen_V4" ]; then
3727     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
3728     _cleardomainconf Le_Listen_V6
3729   elif [ "$Le_Listen_V6" ]; then
3730     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
3731     _cleardomainconf Le_Listen_V4
3732   fi
3733
3734   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
3735
3736   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
3737   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
3738
3739   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
3740   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
3741
3742   _on_issue_success "$_post_hook" "$_renew_hook"
3743
3744   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
3745     _savedomainconf "Le_RealCertPath" "$_real_cert"
3746     _savedomainconf "Le_RealCACertPath" "$_real_ca"
3747     _savedomainconf "Le_RealKeyPath" "$_real_key"
3748     _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
3749     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
3750     _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
3751   fi
3752
3753 }
3754
3755 #domain  [isEcc]
3756 renew() {
3757   Le_Domain="$1"
3758   if [ -z "$Le_Domain" ]; then
3759     _usage "Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]"
3760     return 1
3761   fi
3762
3763   _isEcc="$2"
3764
3765   _initpath "$Le_Domain" "$_isEcc"
3766
3767   _info "$(__green "Renew: '$Le_Domain'")"
3768   if [ ! -f "$DOMAIN_CONF" ]; then
3769     _info "'$Le_Domain' is not a issued domain, skip."
3770     return 0
3771   fi
3772
3773   if [ "$Le_RenewalDays" ]; then
3774     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
3775   fi
3776
3777   . "$DOMAIN_CONF"
3778
3779   if [ "$Le_API" ]; then
3780     API="$Le_API"
3781     #reload ca configs
3782     ACCOUNT_KEY_PATH=""
3783     ACCOUNT_JSON_PATH=""
3784     CA_CONF=""
3785     _debug3 "initpath again."
3786     _initpath "$Le_Domain" "$_isEcc"
3787   fi
3788
3789   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3790     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
3791     _info "Add '$(__red '--force')' to force to renew."
3792     return "$RENEW_SKIP"
3793   fi
3794
3795   IS_RENEW="1"
3796   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
3797   res="$?"
3798   if [ "$res" != "0" ]; then
3799     return "$res"
3800   fi
3801
3802   if [ "$Le_DeployHook" ]; then
3803     _deploy "$Le_Domain" "$Le_DeployHook"
3804     res="$?"
3805   fi
3806
3807   IS_RENEW=""
3808
3809   return "$res"
3810 }
3811
3812 #renewAll  [stopRenewOnError]
3813 renewAll() {
3814   _initpath
3815   _stopRenewOnError="$1"
3816   _debug "_stopRenewOnError" "$_stopRenewOnError"
3817   _ret="0"
3818
3819   for di in "${CERT_HOME}"/*.*/; do
3820     _debug di "$di"
3821     if ! [ -d "$di" ]; then
3822       _debug "Not directory, skip: $di"
3823       continue
3824     fi
3825     d=$(basename "$di")
3826     _debug d "$d"
3827     (
3828       if _endswith "$d" "$ECC_SUFFIX"; then
3829         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
3830         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
3831       fi
3832       renew "$d" "$_isEcc"
3833     )
3834     rc="$?"
3835     _debug "Return code: $rc"
3836     if [ "$rc" != "0" ]; then
3837       if [ "$rc" = "$RENEW_SKIP" ]; then
3838         _info "Skipped $d"
3839       elif [ "$_stopRenewOnError" ]; then
3840         _err "Error renew $d,  stop now."
3841         return "$rc"
3842       else
3843         _ret="$rc"
3844         _err "Error renew $d, Go ahead to next one."
3845       fi
3846     fi
3847   done
3848   return "$_ret"
3849 }
3850
3851 #csr webroot
3852 signcsr() {
3853   _csrfile="$1"
3854   _csrW="$2"
3855   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
3856     _usage "Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ "
3857     return 1
3858   fi
3859
3860   _initpath
3861
3862   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
3863   if [ "$?" != "0" ]; then
3864     _err "Can not read subject from csr: $_csrfile"
3865     return 1
3866   fi
3867   _debug _csrsubj "$_csrsubj"
3868
3869   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
3870   if [ "$?" != "0" ]; then
3871     _err "Can not read domain list from csr: $_csrfile"
3872     return 1
3873   fi
3874   _debug "_csrdomainlist" "$_csrdomainlist"
3875
3876   if [ -z "$_csrsubj" ]; then
3877     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
3878     _debug _csrsubj "$_csrsubj"
3879     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
3880     _debug "_csrdomainlist" "$_csrdomainlist"
3881   fi
3882
3883   if [ -z "$_csrsubj" ]; then
3884     _err "Can not read subject from csr: $_csrfile"
3885     return 1
3886   fi
3887
3888   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
3889   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
3890     _err "Can not read key length from csr: $_csrfile"
3891     return 1
3892   fi
3893
3894   _initpath "$_csrsubj" "$_csrkeylength"
3895   mkdir -p "$DOMAIN_PATH"
3896
3897   _info "Copy csr to: $CSR_PATH"
3898   cp "$_csrfile" "$CSR_PATH"
3899
3900   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength"
3901
3902 }
3903
3904 showcsr() {
3905   _csrfile="$1"
3906   _csrd="$2"
3907   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
3908     _usage "Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr"
3909     return 1
3910   fi
3911
3912   _initpath
3913
3914   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
3915   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
3916     _err "Can not read subject from csr: $_csrfile"
3917     return 1
3918   fi
3919
3920   _info "Subject=$_csrsubj"
3921
3922   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
3923   if [ "$?" != "0" ]; then
3924     _err "Can not read domain list from csr: $_csrfile"
3925     return 1
3926   fi
3927   _debug "_csrdomainlist" "$_csrdomainlist"
3928
3929   _info "SubjectAltNames=$_csrdomainlist"
3930
3931   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
3932   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
3933     _err "Can not read key length from csr: $_csrfile"
3934     return 1
3935   fi
3936   _info "KeyLength=$_csrkeylength"
3937 }
3938
3939 list() {
3940   _raw="$1"
3941   _initpath
3942
3943   _sep="|"
3944   if [ "$_raw" ]; then
3945     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
3946     for di in "${CERT_HOME}"/*.*/; do
3947       if ! [ -d "$di" ]; then
3948         _debug "Not directory, skip: $di"
3949         continue
3950       fi
3951       d=$(basename "$di")
3952       _debug d "$d"
3953       (
3954         if _endswith "$d" "$ECC_SUFFIX"; then
3955           _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
3956           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
3957         fi
3958         _initpath "$d" "$_isEcc"
3959         if [ -f "$DOMAIN_CONF" ]; then
3960           . "$DOMAIN_CONF"
3961           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
3962         fi
3963       )
3964     done
3965   else
3966     if _exists column; then
3967       list "raw" | column -t -s "$_sep"
3968     else
3969       list "raw" | tr "$_sep" '\t'
3970     fi
3971   fi
3972
3973 }
3974
3975 _deploy() {
3976   _d="$1"
3977   _hooks="$2"
3978
3979   for _d_api in $(echo "$_hooks" | tr ',' " "); do
3980     _deployApi="$(_findHook "$_d" deploy "$_d_api")"
3981     if [ -z "$_deployApi" ]; then
3982       _err "The deploy hook $_d_api is not found."
3983       return 1
3984     fi
3985     _debug _deployApi "$_deployApi"
3986
3987     if ! (
3988       if ! . "$_deployApi"; then
3989         _err "Load file $_deployApi error. Please check your api file and try again."
3990         return 1
3991       fi
3992
3993       d_command="${_d_api}_deploy"
3994       if ! _exists "$d_command"; then
3995         _err "It seems that your api file is not correct, it must have a function named: $d_command"
3996         return 1
3997       fi
3998
3999       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
4000         _err "Error deploy for domain:$_d"
4001         return 1
4002       fi
4003     ); then
4004       _err "Deploy error."
4005       return 1
4006     else
4007       _info "$(__green Success)"
4008     fi
4009   done
4010 }
4011
4012 #domain hooks
4013 deploy() {
4014   _d="$1"
4015   _hooks="$2"
4016   _isEcc="$3"
4017   if [ -z "$_hooks" ]; then
4018     _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
4019     return 1
4020   fi
4021
4022   _initpath "$_d" "$_isEcc"
4023   if [ ! -d "$DOMAIN_PATH" ]; then
4024     _err "Domain is not valid:'$_d'"
4025     return 1
4026   fi
4027
4028   . "$DOMAIN_CONF"
4029
4030   _savedomainconf Le_DeployHook "$_hooks"
4031
4032   _deploy "$_d" "$_hooks"
4033 }
4034
4035 installcert() {
4036   _main_domain="$1"
4037   if [ -z "$_main_domain" ]; then
4038     _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
4039     return 1
4040   fi
4041
4042   _real_cert="$2"
4043   _real_key="$3"
4044   _real_ca="$4"
4045   _reload_cmd="$5"
4046   _real_fullchain="$6"
4047   _isEcc="$7"
4048
4049   _initpath "$_main_domain" "$_isEcc"
4050   if [ ! -d "$DOMAIN_PATH" ]; then
4051     _err "Domain is not valid:'$_main_domain'"
4052     return 1
4053   fi
4054
4055   _savedomainconf "Le_RealCertPath" "$_real_cert"
4056   _savedomainconf "Le_RealCACertPath" "$_real_ca"
4057   _savedomainconf "Le_RealKeyPath" "$_real_key"
4058   _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4059   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4060
4061   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4062 }
4063
4064 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
4065 _installcert() {
4066   _main_domain="$1"
4067   _real_cert="$2"
4068   _real_key="$3"
4069   _real_ca="$4"
4070   _real_fullchain="$5"
4071   _reload_cmd="$6"
4072   _backup_prefix="$7"
4073
4074   if [ "$_real_cert" = "$NO_VALUE" ]; then
4075     _real_cert=""
4076   fi
4077   if [ "$_real_key" = "$NO_VALUE" ]; then
4078     _real_key=""
4079   fi
4080   if [ "$_real_ca" = "$NO_VALUE" ]; then
4081     _real_ca=""
4082   fi
4083   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
4084     _reload_cmd=""
4085   fi
4086   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
4087     _real_fullchain=""
4088   fi
4089
4090   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
4091   mkdir -p "$_backup_path"
4092
4093   if [ "$_real_cert" ]; then
4094     _info "Installing cert to:$_real_cert"
4095     if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
4096       cp "$_real_cert" "$_backup_path/cert.bak"
4097     fi
4098     cat "$CERT_PATH" >"$_real_cert"
4099   fi
4100
4101   if [ "$_real_ca" ]; then
4102     _info "Installing CA to:$_real_ca"
4103     if [ "$_real_ca" = "$_real_cert" ]; then
4104       echo "" >>"$_real_ca"
4105       cat "$CA_CERT_PATH" >>"$_real_ca"
4106     else
4107       if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
4108         cp "$_real_ca" "$_backup_path/ca.bak"
4109       fi
4110       cat "$CA_CERT_PATH" >"$_real_ca"
4111     fi
4112   fi
4113
4114   if [ "$_real_key" ]; then
4115     _info "Installing key to:$_real_key"
4116     if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
4117       cp "$_real_key" "$_backup_path/key.bak"
4118     fi
4119     cat "$CERT_KEY_PATH" >"$_real_key"
4120   fi
4121
4122   if [ "$_real_fullchain" ]; then
4123     _info "Installing full chain to:$_real_fullchain"
4124     if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
4125       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
4126     fi
4127     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain"
4128   fi
4129
4130   if [ "$_reload_cmd" ]; then
4131     _info "Run reload cmd: $_reload_cmd"
4132     if (
4133       export CERT_PATH
4134       export CERT_KEY_PATH
4135       export CA_CERT_PATH
4136       export CERT_FULLCHAIN_PATH
4137       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
4138     ); then
4139       _info "$(__green "Reload success")"
4140     else
4141       _err "Reload error for :$Le_Domain"
4142     fi
4143   fi
4144
4145 }
4146
4147 #confighome
4148 installcronjob() {
4149   _c_home="$1"
4150   _initpath
4151   if ! _exists "crontab"; then
4152     _err "crontab doesn't exist, so, we can not install cron jobs."
4153     _err "All your certs will not be renewed automatically."
4154     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
4155     return 1
4156   fi
4157
4158   _info "Installing cron job"
4159   if ! crontab -l | grep "$PROJECT_ENTRY --cron"; then
4160     if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
4161       lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
4162     else
4163       _err "Can not install cronjob, $PROJECT_ENTRY not found."
4164       return 1
4165     fi
4166
4167     if [ "$_c_home" ]; then
4168       _c_entry="--config-home \"$_c_home\" "
4169     fi
4170     _t=$(_time)
4171     random_minute=$(_math $_t % 60)
4172     if _exists uname && uname -a | grep SunOS >/dev/null; then
4173       crontab -l | {
4174         cat
4175         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4176       } | crontab --
4177     else
4178       crontab -l | {
4179         cat
4180         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4181       } | crontab -
4182     fi
4183   fi
4184   if [ "$?" != "0" ]; then
4185     _err "Install cron job failed. You need to manually renew your certs."
4186     _err "Or you can add cronjob by yourself:"
4187     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
4188     return 1
4189   fi
4190 }
4191
4192 uninstallcronjob() {
4193   if ! _exists "crontab"; then
4194     return
4195   fi
4196   _info "Removing cron job"
4197   cr="$(crontab -l | grep "$PROJECT_ENTRY --cron")"
4198   if [ "$cr" ]; then
4199     if _exists uname && uname -a | grep solaris >/dev/null; then
4200       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab --
4201     else
4202       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab -
4203     fi
4204     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
4205     _info LE_WORKING_DIR "$LE_WORKING_DIR"
4206     if _contains "$cr" "--config-home"; then
4207       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
4208       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
4209     fi
4210   fi
4211   _initpath
4212
4213 }
4214
4215 revoke() {
4216   Le_Domain="$1"
4217   if [ -z "$Le_Domain" ]; then
4218     _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]"
4219     return 1
4220   fi
4221
4222   _isEcc="$2"
4223
4224   _initpath "$Le_Domain" "$_isEcc"
4225   if [ ! -f "$DOMAIN_CONF" ]; then
4226     _err "$Le_Domain is not a issued domain, skip."
4227     return 1
4228   fi
4229
4230   if [ ! -f "$CERT_PATH" ]; then
4231     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
4232     return 1
4233   fi
4234
4235   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
4236
4237   if [ -z "$cert" ]; then
4238     _err "Cert for $Le_Domain is empty found, skip."
4239     return 1
4240   fi
4241
4242   data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
4243   uri="$API/acme/revoke-cert"
4244
4245   if [ -f "$CERT_KEY_PATH" ]; then
4246     _info "Try domain key first."
4247     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
4248       if [ -z "$response" ]; then
4249         _info "Revoke success."
4250         rm -f "$CERT_PATH"
4251         return 0
4252       else
4253         _err "Revoke error by domain key."
4254         _err "$response"
4255       fi
4256     fi
4257   else
4258     _info "Domain key file doesn't exists."
4259   fi
4260
4261   _info "Try account key."
4262
4263   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
4264     if [ -z "$response" ]; then
4265       _info "Revoke success."
4266       rm -f "$CERT_PATH"
4267       return 0
4268     else
4269       _err "Revoke error."
4270       _debug "$response"
4271     fi
4272   fi
4273   return 1
4274 }
4275
4276 #domain  ecc
4277 remove() {
4278   Le_Domain="$1"
4279   if [ -z "$Le_Domain" ]; then
4280     _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
4281     return 1
4282   fi
4283
4284   _isEcc="$2"
4285
4286   _initpath "$Le_Domain" "$_isEcc"
4287   _removed_conf="$DOMAIN_CONF.removed"
4288   if [ ! -f "$DOMAIN_CONF" ]; then
4289     if [ -f "$_removed_conf" ]; then
4290       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
4291     else
4292       _err "$Le_Domain is not a issued domain, skip."
4293     fi
4294     return 1
4295   fi
4296
4297   if mv "$DOMAIN_CONF" "$_removed_conf"; then
4298     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
4299     _info "You can remove them by yourself."
4300     return 0
4301   else
4302     _err "Remove $Le_Domain failed."
4303     return 1
4304   fi
4305 }
4306
4307 #domain vtype
4308 _deactivate() {
4309   _d_domain="$1"
4310   _d_type="$2"
4311   _initpath
4312
4313   _d_i=0
4314   _d_max_retry=9
4315   while [ "$_d_i" -lt "$_d_max_retry" ]; do
4316     _info "Deactivate: $_d_domain"
4317     _d_i="$(_math $_d_i + 1)"
4318
4319     if ! __get_domain_new_authz "$_d_domain"; then
4320       _err "Can not get domain new authz token."
4321       return 1
4322     fi
4323
4324     authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
4325     _debug "authzUri" "$authzUri"
4326
4327     if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
4328       _err "new-authz error: $response"
4329       return 1
4330     fi
4331
4332     entry="$(printf "%s\n" "$response" | _egrep_o '{"type":"[^"]*","status":"valid","uri"[^}]*')"
4333     _debug entry "$entry"
4334
4335     if [ -z "$entry" ]; then
4336       _info "No more valid entry found."
4337       break
4338     fi
4339
4340     _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
4341     _debug _vtype "$_vtype"
4342     _info "Found $_vtype"
4343
4344     uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
4345     _debug uri "$uri"
4346
4347     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
4348       _info "Skip $_vtype"
4349       continue
4350     fi
4351
4352     _info "Deactivate: $_vtype"
4353
4354     if ! _send_signed_request "$authzUri" "{\"resource\": \"authz\", \"status\":\"deactivated\"}"; then
4355       _err "Can not deactivate $_vtype."
4356       return 1
4357     fi
4358
4359     _info "Deactivate: $_vtype success."
4360
4361   done
4362   _debug "$_d_i"
4363   if [ "$_d_i" -lt "$_d_max_retry" ]; then
4364     _info "Deactivated success!"
4365   else
4366     _err "Deactivate failed."
4367   fi
4368
4369 }
4370
4371 deactivate() {
4372   _d_domain_list="$1"
4373   _d_type="$2"
4374   _initpath
4375   _debug _d_domain_list "$_d_domain_list"
4376   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
4377     _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
4378     return 1
4379   fi
4380   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
4381     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
4382       continue
4383     fi
4384     if ! _deactivate "$_d_dm" "$_d_type"; then
4385       return 1
4386     fi
4387   done
4388 }
4389
4390 # Detect profile file if not specified as environment variable
4391 _detect_profile() {
4392   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
4393     echo "$PROFILE"
4394     return
4395   fi
4396
4397   DETECTED_PROFILE=''
4398   SHELLTYPE="$(basename "/$SHELL")"
4399
4400   if [ "$SHELLTYPE" = "bash" ]; then
4401     if [ -f "$HOME/.bashrc" ]; then
4402       DETECTED_PROFILE="$HOME/.bashrc"
4403     elif [ -f "$HOME/.bash_profile" ]; then
4404       DETECTED_PROFILE="$HOME/.bash_profile"
4405     fi
4406   elif [ "$SHELLTYPE" = "zsh" ]; then
4407     DETECTED_PROFILE="$HOME/.zshrc"
4408   fi
4409
4410   if [ -z "$DETECTED_PROFILE" ]; then
4411     if [ -f "$HOME/.profile" ]; then
4412       DETECTED_PROFILE="$HOME/.profile"
4413     elif [ -f "$HOME/.bashrc" ]; then
4414       DETECTED_PROFILE="$HOME/.bashrc"
4415     elif [ -f "$HOME/.bash_profile" ]; then
4416       DETECTED_PROFILE="$HOME/.bash_profile"
4417     elif [ -f "$HOME/.zshrc" ]; then
4418       DETECTED_PROFILE="$HOME/.zshrc"
4419     fi
4420   fi
4421
4422   if [ ! -z "$DETECTED_PROFILE" ]; then
4423     echo "$DETECTED_PROFILE"
4424   fi
4425 }
4426
4427 _initconf() {
4428   _initpath
4429   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4430     echo "
4431
4432 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
4433 #LOG_LEVEL=1
4434
4435 #AUTO_UPGRADE=\"1\"
4436
4437 #NO_TIMESTAMP=1
4438
4439     " >"$ACCOUNT_CONF_PATH"
4440   fi
4441 }
4442
4443 # nocron
4444 _precheck() {
4445   _nocron="$1"
4446
4447   if ! _exists "curl" && ! _exists "wget"; then
4448     _err "Please install curl or wget first, we need to access http resources."
4449     return 1
4450   fi
4451
4452   if [ -z "$_nocron" ]; then
4453     if ! _exists "crontab"; then
4454       _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
4455       _err "We need to set cron job to renew the certs automatically."
4456       _err "Otherwise, your certs will not be able to be renewed automatically."
4457       if [ -z "$FORCE" ]; then
4458         _err "Please add '--force' and try install again to go without crontab."
4459         _err "./$PROJECT_ENTRY --install --force"
4460         return 1
4461       fi
4462     fi
4463   fi
4464
4465   if ! _exists "$ACME_OPENSSL_BIN"; then
4466     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
4467     _err "We need openssl to generate keys."
4468     return 1
4469   fi
4470
4471   if ! _exists "nc"; then
4472     _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
4473     _err "We use nc for standalone server if you use standalone mode."
4474     _err "If you don't use standalone mode, just ignore this warning."
4475   fi
4476
4477   return 0
4478 }
4479
4480 _setShebang() {
4481   _file="$1"
4482   _shebang="$2"
4483   if [ -z "$_shebang" ]; then
4484     _usage "Usage: file shebang"
4485     return 1
4486   fi
4487   cp "$_file" "$_file.tmp"
4488   echo "$_shebang" >"$_file"
4489   sed -n 2,99999p "$_file.tmp" >>"$_file"
4490   rm -f "$_file.tmp"
4491 }
4492
4493 #confighome
4494 _installalias() {
4495   _c_home="$1"
4496   _initpath
4497
4498   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4499   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
4500     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
4501     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
4502     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
4503   fi
4504
4505   if [ "$_c_home" ]; then
4506     _c_entry=" --config-home '$_c_home'"
4507   fi
4508
4509   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
4510   if [ "$_c_home" ]; then
4511     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
4512   fi
4513   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4514
4515   _profile="$(_detect_profile)"
4516   if [ "$_profile" ]; then
4517     _debug "Found profile: $_profile"
4518     _info "Installing alias to '$_profile'"
4519     _setopt "$_profile" ". \"$_envfile\""
4520     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
4521   else
4522     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
4523   fi
4524
4525   #for csh
4526   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
4527   _csh_profile="$HOME/.cshrc"
4528   if [ -f "$_csh_profile" ]; then
4529     _info "Installing alias to '$_csh_profile'"
4530     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4531     if [ "$_c_home" ]; then
4532       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4533     fi
4534     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4535     _setopt "$_csh_profile" "source \"$_cshfile\""
4536   fi
4537
4538   #for tcsh
4539   _tcsh_profile="$HOME/.tcshrc"
4540   if [ -f "$_tcsh_profile" ]; then
4541     _info "Installing alias to '$_tcsh_profile'"
4542     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4543     if [ "$_c_home" ]; then
4544       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4545     fi
4546     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4547     _setopt "$_tcsh_profile" "source \"$_cshfile\""
4548   fi
4549
4550 }
4551
4552 # nocron confighome
4553 install() {
4554
4555   if [ -z "$LE_WORKING_DIR" ]; then
4556     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
4557   fi
4558
4559   _nocron="$1"
4560   _c_home="$2"
4561   if ! _initpath; then
4562     _err "Install failed."
4563     return 1
4564   fi
4565   if [ "$_nocron" ]; then
4566     _debug "Skip install cron job"
4567   fi
4568
4569   if ! _precheck "$_nocron"; then
4570     _err "Pre-check failed, can not install."
4571     return 1
4572   fi
4573
4574   #convert from le
4575   if [ -d "$HOME/.le" ]; then
4576     for envfile in "le.env" "le.sh.env"; do
4577       if [ -f "$HOME/.le/$envfile" ]; then
4578         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
4579           _upgrading="1"
4580           _info "You are upgrading from le.sh"
4581           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
4582           mv "$HOME/.le" "$LE_WORKING_DIR"
4583           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4584           break
4585         fi
4586       fi
4587     done
4588   fi
4589
4590   _info "Installing to $LE_WORKING_DIR"
4591
4592   if ! mkdir -p "$LE_WORKING_DIR"; then
4593     _err "Can not create working dir: $LE_WORKING_DIR"
4594     return 1
4595   fi
4596
4597   chmod 700 "$LE_WORKING_DIR"
4598
4599   if ! mkdir -p "$LE_CONFIG_HOME"; then
4600     _err "Can not create config dir: $LE_CONFIG_HOME"
4601     return 1
4602   fi
4603
4604   chmod 700 "$LE_CONFIG_HOME"
4605
4606   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
4607
4608   if [ "$?" != "0" ]; then
4609     _err "Install failed, can not copy $PROJECT_ENTRY"
4610     return 1
4611   fi
4612
4613   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
4614
4615   _installalias "$_c_home"
4616
4617   for subf in $_SUB_FOLDERS; do
4618     if [ -d "$subf" ]; then
4619       mkdir -p "$LE_WORKING_DIR/$subf"
4620       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
4621     fi
4622   done
4623
4624   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4625     _initconf
4626   fi
4627
4628   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
4629     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
4630   fi
4631
4632   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
4633     _saveaccountconf "CERT_HOME" "$CERT_HOME"
4634   fi
4635
4636   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
4637     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
4638   fi
4639
4640   if [ -z "$_nocron" ]; then
4641     installcronjob "$_c_home"
4642   fi
4643
4644   if [ -z "$NO_DETECT_SH" ]; then
4645     #Modify shebang
4646     if _exists bash; then
4647       _info "Good, bash is found, so change the shebang to use bash as preferred."
4648       _shebang='#!'"$(env bash -c "command -v bash")"
4649       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
4650       for subf in $_SUB_FOLDERS; do
4651         if [ -d "$LE_WORKING_DIR/$subf" ]; then
4652           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
4653             _setShebang "$_apifile" "$_shebang"
4654           done
4655         fi
4656       done
4657     fi
4658   fi
4659
4660   _info OK
4661 }
4662
4663 # nocron
4664 uninstall() {
4665   _nocron="$1"
4666   if [ -z "$_nocron" ]; then
4667     uninstallcronjob
4668   fi
4669   _initpath
4670
4671   _uninstallalias
4672
4673   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
4674   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
4675
4676 }
4677
4678 _uninstallalias() {
4679   _initpath
4680
4681   _profile="$(_detect_profile)"
4682   if [ "$_profile" ]; then
4683     _info "Uninstalling alias from: '$_profile'"
4684     text="$(cat "$_profile")"
4685     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
4686   fi
4687
4688   _csh_profile="$HOME/.cshrc"
4689   if [ -f "$_csh_profile" ]; then
4690     _info "Uninstalling alias from: '$_csh_profile'"
4691     text="$(cat "$_csh_profile")"
4692     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
4693   fi
4694
4695   _tcsh_profile="$HOME/.tcshrc"
4696   if [ -f "$_tcsh_profile" ]; then
4697     _info "Uninstalling alias from: '$_csh_profile'"
4698     text="$(cat "$_tcsh_profile")"
4699     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
4700   fi
4701
4702 }
4703
4704 cron() {
4705   IN_CRON=1
4706   _initpath
4707   if [ "$AUTO_UPGRADE" = "1" ]; then
4708     export LE_WORKING_DIR
4709     (
4710       if ! upgrade; then
4711         _err "Cron:Upgrade failed!"
4712         return 1
4713       fi
4714     )
4715     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
4716
4717     if [ -t 1 ]; then
4718       __INTERACTIVE="1"
4719     fi
4720
4721     _info "Auto upgraded to: $VER"
4722   fi
4723   renewAll
4724   _ret="$?"
4725   IN_CRON=""
4726   exit $_ret
4727 }
4728
4729 version() {
4730   echo "$PROJECT"
4731   echo "v$VER"
4732 }
4733
4734 showhelp() {
4735   _initpath
4736   version
4737   echo "Usage: $PROJECT_ENTRY  command ...[parameters]....
4738 Commands:
4739   --help, -h               Show this help message.
4740   --version, -v            Show version info.
4741   --install                Install $PROJECT_NAME to your system.
4742   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
4743   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
4744   --issue                  Issue a cert.
4745   --signcsr                Issue a cert from an existing csr.
4746   --deploy                 Deploy the cert to your server.
4747   --install-cert           Install the issued cert to apache/nginx or any other server.
4748   --renew, -r              Renew a cert.
4749   --renew-all              Renew all the certs.
4750   --revoke                 Revoke a cert.
4751   --remove                 Remove the cert from $PROJECT
4752   --list                   List all the certs.
4753   --showcsr                Show the content of a csr.
4754   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
4755   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
4756   --cron                   Run cron job to renew all the certs.
4757   --toPkcs                 Export the certificate and key to a pfx file.
4758   --toPkcs8                Convert to pkcs8 format.
4759   --update-account         Update account info.
4760   --register-account       Register account key.
4761   --create-account-key     Create an account private key, professional use.
4762   --create-domain-key      Create an domain private key, professional use.
4763   --createCSR, -ccsr       Create CSR , professional use.
4764   --deactivate             Deactivate the domain authz, professional use.
4765
4766 Parameters:
4767   --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
4768   --force, -f                       Used to force to install or force to renew a cert immediately.
4769   --staging, --test                 Use staging server, just for test.
4770   --debug                           Output debug info.
4771   --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
4772   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
4773   --standalone                      Use standalone mode.
4774   --stateless                       Use stateless mode, see: $_STATELESS_WIKI
4775   --tls                             Use standalone tls mode.
4776   --apache                          Use apache mode.
4777   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
4778   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
4779
4780   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
4781   --accountkeylength, -ak [2048]    Specifies the account key length.
4782   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
4783   --log-level 1|2                   Specifies the log level, default is 1.
4784   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
4785
4786   These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
4787
4788   --cert-file                       After issue/renew, the cert will be copied to this path.
4789   --key-file                        After issue/renew, the key will be copied to this path.
4790   --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
4791   --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.
4792
4793   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
4794
4795   --accountconf                     Specifies a customized account config file.
4796   --home                            Specifies the home dir for $PROJECT_NAME .
4797   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
4798   --config-home                     Specifies the home dir to save all the configurations.
4799   --useragent                       Specifies the user agent string. it will be saved for future use too.
4800   --accountemail                    Specifies the account email for registering, Only valid for the '--install' command.
4801   --accountkey                      Specifies the account key path, Only valid for the '--install' command.
4802   --days                            Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
4803   --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
4804   --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
4805   --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
4806   --listraw                         Only used for '--list' command, list the certs in raw format.
4807   --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
4808   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
4809   --ca-bundle                       Specifices the path to the CA certificate bundle to verify api server's certificate.
4810   --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
4811   --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
4812   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
4813   --csr                             Specifies the input csr.
4814   --pre-hook                        Command to be run before obtaining any certificates.
4815   --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obain/renew is success or failed.
4816   --renew-hook                      Command to be run once for each successfully renewed certificate.
4817   --deploy-hook                     The hook file to deploy cert
4818   --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
4819   --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
4820   --listen-v4                       Force standalone/tls server to listen at ipv4.
4821   --listen-v6                       Force standalone/tls server to listen at ipv6.
4822   --openssl-bin                     Specifies a custom openssl bin location.
4823   --use-wget                        Force to use wget, if you have both curl and wget installed.
4824   "
4825 }
4826
4827 # nocron
4828 _installOnline() {
4829   _info "Installing from online archive."
4830   _nocron="$1"
4831   if [ ! "$BRANCH" ]; then
4832     BRANCH="master"
4833   fi
4834
4835   target="$PROJECT/archive/$BRANCH.tar.gz"
4836   _info "Downloading $target"
4837   localname="$BRANCH.tar.gz"
4838   if ! _get "$target" >$localname; then
4839     _err "Download error."
4840     return 1
4841   fi
4842   (
4843     _info "Extracting $localname"
4844     if ! (tar xzf $localname || gtar xzf $localname); then
4845       _err "Extraction error."
4846       exit 1
4847     fi
4848
4849     cd "$PROJECT_NAME-$BRANCH"
4850     chmod +x $PROJECT_ENTRY
4851     if ./$PROJECT_ENTRY install "$_nocron"; then
4852       _info "Install success!"
4853     fi
4854
4855     cd ..
4856
4857     rm -rf "$PROJECT_NAME-$BRANCH"
4858     rm -f "$localname"
4859   )
4860 }
4861
4862 upgrade() {
4863   if (
4864     _initpath
4865     export LE_WORKING_DIR
4866     cd "$LE_WORKING_DIR"
4867     _installOnline "nocron"
4868   ); then
4869     _info "Upgrade success!"
4870     exit 0
4871   else
4872     _err "Upgrade failed!"
4873     exit 1
4874   fi
4875 }
4876
4877 _processAccountConf() {
4878   if [ "$_useragent" ]; then
4879     _saveaccountconf "USER_AGENT" "$_useragent"
4880   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
4881     _saveaccountconf "USER_AGENT" "$USER_AGENT"
4882   fi
4883
4884   if [ "$_accountemail" ]; then
4885     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
4886   elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
4887     _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
4888   fi
4889
4890   if [ "$_openssl_bin" ]; then
4891     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
4892   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
4893     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
4894   fi
4895
4896   if [ "$_auto_upgrade" ]; then
4897     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
4898   elif [ "$AUTO_UPGRADE" ]; then
4899     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
4900   fi
4901
4902   if [ "$_use_wget" ]; then
4903     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
4904   elif [ "$ACME_USE_WGET" ]; then
4905     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
4906   fi
4907
4908 }
4909
4910 _process() {
4911   _CMD=""
4912   _domain=""
4913   _altdomains="$NO_VALUE"
4914   _webroot=""
4915   _keylength=""
4916   _accountkeylength=""
4917   _cert_file=""
4918   _key_file=""
4919   _ca_file=""
4920   _fullchain_file=""
4921   _reloadcmd=""
4922   _password=""
4923   _accountconf=""
4924   _useragent=""
4925   _accountemail=""
4926   _accountkey=""
4927   _certhome=""
4928   _confighome=""
4929   _httpport=""
4930   _tlsport=""
4931   _dnssleep=""
4932   _listraw=""
4933   _stopRenewOnError=""
4934   #_insecure=""
4935   _ca_bundle=""
4936   _ca_path=""
4937   _nocron=""
4938   _ecc=""
4939   _csr=""
4940   _pre_hook=""
4941   _post_hook=""
4942   _renew_hook=""
4943   _deploy_hook=""
4944   _logfile=""
4945   _log=""
4946   _local_address=""
4947   _log_level=""
4948   _auto_upgrade=""
4949   _listen_v4=""
4950   _listen_v6=""
4951   _openssl_bin=""
4952   _syslog=""
4953   _use_wget=""
4954   while [ ${#} -gt 0 ]; do
4955     case "${1}" in
4956
4957       --help | -h)
4958         showhelp
4959         return
4960         ;;
4961       --version | -v)
4962         version
4963         return
4964         ;;
4965       --install)
4966         _CMD="install"
4967         ;;
4968       --uninstall)
4969         _CMD="uninstall"
4970         ;;
4971       --upgrade)
4972         _CMD="upgrade"
4973         ;;
4974       --issue)
4975         _CMD="issue"
4976         ;;
4977       --deploy)
4978         _CMD="deploy"
4979         ;;
4980       --signcsr)
4981         _CMD="signcsr"
4982         ;;
4983       --showcsr)
4984         _CMD="showcsr"
4985         ;;
4986       --installcert | -i | --install-cert)
4987         _CMD="installcert"
4988         ;;
4989       --renew | -r)
4990         _CMD="renew"
4991         ;;
4992       --renewAll | --renewall | --renew-all)
4993         _CMD="renewAll"
4994         ;;
4995       --revoke)
4996         _CMD="revoke"
4997         ;;
4998       --remove)
4999         _CMD="remove"
5000         ;;
5001       --list)
5002         _CMD="list"
5003         ;;
5004       --installcronjob | --install-cronjob)
5005         _CMD="installcronjob"
5006         ;;
5007       --uninstallcronjob | --uninstall-cronjob)
5008         _CMD="uninstallcronjob"
5009         ;;
5010       --cron)
5011         _CMD="cron"
5012         ;;
5013       --toPkcs)
5014         _CMD="toPkcs"
5015         ;;
5016       --toPkcs8)
5017         _CMD="toPkcs8"
5018         ;;
5019       --createAccountKey | --createaccountkey | -cak | --create-account-key)
5020         _CMD="createAccountKey"
5021         ;;
5022       --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
5023         _CMD="createDomainKey"
5024         ;;
5025       --createCSR | --createcsr | -ccr)
5026         _CMD="createCSR"
5027         ;;
5028       --deactivate)
5029         _CMD="deactivate"
5030         ;;
5031       --updateaccount | --update-account)
5032         _CMD="updateaccount"
5033         ;;
5034       --registeraccount | --register-account)
5035         _CMD="registeraccount"
5036         ;;
5037       --domain | -d)
5038         _dvalue="$2"
5039
5040         if [ "$_dvalue" ]; then
5041           if _startswith "$_dvalue" "-"; then
5042             _err "'$_dvalue' is not a valid domain for parameter '$1'"
5043             return 1
5044           fi
5045           if _is_idn "$_dvalue" && ! _exists idn; then
5046             _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
5047             return 1
5048           fi
5049
5050           if [ -z "$_domain" ]; then
5051             _domain="$_dvalue"
5052           else
5053             if [ "$_altdomains" = "$NO_VALUE" ]; then
5054               _altdomains="$_dvalue"
5055             else
5056               _altdomains="$_altdomains,$_dvalue"
5057             fi
5058           fi
5059         fi
5060
5061         shift
5062         ;;
5063
5064       --force | -f)
5065         FORCE="1"
5066         ;;
5067       --staging | --test)
5068         STAGE="1"
5069         ;;
5070       --debug)
5071         if [ -z "$2" ] || _startswith "$2" "-"; then
5072           DEBUG="$DEBUG_LEVEL_DEFAULT"
5073         else
5074           DEBUG="$2"
5075           shift
5076         fi
5077         ;;
5078       --output-insecure)
5079         export OUTPUT_INSECURE=1
5080         ;;
5081       --webroot | -w)
5082         wvalue="$2"
5083         if [ -z "$_webroot" ]; then
5084           _webroot="$wvalue"
5085         else
5086           _webroot="$_webroot,$wvalue"
5087         fi
5088         shift
5089         ;;
5090       --standalone)
5091         wvalue="$NO_VALUE"
5092         if [ -z "$_webroot" ]; then
5093           _webroot="$wvalue"
5094         else
5095           _webroot="$_webroot,$wvalue"
5096         fi
5097         ;;
5098       --stateless)
5099         wvalue="$MODE_STATELESS"
5100         if [ -z "$_webroot" ]; then
5101           _webroot="$wvalue"
5102         else
5103           _webroot="$_webroot,$wvalue"
5104         fi
5105         ;;
5106       --local-address)
5107         lvalue="$2"
5108         _local_address="$_local_address$lvalue,"
5109         shift
5110         ;;
5111       --apache)
5112         wvalue="apache"
5113         if [ -z "$_webroot" ]; then
5114           _webroot="$wvalue"
5115         else
5116           _webroot="$_webroot,$wvalue"
5117         fi
5118         ;;
5119       --nginx)
5120         wvalue="$NGINX"
5121         if [ -z "$_webroot" ]; then
5122           _webroot="$wvalue"
5123         else
5124           _webroot="$_webroot,$wvalue"
5125         fi
5126         ;;
5127       --tls)
5128         wvalue="$W_TLS"
5129         if [ -z "$_webroot" ]; then
5130           _webroot="$wvalue"
5131         else
5132           _webroot="$_webroot,$wvalue"
5133         fi
5134         ;;
5135       --dns)
5136         wvalue="dns"
5137         if ! _startswith "$2" "-"; then
5138           wvalue="$2"
5139           shift
5140         fi
5141         if [ -z "$_webroot" ]; then
5142           _webroot="$wvalue"
5143         else
5144           _webroot="$_webroot,$wvalue"
5145         fi
5146         ;;
5147       --dnssleep)
5148         _dnssleep="$2"
5149         Le_DNSSleep="$_dnssleep"
5150         shift
5151         ;;
5152
5153       --keylength | -k)
5154         _keylength="$2"
5155         shift
5156         ;;
5157       --accountkeylength | -ak)
5158         _accountkeylength="$2"
5159         shift
5160         ;;
5161
5162       --cert-file | --certpath)
5163         _cert_file="$2"
5164         shift
5165         ;;
5166       --key-file | --keypath)
5167         _key_file="$2"
5168         shift
5169         ;;
5170       --ca-file | --capath)
5171         _ca_file="$2"
5172         shift
5173         ;;
5174       --fullchain-file | --fullchainpath)
5175         _fullchain_file="$2"
5176         shift
5177         ;;
5178       --reloadcmd | --reloadCmd)
5179         _reloadcmd="$2"
5180         shift
5181         ;;
5182       --password)
5183         _password="$2"
5184         shift
5185         ;;
5186       --accountconf)
5187         _accountconf="$2"
5188         ACCOUNT_CONF_PATH="$_accountconf"
5189         shift
5190         ;;
5191       --home)
5192         LE_WORKING_DIR="$2"
5193         shift
5194         ;;
5195       --certhome | --cert-home)
5196         _certhome="$2"
5197         CERT_HOME="$_certhome"
5198         shift
5199         ;;
5200       --config-home)
5201         _confighome="$2"
5202         LE_CONFIG_HOME="$_confighome"
5203         shift
5204         ;;
5205       --useragent)
5206         _useragent="$2"
5207         USER_AGENT="$_useragent"
5208         shift
5209         ;;
5210       --accountemail)
5211         _accountemail="$2"
5212         ACCOUNT_EMAIL="$_accountemail"
5213         shift
5214         ;;
5215       --accountkey)
5216         _accountkey="$2"
5217         ACCOUNT_KEY_PATH="$_accountkey"
5218         shift
5219         ;;
5220       --days)
5221         _days="$2"
5222         Le_RenewalDays="$_days"
5223         shift
5224         ;;
5225       --httpport)
5226         _httpport="$2"
5227         Le_HTTPPort="$_httpport"
5228         shift
5229         ;;
5230       --tlsport)
5231         _tlsport="$2"
5232         Le_TLSPort="$_tlsport"
5233         shift
5234         ;;
5235
5236       --listraw)
5237         _listraw="raw"
5238         ;;
5239       --stopRenewOnError | --stoprenewonerror | -se)
5240         _stopRenewOnError="1"
5241         ;;
5242       --insecure)
5243         #_insecure="1"
5244         HTTPS_INSECURE="1"
5245         ;;
5246       --ca-bundle)
5247         _ca_bundle="$(_readlink -f "$2")"
5248         CA_BUNDLE="$_ca_bundle"
5249         shift
5250         ;;
5251       --ca-path)
5252         _ca_path="$2"
5253         CA_PATH="$_ca_path"
5254         shift
5255         ;;
5256       --nocron)
5257         _nocron="1"
5258         ;;
5259       --ecc)
5260         _ecc="isEcc"
5261         ;;
5262       --csr)
5263         _csr="$2"
5264         shift
5265         ;;
5266       --pre-hook)
5267         _pre_hook="$2"
5268         shift
5269         ;;
5270       --post-hook)
5271         _post_hook="$2"
5272         shift
5273         ;;
5274       --renew-hook)
5275         _renew_hook="$2"
5276         shift
5277         ;;
5278       --deploy-hook)
5279         if [ -z "$2" ] || _startswith "$2" "-"; then
5280           _usage "Please specify a value for '--deploy-hook'"
5281           return 1
5282         fi
5283         _deploy_hook="$_deploy_hook$2,"
5284         shift
5285         ;;
5286       --ocsp-must-staple | --ocsp)
5287         Le_OCSP_Staple="1"
5288         ;;
5289       --log | --logfile)
5290         _log="1"
5291         _logfile="$2"
5292         if _startswith "$_logfile" '-'; then
5293           _logfile=""
5294         else
5295           shift
5296         fi
5297         LOG_FILE="$_logfile"
5298         if [ -z "$LOG_LEVEL" ]; then
5299           LOG_LEVEL="$DEFAULT_LOG_LEVEL"
5300         fi
5301         ;;
5302       --log-level)
5303         _log_level="$2"
5304         LOG_LEVEL="$_log_level"
5305         shift
5306         ;;
5307       --syslog)
5308         if ! _startswith "$2" '-'; then
5309           _syslog="$2"
5310           shift
5311         fi
5312         if [ -z "$_syslog" ]; then
5313           _syslog="$SYSLOG_LEVEL_DEFAULT"
5314         fi
5315         ;;
5316       --auto-upgrade)
5317         _auto_upgrade="$2"
5318         if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
5319           _auto_upgrade="1"
5320         else
5321           shift
5322         fi
5323         AUTO_UPGRADE="$_auto_upgrade"
5324         ;;
5325       --listen-v4)
5326         _listen_v4="1"
5327         Le_Listen_V4="$_listen_v4"
5328         ;;
5329       --listen-v6)
5330         _listen_v6="1"
5331         Le_Listen_V6="$_listen_v6"
5332         ;;
5333       --openssl-bin)
5334         _openssl_bin="$2"
5335         ACME_OPENSSL_BIN="$_openssl_bin"
5336         shift
5337         ;;
5338       --use-wget)
5339         _use_wget="1"
5340         ACME_USE_WGET="1"
5341         ;;
5342       *)
5343         _err "Unknown parameter : $1"
5344         return 1
5345         ;;
5346     esac
5347
5348     shift 1
5349   done
5350
5351   if [ "${_CMD}" != "install" ]; then
5352     __initHome
5353     if [ "$_log" ]; then
5354       if [ -z "$_logfile" ]; then
5355         _logfile="$DEFAULT_LOG_FILE"
5356       fi
5357     fi
5358     if [ "$_logfile" ]; then
5359       _saveaccountconf "LOG_FILE" "$_logfile"
5360       LOG_FILE="$_logfile"
5361     fi
5362
5363     if [ "$_log_level" ]; then
5364       _saveaccountconf "LOG_LEVEL" "$_log_level"
5365       LOG_LEVEL="$_log_level"
5366     fi
5367
5368     if [ "$_syslog" ]; then
5369       if _exists logger; then
5370         if [ "$_syslog" = "0" ]; then
5371           _clearaccountconf "SYS_LOG"
5372         else
5373           _saveaccountconf "SYS_LOG" "$_syslog"
5374         fi
5375         SYS_LOG="$_syslog"
5376       else
5377         _err "The 'logger' command is not found, can not enable syslog."
5378         _clearaccountconf "SYS_LOG"
5379         SYS_LOG=""
5380       fi
5381     fi
5382
5383     _processAccountConf
5384   fi
5385
5386   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
5387
5388   if [ "$DEBUG" ]; then
5389     version
5390   fi
5391
5392   case "${_CMD}" in
5393     install) install "$_nocron" "$_confighome" ;;
5394     uninstall) uninstall "$_nocron" ;;
5395     upgrade) upgrade ;;
5396     issue)
5397       issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address"
5398       ;;
5399     deploy)
5400       deploy "$_domain" "$_deploy_hook" "$_ecc"
5401       ;;
5402     signcsr)
5403       signcsr "$_csr" "$_webroot"
5404       ;;
5405     showcsr)
5406       showcsr "$_csr" "$_domain"
5407       ;;
5408     installcert)
5409       installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
5410       ;;
5411     renew)
5412       renew "$_domain" "$_ecc"
5413       ;;
5414     renewAll)
5415       renewAll "$_stopRenewOnError"
5416       ;;
5417     revoke)
5418       revoke "$_domain" "$_ecc"
5419       ;;
5420     remove)
5421       remove "$_domain" "$_ecc"
5422       ;;
5423     deactivate)
5424       deactivate "$_domain,$_altdomains"
5425       ;;
5426     registeraccount)
5427       registeraccount "$_accountkeylength"
5428       ;;
5429     updateaccount)
5430       updateaccount
5431       ;;
5432     list)
5433       list "$_listraw"
5434       ;;
5435     installcronjob) installcronjob "$_confighome" ;;
5436     uninstallcronjob) uninstallcronjob ;;
5437     cron) cron ;;
5438     toPkcs)
5439       toPkcs "$_domain" "$_password" "$_ecc"
5440       ;;
5441     toPkcs8)
5442       toPkcs8 "$_domain" "$_ecc"
5443       ;;
5444     createAccountKey)
5445       createAccountKey "$_accountkeylength"
5446       ;;
5447     createDomainKey)
5448       createDomainKey "$_domain" "$_keylength"
5449       ;;
5450     createCSR)
5451       createCSR "$_domain" "$_altdomains" "$_ecc"
5452       ;;
5453
5454     *)
5455       if [ "$_CMD" ]; then
5456         _err "Invalid command: $_CMD"
5457       fi
5458       showhelp
5459       return 1
5460       ;;
5461   esac
5462   _ret="$?"
5463   if [ "$_ret" != "0" ]; then
5464     return $_ret
5465   fi
5466
5467   if [ "${_CMD}" = "install" ]; then
5468     if [ "$_log" ]; then
5469       if [ -z "$LOG_FILE" ]; then
5470         LOG_FILE="$DEFAULT_LOG_FILE"
5471       fi
5472       _saveaccountconf "LOG_FILE" "$LOG_FILE"
5473     fi
5474
5475     if [ "$_log_level" ]; then
5476       _saveaccountconf "LOG_LEVEL" "$_log_level"
5477     fi
5478
5479     if [ "$_syslog" ]; then
5480       if _exists logger; then
5481         if [ "$_syslog" = "0" ]; then
5482           _clearaccountconf "SYS_LOG"
5483         else
5484           _saveaccountconf "SYS_LOG" "$_syslog"
5485         fi
5486       else
5487         _err "The 'logger' command is not found, can not enable syslog."
5488         _clearaccountconf "SYS_LOG"
5489         SYS_LOG=""
5490       fi
5491     fi
5492
5493     _processAccountConf
5494   fi
5495
5496 }
5497
5498 if [ "$INSTALLONLINE" ]; then
5499   INSTALLONLINE=""
5500   _installOnline
5501   exit
5502 fi
5503
5504 main() {
5505   [ -z "$1" ] && showhelp && return
5506   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
5507 }
5508
5509 main "$@"