acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.7.6
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12 _SCRIPT_="$0"
  13
  14 _SUB_FOLDERS="dnsapi deploy"
  15
  16 LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
  17 LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
  18
  19 LETSENCRYPT_CA_V2="https://acme-v02.api.letsencrypt.org/directory"
  20 LETSENCRYPT_STAGING_CA_V2="https://acme-staging-v02.api.letsencrypt.org/directory"
  21
  22 DEFAULT_CA=$LETSENCRYPT_CA_V1
  23 DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V1
  24
  25 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  26 DEFAULT_ACCOUNT_EMAIL=""
  27
  28 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  29 DEFAULT_DOMAIN_KEY_LENGTH=2048
  30
  31 DEFAULT_OPENSSL_BIN="openssl"
  32
  33 _OLD_CA_HOST="https://acme-v01.api.letsencrypt.org"
  34 _OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
  35
  36 VTYPE_HTTP="http-01"
  37 VTYPE_DNS="dns-01"
  38 VTYPE_TLS="tls-sni-01"
  39 VTYPE_TLS2="tls-sni-02"
  40
  41 LOCAL_ANY_ADDRESS="0.0.0.0"
  42
  43 MAX_RENEW=60
  44
  45 DEFAULT_DNS_SLEEP=120
  46
  47 NO_VALUE="no"
  48
  49 W_TLS="tls"
  50
  51 MODE_STATELESS="stateless"
  52
  53 STATE_VERIFIED="verified_ok"
  54
  55 NGINX="nginx:"
  56 NGINX_START="#ACME_NGINX_START"
  57 NGINX_END="#ACME_NGINX_END"
  58
  59 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  60 END_CSR="-----END CERTIFICATE REQUEST-----"
  61
  62 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  63 END_CERT="-----END CERTIFICATE-----"
  64
  65 RENEW_SKIP=2
  66
  67 ECC_SEP="_"
  68 ECC_SUFFIX="${ECC_SEP}ecc"
  69
  70 LOG_LEVEL_1=1
  71 LOG_LEVEL_2=2
  72 LOG_LEVEL_3=3
  73 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  74
  75 DEBUG_LEVEL_1=1
  76 DEBUG_LEVEL_2=2
  77 DEBUG_LEVEL_3=3
  78 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  79 DEBUG_LEVEL_NONE=0
  80
  81 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  82
  83 SYSLOG_ERROR="user.error"
  84 SYSLOG_INFO="user.info"
  85 SYSLOG_DEBUG="user.debug"
  86
  87 #error
  88 SYSLOG_LEVEL_ERROR=3
  89 #info
  90 SYSLOG_LEVEL_INFO=6
  91 #debug
  92 SYSLOG_LEVEL_DEBUG=7
  93 #debug2
  94 SYSLOG_LEVEL_DEBUG_2=8
  95 #debug3
  96 SYSLOG_LEVEL_DEBUG_3=9
  97
  98 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  99 #none
 100 SYSLOG_LEVEL_NONE=0
 101
 102 _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
 103
 104 _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
 105
 106 _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
 107
 108 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 109
 110 _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
 111
 112 __INTERACTIVE=""
 113 if [ -t 1 ]; then
 114   __INTERACTIVE="1"
 115 fi
 116
 117 __green() {
 118   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 119     printf '\033[1;31;32m'
 120   fi
 121   printf -- "%b" "$1"
 122   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 123     printf '\033[0m'
 124   fi
 125 }
 126
 127 __red() {
 128   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 129     printf '\033[1;31;40m'
 130   fi
 131   printf -- "%b" "$1"
 132   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 133     printf '\033[0m'
 134   fi
 135 }
 136
 137 _printargs() {
 138   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 139     printf -- "%s" "[$(date)] "
 140   fi
 141   if [ -z "$2" ]; then
 142     printf -- "%s" "$1"
 143   else
 144     printf -- "%s" "$1='$2'"
 145   fi
 146   printf "\n"
 147 }
 148
 149 _dlg_versions() {
 150   echo "Diagnosis versions: "
 151   echo "openssl:$ACME_OPENSSL_BIN"
 152   if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
 153     ${ACME_OPENSSL_BIN:-openssl} version 2>&1
 154   else
 155     echo "$ACME_OPENSSL_BIN doesn't exists."
 156   fi
 157
 158   echo "apache:"
 159   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 160     $_APACHECTL -V 2>&1
 161   else
 162     echo "apache doesn't exists."
 163   fi
 164
 165   echo "nginx:"
 166   if _exists "nginx"; then
 167     nginx -V 2>&1
 168   else
 169     echo "nginx doesn't exists."
 170   fi
 171
 172   echo "socat:"
 173   if _exists "socat"; then
 174     socat -h 2>&1
 175   else
 176     _debug "socat doesn't exists."
 177   fi
 178 }
 179
 180 #class
 181 _syslog() {
 182   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 183     return
 184   fi
 185   _logclass="$1"
 186   shift
 187   if [ -z "$__logger_i" ]; then
 188     if _contains "$(logger --help 2>&1)" "-i"; then
 189       __logger_i="logger -i"
 190     else
 191       __logger_i="logger"
 192     fi
 193   fi
 194   $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 195 }
 196
 197 _log() {
 198   [ -z "$LOG_FILE" ] && return
 199   _printargs "$@" >>"$LOG_FILE"
 200 }
 201
 202 _info() {
 203   _log "$@"
 204   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 205     _syslog "$SYSLOG_INFO" "$@"
 206   fi
 207   _printargs "$@"
 208 }
 209
 210 _err() {
 211   _syslog "$SYSLOG_ERROR" "$@"
 212   _log "$@"
 213   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 214     printf -- "%s" "[$(date)] " >&2
 215   fi
 216   if [ -z "$2" ]; then
 217     __red "$1" >&2
 218   else
 219     __red "$1='$2'" >&2
 220   fi
 221   printf "\n" >&2
 222   return 1
 223 }
 224
 225 _usage() {
 226   __red "$@" >&2
 227   printf "\n" >&2
 228 }
 229
 230 _debug() {
 231   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 232     _log "$@"
 233   fi
 234   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 235     _syslog "$SYSLOG_DEBUG" "$@"
 236   fi
 237   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 238     _printargs "$@" >&2
 239   fi
 240 }
 241
 242 #output the sensitive messages
 243 _secure_debug() {
 244   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 245     if [ "$OUTPUT_INSECURE" = "1" ]; then
 246       _log "$@"
 247     else
 248       _log "$1" "$HIDDEN_VALUE"
 249     fi
 250   fi
 251   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 252     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 253   fi
 254   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 255     if [ "$OUTPUT_INSECURE" = "1" ]; then
 256       _printargs "$@" >&2
 257     else
 258       _printargs "$1" "$HIDDEN_VALUE" >&2
 259     fi
 260   fi
 261 }
 262
 263 _debug2() {
 264   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 265     _log "$@"
 266   fi
 267   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 268     _syslog "$SYSLOG_DEBUG" "$@"
 269   fi
 270   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 271     _printargs "$@" >&2
 272   fi
 273 }
 274
 275 _secure_debug2() {
 276   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 277     if [ "$OUTPUT_INSECURE" = "1" ]; then
 278       _log "$@"
 279     else
 280       _log "$1" "$HIDDEN_VALUE"
 281     fi
 282   fi
 283   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 284     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 285   fi
 286   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 287     if [ "$OUTPUT_INSECURE" = "1" ]; then
 288       _printargs "$@" >&2
 289     else
 290       _printargs "$1" "$HIDDEN_VALUE" >&2
 291     fi
 292   fi
 293 }
 294
 295 _debug3() {
 296   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 297     _log "$@"
 298   fi
 299   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 300     _syslog "$SYSLOG_DEBUG" "$@"
 301   fi
 302   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 303     _printargs "$@" >&2
 304   fi
 305 }
 306
 307 _secure_debug3() {
 308   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 309     if [ "$OUTPUT_INSECURE" = "1" ]; then
 310       _log "$@"
 311     else
 312       _log "$1" "$HIDDEN_VALUE"
 313     fi
 314   fi
 315   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 316     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 317   fi
 318   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 319     if [ "$OUTPUT_INSECURE" = "1" ]; then
 320       _printargs "$@" >&2
 321     else
 322       _printargs "$1" "$HIDDEN_VALUE" >&2
 323     fi
 324   fi
 325 }
 326
 327 _upper_case() {
 328   # shellcheck disable=SC2018,SC2019
 329   tr 'a-z' 'A-Z'
 330 }
 331
 332 _lower_case() {
 333   # shellcheck disable=SC2018,SC2019
 334   tr 'A-Z' 'a-z'
 335 }
 336
 337 _startswith() {
 338   _str="$1"
 339   _sub="$2"
 340   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 341 }
 342
 343 _endswith() {
 344   _str="$1"
 345   _sub="$2"
 346   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 347 }
 348
 349 _contains() {
 350   _str="$1"
 351   _sub="$2"
 352   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 353 }
 354
 355 _hasfield() {
 356   _str="$1"
 357   _field="$2"
 358   _sep="$3"
 359   if [ -z "$_field" ]; then
 360     _usage "Usage: str field  [sep]"
 361     return 1
 362   fi
 363
 364   if [ -z "$_sep" ]; then
 365     _sep=","
 366   fi
 367
 368   for f in $(echo "$_str" | tr "$_sep" ' '); do
 369     if [ "$f" = "$_field" ]; then
 370       _debug2 "'$_str' contains '$_field'"
 371       return 0 #contains ok
 372     fi
 373   done
 374   _debug2 "'$_str' does not contain '$_field'"
 375   return 1 #not contains
 376 }
 377
 378 # str index [sep]
 379 _getfield() {
 380   _str="$1"
 381   _findex="$2"
 382   _sep="$3"
 383
 384   if [ -z "$_findex" ]; then
 385     _usage "Usage: str field  [sep]"
 386     return 1
 387   fi
 388
 389   if [ -z "$_sep" ]; then
 390     _sep=","
 391   fi
 392
 393   _ffi="$_findex"
 394   while [ "$_ffi" -gt "0" ]; do
 395     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 396     if [ "$_fv" ]; then
 397       printf -- "%s" "$_fv"
 398       return 0
 399     fi
 400     _ffi="$(_math "$_ffi" - 1)"
 401   done
 402
 403   printf -- "%s" "$_str"
 404
 405 }
 406
 407 _exists() {
 408   cmd="$1"
 409   if [ -z "$cmd" ]; then
 410     _usage "Usage: _exists cmd"
 411     return 1
 412   fi
 413
 414   if eval type type >/dev/null 2>&1; then
 415     eval type "$cmd" >/dev/null 2>&1
 416   elif command >/dev/null 2>&1; then
 417     command -v "$cmd" >/dev/null 2>&1
 418   else
 419     which "$cmd" >/dev/null 2>&1
 420   fi
 421   ret="$?"
 422   _debug3 "$cmd exists=$ret"
 423   return $ret
 424 }
 425
 426 #a + b
 427 _math() {
 428   _m_opts="$@"
 429   printf "%s" "$(($_m_opts))"
 430 }
 431
 432 _h_char_2_dec() {
 433   _ch=$1
 434   case "${_ch}" in
 435     a | A)
 436       printf "10"
 437       ;;
 438     b | B)
 439       printf "11"
 440       ;;
 441     c | C)
 442       printf "12"
 443       ;;
 444     d | D)
 445       printf "13"
 446       ;;
 447     e | E)
 448       printf "14"
 449       ;;
 450     f | F)
 451       printf "15"
 452       ;;
 453     *)
 454       printf "%s" "$_ch"
 455       ;;
 456   esac
 457
 458 }
 459
 460 _URGLY_PRINTF=""
 461 if [ "$(printf '\x41')" != 'A' ]; then
 462   _URGLY_PRINTF=1
 463 fi
 464
 465 _ESCAPE_XARGS=""
 466 if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
 467   _ESCAPE_XARGS=1
 468 fi
 469
 470 _h2b() {
 471   if _exists xxd && xxd -r -p 2>/dev/null; then
 472     return
 473   fi
 474
 475   hex=$(cat)
 476   ic=""
 477   jc=""
 478   _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
 479   if [ -z "$_URGLY_PRINTF" ]; then
 480     if [ "$_ESCAPE_XARGS" ] && _exists xargs; then
 481       _debug2 "xargs"
 482       echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
 483     else
 484       for h in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
 485         if [ -z "$h" ]; then
 486           break
 487         fi
 488         printf "\x$h%s"
 489       done
 490     fi
 491   else
 492     for c in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
 493       if [ -z "$ic" ]; then
 494         ic=$c
 495         continue
 496       fi
 497       jc=$c
 498       ic="$(_h_char_2_dec "$ic")"
 499       jc="$(_h_char_2_dec "$jc")"
 500       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 501       ic=""
 502       jc=""
 503     done
 504   fi
 505
 506 }
 507
 508 _is_solaris() {
 509   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 510 }
 511
 512 #_ascii_hex str
 513 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 514 _ascii_hex() {
 515   _debug2 "Using _ascii_hex"
 516   _str="$1"
 517   _str_len=${#_str}
 518   _h_i=1
 519   while [ "$_h_i" -le "$_str_len" ]; do
 520     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 521     printf " %02x" "'$_str_c"
 522     _h_i="$(_math "$_h_i" + 1)"
 523   done
 524 }
 525
 526 #stdin  output hexstr splited by one space
 527 #input:"abc"
 528 #output: " 61 62 63"
 529 _hex_dump() {
 530   if _exists od; then
 531     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 532   elif _exists hexdump; then
 533     _debug3 "using hexdump"
 534     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 535   elif _exists xxd; then
 536     _debug3 "using xxd"
 537     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 538   else
 539     _debug3 "using _ascii_hex"
 540     str=$(cat)
 541     _ascii_hex "$str"
 542   fi
 543 }
 544
 545 #url encode, no-preserved chars
 546 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 547 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 548
 549 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 550 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 551
 552 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 553 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 554
 555 #stdin stdout
 556 _url_encode() {
 557   _hex_str=$(_hex_dump)
 558   _debug3 "_url_encode"
 559   _debug3 "_hex_str" "$_hex_str"
 560   for _hex_code in $_hex_str; do
 561     #upper case
 562     case "${_hex_code}" in
 563       "41")
 564         printf "%s" "A"
 565         ;;
 566       "42")
 567         printf "%s" "B"
 568         ;;
 569       "43")
 570         printf "%s" "C"
 571         ;;
 572       "44")
 573         printf "%s" "D"
 574         ;;
 575       "45")
 576         printf "%s" "E"
 577         ;;
 578       "46")
 579         printf "%s" "F"
 580         ;;
 581       "47")
 582         printf "%s" "G"
 583         ;;
 584       "48")
 585         printf "%s" "H"
 586         ;;
 587       "49")
 588         printf "%s" "I"
 589         ;;
 590       "4a")
 591         printf "%s" "J"
 592         ;;
 593       "4b")
 594         printf "%s" "K"
 595         ;;
 596       "4c")
 597         printf "%s" "L"
 598         ;;
 599       "4d")
 600         printf "%s" "M"
 601         ;;
 602       "4e")
 603         printf "%s" "N"
 604         ;;
 605       "4f")
 606         printf "%s" "O"
 607         ;;
 608       "50")
 609         printf "%s" "P"
 610         ;;
 611       "51")
 612         printf "%s" "Q"
 613         ;;
 614       "52")
 615         printf "%s" "R"
 616         ;;
 617       "53")
 618         printf "%s" "S"
 619         ;;
 620       "54")
 621         printf "%s" "T"
 622         ;;
 623       "55")
 624         printf "%s" "U"
 625         ;;
 626       "56")
 627         printf "%s" "V"
 628         ;;
 629       "57")
 630         printf "%s" "W"
 631         ;;
 632       "58")
 633         printf "%s" "X"
 634         ;;
 635       "59")
 636         printf "%s" "Y"
 637         ;;
 638       "5a")
 639         printf "%s" "Z"
 640         ;;
 641
 642       #lower case
 643       "61")
 644         printf "%s" "a"
 645         ;;
 646       "62")
 647         printf "%s" "b"
 648         ;;
 649       "63")
 650         printf "%s" "c"
 651         ;;
 652       "64")
 653         printf "%s" "d"
 654         ;;
 655       "65")
 656         printf "%s" "e"
 657         ;;
 658       "66")
 659         printf "%s" "f"
 660         ;;
 661       "67")
 662         printf "%s" "g"
 663         ;;
 664       "68")
 665         printf "%s" "h"
 666         ;;
 667       "69")
 668         printf "%s" "i"
 669         ;;
 670       "6a")
 671         printf "%s" "j"
 672         ;;
 673       "6b")
 674         printf "%s" "k"
 675         ;;
 676       "6c")
 677         printf "%s" "l"
 678         ;;
 679       "6d")
 680         printf "%s" "m"
 681         ;;
 682       "6e")
 683         printf "%s" "n"
 684         ;;
 685       "6f")
 686         printf "%s" "o"
 687         ;;
 688       "70")
 689         printf "%s" "p"
 690         ;;
 691       "71")
 692         printf "%s" "q"
 693         ;;
 694       "72")
 695         printf "%s" "r"
 696         ;;
 697       "73")
 698         printf "%s" "s"
 699         ;;
 700       "74")
 701         printf "%s" "t"
 702         ;;
 703       "75")
 704         printf "%s" "u"
 705         ;;
 706       "76")
 707         printf "%s" "v"
 708         ;;
 709       "77")
 710         printf "%s" "w"
 711         ;;
 712       "78")
 713         printf "%s" "x"
 714         ;;
 715       "79")
 716         printf "%s" "y"
 717         ;;
 718       "7a")
 719         printf "%s" "z"
 720         ;;
 721       #numbers
 722       "30")
 723         printf "%s" "0"
 724         ;;
 725       "31")
 726         printf "%s" "1"
 727         ;;
 728       "32")
 729         printf "%s" "2"
 730         ;;
 731       "33")
 732         printf "%s" "3"
 733         ;;
 734       "34")
 735         printf "%s" "4"
 736         ;;
 737       "35")
 738         printf "%s" "5"
 739         ;;
 740       "36")
 741         printf "%s" "6"
 742         ;;
 743       "37")
 744         printf "%s" "7"
 745         ;;
 746       "38")
 747         printf "%s" "8"
 748         ;;
 749       "39")
 750         printf "%s" "9"
 751         ;;
 752       "2d")
 753         printf "%s" "-"
 754         ;;
 755       "5f")
 756         printf "%s" "_"
 757         ;;
 758       "2e")
 759         printf "%s" "."
 760         ;;
 761       "7e")
 762         printf "%s" "~"
 763         ;;
 764       #other hex
 765       *)
 766         printf '%%%s' "$_hex_code"
 767         ;;
 768     esac
 769   done
 770 }
 771
 772 #options file
 773 _sed_i() {
 774   options="$1"
 775   filename="$2"
 776   if [ -z "$filename" ]; then
 777     _usage "Usage:_sed_i options filename"
 778     return 1
 779   fi
 780   _debug2 options "$options"
 781   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 782     _debug "Using sed  -i"
 783     sed -i "$options" "$filename"
 784   else
 785     _debug "No -i support in sed"
 786     text="$(cat "$filename")"
 787     echo "$text" | sed "$options" >"$filename"
 788   fi
 789 }
 790
 791 _egrep_o() {
 792   if ! egrep -o "$1" 2>/dev/null; then
 793     sed -n 's/.*\('"$1"'\).*/\1/p'
 794   fi
 795 }
 796
 797 #Usage: file startline endline
 798 _getfile() {
 799   filename="$1"
 800   startline="$2"
 801   endline="$3"
 802   if [ -z "$endline" ]; then
 803     _usage "Usage: file startline endline"
 804     return 1
 805   fi
 806
 807   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 808   if [ -z "$i" ]; then
 809     _err "Can not find start line: $startline"
 810     return 1
 811   fi
 812   i="$(_math "$i" + 1)"
 813   _debug i "$i"
 814
 815   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 816   if [ -z "$j" ]; then
 817     _err "Can not find end line: $endline"
 818     return 1
 819   fi
 820   j="$(_math "$j" - 1)"
 821   _debug j "$j"
 822
 823   sed -n "$i,${j}p" "$filename"
 824
 825 }
 826
 827 #Usage: multiline
 828 _base64() {
 829   [ "" ] #urgly
 830   if [ "$1" ]; then
 831     _debug3 "base64 multiline:'$1'"
 832     ${ACME_OPENSSL_BIN:-openssl} base64 -e
 833   else
 834     _debug3 "base64 single line."
 835     ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
 836   fi
 837 }
 838
 839 #Usage: multiline
 840 _dbase64() {
 841   if [ "$1" ]; then
 842     ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
 843   else
 844     ${ACME_OPENSSL_BIN:-openssl} base64 -d
 845   fi
 846 }
 847
 848 #Usage: hashalg  [outputhex]
 849 #Output Base64-encoded digest
 850 _digest() {
 851   alg="$1"
 852   if [ -z "$alg" ]; then
 853     _usage "Usage: _digest hashalg"
 854     return 1
 855   fi
 856
 857   outputhex="$2"
 858
 859   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 860     if [ "$outputhex" ]; then
 861       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 862     else
 863       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
 864     fi
 865   else
 866     _err "$alg is not supported yet"
 867     return 1
 868   fi
 869
 870 }
 871
 872 #Usage: hashalg  secret_hex  [outputhex]
 873 #Output binary hmac
 874 _hmac() {
 875   alg="$1"
 876   secret_hex="$2"
 877   outputhex="$3"
 878
 879   if [ -z "$secret_hex" ]; then
 880     _usage "Usage: _hmac hashalg secret [outputhex]"
 881     return 1
 882   fi
 883
 884   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
 885     if [ "$outputhex" ]; then
 886       (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
 887     else
 888       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
 889     fi
 890   else
 891     _err "$alg is not supported yet"
 892     return 1
 893   fi
 894
 895 }
 896
 897 #Usage: keyfile hashalg
 898 #Output: Base64-encoded signature value
 899 _sign() {
 900   keyfile="$1"
 901   alg="$2"
 902   if [ -z "$alg" ]; then
 903     _usage "Usage: _sign keyfile hashalg"
 904     return 1
 905   fi
 906
 907   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
 908
 909   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 910     $_sign_openssl -$alg | _base64
 911   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 912     if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
 913       _err "Sign failed: $_sign_openssl"
 914       _err "Key file: $keyfile"
 915       _err "Key content:$(wc -l <"$keyfile") lines"
 916       return 1
 917     fi
 918     _debug3 "_signedECText" "$_signedECText"
 919     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 920     _debug3 "_ec_r" "$_ec_r"
 921     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 922     _debug3 "_ec_s" "$_ec_s"
 923     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
 924   else
 925     _err "Unknown key file format."
 926     return 1
 927   fi
 928
 929 }
 930
 931 #keylength or isEcc flag (empty str => not ecc)
 932 _isEccKey() {
 933   _length="$1"
 934
 935   if [ -z "$_length" ]; then
 936     return 1
 937   fi
 938
 939   [ "$_length" != "1024" ] \
 940     && [ "$_length" != "2048" ] \
 941     && [ "$_length" != "3072" ] \
 942     && [ "$_length" != "4096" ] \
 943     && [ "$_length" != "8192" ]
 944 }
 945
 946 # _createkey  2048|ec-256   file
 947 _createkey() {
 948   length="$1"
 949   f="$2"
 950   _debug2 "_createkey for file:$f"
 951   eccname="$length"
 952   if _startswith "$length" "ec-"; then
 953     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
 954
 955     if [ "$length" = "256" ]; then
 956       eccname="prime256v1"
 957     fi
 958     if [ "$length" = "384" ]; then
 959       eccname="secp384r1"
 960     fi
 961     if [ "$length" = "521" ]; then
 962       eccname="secp521r1"
 963     fi
 964
 965   fi
 966
 967   if [ -z "$length" ]; then
 968     length=2048
 969   fi
 970
 971   _debug "Use length $length"
 972
 973   if ! touch "$f" >/dev/null 2>&1; then
 974     _f_path="$(dirname "$f")"
 975     _debug _f_path "$_f_path"
 976     if ! mkdir -p "$_f_path"; then
 977       _err "Can not create path: $_f_path"
 978       return 1
 979     fi
 980   fi
 981
 982   if _isEccKey "$length"; then
 983     _debug "Using ec name: $eccname"
 984     ${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null >"$f"
 985   else
 986     _debug "Using RSA: $length"
 987     ${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null >"$f"
 988   fi
 989
 990   if [ "$?" != "0" ]; then
 991     _err "Create key error."
 992     return 1
 993   fi
 994 }
 995
 996 #domain
 997 _is_idn() {
 998   _is_idn_d="$1"
 999   _debug2 _is_idn_d "$_is_idn_d"
1000   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '*.,-')
1001   _debug2 _idn_temp "$_idn_temp"
1002   [ "$_idn_temp" ]
1003 }
1004
1005 #aa.com
1006 #aa.com,bb.com,cc.com
1007 _idn() {
1008   __idn_d="$1"
1009   if ! _is_idn "$__idn_d"; then
1010     printf "%s" "$__idn_d"
1011     return 0
1012   fi
1013
1014   if _exists idn; then
1015     if _contains "$__idn_d" ','; then
1016       _i_first="1"
1017       for f in $(echo "$__idn_d" | tr ',' ' '); do
1018         [ -z "$f" ] && continue
1019         if [ -z "$_i_first" ]; then
1020           printf "%s" ","
1021         else
1022           _i_first=""
1023         fi
1024         idn --quiet "$f" | tr -d "\r\n"
1025       done
1026     else
1027       idn "$__idn_d" | tr -d "\r\n"
1028     fi
1029   else
1030     _err "Please install idn to process IDN names."
1031   fi
1032 }
1033
1034 #_createcsr  cn  san_list  keyfile csrfile conf
1035 _createcsr() {
1036   _debug _createcsr
1037   domain="$1"
1038   domainlist="$2"
1039   csrkey="$3"
1040   csr="$4"
1041   csrconf="$5"
1042   _debug2 domain "$domain"
1043   _debug2 domainlist "$domainlist"
1044   _debug2 csrkey "$csrkey"
1045   _debug2 csr "$csr"
1046   _debug2 csrconf "$csrconf"
1047
1048   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1049
1050   if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1051     #single domain
1052     _info "Single domain" "$domain"
1053     printf -- "\nsubjectAltName=DNS:$domain" >>"$csrconf"
1054   else
1055     domainlist="$(_idn "$domainlist")"
1056     _debug2 domainlist "$domainlist"
1057     if _contains "$domainlist" ","; then
1058       alt="DNS:$domain,DNS:$(echo "$domainlist" | sed "s/,,/,/g" | sed "s/,/,DNS:/g")"
1059     else
1060       alt="DNS:$domain,DNS:$domainlist"
1061     fi
1062     #multi
1063     _info "Multi domain" "$alt"
1064     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1065   fi
1066   if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
1067     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1068     _cleardomainconf Le_OCSP_Stable
1069     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1070   fi
1071
1072   _csr_cn="$(_idn "$domain")"
1073   _debug2 _csr_cn "$_csr_cn"
1074   if _contains "$(uname -a)" "MINGW"; then
1075     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1076   else
1077     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1078   fi
1079 }
1080
1081 #_signcsr key  csr  conf cert
1082 _signcsr() {
1083   key="$1"
1084   csr="$2"
1085   conf="$3"
1086   cert="$4"
1087   _debug "_signcsr"
1088
1089   _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1090   _ret="$?"
1091   _debug "$_msg"
1092   return $_ret
1093 }
1094
1095 #_csrfile
1096 _readSubjectFromCSR() {
1097   _csrfile="$1"
1098   if [ -z "$_csrfile" ]; then
1099     _usage "_readSubjectFromCSR mycsr.csr"
1100     return 1
1101   fi
1102   ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | tr ',' "\n" | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
1103 }
1104
1105 #_csrfile
1106 #echo comma separated domain list
1107 _readSubjectAltNamesFromCSR() {
1108   _csrfile="$1"
1109   if [ -z "$_csrfile" ]; then
1110     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1111     return 1
1112   fi
1113
1114   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1115   _debug _csrsubj "$_csrsubj"
1116
1117   _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1118   _debug _dnsAltnames "$_dnsAltnames"
1119
1120   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1121     _debug "AltNames contains subject"
1122     _dnsAltnames="$(printf "%s" "$_dnsAltnames," | sed "s/DNS:$_csrsubj,//g")"
1123   else
1124     _debug "AltNames doesn't contain subject"
1125   fi
1126
1127   printf "%s" "$_dnsAltnames" | sed "s/DNS://g"
1128 }
1129
1130 #_csrfile
1131 _readKeyLengthFromCSR() {
1132   _csrfile="$1"
1133   if [ -z "$_csrfile" ]; then
1134     _usage "_readKeyLengthFromCSR mycsr.csr"
1135     return 1
1136   fi
1137
1138   _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
1139   _debug2 _outcsr "$_outcsr"
1140   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1141     _debug "ECC CSR"
1142     echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1143   else
1144     _debug "RSA CSR"
1145     _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
1146     if [ "$_rkl" ]; then
1147       echo "$_rkl"
1148     else
1149       echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1150     fi
1151   fi
1152 }
1153
1154 _ss() {
1155   _port="$1"
1156
1157   if _exists "ss"; then
1158     _debug "Using: ss"
1159     ss -ntpl 2>/dev/null | grep ":$_port "
1160     return 0
1161   fi
1162
1163   if _exists "netstat"; then
1164     _debug "Using: netstat"
1165     if netstat -h 2>&1 | grep "\-p proto" >/dev/null; then
1166       #for windows version netstat tool
1167       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1168     else
1169       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1170         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1171       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1172         #for solaris
1173         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1174       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1175         #for full linux
1176         netstat -ntpl | grep ":$_port "
1177       else
1178         #for busybox (embedded linux; no pid support)
1179         netstat -ntl 2>/dev/null | grep ":$_port "
1180       fi
1181     fi
1182     return 0
1183   fi
1184
1185   return 1
1186 }
1187
1188 #outfile key cert cacert [password [name [caname]]]
1189 _toPkcs() {
1190   _cpfx="$1"
1191   _ckey="$2"
1192   _ccert="$3"
1193   _cca="$4"
1194   pfxPassword="$5"
1195   pfxName="$6"
1196   pfxCaname="$7"
1197
1198   if [ "$pfxCaname" ]; then
1199     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
1200   elif [ "$pfxName" ]; then
1201     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
1202   elif [ "$pfxPassword" ]; then
1203     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
1204   else
1205     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
1206   fi
1207
1208 }
1209
1210 #domain [password] [isEcc]
1211 toPkcs() {
1212   domain="$1"
1213   pfxPassword="$2"
1214   if [ -z "$domain" ]; then
1215     _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
1216     return 1
1217   fi
1218
1219   _isEcc="$3"
1220
1221   _initpath "$domain" "$_isEcc"
1222
1223   _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
1224
1225   if [ "$?" = "0" ]; then
1226     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1227   fi
1228
1229 }
1230
1231 #domain [isEcc]
1232 toPkcs8() {
1233   domain="$1"
1234
1235   if [ -z "$domain" ]; then
1236     _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
1237     return 1
1238   fi
1239
1240   _isEcc="$2"
1241
1242   _initpath "$domain" "$_isEcc"
1243
1244   ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1245
1246   if [ "$?" = "0" ]; then
1247     _info "Success, $CERT_PKCS8_PATH"
1248   fi
1249
1250 }
1251
1252 #[2048]
1253 createAccountKey() {
1254   _info "Creating account key"
1255   if [ -z "$1" ]; then
1256     _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
1257     return
1258   fi
1259
1260   length=$1
1261   _create_account_key "$length"
1262
1263 }
1264
1265 _create_account_key() {
1266
1267   length=$1
1268
1269   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1270     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1271     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1272   fi
1273
1274   _debug length "$length"
1275   _initpath
1276
1277   mkdir -p "$CA_DIR"
1278   if [ -f "$ACCOUNT_KEY_PATH" ]; then
1279     _info "Account key exists, skip"
1280     return
1281   else
1282     #generate account key
1283     _createkey "$length" "$ACCOUNT_KEY_PATH"
1284   fi
1285
1286 }
1287
1288 #domain [length]
1289 createDomainKey() {
1290   _info "Creating domain key"
1291   if [ -z "$1" ]; then
1292     _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]"
1293     return
1294   fi
1295
1296   domain=$1
1297   _cdl=$2
1298
1299   if [ -z "$_cdl" ]; then
1300     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1301     _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
1302   fi
1303
1304   _initpath "$domain" "$_cdl"
1305
1306   if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
1307     if _createkey "$_cdl" "$CERT_KEY_PATH"; then
1308       _savedomainconf Le_Keylength "$_cdl"
1309       _info "The domain key is here: $(__green $CERT_KEY_PATH)"
1310     fi
1311   else
1312     if [ "$IS_RENEW" ]; then
1313       _info "Domain key exists, skip"
1314       return 0
1315     else
1316       _err "Domain key exists, do you want to overwrite the key?"
1317       _err "Add '--force', and try again."
1318       return 1
1319     fi
1320   fi
1321
1322 }
1323
1324 # domain  domainlist isEcc
1325 createCSR() {
1326   _info "Creating csr"
1327   if [ -z "$1" ]; then
1328     _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]"
1329     return
1330   fi
1331
1332   domain="$1"
1333   domainlist="$2"
1334   _isEcc="$3"
1335
1336   _initpath "$domain" "$_isEcc"
1337
1338   if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
1339     _info "CSR exists, skip"
1340     return
1341   fi
1342
1343   if [ ! -f "$CERT_KEY_PATH" ]; then
1344     _err "The key file is not found: $CERT_KEY_PATH"
1345     _err "Please create the key file first."
1346     return 1
1347   fi
1348   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1349
1350 }
1351
1352 _url_replace() {
1353   tr '/+' '_-' | tr -d '= '
1354 }
1355
1356 _time2str() {
1357   #Linux
1358   if date -u -d@"$1" 2>/dev/null; then
1359     return
1360   fi
1361
1362   #BSD
1363   if date -u -r "$1" 2>/dev/null; then
1364     return
1365   fi
1366
1367   #Soaris
1368   if _exists adb; then
1369     _t_s_a=$(echo "0t${1}=Y" | adb)
1370     echo "$_t_s_a"
1371   fi
1372
1373   #Busybox
1374   if echo "$1" | awk '{ print strftime("%c", $0); }' 2>/dev/null; then
1375     return
1376   fi
1377 }
1378
1379 _normalizeJson() {
1380   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1381 }
1382
1383 _stat() {
1384   #Linux
1385   if stat -c '%U:%G' "$1" 2>/dev/null; then
1386     return
1387   fi
1388
1389   #BSD
1390   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1391     return
1392   fi
1393
1394   return 1 #error, 'stat' not found
1395 }
1396
1397 #keyfile
1398 _calcjwk() {
1399   keyfile="$1"
1400   if [ -z "$keyfile" ]; then
1401     _usage "Usage: _calcjwk keyfile"
1402     return 1
1403   fi
1404
1405   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1406     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1407     return 0
1408   fi
1409
1410   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1411     _debug "RSA key"
1412     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1413     if [ "${#pub_exp}" = "5" ]; then
1414       pub_exp=0$pub_exp
1415     fi
1416     _debug3 pub_exp "$pub_exp"
1417
1418     e=$(echo "$pub_exp" | _h2b | _base64)
1419     _debug3 e "$e"
1420
1421     modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1422     _debug3 modulus "$modulus"
1423     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1424     _debug3 n "$n"
1425
1426     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1427     _debug3 jwk "$jwk"
1428
1429     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1430     JWK_HEADERPLACE_PART1='{"nonce": "'
1431     JWK_HEADERPLACE_PART2='", "alg": "RS256"'
1432   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1433     _debug "EC key"
1434     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1435     _debug3 crv "$crv"
1436     __ECC_KEY_LEN=$(echo "$crv" | cut -d "-" -f 2)
1437     if [ "$__ECC_KEY_LEN" = "521" ]; then
1438       __ECC_KEY_LEN=512
1439     fi
1440     _debug3 __ECC_KEY_LEN "$__ECC_KEY_LEN"
1441     if [ -z "$crv" ]; then
1442       _debug "Let's try ASN1 OID"
1443       crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1444       _debug3 crv_oid "$crv_oid"
1445       case "${crv_oid}" in
1446         "prime256v1")
1447           crv="P-256"
1448           __ECC_KEY_LEN=256
1449           ;;
1450         "secp384r1")
1451           crv="P-384"
1452           __ECC_KEY_LEN=384
1453           ;;
1454         "secp521r1")
1455           crv="P-521"
1456           __ECC_KEY_LEN=512
1457           ;;
1458         *)
1459           _err "ECC oid : $crv_oid"
1460           return 1
1461           ;;
1462       esac
1463       _debug3 crv "$crv"
1464     fi
1465
1466     pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1467     pubi=$(_math "$pubi" + 1)
1468     _debug3 pubi "$pubi"
1469
1470     pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1471     pubj=$(_math "$pubj" - 1)
1472     _debug3 pubj "$pubj"
1473
1474     pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1475     _debug3 pubtext "$pubtext"
1476
1477     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1478     xlen=$(_math "$xlen" / 4)
1479     _debug3 xlen "$xlen"
1480
1481     xend=$(_math "$xlen" + 1)
1482     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1483     _debug3 x "$x"
1484
1485     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1486     _debug3 x64 "$x64"
1487
1488     xend=$(_math "$xend" + 1)
1489     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1490     _debug3 y "$y"
1491
1492     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1493     _debug3 y64 "$y64"
1494
1495     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1496     _debug3 jwk "$jwk"
1497
1498     JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
1499     JWK_HEADERPLACE_PART1='{"nonce": "'
1500     JWK_HEADERPLACE_PART2='", "alg": "ES'$__ECC_KEY_LEN'"'
1501   else
1502     _err "Only RSA or EC key is supported."
1503     return 1
1504   fi
1505
1506   _debug3 JWK_HEADER "$JWK_HEADER"
1507   __CACHED_JWK_KEY_FILE="$keyfile"
1508 }
1509
1510 _time() {
1511   date -u "+%s"
1512 }
1513
1514 _utc_date() {
1515   date -u "+%Y-%m-%d %H:%M:%S"
1516 }
1517
1518 _mktemp() {
1519   if _exists mktemp; then
1520     if mktemp 2>/dev/null; then
1521       return 0
1522     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1523       #for Mac osx
1524       return 0
1525     fi
1526   fi
1527   if [ -d "/tmp" ]; then
1528     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1529     return 0
1530   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1531     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1532     return 0
1533   fi
1534   _err "Can not create temp file."
1535 }
1536
1537 _inithttp() {
1538
1539   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1540     HTTP_HEADER="$(_mktemp)"
1541     _debug2 HTTP_HEADER "$HTTP_HEADER"
1542   fi
1543
1544   if [ "$__HTTP_INITIALIZED" ]; then
1545     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1546       _debug2 "Http already initialized."
1547       return 0
1548     fi
1549   fi
1550
1551   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1552     _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
1553     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1554       _CURL_DUMP="$(_mktemp)"
1555       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1556     fi
1557
1558     if [ "$CA_PATH" ]; then
1559       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1560     elif [ "$CA_BUNDLE" ]; then
1561       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1562     fi
1563
1564   fi
1565
1566   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1567     _ACME_WGET="wget -q"
1568     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1569       _ACME_WGET="$_ACME_WGET -d "
1570     fi
1571     if [ "$CA_PATH" ]; then
1572       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1573     elif [ "$CA_BUNDLE" ]; then
1574       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1575     fi
1576   fi
1577
1578   #from wget 1.14: do not skip body on 404 error
1579   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1580     _ACME_WGET="$_ACME_WGET --content-on-error "
1581   fi
1582
1583   __HTTP_INITIALIZED=1
1584
1585 }
1586
1587 # body  url [needbase64] [POST|PUT]
1588 _post() {
1589   body="$1"
1590   _post_url="$2"
1591   needbase64="$3"
1592   httpmethod="$4"
1593
1594   if [ -z "$httpmethod" ]; then
1595     httpmethod="POST"
1596   fi
1597   _debug $httpmethod
1598   _debug "_post_url" "$_post_url"
1599   _debug2 "body" "$body"
1600
1601   _inithttp
1602
1603   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1604     _CURL="$_ACME_CURL"
1605     if [ "$HTTPS_INSECURE" ]; then
1606       _CURL="$_CURL --insecure  "
1607     fi
1608     _debug "_CURL" "$_CURL"
1609     if [ "$needbase64" ]; then
1610       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
1611     else
1612       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
1613     fi
1614     _ret="$?"
1615     if [ "$_ret" != "0" ]; then
1616       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1617       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1618         _err "Here is the curl dump log:"
1619         _err "$(cat "$_CURL_DUMP")"
1620       fi
1621     fi
1622   elif [ "$_ACME_WGET" ]; then
1623     _WGET="$_ACME_WGET"
1624     if [ "$HTTPS_INSECURE" ]; then
1625       _WGET="$_WGET --no-check-certificate "
1626     fi
1627     _debug "_WGET" "$_WGET"
1628     if [ "$needbase64" ]; then
1629       if [ "$httpmethod" = "POST" ]; then
1630         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1631       else
1632         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1633       fi
1634     else
1635       if [ "$httpmethod" = "POST" ]; then
1636         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1637       else
1638         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1639       fi
1640     fi
1641     _ret="$?"
1642     if [ "$_ret" = "8" ]; then
1643       _ret=0
1644       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1645     fi
1646     if [ "$_ret" != "0" ]; then
1647       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1648     fi
1649     _sed_i "s/^ *//g" "$HTTP_HEADER"
1650   else
1651     _ret="$?"
1652     _err "Neither curl nor wget is found, can not do $httpmethod."
1653   fi
1654   _debug "_ret" "$_ret"
1655   printf "%s" "$response"
1656   return $_ret
1657 }
1658
1659 # url getheader timeout
1660 _get() {
1661   _debug GET
1662   url="$1"
1663   onlyheader="$2"
1664   t="$3"
1665   _debug url "$url"
1666   _debug "timeout=$t"
1667
1668   _inithttp
1669
1670   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1671     _CURL="$_ACME_CURL"
1672     if [ "$HTTPS_INSECURE" ]; then
1673       _CURL="$_CURL --insecure  "
1674     fi
1675     if [ "$t" ]; then
1676       _CURL="$_CURL --connect-timeout $t"
1677     fi
1678     _debug "_CURL" "$_CURL"
1679     if [ "$onlyheader" ]; then
1680       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1681     else
1682       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1683     fi
1684     ret=$?
1685     if [ "$ret" != "0" ]; then
1686       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1687       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1688         _err "Here is the curl dump log:"
1689         _err "$(cat "$_CURL_DUMP")"
1690       fi
1691     fi
1692   elif [ "$_ACME_WGET" ]; then
1693     _WGET="$_ACME_WGET"
1694     if [ "$HTTPS_INSECURE" ]; then
1695       _WGET="$_WGET --no-check-certificate "
1696     fi
1697     if [ "$t" ]; then
1698       _WGET="$_WGET --timeout=$t"
1699     fi
1700     _debug "_WGET" "$_WGET"
1701     if [ "$onlyheader" ]; then
1702       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1703     else
1704       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1705     fi
1706     ret=$?
1707     if [ "$ret" = "8" ]; then
1708       ret=0
1709       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1710     fi
1711     if [ "$ret" != "0" ]; then
1712       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1713     fi
1714   else
1715     ret=$?
1716     _err "Neither curl nor wget is found, can not do GET."
1717   fi
1718   _debug "ret" "$ret"
1719   return $ret
1720 }
1721
1722 _head_n() {
1723   head -n "$1"
1724 }
1725
1726 _tail_n() {
1727   if ! tail -n "$1" 2>/dev/null; then
1728     #fix for solaris
1729     tail -"$1"
1730   fi
1731 }
1732
1733 # url  payload needbase64  keyfile
1734 _send_signed_request() {
1735   url=$1
1736   payload=$2
1737   needbase64=$3
1738   keyfile=$4
1739   if [ -z "$keyfile" ]; then
1740     keyfile="$ACCOUNT_KEY_PATH"
1741   fi
1742   _debug url "$url"
1743   _debug payload "$payload"
1744
1745   if ! _calcjwk "$keyfile"; then
1746     return 1
1747   fi
1748
1749   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
1750   _debug3 payload64 "$payload64"
1751
1752   MAX_REQUEST_RETRY_TIMES=5
1753   _request_retry_times=0
1754   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
1755     _debug3 _request_retry_times "$_request_retry_times"
1756     if [ -z "$_CACHED_NONCE" ]; then
1757       _headers=""
1758       if [ "$ACME_NEW_NONCE" ]; then
1759         _debug2 "Get nonce. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
1760         nonceurl="$ACME_NEW_NONCE"
1761         if _post "" "$nonceurl" "" "HEAD"; then
1762           _headers="$(cat "$HTTP_HEADER")"
1763         fi
1764       fi
1765       if [ -z "$_headers" ]; then
1766         _debug2 "Get nonce. ACME_DIRECTORY" "$ACME_DIRECTORY"
1767         nonceurl="$ACME_DIRECTORY"
1768         _headers="$(_get "$nonceurl" "onlyheader")"
1769       fi
1770
1771       if [ "$?" != "0" ]; then
1772         _err "Can not connect to $nonceurl to get nonce."
1773         return 1
1774       fi
1775
1776       _debug2 _headers "$_headers"
1777
1778       _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1779       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
1780     else
1781       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
1782     fi
1783     nonce="$_CACHED_NONCE"
1784     _debug2 nonce "$nonce"
1785
1786     if [ "$ACME_VERSION" = "2" ]; then
1787       if [ "$url" = "$ACME_NEW_ACCOUNT" ] || [ "$url" = "$ACME_REVOKE_CERT" ]; then
1788         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
1789       else
1790         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"$ACCOUNT_URL\""'}'
1791       fi
1792     else
1793       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
1794     fi
1795     _debug3 protected "$protected"
1796
1797     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
1798     _debug3 protected64 "$protected64"
1799
1800     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
1801       _err "Sign request failed."
1802       return 1
1803     fi
1804     _debug3 _sig_t "$_sig_t"
1805
1806     sig="$(printf "%s" "$_sig_t" | _url_replace)"
1807     _debug3 sig "$sig"
1808
1809     if [ "$ACME_VERSION" = "2" ]; then
1810       body="{\"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1811     else
1812       body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1813     fi
1814     _debug3 body "$body"
1815
1816     response="$(_post "$body" "$url" "$needbase64")"
1817     _CACHED_NONCE=""
1818
1819     if [ "$?" != "0" ]; then
1820       _err "Can not post to $url"
1821       return 1
1822     fi
1823     _debug2 original "$response"
1824     response="$(echo "$response" | _normalizeJson)"
1825
1826     responseHeaders="$(cat "$HTTP_HEADER")"
1827
1828     _debug2 responseHeaders "$responseHeaders"
1829     _debug2 response "$response"
1830     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
1831     _debug code "$code"
1832
1833     _CACHED_NONCE="$(echo "$responseHeaders" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1834
1835     _body="$response"
1836     if [ "$needbase64" ]; then
1837       _body="$(echo "$_body" | _dbase64)"
1838       _debug2 _body "$_body"
1839     fi
1840
1841     if _contains "$_body" "JWS has invalid anti-replay nonce"; then
1842       _info "It seems the CA server is busy now, let's wait and retry."
1843       _request_retry_times=$(_math "$_request_retry_times" + 1)
1844       _sleep 5
1845       continue
1846     fi
1847     break
1848   done
1849
1850 }
1851
1852 #setopt "file"  "opt"  "="  "value" [";"]
1853 _setopt() {
1854   __conf="$1"
1855   __opt="$2"
1856   __sep="$3"
1857   __val="$4"
1858   __end="$5"
1859   if [ -z "$__opt" ]; then
1860     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
1861     return
1862   fi
1863   if [ ! -f "$__conf" ]; then
1864     touch "$__conf"
1865   fi
1866
1867   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
1868     _debug3 OK
1869     if _contains "$__val" "&"; then
1870       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1871     fi
1872     text="$(cat "$__conf")"
1873     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1874
1875   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
1876     if _contains "$__val" "&"; then
1877       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1878     fi
1879     text="$(cat "$__conf")"
1880     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1881
1882   else
1883     _debug3 APP
1884     echo "$__opt$__sep$__val$__end" >>"$__conf"
1885   fi
1886   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
1887 }
1888
1889 #_save_conf  file key  value
1890 #save to conf
1891 _save_conf() {
1892   _s_c_f="$1"
1893   _sdkey="$2"
1894   _sdvalue="$3"
1895   if [ "$_s_c_f" ]; then
1896     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
1897   else
1898     _err "config file is empty, can not save $_sdkey=$_sdvalue"
1899   fi
1900 }
1901
1902 #_clear_conf file  key
1903 _clear_conf() {
1904   _c_c_f="$1"
1905   _sdkey="$2"
1906   if [ "$_c_c_f" ]; then
1907     _conf_data="$(cat "$_c_c_f")"
1908     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
1909   else
1910     _err "config file is empty, can not clear"
1911   fi
1912 }
1913
1914 #_read_conf file  key
1915 _read_conf() {
1916   _r_c_f="$1"
1917   _sdkey="$2"
1918   if [ -f "$_r_c_f" ]; then
1919     (
1920       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
1921       eval "printf \"%s\" \"\$$_sdkey\""
1922     )
1923   else
1924     _debug "config file is empty, can not read $_sdkey"
1925   fi
1926 }
1927
1928 #_savedomainconf   key  value
1929 #save to domain.conf
1930 _savedomainconf() {
1931   _save_conf "$DOMAIN_CONF" "$1" "$2"
1932 }
1933
1934 #_cleardomainconf   key
1935 _cleardomainconf() {
1936   _clear_conf "$DOMAIN_CONF" "$1"
1937 }
1938
1939 #_readdomainconf   key
1940 _readdomainconf() {
1941   _read_conf "$DOMAIN_CONF" "$1"
1942 }
1943
1944 #_saveaccountconf  key  value
1945 _saveaccountconf() {
1946   _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
1947 }
1948
1949 #key  value
1950 _saveaccountconf_mutable() {
1951   _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2"
1952   #remove later
1953   _clearaccountconf "$1"
1954 }
1955
1956 #key
1957 _readaccountconf() {
1958   _read_conf "$ACCOUNT_CONF_PATH" "$1"
1959 }
1960
1961 #key
1962 _readaccountconf_mutable() {
1963   _rac_key="$1"
1964   _readaccountconf "SAVED_$_rac_key"
1965 }
1966
1967 #_clearaccountconf   key
1968 _clearaccountconf() {
1969   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
1970 }
1971
1972 #_savecaconf  key  value
1973 _savecaconf() {
1974   _save_conf "$CA_CONF" "$1" "$2"
1975 }
1976
1977 #_readcaconf   key
1978 _readcaconf() {
1979   _read_conf "$CA_CONF" "$1"
1980 }
1981
1982 #_clearaccountconf   key
1983 _clearcaconf() {
1984   _clear_conf "$CA_CONF" "$1"
1985 }
1986
1987 # content localaddress
1988 _startserver() {
1989   content="$1"
1990   ncaddr="$2"
1991   _debug "ncaddr" "$ncaddr"
1992
1993   _debug "startserver: $$"
1994
1995   _debug Le_HTTPPort "$Le_HTTPPort"
1996   _debug Le_Listen_V4 "$Le_Listen_V4"
1997   _debug Le_Listen_V6 "$Le_Listen_V6"
1998
1999   _NC="socat"
2000   if [ "$Le_Listen_V4" ]; then
2001     _NC="$_NC -4"
2002   elif [ "$Le_Listen_V6" ]; then
2003     _NC="$_NC -6"
2004   fi
2005
2006   _debug "_NC" "$_NC"
2007   #todo  listen address
2008   $_NC TCP-LISTEN:$Le_HTTPPort,crlf,reuseaddr,fork SYSTEM:"sleep 0.5; echo HTTP/1.1 200 OK; echo ; echo  $content; echo;" &
2009   serverproc="$!"
2010 }
2011
2012 _stopserver() {
2013   pid="$1"
2014   _debug "pid" "$pid"
2015   if [ -z "$pid" ]; then
2016     return
2017   fi
2018
2019   kill $pid
2020
2021 }
2022
2023 # sleep sec
2024 _sleep() {
2025   _sleep_sec="$1"
2026   if [ "$__INTERACTIVE" ]; then
2027     _sleep_c="$_sleep_sec"
2028     while [ "$_sleep_c" -ge "0" ]; do
2029       printf "\r      \r"
2030       __green "$_sleep_c"
2031       _sleep_c="$(_math "$_sleep_c" - 1)"
2032       sleep 1
2033     done
2034     printf "\r"
2035   else
2036     sleep "$_sleep_sec"
2037   fi
2038 }
2039
2040 # _starttlsserver  san_a  san_b port content _ncaddr
2041 _starttlsserver() {
2042   _info "Starting tls server."
2043   san_a="$1"
2044   san_b="$2"
2045   port="$3"
2046   content="$4"
2047   opaddr="$5"
2048
2049   _debug san_a "$san_a"
2050   _debug san_b "$san_b"
2051   _debug port "$port"
2052
2053   #create key TLS_KEY
2054   if ! _createkey "2048" "$TLS_KEY"; then
2055     _err "Create tls validation key error."
2056     return 1
2057   fi
2058
2059   #create csr
2060   alt="$san_a"
2061   if [ "$san_b" ]; then
2062     alt="$alt,$san_b"
2063   fi
2064   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF"; then
2065     _err "Create tls validation csr error."
2066     return 1
2067   fi
2068
2069   #self signed
2070   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2071     _err "Create tls validation cert error."
2072     return 1
2073   fi
2074
2075   __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -www -cert $TLS_CERT  -key $TLS_KEY "
2076   if [ "$opaddr" ]; then
2077     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2078   else
2079     __S_OPENSSL="$__S_OPENSSL -accept $port"
2080   fi
2081
2082   _debug Le_Listen_V4 "$Le_Listen_V4"
2083   _debug Le_Listen_V6 "$Le_Listen_V6"
2084   if [ "$Le_Listen_V4" ]; then
2085     __S_OPENSSL="$__S_OPENSSL -4"
2086   elif [ "$Le_Listen_V6" ]; then
2087     __S_OPENSSL="$__S_OPENSSL -6"
2088   fi
2089
2090   _debug "$__S_OPENSSL"
2091   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2092     $__S_OPENSSL -tlsextdebug &
2093   else
2094     $__S_OPENSSL >/dev/null 2>&1 &
2095   fi
2096
2097   serverproc="$!"
2098   sleep 1
2099   _debug serverproc "$serverproc"
2100 }
2101
2102 #file
2103 _readlink() {
2104   _rf="$1"
2105   if ! readlink -f "$_rf" 2>/dev/null; then
2106     if _startswith "$_rf" "/"; then
2107       echo "$_rf"
2108       return 0
2109     fi
2110     echo "$(pwd)/$_rf" | _conapath
2111   fi
2112 }
2113
2114 _conapath() {
2115   sed "s#/\./#/#g"
2116 }
2117
2118 __initHome() {
2119   if [ -z "$_SCRIPT_HOME" ]; then
2120     if _exists readlink && _exists dirname; then
2121       _debug "Lets find script dir."
2122       _debug "_SCRIPT_" "$_SCRIPT_"
2123       _script="$(_readlink "$_SCRIPT_")"
2124       _debug "_script" "$_script"
2125       _script_home="$(dirname "$_script")"
2126       _debug "_script_home" "$_script_home"
2127       if [ -d "$_script_home" ]; then
2128         _SCRIPT_HOME="$_script_home"
2129       else
2130         _err "It seems the script home is not correct:$_script_home"
2131       fi
2132     fi
2133   fi
2134
2135   #  if [ -z "$LE_WORKING_DIR" ]; then
2136   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2137   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2138   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2139   #    else
2140   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2141   #    fi
2142   #  fi
2143
2144   if [ -z "$LE_WORKING_DIR" ]; then
2145     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2146     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2147   fi
2148   export LE_WORKING_DIR
2149
2150   if [ -z "$LE_CONFIG_HOME" ]; then
2151     LE_CONFIG_HOME="$LE_WORKING_DIR"
2152   fi
2153   _debug "Using config home:$LE_CONFIG_HOME"
2154   export LE_CONFIG_HOME
2155
2156   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2157
2158   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2159     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2160       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2161     fi
2162   fi
2163
2164   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2165     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2166   fi
2167
2168   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2169
2170   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2171
2172   if [ -z "$LE_TEMP_DIR" ]; then
2173     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2174   fi
2175 }
2176
2177 #server
2178 _initAPI() {
2179   _api_server="${1:-$ACME_DIRECTORY}"
2180   _debug "_init api for server: $_api_server"
2181
2182   if [ -z "$ACME_NEW_ACCOUNT" ]; then
2183     response=$(_get "$_api_server")
2184     if [ "$?" != "0" ]; then
2185       _debug2 "response" "$response"
2186       _err "Can not init api."
2187       return 1
2188     fi
2189     _debug2 "response" "$response"
2190
2191     ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
2192     if [ -z "$ACME_KEY_CHANGE" ]; then
2193       ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
2194     fi
2195     export ACME_KEY_CHANGE
2196
2197     ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
2198     if [ -z "$ACME_NEW_AUTHZ" ]; then
2199       ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
2200     fi
2201     export ACME_NEW_AUTHZ
2202
2203     ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2204     ACME_NEW_ORDER_RES="new-cert"
2205     if [ -z "$ACME_NEW_ORDER" ]; then
2206       ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
2207       ACME_NEW_ORDER_RES="new-order"
2208       if [ -z "$ACME_NEW_ORDER" ]; then
2209         ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
2210       fi
2211     fi
2212     export ACME_NEW_ORDER
2213     export ACME_NEW_ORDER_RES
2214
2215     ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
2216     ACME_NEW_ACCOUNT_RES="new-reg"
2217     if [ -z "$ACME_NEW_ACCOUNT" ]; then
2218       ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
2219       ACME_NEW_ACCOUNT_RES="new-account"
2220       if [ -z "$ACME_NEW_ACCOUNT" ]; then
2221         ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
2222         if [ "$ACME_NEW_ACCOUNT" ]; then
2223           export ACME_VERSION=2
2224         fi
2225       fi
2226     fi
2227     export ACME_NEW_ACCOUNT
2228     export ACME_NEW_ACCOUNT_RES
2229
2230     ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2231     if [ -z "$ACME_REVOKE_CERT" ]; then
2232       ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
2233     fi
2234     export ACME_REVOKE_CERT
2235
2236     ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
2237     if [ -z "$ACME_NEW_NONCE" ]; then
2238       ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
2239     fi
2240     export ACME_NEW_NONCE
2241
2242     ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
2243     if [ -z "$ACME_AGREEMENT" ]; then
2244       ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
2245     fi
2246     export ACME_AGREEMENT
2247
2248     _debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
2249     _debug "ACME_NEW_AUTHZ" "$ACME_NEW_AUTHZ"
2250     _debug "ACME_NEW_ORDER" "$ACME_NEW_ORDER"
2251     _debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
2252     _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
2253     _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
2254     _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
2255     _debug "ACME_VERSION" "$ACME_VERSION"
2256
2257   fi
2258 }
2259
2260 #[domain]  [keylength or isEcc flag]
2261 _initpath() {
2262   domain="$1"
2263   _ilength="$2"
2264
2265   __initHome
2266
2267   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2268     . "$ACCOUNT_CONF_PATH"
2269   fi
2270
2271   if [ "$IN_CRON" ]; then
2272     if [ ! "$_USER_PATH_EXPORTED" ]; then
2273       _USER_PATH_EXPORTED=1
2274       export PATH="$USER_PATH:$PATH"
2275     fi
2276   fi
2277
2278   if [ -z "$CA_HOME" ]; then
2279     CA_HOME="$DEFAULT_CA_HOME"
2280   fi
2281
2282   if [ "$ACME_VERSION" = "2" ]; then
2283     DEFAULT_CA="$LETSENCRYPT_CA_V2"
2284     DEFAULT_STAGING_CA="$LETSENCRYPT_STAGING_CA_V2"
2285   fi
2286
2287   if [ -z "$ACME_DIRECTORY" ]; then
2288     if [ -z "$STAGE" ]; then
2289       ACME_DIRECTORY="$DEFAULT_CA"
2290     else
2291       ACME_DIRECTORY="$DEFAULT_STAGING_CA"
2292       _info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
2293     fi
2294   fi
2295
2296   _debug2 ACME_DIRECTORY "$ACME_DIRECTORY"
2297   _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
2298   _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
2299
2300   CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
2301
2302   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2303
2304   if [ -z "$CA_CONF" ]; then
2305     CA_CONF="$_DEFAULT_CA_CONF"
2306   fi
2307   _debug3 CA_CONF "$CA_CONF"
2308
2309   if [ -f "$CA_CONF" ]; then
2310     . "$CA_CONF"
2311   fi
2312
2313   if [ -z "$ACME_DIR" ]; then
2314     ACME_DIR="/home/.acme"
2315   fi
2316
2317   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2318     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2319   fi
2320
2321   if [ -z "$USER_AGENT" ]; then
2322     USER_AGENT="$DEFAULT_USER_AGENT"
2323   fi
2324
2325   if [ -z "$HTTP_HEADER" ]; then
2326     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2327   fi
2328
2329   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2330   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2331
2332   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2333   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2334   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2335     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2336   fi
2337
2338   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2339     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2340   fi
2341
2342   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2343   if [ -z "$CERT_HOME" ]; then
2344     CERT_HOME="$_DEFAULT_CERT_HOME"
2345   fi
2346
2347   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2348     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2349   fi
2350
2351   if [ -z "$domain" ]; then
2352     return 0
2353   fi
2354
2355   if [ -z "$DOMAIN_PATH" ]; then
2356     domainhome="$CERT_HOME/$domain"
2357     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2358
2359     DOMAIN_PATH="$domainhome"
2360
2361     if _isEccKey "$_ilength"; then
2362       DOMAIN_PATH="$domainhomeecc"
2363     else
2364       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2365         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2366       fi
2367     fi
2368     _debug DOMAIN_PATH "$DOMAIN_PATH"
2369   fi
2370
2371   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2372     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2373   fi
2374
2375   if [ -z "$DOMAIN_CONF" ]; then
2376     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2377   fi
2378
2379   if [ -z "$DOMAIN_SSL_CONF" ]; then
2380     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2381   fi
2382
2383   if [ -z "$CSR_PATH" ]; then
2384     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2385   fi
2386   if [ -z "$CERT_KEY_PATH" ]; then
2387     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2388   fi
2389   if [ -z "$CERT_PATH" ]; then
2390     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2391   fi
2392   if [ -z "$CA_CERT_PATH" ]; then
2393     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2394   fi
2395   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2396     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2397   fi
2398   if [ -z "$CERT_PFX_PATH" ]; then
2399     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2400   fi
2401   if [ -z "$CERT_PKCS8_PATH" ]; then
2402     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2403   fi
2404
2405   if [ -z "$TLS_CONF" ]; then
2406     TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
2407   fi
2408   if [ -z "$TLS_CERT" ]; then
2409     TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
2410   fi
2411   if [ -z "$TLS_KEY" ]; then
2412     TLS_KEY="$DOMAIN_PATH/tls.validation.key"
2413   fi
2414   if [ -z "$TLS_CSR" ]; then
2415     TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
2416   fi
2417
2418 }
2419
2420 _exec() {
2421   if [ -z "$_EXEC_TEMP_ERR" ]; then
2422     _EXEC_TEMP_ERR="$(_mktemp)"
2423   fi
2424
2425   if [ "$_EXEC_TEMP_ERR" ]; then
2426     eval "$@ 2>>$_EXEC_TEMP_ERR"
2427   else
2428     eval "$@"
2429   fi
2430 }
2431
2432 _exec_err() {
2433   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2434 }
2435
2436 _apachePath() {
2437   _APACHECTL="apachectl"
2438   if ! _exists apachectl; then
2439     if _exists apache2ctl; then
2440       _APACHECTL="apache2ctl"
2441     else
2442       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2443       _err "Please use webroot mode to try again."
2444       return 1
2445     fi
2446   fi
2447
2448   if ! _exec $_APACHECTL -V >/dev/null; then
2449     _exec_err
2450     return 1
2451   fi
2452
2453   if [ "$APACHE_HTTPD_CONF" ]; then
2454     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2455     httpdconf="$APACHE_HTTPD_CONF"
2456     httpdconfname="$(basename "$httpdconfname")"
2457   else
2458     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2459     _debug httpdconfname "$httpdconfname"
2460
2461     if [ -z "$httpdconfname" ]; then
2462       _err "Can not read apache config file."
2463       return 1
2464     fi
2465
2466     if _startswith "$httpdconfname" '/'; then
2467       httpdconf="$httpdconfname"
2468       httpdconfname="$(basename "$httpdconfname")"
2469     else
2470       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2471       _debug httpdroot "$httpdroot"
2472       httpdconf="$httpdroot/$httpdconfname"
2473       httpdconfname="$(basename "$httpdconfname")"
2474     fi
2475   fi
2476   _debug httpdconf "$httpdconf"
2477   _debug httpdconfname "$httpdconfname"
2478   if [ ! -f "$httpdconf" ]; then
2479     _err "Apache Config file not found" "$httpdconf"
2480     return 1
2481   fi
2482   return 0
2483 }
2484
2485 _restoreApache() {
2486   if [ -z "$usingApache" ]; then
2487     return 0
2488   fi
2489   _initpath
2490   if ! _apachePath; then
2491     return 1
2492   fi
2493
2494   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2495     _debug "No config file to restore."
2496     return 0
2497   fi
2498
2499   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2500   _debug "Restored: $httpdconf."
2501   if ! _exec $_APACHECTL -t; then
2502     _exec_err
2503     _err "Sorry, restore apache config error, please contact me."
2504     return 1
2505   fi
2506   _debug "Restored successfully."
2507   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2508   return 0
2509 }
2510
2511 _setApache() {
2512   _initpath
2513   if ! _apachePath; then
2514     return 1
2515   fi
2516
2517   #test the conf first
2518   _info "Checking if there is an error in the apache config file before starting."
2519
2520   if ! _exec "$_APACHECTL" -t >/dev/null; then
2521     _exec_err
2522     _err "The apache config file has error, please fix it first, then try again."
2523     _err "Don't worry, there is nothing changed to your system."
2524     return 1
2525   else
2526     _info "OK"
2527   fi
2528
2529   #backup the conf
2530   _debug "Backup apache config file" "$httpdconf"
2531   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2532     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2533     _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
2534     return 1
2535   fi
2536   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2537   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2538   _info "The backup file will be deleted on success, just forget it."
2539
2540   #add alias
2541
2542   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2543   _debug "apacheVer" "$apacheVer"
2544   apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
2545   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2546
2547   if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
2548     echo "
2549 Alias /.well-known/acme-challenge  $ACME_DIR
2550
2551 <Directory $ACME_DIR >
2552 Require all granted
2553 </Directory>
2554   " >>"$httpdconf"
2555   else
2556     echo "
2557 Alias /.well-known/acme-challenge  $ACME_DIR
2558
2559 <Directory $ACME_DIR >
2560 Order allow,deny
2561 Allow from all
2562 </Directory>
2563   " >>"$httpdconf"
2564   fi
2565
2566   _msg="$($_APACHECTL -t 2>&1)"
2567   if [ "$?" != "0" ]; then
2568     _err "Sorry, apache config error"
2569     if _restoreApache; then
2570       _err "The apache config file is restored."
2571     else
2572       _err "Sorry, The apache config file can not be restored, please report bug."
2573     fi
2574     return 1
2575   fi
2576
2577   if [ ! -d "$ACME_DIR" ]; then
2578     mkdir -p "$ACME_DIR"
2579     chmod 755 "$ACME_DIR"
2580   fi
2581
2582   if ! _exec "$_APACHECTL" graceful; then
2583     _exec_err
2584     _err "$_APACHECTL  graceful error, please contact me."
2585     _restoreApache
2586     return 1
2587   fi
2588   usingApache="1"
2589   return 0
2590 }
2591
2592 #find the real nginx conf file
2593 #backup
2594 #set the nginx conf
2595 #returns the real nginx conf file
2596 _setNginx() {
2597   _d="$1"
2598   _croot="$2"
2599   _thumbpt="$3"
2600
2601   FOUND_REAL_NGINX_CONF=""
2602   FOUND_REAL_NGINX_CONF_LN=""
2603   BACKUP_NGINX_CONF=""
2604   _debug _croot "$_croot"
2605   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2606   _debug _start_f "$_start_f"
2607   if [ -z "$_start_f" ]; then
2608     _debug "find start conf from nginx command"
2609     if [ -z "$NGINX_CONF" ]; then
2610       if ! _exists "nginx"; then
2611         _err "nginx command is not found."
2612         return 1
2613       fi
2614       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2615       _debug NGINX_CONF "$NGINX_CONF"
2616       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2617       _debug NGINX_CONF "$NGINX_CONF"
2618       if [ ! -f "$NGINX_CONF" ]; then
2619         _err "'$NGINX_CONF' doesn't exist."
2620         NGINX_CONF=""
2621         return 1
2622       fi
2623       _debug "Found nginx conf file:$NGINX_CONF"
2624     fi
2625     _start_f="$NGINX_CONF"
2626   fi
2627   _debug "Start detect nginx conf for $_d from:$_start_f"
2628   if ! _checkConf "$_d" "$_start_f"; then
2629     _err "Can not find conf file for domain $d"
2630     return 1
2631   fi
2632   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2633
2634   _ln=$FOUND_REAL_NGINX_CONF_LN
2635   _debug "_ln" "$_ln"
2636
2637   _lnn=$(_math $_ln + 1)
2638   _debug _lnn "$_lnn"
2639   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2640   _debug "_start_tag" "$_start_tag"
2641   if [ "$_start_tag" = "$NGINX_START" ]; then
2642     _info "The domain $_d is already configured, skip"
2643     FOUND_REAL_NGINX_CONF=""
2644     return 0
2645   fi
2646
2647   mkdir -p "$DOMAIN_BACKUP_PATH"
2648   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2649   _debug _backup_conf "$_backup_conf"
2650   BACKUP_NGINX_CONF="$_backup_conf"
2651   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2652   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2653     _err "backup error."
2654     FOUND_REAL_NGINX_CONF=""
2655     return 1
2656   fi
2657
2658   if ! _exists "nginx"; then
2659     _err "nginx command is not found."
2660     return 1
2661   fi
2662   _info "Check the nginx conf before setting up."
2663   if ! _exec "nginx -t" >/dev/null; then
2664     _exec_err
2665     return 1
2666   fi
2667
2668   _info "OK, Set up nginx config file"
2669
2670   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2671     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2672     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2673     return 1
2674   fi
2675
2676   echo "$NGINX_START
2677 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
2678   default_type text/plain;
2679   return 200 \"\$1.$_thumbpt\";
2680 }
2681 #NGINX_START
2682 " >>"$FOUND_REAL_NGINX_CONF"
2683
2684   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
2685     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2686     _err "write nginx conf error, but don't worry, the file is restored."
2687     return 1
2688   fi
2689   _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
2690   _info "nginx conf is done, let's check it again."
2691   if ! _exec "nginx -t" >/dev/null; then
2692     _exec_err
2693     _err "It seems that nginx conf was broken, let's restore."
2694     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2695     return 1
2696   fi
2697
2698   _info "Reload nginx"
2699   if ! _exec "nginx -s reload" >/dev/null; then
2700     _exec_err
2701     _err "It seems that nginx reload error, let's restore."
2702     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2703     return 1
2704   fi
2705
2706   return 0
2707 }
2708
2709 #d , conf
2710 _checkConf() {
2711   _d="$1"
2712   _c_file="$2"
2713   _debug "Start _checkConf from:$_c_file"
2714   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
2715     _debug "wildcard"
2716     for _w_f in $2; do
2717       if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
2718         return 0
2719       fi
2720     done
2721     #not found
2722     return 1
2723   elif [ -f "$2" ]; then
2724     _debug "single"
2725     if _isRealNginxConf "$1" "$2"; then
2726       _debug "$2 is found."
2727       FOUND_REAL_NGINX_CONF="$2"
2728       return 0
2729     fi
2730     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
2731       _debug "Try include files"
2732       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
2733         _debug "check included $included"
2734         if _checkConf "$1" "$included"; then
2735           return 0
2736         fi
2737       done
2738     fi
2739     return 1
2740   else
2741     _debug "$2 not found."
2742     return 1
2743   fi
2744   return 1
2745 }
2746
2747 #d , conf
2748 _isRealNginxConf() {
2749   _debug "_isRealNginxConf $1 $2"
2750   if [ -f "$2" ]; then
2751     for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
2752       _debug _fln "$_fln"
2753       if [ "$_fln" ]; then
2754         _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *" | grep -v server_name | _tail_n 1)
2755         _debug "_start" "$_start"
2756         _start_n=$(echo "$_start" | cut -d : -f 1)
2757         _start_nn=$(_math $_start_n + 1)
2758         _debug "_start_n" "$_start_n"
2759         _debug "_start_nn" "$_start_nn"
2760
2761         _left="$(sed -n "${_start_nn},99999p" "$2")"
2762         _debug2 _left "$_left"
2763         if echo "$_left" | tr "\t" ' ' | grep -n "^ *server *" >/dev/null; then
2764           _end=$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *" | _head_n 1)
2765           _debug "_end" "$_end"
2766           _end_n=$(echo "$_end" | cut -d : -f 1)
2767           _debug "_end_n" "$_end_n"
2768           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
2769         else
2770           _seg_n="$_left"
2771         fi
2772
2773         _debug "_seg_n" "$_seg_n"
2774
2775         _skip_ssl=1
2776         for _listen_i in $(echo "$_seg_n" | tr "\t" ' ' | grep "^ *listen" | tr -d " "); do
2777           if [ "$_listen_i" ]; then
2778             if [ "$(echo "$_listen_i" | _egrep_o "listen.*ssl[ |;]")" ]; then
2779               _debug2 "$_listen_i is ssl"
2780             else
2781               _debug2 "$_listen_i is plain text"
2782               _skip_ssl=""
2783               break
2784             fi
2785           fi
2786         done
2787
2788         if [ "$_skip_ssl" = "1" ]; then
2789           _debug "ssl on, skip"
2790         else
2791           FOUND_REAL_NGINX_CONF_LN=$_fln
2792           _debug3 "found FOUND_REAL_NGINX_CONF_LN" "$FOUND_REAL_NGINX_CONF_LN"
2793           return 0
2794         fi
2795       fi
2796     done
2797   fi
2798   return 1
2799 }
2800
2801 #restore all the nginx conf
2802 _restoreNginx() {
2803   if [ -z "$NGINX_RESTORE_VLIST" ]; then
2804     _debug "No need to restore nginx, skip."
2805     return
2806   fi
2807   _debug "_restoreNginx"
2808   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
2809
2810   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
2811     _debug "ng_entry" "$ng_entry"
2812     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
2813     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
2814     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
2815     _info "Restoring from $_ngbackupconf to $_ngconf"
2816     cat "$_ngbackupconf" >"$_ngconf"
2817   done
2818
2819   _info "Reload nginx"
2820   if ! _exec "nginx -s reload" >/dev/null; then
2821     _exec_err
2822     _err "It seems that nginx reload error, please report bug."
2823     return 1
2824   fi
2825   return 0
2826 }
2827
2828 _clearup() {
2829   _stopserver "$serverproc"
2830   serverproc=""
2831   _restoreApache
2832   _restoreNginx
2833   _clearupdns
2834   if [ -z "$DEBUG" ]; then
2835     rm -f "$TLS_CONF"
2836     rm -f "$TLS_CERT"
2837     rm -f "$TLS_KEY"
2838     rm -f "$TLS_CSR"
2839   fi
2840 }
2841
2842 _clearupdns() {
2843   _debug "_clearupdns"
2844   if [ "$dnsadded" != 1 ] || [ -z "$vlist" ]; then
2845     _debug "skip dns."
2846     return
2847   fi
2848
2849   ventries=$(echo "$vlist" | tr ',' ' ')
2850   for ventry in $ventries; do
2851     d=$(echo "$ventry" | cut -d "$sep" -f 1)
2852     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2853     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2854     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2855     txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
2856     _debug txt "$txt"
2857     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
2858       _debug "$d is already verified, skip $vtype."
2859       continue
2860     fi
2861
2862     if [ "$vtype" != "$VTYPE_DNS" ]; then
2863       _info "Skip $d for $vtype"
2864       continue
2865     fi
2866
2867     d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
2868     _debug d_api "$d_api"
2869
2870     if [ -z "$d_api" ]; then
2871       _info "Not Found domain api file: $d_api"
2872       continue
2873     fi
2874
2875     (
2876       if ! . "$d_api"; then
2877         _err "Load file $d_api error. Please check your api file and try again."
2878         return 1
2879       fi
2880
2881       rmcommand="${_currentRoot}_rm"
2882       if ! _exists "$rmcommand"; then
2883         _err "It seems that your api file doesn't define $rmcommand"
2884         return 1
2885       fi
2886
2887       _dns_root_d="$d"
2888       if _startswith "$_dns_root_d" "*."; then
2889         _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
2890       fi
2891       txtdomain="_acme-challenge.$_dns_root_d"
2892
2893       if ! $rmcommand "$txtdomain" "$txt"; then
2894         _err "Error removing txt for domain:$txtdomain"
2895         return 1
2896       fi
2897     )
2898
2899   done
2900 }
2901
2902 # webroot  removelevel tokenfile
2903 _clearupwebbroot() {
2904   __webroot="$1"
2905   if [ -z "$__webroot" ]; then
2906     _debug "no webroot specified, skip"
2907     return 0
2908   fi
2909
2910   _rmpath=""
2911   if [ "$2" = '1' ]; then
2912     _rmpath="$__webroot/.well-known"
2913   elif [ "$2" = '2' ]; then
2914     _rmpath="$__webroot/.well-known/acme-challenge"
2915   elif [ "$2" = '3' ]; then
2916     _rmpath="$__webroot/.well-known/acme-challenge/$3"
2917   else
2918     _debug "Skip for removelevel:$2"
2919   fi
2920
2921   if [ "$_rmpath" ]; then
2922     if [ "$DEBUG" ]; then
2923       _debug "Debugging, skip removing: $_rmpath"
2924     else
2925       rm -rf "$_rmpath"
2926     fi
2927   fi
2928
2929   return 0
2930
2931 }
2932
2933 _on_before_issue() {
2934   _chk_web_roots="$1"
2935   _chk_main_domain="$2"
2936   _chk_alt_domains="$3"
2937   _chk_pre_hook="$4"
2938   _chk_local_addr="$5"
2939   _debug _on_before_issue
2940   #run pre hook
2941   if [ "$_chk_pre_hook" ]; then
2942     _info "Run pre hook:'$_chk_pre_hook'"
2943     if ! (
2944       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
2945     ); then
2946       _err "Error when run pre hook."
2947       return 1
2948     fi
2949   fi
2950
2951   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
2952     if ! _exists "socat"; then
2953       _err "Please install socat tools first."
2954       return 1
2955     fi
2956   fi
2957
2958   _debug Le_LocalAddress "$_chk_local_addr"
2959
2960   alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
2961   _index=1
2962   _currentRoot=""
2963   _addrIndex=1
2964   for d in $alldomains; do
2965     _debug "Check for domain" "$d"
2966     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
2967     _debug "_currentRoot" "$_currentRoot"
2968     _index=$(_math $_index + 1)
2969     _checkport=""
2970     if [ "$_currentRoot" = "$NO_VALUE" ]; then
2971       _info "Standalone mode."
2972       if [ -z "$Le_HTTPPort" ]; then
2973         Le_HTTPPort=80
2974       else
2975         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
2976       fi
2977       _checkport="$Le_HTTPPort"
2978     elif [ "$_currentRoot" = "$W_TLS" ]; then
2979       _info "Standalone tls mode."
2980       if [ -z "$Le_TLSPort" ]; then
2981         Le_TLSPort=443
2982       else
2983         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
2984       fi
2985       _checkport="$Le_TLSPort"
2986     fi
2987
2988     if [ "$_checkport" ]; then
2989       _debug _checkport "$_checkport"
2990       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
2991       _debug _checkaddr "$_checkaddr"
2992
2993       _addrIndex="$(_math $_addrIndex + 1)"
2994
2995       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
2996       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
2997       if [ -z "$netprc" ]; then
2998         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
2999       fi
3000       if [ "$netprc" ]; then
3001         _err "$netprc"
3002         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
3003         _err "Please stop it first"
3004         return 1
3005       fi
3006     fi
3007   done
3008
3009   if _hasfield "$_chk_web_roots" "apache"; then
3010     if ! _setApache; then
3011       _err "set up apache error. Report error to me."
3012       return 1
3013     fi
3014   else
3015     usingApache=""
3016   fi
3017
3018 }
3019
3020 _on_issue_err() {
3021   _chk_post_hook="$1"
3022   _chk_vlist="$2"
3023   _debug _on_issue_err
3024
3025   if [ "$LOG_FILE" ]; then
3026     _err "Please check log file for more details: $LOG_FILE"
3027   else
3028     _err "Please add '--debug' or '--log' to check more details."
3029     _err "See: $_DEBUG_WIKI"
3030   fi
3031
3032   #run the post hook
3033   if [ "$_chk_post_hook" ]; then
3034     _info "Run post hook:'$_chk_post_hook'"
3035     if ! (
3036       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3037     ); then
3038       _err "Error when run post hook."
3039       return 1
3040     fi
3041   fi
3042
3043   #trigger the validation to flush the pending authz
3044   _debug2 "_chk_vlist" "$_chk_vlist"
3045   if [ "$_chk_vlist" ]; then
3046     (
3047       _debug2 "start to deactivate authz"
3048       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
3049       for ventry in $ventries; do
3050         d=$(echo "$ventry" | cut -d "$sep" -f 1)
3051         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3052         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3053         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3054         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3055         __trigger_validation "$uri" "$keyauthorization"
3056       done
3057     )
3058   fi
3059
3060   if [ "$IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "dns"; then
3061     _err "$_DNS_MANUAL_ERR"
3062   fi
3063
3064   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
3065     _debug "$(_dlg_versions)"
3066   fi
3067
3068 }
3069
3070 _on_issue_success() {
3071   _chk_post_hook="$1"
3072   _chk_renew_hook="$2"
3073   _debug _on_issue_success
3074   #run the post hook
3075   if [ "$_chk_post_hook" ]; then
3076     _info "Run post hook:'$_chk_post_hook'"
3077     if ! (
3078       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3079     ); then
3080       _err "Error when run post hook."
3081       return 1
3082     fi
3083   fi
3084
3085   #run renew hook
3086   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
3087     _info "Run renew hook:'$_chk_renew_hook'"
3088     if ! (
3089       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
3090     ); then
3091       _err "Error when run renew hook."
3092       return 1
3093     fi
3094   fi
3095
3096   if _hasfield "$Le_Webroot" "dns"; then
3097     _err "$_DNS_MANUAL_WARN"
3098   fi
3099
3100 }
3101
3102 updateaccount() {
3103   _initpath
3104   _regAccount
3105 }
3106
3107 registeraccount() {
3108   _reg_length="$1"
3109   _initpath
3110   _regAccount "$_reg_length"
3111 }
3112
3113 __calcAccountKeyHash() {
3114   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
3115 }
3116
3117 __calc_account_thumbprint() {
3118   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
3119 }
3120
3121 #keylength
3122 _regAccount() {
3123   _initpath
3124   _reg_length="$1"
3125   _debug3 _regAccount "$_regAccount"
3126   _initAPI
3127
3128   mkdir -p "$CA_DIR"
3129   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3130     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3131     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3132   fi
3133
3134   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3135     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3136     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3137   fi
3138
3139   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3140     if ! _create_account_key "$_reg_length"; then
3141       _err "Create account key error."
3142       return 1
3143     fi
3144   fi
3145
3146   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3147     return 1
3148   fi
3149
3150   if [ "$ACME_VERSION" = "2" ]; then
3151     regjson='{"termsOfServiceAgreed": true}'
3152     if [ "$ACCOUNT_EMAIL" ]; then
3153       regjson='{"contact": ["mailto: '$ACCOUNT_EMAIL'"], "termsOfServiceAgreed": true}'
3154     fi
3155   else
3156     _reg_res="$ACME_NEW_ACCOUNT_RES"
3157     regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
3158     if [ "$ACCOUNT_EMAIL" ]; then
3159       regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
3160     fi
3161   fi
3162
3163   _info "Registering account"
3164
3165   if ! _send_signed_request "${ACME_NEW_ACCOUNT}" "$regjson"; then
3166     _err "Register account Error: $response"
3167     return 1
3168   fi
3169
3170   if [ "$code" = "" ] || [ "$code" = '201' ]; then
3171     echo "$response" >"$ACCOUNT_JSON_PATH"
3172     _info "Registered"
3173   elif [ "$code" = '409' ] || [ "$code" = '200' ]; then
3174     _info "Already registered"
3175   else
3176     _err "Register account Error: $response"
3177     return 1
3178   fi
3179
3180   _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
3181   _debug "_accUri" "$_accUri"
3182   _savecaconf "ACCOUNT_URL" "$_accUri"
3183   export ACCOUNT_URL="$ACCOUNT_URL"
3184
3185   CA_KEY_HASH="$(__calcAccountKeyHash)"
3186   _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3187   _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3188
3189   if [ "$code" = '403' ]; then
3190     _err "It seems that the account key is already deactivated, please use a new account key."
3191     return 1
3192   fi
3193
3194   ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3195   _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3196 }
3197
3198 #Implement deactivate account
3199 deactivateaccount() {
3200   _initpath
3201
3202   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3203     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3204     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3205   fi
3206
3207   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3208     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3209     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3210   fi
3211
3212   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3213     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
3214     return 1
3215   fi
3216
3217   _accUri=$(_readcaconf "ACCOUNT_URL")
3218   _debug _accUri "$_accUri"
3219
3220   if [ -z "$_accUri" ]; then
3221     _err "The account url is empty, please run '--update-account' first to update the account info first,"
3222     _err "Then try again."
3223     return 1
3224   fi
3225
3226   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3227     return 1
3228   fi
3229   _initAPI
3230
3231   if [ "$ACME_VERSION" = "2" ]; then
3232     _djson="{\"status\":\"deactivated\"}"
3233   else
3234     _djson="{\"resource\": \"reg\", \"status\":\"deactivated\"}"
3235   fi
3236   if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
3237     _info "Deactivate account success for $_accUri."
3238     _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
3239   elif [ "$code" = "403" ]; then
3240     _info "The account is already deactivated."
3241     _accid=$(_getfield "$_accUri" "999" "/")
3242   else
3243     _err "Deactivate: account failed for $_accUri."
3244     return 1
3245   fi
3246
3247   _debug "Account id: $_accid"
3248   if [ "$_accid" ]; then
3249     _deactivated_account_path="$CA_DIR/deactivated/$_accid"
3250     _debug _deactivated_account_path "$_deactivated_account_path"
3251     if mkdir -p "$_deactivated_account_path"; then
3252       _info "Moving deactivated account info to $_deactivated_account_path/"
3253       mv "$CA_CONF" "$_deactivated_account_path/"
3254       mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
3255       mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
3256     else
3257       _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
3258       rm -f "$CA_CONF"
3259       rm -f "$ACCOUNT_JSON_PATH"
3260       rm -f "$ACCOUNT_KEY_PATH"
3261     fi
3262   fi
3263 }
3264
3265 # domain folder  file
3266 _findHook() {
3267   _hookdomain="$1"
3268   _hookcat="$2"
3269   _hookname="$3"
3270
3271   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3272     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3273   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3274     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3275   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3276     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3277   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3278     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3279   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3280     d_api="$LE_WORKING_DIR/$_hookname"
3281   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3282     d_api="$LE_WORKING_DIR/$_hookname.sh"
3283   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3284     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3285   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3286     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3287   fi
3288
3289   printf "%s" "$d_api"
3290 }
3291
3292 #domain
3293 __get_domain_new_authz() {
3294   _gdnd="$1"
3295   _info "Getting new-authz for domain" "$_gdnd"
3296   _initAPI
3297   _Max_new_authz_retry_times=5
3298   _authz_i=0
3299   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3300     _debug "Try new-authz for the $_authz_i time."
3301     if ! _send_signed_request "${ACME_NEW_AUTHZ}" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3302       _err "Can not get domain new authz."
3303       return 1
3304     fi
3305     if _contains "$response" "No registration exists matching provided key"; then
3306       _err "It seems there is an error, but it's recovered now, please try again."
3307       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3308       _clearcaconf "CA_KEY_HASH"
3309       break
3310     fi
3311     if ! _contains "$response" "An error occurred while processing your request"; then
3312       _info "The new-authz request is ok."
3313       break
3314     fi
3315     _authz_i="$(_math "$_authz_i" + 1)"
3316     _info "The server is busy, Sleep $_authz_i to retry."
3317     _sleep "$_authz_i"
3318   done
3319
3320   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3321     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3322   fi
3323
3324   if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
3325     _err "new-authz error: $response"
3326     return 1
3327   fi
3328
3329 }
3330
3331 #uri keyAuthorization
3332 __trigger_validation() {
3333   _debug2 "tigger domain validation."
3334   _t_url="$1"
3335   _debug2 _t_url "$_t_url"
3336   _t_key_authz="$2"
3337   _debug2 _t_key_authz "$_t_key_authz"
3338   if [ "$ACME_VERSION" = "2" ]; then
3339     _send_signed_request "$_t_url" "{\"keyAuthorization\": \"$_t_key_authz\"}"
3340   else
3341     _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
3342   fi
3343 }
3344
3345 #webroot, domain domainlist  keylength
3346 issue() {
3347   if [ -z "$2" ]; then
3348     _usage "Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ "
3349     return 1
3350   fi
3351   if [ -z "$1" ]; then
3352     _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
3353     return 1
3354   fi
3355   _web_roots="$1"
3356   _main_domain="$2"
3357   _alt_domains="$3"
3358
3359   if _contains "$_main_domain" ","; then
3360     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
3361     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
3362   fi
3363   _key_length="$4"
3364   _real_cert="$5"
3365   _real_key="$6"
3366   _real_ca="$7"
3367   _reload_cmd="$8"
3368   _real_fullchain="$9"
3369   _pre_hook="${10}"
3370   _post_hook="${11}"
3371   _renew_hook="${12}"
3372   _local_addr="${13}"
3373
3374   #remove these later.
3375   if [ "$_web_roots" = "dns-cf" ]; then
3376     _web_roots="dns_cf"
3377   fi
3378   if [ "$_web_roots" = "dns-dp" ]; then
3379     _web_roots="dns_dp"
3380   fi
3381   if [ "$_web_roots" = "dns-cx" ]; then
3382     _web_roots="dns_cx"
3383   fi
3384
3385   if [ ! "$IS_RENEW" ]; then
3386     _initpath "$_main_domain" "$_key_length"
3387     mkdir -p "$DOMAIN_PATH"
3388   fi
3389
3390   _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
3391
3392   _initAPI
3393
3394   if [ -f "$DOMAIN_CONF" ]; then
3395     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
3396     _debug Le_NextRenewTime "$Le_NextRenewTime"
3397     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3398       _saved_domain=$(_readdomainconf Le_Domain)
3399       _debug _saved_domain "$_saved_domain"
3400       _saved_alt=$(_readdomainconf Le_Alt)
3401       _debug _saved_alt "$_saved_alt"
3402       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
3403         _info "Domains not changed."
3404         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
3405         _info "Add '$(__red '--force')' to force to renew."
3406         return $RENEW_SKIP
3407       else
3408         _info "Domains have changed."
3409       fi
3410     fi
3411   fi
3412
3413   _savedomainconf "Le_Domain" "$_main_domain"
3414   _savedomainconf "Le_Alt" "$_alt_domains"
3415   _savedomainconf "Le_Webroot" "$_web_roots"
3416
3417   _savedomainconf "Le_PreHook" "$_pre_hook"
3418   _savedomainconf "Le_PostHook" "$_post_hook"
3419   _savedomainconf "Le_RenewHook" "$_renew_hook"
3420
3421   if [ "$_local_addr" ]; then
3422     _savedomainconf "Le_LocalAddress" "$_local_addr"
3423   else
3424     _cleardomainconf "Le_LocalAddress"
3425   fi
3426
3427   Le_API="$ACME_DIRECTORY"
3428   _savedomainconf "Le_API" "$Le_API"
3429
3430   if [ "$_alt_domains" = "$NO_VALUE" ]; then
3431     _alt_domains=""
3432   fi
3433
3434   if [ "$_key_length" = "$NO_VALUE" ]; then
3435     _key_length=""
3436   fi
3437
3438   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
3439     _err "_on_before_issue."
3440     return 1
3441   fi
3442
3443   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
3444   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
3445
3446   if [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
3447     if ! _regAccount "$_accountkeylength"; then
3448       _on_issue_err "$_post_hook"
3449       return 1
3450     fi
3451   else
3452     _debug "_saved_account_key_hash is not changed, skip register account."
3453   fi
3454
3455   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
3456     _info "Signing from existing CSR."
3457   else
3458     _key=$(_readdomainconf Le_Keylength)
3459     _debug "Read key length:$_key"
3460     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
3461       if ! createDomainKey "$_main_domain" "$_key_length"; then
3462         _err "Create domain key error."
3463         _clearup
3464         _on_issue_err "$_post_hook"
3465         return 1
3466       fi
3467     fi
3468
3469     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
3470       _err "Create CSR error."
3471       _clearup
3472       _on_issue_err "$_post_hook"
3473       return 1
3474     fi
3475   fi
3476
3477   _savedomainconf "Le_Keylength" "$_key_length"
3478
3479   vlist="$Le_Vlist"
3480
3481   _info "Getting domain auth token for each domain"
3482   sep='#'
3483   dvsep=','
3484   if [ -z "$vlist" ]; then
3485     if [ "$ACME_VERSION" = "2" ]; then
3486       #make new order request
3487       _identifiers="{\"type\":\"dns\",\"value\":\"$_main_domain\"}"
3488       for d in $(echo "$_alt_domains" | tr ',' ' '); do
3489         if [ "$d" ]; then
3490           _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$d\"}"
3491         fi
3492       done
3493       _debug2 _identifiers "$_identifiers"
3494       if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
3495         _err "Create new order error."
3496         _clearup
3497         _on_issue_err "$_post_hook"
3498         return 1
3499       fi
3500
3501       Le_OrderFinalize="$(echo "$response" | tr -d '\r\n' | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
3502       _debug Le_OrderFinalize "$Le_OrderFinalize"
3503       if [ -z "$Le_OrderFinalize" ]; then
3504         _err "Le_OrderFinalize not found."
3505         _clearup
3506         _on_issue_err "$_post_hook"
3507         return 1
3508       fi
3509
3510       #for dns manual mode
3511       _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
3512
3513       _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
3514       _debug2 _authorizations_seg "$_authorizations_seg"
3515       if [ -z "$_authorizations_seg" ]; then
3516         _err "_authorizations_seg not found."
3517         _clearup
3518         _on_issue_err "$_post_hook"
3519         return 1
3520       fi
3521
3522       #domain and authz map
3523       _authorizations_map=""
3524       for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
3525         _debug2 "_authz_url" "$_authz_url"
3526         if ! response="$(_get "$_authz_url")"; then
3527           _err "get to authz error."
3528           _clearup
3529           _on_issue_err "$_post_hook"
3530           return 1
3531         fi
3532
3533         response="$(echo "$response" | _normalizeJson)"
3534         _debug2 response "$response"
3535         _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
3536         if _contains "$response" "\"wildcard\" *: *true"; then
3537           _d="*.$_d"
3538         fi
3539         _debug2 _d "$_d"
3540         _authorizations_map="$_d,$response
3541 $_authorizations_map"
3542       done
3543       _debug2 _authorizations_map "$_authorizations_map"
3544     fi
3545
3546     alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
3547     _index=0
3548     _currentRoot=""
3549     for d in $alldomains; do
3550       _info "Getting webroot for domain" "$d"
3551       _index=$(_math $_index + 1)
3552       _w="$(echo $_web_roots | cut -d , -f $_index)"
3553       _debug _w "$_w"
3554       if [ "$_w" ]; then
3555         _currentRoot="$_w"
3556       fi
3557       _debug "_currentRoot" "$_currentRoot"
3558
3559       vtype="$VTYPE_HTTP"
3560       #todo, v2 wildcard force to use dns
3561       if _startswith "$_currentRoot" "dns"; then
3562         vtype="$VTYPE_DNS"
3563       fi
3564
3565       if [ "$_currentRoot" = "$W_TLS" ]; then
3566         if [ "$ACME_VERSION" = "2" ]; then
3567           vtype="$VTYPE_TLS2"
3568         else
3569           vtype="$VTYPE_TLS"
3570         fi
3571       fi
3572
3573       if [ "$ACME_VERSION" = "2" ]; then
3574         response="$(echo "$_authorizations_map" | grep "^$d," | sed "s/$d,//")"
3575         _debug2 "response" "$response"
3576         if [ -z "$response" ]; then
3577           _err "get to authz error."
3578           _clearup
3579           _on_issue_err "$_post_hook"
3580           return 1
3581         fi
3582       else
3583         if ! __get_domain_new_authz "$d"; then
3584           _clearup
3585           _on_issue_err "$_post_hook"
3586           return 1
3587         fi
3588       fi
3589
3590       if [ -z "$thumbprint" ]; then
3591         thumbprint="$(__calc_account_thumbprint)"
3592       fi
3593
3594       entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
3595       _debug entry "$entry"
3596       if [ -z "$entry" ]; then
3597         _err "Error, can not get domain token $d"
3598         _clearup
3599         _on_issue_err "$_post_hook"
3600         return 1
3601       fi
3602       token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
3603       _debug token "$token"
3604
3605       if [ "$ACME_VERSION" = "2" ]; then
3606         uri="$(printf "%s\n" "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
3607       else
3608         uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
3609       fi
3610       _debug uri "$uri"
3611
3612       keyauthorization="$token.$thumbprint"
3613       _debug keyauthorization "$keyauthorization"
3614
3615       if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
3616         _debug "$d is already verified."
3617         keyauthorization="$STATE_VERIFIED"
3618         _debug keyauthorization "$keyauthorization"
3619       fi
3620
3621       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
3622       _debug dvlist "$dvlist"
3623
3624       vlist="$vlist$dvlist$dvsep"
3625
3626     done
3627     _debug vlist "$vlist"
3628     #add entry
3629     dnsadded=""
3630     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3631     for ventry in $ventries; do
3632       d=$(echo "$ventry" | cut -d "$sep" -f 1)
3633       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3634       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3635       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3636       _debug d "$d"
3637       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3638         _debug "$d is already verified, skip $vtype."
3639         continue
3640       fi
3641
3642       if [ "$vtype" = "$VTYPE_DNS" ]; then
3643         dnsadded='0'
3644         _dns_root_d="$d"
3645         if _startswith "$_dns_root_d" "*."; then
3646           _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
3647         fi
3648         txtdomain="_acme-challenge.$_dns_root_d"
3649         _debug txtdomain "$txtdomain"
3650         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
3651         _debug txt "$txt"
3652
3653         d_api="$(_findHook "$_dns_root_d" dnsapi "$_currentRoot")"
3654
3655         _debug d_api "$d_api"
3656
3657         if [ "$d_api" ]; then
3658           _info "Found domain api file: $d_api"
3659         else
3660           _info "$(__red "Add the following TXT record:")"
3661           _info "$(__red "Domain: '$(__green "$txtdomain")'")"
3662           _info "$(__red "TXT value: '$(__green "$txt")'")"
3663           _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
3664           _info "$(__red "so the resulting subdomain will be: $txtdomain")"
3665           continue
3666         fi
3667
3668         (
3669           if ! . "$d_api"; then
3670             _err "Load file $d_api error. Please check your api file and try again."
3671             return 1
3672           fi
3673
3674           addcommand="${_currentRoot}_add"
3675           if ! _exists "$addcommand"; then
3676             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
3677             return 1
3678           fi
3679
3680           if ! $addcommand "$txtdomain" "$txt"; then
3681             _err "Error add txt for domain:$txtdomain"
3682             return 1
3683           fi
3684         )
3685
3686         if [ "$?" != "0" ]; then
3687           _clearup
3688           _on_issue_err "$_post_hook" "$vlist"
3689           return 1
3690         fi
3691         dnsadded='1'
3692       fi
3693     done
3694
3695     if [ "$dnsadded" = '0' ]; then
3696       _savedomainconf "Le_Vlist" "$vlist"
3697       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
3698       _err "Please add the TXT records to the domains, and retry again."
3699       _clearup
3700       _on_issue_err "$_post_hook"
3701       return 1
3702     fi
3703
3704   fi
3705
3706   if [ "$dnsadded" = '1' ]; then
3707     if [ -z "$Le_DNSSleep" ]; then
3708       Le_DNSSleep="$DEFAULT_DNS_SLEEP"
3709     else
3710       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
3711     fi
3712
3713     _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
3714     _sleep "$Le_DNSSleep"
3715   fi
3716
3717   NGINX_RESTORE_VLIST=""
3718   _debug "ok, let's start to verify"
3719
3720   _ncIndex=1
3721   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3722   for ventry in $ventries; do
3723     d=$(echo "$ventry" | cut -d "$sep" -f 1)
3724     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3725     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3726     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3727     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3728
3729     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3730       _info "$d is already verified, skip $vtype."
3731       continue
3732     fi
3733
3734     _info "Verifying:$d"
3735     _debug "d" "$d"
3736     _debug "keyauthorization" "$keyauthorization"
3737     _debug "uri" "$uri"
3738     removelevel=""
3739     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
3740
3741     _debug "_currentRoot" "$_currentRoot"
3742
3743     if [ "$vtype" = "$VTYPE_HTTP" ]; then
3744       if [ "$_currentRoot" = "$NO_VALUE" ]; then
3745         _info "Standalone mode server"
3746         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3747         _ncIndex="$(_math $_ncIndex + 1)"
3748         _startserver "$keyauthorization" "$_ncaddr"
3749         if [ "$?" != "0" ]; then
3750           _clearup
3751           _on_issue_err "$_post_hook" "$vlist"
3752           return 1
3753         fi
3754         sleep 1
3755         _debug serverproc "$serverproc"
3756       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
3757         _info "Stateless mode for domain:$d"
3758         _sleep 1
3759       elif _startswith "$_currentRoot" "$NGINX"; then
3760         _info "Nginx mode for domain:$d"
3761         #set up nginx server
3762         FOUND_REAL_NGINX_CONF=""
3763         BACKUP_NGINX_CONF=""
3764         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
3765           _clearup
3766           _on_issue_err "$_post_hook" "$vlist"
3767           return 1
3768         fi
3769
3770         if [ "$FOUND_REAL_NGINX_CONF" ]; then
3771           _realConf="$FOUND_REAL_NGINX_CONF"
3772           _backup="$BACKUP_NGINX_CONF"
3773           _debug _realConf "$_realConf"
3774           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
3775         fi
3776         _sleep 1
3777       else
3778         if [ "$_currentRoot" = "apache" ]; then
3779           wellknown_path="$ACME_DIR"
3780         else
3781           wellknown_path="$_currentRoot/.well-known/acme-challenge"
3782           if [ ! -d "$_currentRoot/.well-known" ]; then
3783             removelevel='1'
3784           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
3785             removelevel='2'
3786           else
3787             removelevel='3'
3788           fi
3789         fi
3790
3791         _debug wellknown_path "$wellknown_path"
3792
3793         _debug "writing token:$token to $wellknown_path/$token"
3794
3795         mkdir -p "$wellknown_path"
3796
3797         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
3798           _err "$d:Can not write token to file : $wellknown_path/$token"
3799           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3800           _clearup
3801           _on_issue_err "$_post_hook" "$vlist"
3802           return 1
3803         fi
3804
3805         if [ ! "$usingApache" ]; then
3806           if webroot_owner=$(_stat "$_currentRoot"); then
3807             _debug "Changing owner/group of .well-known to $webroot_owner"
3808             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
3809               _debug "$(cat "$_EXEC_TEMP_ERR")"
3810               _exec_err >/dev/null 2>&1
3811             fi
3812           else
3813             _debug "not changing owner/group of webroot"
3814           fi
3815         fi
3816
3817       fi
3818
3819     elif [ "$vtype" = "$VTYPE_TLS" ]; then
3820       #create A
3821       #_hash_A="$(printf "%s" $token | _digest "sha256" "hex" )"
3822       #_debug2 _hash_A "$_hash_A"
3823       #_x="$(echo $_hash_A | cut -c 1-32)"
3824       #_debug2 _x "$_x"
3825       #_y="$(echo $_hash_A | cut -c 33-64)"
3826       #_debug2 _y "$_y"
3827       #_SAN_A="$_x.$_y.token.acme.invalid"
3828       #_debug2 _SAN_A "$_SAN_A"
3829
3830       #create B
3831       _hash_B="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
3832       _debug2 _hash_B "$_hash_B"
3833       _x="$(echo "$_hash_B" | cut -c 1-32)"
3834       _debug2 _x "$_x"
3835       _y="$(echo "$_hash_B" | cut -c 33-64)"
3836       _debug2 _y "$_y"
3837
3838       #_SAN_B="$_x.$_y.ka.acme.invalid"
3839
3840       _SAN_B="$_x.$_y.acme.invalid"
3841       _debug2 _SAN_B "$_SAN_B"
3842
3843       _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3844       _ncIndex="$(_math "$_ncIndex" + 1)"
3845       if ! _starttlsserver "$_SAN_B" "$_SAN_A" "$Le_TLSPort" "$keyauthorization" "$_ncaddr"; then
3846         _err "Start tls server error."
3847         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3848         _clearup
3849         _on_issue_err "$_post_hook" "$vlist"
3850         return 1
3851       fi
3852     fi
3853
3854     if ! __trigger_validation "$uri" "$keyauthorization"; then
3855       _err "$d:Can not get challenge: $response"
3856       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3857       _clearup
3858       _on_issue_err "$_post_hook" "$vlist"
3859       return 1
3860     fi
3861
3862     if [ "$code" ] && [ "$code" != '202' ]; then
3863       if [ "$ACME_VERSION" = "2" ] && [ "$code" = '200' ]; then
3864         _debug "trigger validation code: $code"
3865       else
3866         _err "$d:Challenge error: $response"
3867         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3868         _clearup
3869         _on_issue_err "$_post_hook" "$vlist"
3870         return 1
3871       fi
3872     fi
3873
3874     waittimes=0
3875     if [ -z "$MAX_RETRY_TIMES" ]; then
3876       MAX_RETRY_TIMES=30
3877     fi
3878
3879     while true; do
3880       waittimes=$(_math "$waittimes" + 1)
3881       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
3882         _err "$d:Timeout"
3883         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3884         _clearup
3885         _on_issue_err "$_post_hook" "$vlist"
3886         return 1
3887       fi
3888
3889       _debug "sleep 2 secs to verify"
3890       sleep 2
3891       _debug "checking"
3892       response="$(_get "$uri")"
3893       if [ "$?" != "0" ]; then
3894         _err "$d:Verify error:$response"
3895         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3896         _clearup
3897         _on_issue_err "$_post_hook" "$vlist"
3898         return 1
3899       fi
3900       _debug2 original "$response"
3901
3902       response="$(echo "$response" | _normalizeJson)"
3903       _debug2 response "$response"
3904
3905       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
3906       if [ "$status" = "valid" ]; then
3907         _info "$(__green Success)"
3908         _stopserver "$serverproc"
3909         serverproc=""
3910         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3911         break
3912       fi
3913
3914       if [ "$status" = "invalid" ]; then
3915         error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
3916         _debug2 error "$error"
3917         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
3918         _debug2 errordetail "$errordetail"
3919         if [ "$errordetail" ]; then
3920           _err "$d:Verify error:$errordetail"
3921         else
3922           _err "$d:Verify error:$error"
3923         fi
3924         if [ "$DEBUG" ]; then
3925           if [ "$vtype" = "$VTYPE_HTTP" ]; then
3926             _debug "Debug: get token url."
3927             _get "http://$d/.well-known/acme-challenge/$token" "" 1
3928           fi
3929         fi
3930         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3931         _clearup
3932         _on_issue_err "$_post_hook" "$vlist"
3933         return 1
3934       fi
3935
3936       if [ "$status" = "pending" ]; then
3937         _info "Pending"
3938       else
3939         _err "$d:Verify error:$response"
3940         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3941         _clearup
3942         _on_issue_err "$_post_hook" "$vlist"
3943         return 1
3944       fi
3945
3946     done
3947
3948   done
3949
3950   _clearup
3951   _info "Verify finished, start to sign."
3952   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
3953
3954   if [ "$ACME_VERSION" = "2" ]; then
3955     if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
3956       _err "Sign failed."
3957       _on_issue_err "$_post_hook"
3958       return 1
3959     fi
3960     if [ "$code" != "200" ]; then
3961       _err "Sign failed, code is not 200."
3962       _on_issue_err "$_post_hook"
3963       return 1
3964     fi
3965     Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
3966
3967     if ! _get "$Le_LinkCert" >"$CERT_PATH"; then
3968       _err "Sign failed, code is not 200."
3969       _on_issue_err "$_post_hook"
3970       return 1
3971     fi
3972
3973     if [ "$(grep -- "$BEGIN_CERT" "$CERT_PATH" | wc -l)" -gt "1" ]; then
3974       _debug "Found cert chain"
3975       cat "$CERT_PATH" >"$CERT_FULLCHAIN_PATH"
3976       _end_n="$(grep -n -- "$END_CERT" "$CERT_FULLCHAIN_PATH" | _head_n 1 | cut -d : -f 1)"
3977       _debug _end_n "$_end_n"
3978       sed -n "1,${_end_n}p" "$CERT_FULLCHAIN_PATH" >"$CERT_PATH"
3979       _end_n="$(_math $_end_n + 1)"
3980       sed -n "${_end_n},9999p" "$CERT_FULLCHAIN_PATH" >"$CA_CERT_PATH"
3981     fi
3982   else
3983     if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
3984       _err "Sign failed."
3985       _on_issue_err "$_post_hook"
3986       return 1
3987     fi
3988     _rcert="$response"
3989     Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
3990     echo "$BEGIN_CERT" >"$CERT_PATH"
3991
3992     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
3993     #  _debug "Get cert failed. Let's try last response."
3994     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
3995     #fi
3996
3997     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
3998       _debug "Try cert link."
3999       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
4000     fi
4001
4002     echo "$END_CERT" >>"$CERT_PATH"
4003   fi
4004
4005   _debug "Le_LinkCert" "$Le_LinkCert"
4006   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
4007
4008   if [ "$Le_LinkCert" ]; then
4009     _info "$(__green "Cert success.")"
4010     cat "$CERT_PATH"
4011
4012     _info "Your cert is in $(__green " $CERT_PATH ")"
4013
4014     if [ -f "$CERT_KEY_PATH" ]; then
4015       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
4016     fi
4017
4018     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
4019
4020     if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
4021       USER_PATH="$PATH"
4022       _saveaccountconf "USER_PATH" "$USER_PATH"
4023     fi
4024   fi
4025
4026   if [ -z "$Le_LinkCert" ]; then
4027     response="$(echo "$response" | _dbase64 "multiline" | _normalizeJson)"
4028     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
4029     _on_issue_err "$_post_hook"
4030     return 1
4031   fi
4032
4033   _cleardomainconf "Le_Vlist"
4034
4035   if [ "$ACME_VERSION" = "2" ]; then
4036     _debug "v2 chain."
4037   else
4038     Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
4039
4040     if [ "$Le_LinkIssuer" ]; then
4041       if ! _contains "$Le_LinkIssuer" ":"; then
4042         _info "$(__red "Relative issuer link found.")"
4043         Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
4044       fi
4045       _debug Le_LinkIssuer "$Le_LinkIssuer"
4046       _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
4047
4048       _link_issuer_retry=0
4049       _MAX_ISSUER_RETRY=5
4050       while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
4051         _debug _link_issuer_retry "$_link_issuer_retry"
4052         if [ "$ACME_VERSION" = "2" ]; then
4053           if _get "$Le_LinkIssuer" >"$CA_CERT_PATH"; then
4054             break
4055           fi
4056         else
4057           if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
4058             echo "$BEGIN_CERT" >"$CA_CERT_PATH"
4059             _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
4060             echo "$END_CERT" >>"$CA_CERT_PATH"
4061             cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
4062             rm -f "$CA_CERT_PATH.der"
4063             break
4064           fi
4065         fi
4066         _link_issuer_retry=$(_math $_link_issuer_retry + 1)
4067         _sleep "$_link_issuer_retry"
4068       done
4069       if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
4070         _err "Max retry for issuer ca cert is reached."
4071       fi
4072     else
4073       _debug "No Le_LinkIssuer header found."
4074     fi
4075   fi
4076   [ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
4077   [ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
4078
4079   Le_CertCreateTime=$(_time)
4080   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
4081
4082   Le_CertCreateTimeStr=$(date -u)
4083   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
4084
4085   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "$MAX_RENEW" ]; then
4086     Le_RenewalDays="$MAX_RENEW"
4087   else
4088     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
4089   fi
4090
4091   if [ "$CA_BUNDLE" ]; then
4092     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
4093   else
4094     _clearaccountconf "CA_BUNDLE"
4095   fi
4096
4097   if [ "$CA_PATH" ]; then
4098     _saveaccountconf CA_PATH "$CA_PATH"
4099   else
4100     _clearaccountconf "CA_PATH"
4101   fi
4102
4103   if [ "$HTTPS_INSECURE" ]; then
4104     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
4105   else
4106     _clearaccountconf "HTTPS_INSECURE"
4107   fi
4108
4109   if [ "$Le_Listen_V4" ]; then
4110     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
4111     _cleardomainconf Le_Listen_V6
4112   elif [ "$Le_Listen_V6" ]; then
4113     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
4114     _cleardomainconf Le_Listen_V4
4115   fi
4116
4117   if [ "$Le_ForceNewDomainKey" = "1" ]; then
4118     _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
4119   else
4120     _cleardomainconf Le_ForceNewDomainKey
4121   fi
4122
4123   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
4124
4125   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
4126   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
4127
4128   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
4129   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
4130
4131   if ! _on_issue_success "$_post_hook" "$_renew_hook"; then
4132     _err "Call hook error."
4133     return 1
4134   fi
4135
4136   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
4137     _savedomainconf "Le_RealCertPath" "$_real_cert"
4138     _savedomainconf "Le_RealCACertPath" "$_real_ca"
4139     _savedomainconf "Le_RealKeyPath" "$_real_key"
4140     _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4141     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4142     _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4143   fi
4144
4145 }
4146
4147 #domain  [isEcc]
4148 renew() {
4149   Le_Domain="$1"
4150   if [ -z "$Le_Domain" ]; then
4151     _usage "Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]"
4152     return 1
4153   fi
4154
4155   _isEcc="$2"
4156
4157   _initpath "$Le_Domain" "$_isEcc"
4158
4159   _info "$(__green "Renew: '$Le_Domain'")"
4160   if [ ! -f "$DOMAIN_CONF" ]; then
4161     _info "'$Le_Domain' is not a issued domain, skip."
4162     return 0
4163   fi
4164
4165   if [ "$Le_RenewalDays" ]; then
4166     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
4167   fi
4168
4169   . "$DOMAIN_CONF"
4170
4171   if [ "$Le_API" ]; then
4172     if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
4173       export Le_API="$DEFAULT_CA"
4174       _savedomainconf Le_API "$Le_API"
4175     fi
4176     if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
4177       export Le_API="$DEFAULT_STAGING_CA"
4178       _savedomainconf Le_API "$Le_API"
4179     fi
4180     export ACME_DIRECTORY="$Le_API"
4181     #reload ca configs
4182     ACCOUNT_KEY_PATH=""
4183     ACCOUNT_JSON_PATH=""
4184     CA_CONF=""
4185     _debug3 "initpath again."
4186     _initpath "$Le_Domain" "$_isEcc"
4187   fi
4188
4189   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
4190     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
4191     _info "Add '$(__red '--force')' to force to renew."
4192     return "$RENEW_SKIP"
4193   fi
4194
4195   if [ "$IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
4196     _info "Skip invalid cert for: $Le_Domain"
4197     return 0
4198   fi
4199
4200   IS_RENEW="1"
4201   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
4202   res="$?"
4203   if [ "$res" != "0" ]; then
4204     return "$res"
4205   fi
4206
4207   if [ "$Le_DeployHook" ]; then
4208     _deploy "$Le_Domain" "$Le_DeployHook"
4209     res="$?"
4210   fi
4211
4212   IS_RENEW=""
4213
4214   return "$res"
4215 }
4216
4217 #renewAll  [stopRenewOnError]
4218 renewAll() {
4219   _initpath
4220   _stopRenewOnError="$1"
4221   _debug "_stopRenewOnError" "$_stopRenewOnError"
4222   _ret="0"
4223
4224   for di in "${CERT_HOME}"/*.*/; do
4225     _debug di "$di"
4226     if ! [ -d "$di" ]; then
4227       _debug "Not directory, skip: $di"
4228       continue
4229     fi
4230     d=$(basename "$di")
4231     _debug d "$d"
4232     (
4233       if _endswith "$d" "$ECC_SUFFIX"; then
4234         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4235         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4236       fi
4237       renew "$d" "$_isEcc"
4238     )
4239     rc="$?"
4240     _debug "Return code: $rc"
4241     if [ "$rc" != "0" ]; then
4242       if [ "$rc" = "$RENEW_SKIP" ]; then
4243         _info "Skipped $d"
4244       elif [ "$_stopRenewOnError" ]; then
4245         _err "Error renew $d,  stop now."
4246         return "$rc"
4247       else
4248         _ret="$rc"
4249         _err "Error renew $d."
4250       fi
4251     fi
4252   done
4253   return "$_ret"
4254 }
4255
4256 #csr webroot
4257 signcsr() {
4258   _csrfile="$1"
4259   _csrW="$2"
4260   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
4261     _usage "Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ "
4262     return 1
4263   fi
4264
4265   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4266   if [ "$?" != "0" ]; then
4267     _err "Can not read subject from csr: $_csrfile"
4268     return 1
4269   fi
4270   _debug _csrsubj "$_csrsubj"
4271   if _contains "$_csrsubj" ' ' || ! _contains "$_csrsubj" '.'; then
4272     _info "It seems that the subject: $_csrsubj is not a valid domain name. Drop it."
4273     _csrsubj=""
4274   fi
4275
4276   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4277   if [ "$?" != "0" ]; then
4278     _err "Can not read domain list from csr: $_csrfile"
4279     return 1
4280   fi
4281   _debug "_csrdomainlist" "$_csrdomainlist"
4282
4283   if [ -z "$_csrsubj" ]; then
4284     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
4285     _debug _csrsubj "$_csrsubj"
4286     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
4287     _debug "_csrdomainlist" "$_csrdomainlist"
4288   fi
4289
4290   if [ -z "$_csrsubj" ]; then
4291     _err "Can not read subject from csr: $_csrfile"
4292     return 1
4293   fi
4294
4295   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4296   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4297     _err "Can not read key length from csr: $_csrfile"
4298     return 1
4299   fi
4300
4301   if [ -z "$ACME_VERSION" ] && _contains "$_csrsubj,$_csrdomainlist" "*."; then
4302     export ACME_VERSION=2
4303   fi
4304   _initpath "$_csrsubj" "$_csrkeylength"
4305   mkdir -p "$DOMAIN_PATH"
4306
4307   _info "Copy csr to: $CSR_PATH"
4308   cp "$_csrfile" "$CSR_PATH"
4309
4310   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength"
4311
4312 }
4313
4314 showcsr() {
4315   _csrfile="$1"
4316   _csrd="$2"
4317   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
4318     _usage "Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr"
4319     return 1
4320   fi
4321
4322   _initpath
4323
4324   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4325   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
4326     _err "Can not read subject from csr: $_csrfile"
4327     return 1
4328   fi
4329
4330   _info "Subject=$_csrsubj"
4331
4332   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4333   if [ "$?" != "0" ]; then
4334     _err "Can not read domain list from csr: $_csrfile"
4335     return 1
4336   fi
4337   _debug "_csrdomainlist" "$_csrdomainlist"
4338
4339   _info "SubjectAltNames=$_csrdomainlist"
4340
4341   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4342   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4343     _err "Can not read key length from csr: $_csrfile"
4344     return 1
4345   fi
4346   _info "KeyLength=$_csrkeylength"
4347 }
4348
4349 list() {
4350   _raw="$1"
4351   _initpath
4352
4353   _sep="|"
4354   if [ "$_raw" ]; then
4355     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
4356     for di in "${CERT_HOME}"/*.*/; do
4357       if ! [ -d "$di" ]; then
4358         _debug "Not directory, skip: $di"
4359         continue
4360       fi
4361       d=$(basename "$di")
4362       _debug d "$d"
4363       (
4364         if _endswith "$d" "$ECC_SUFFIX"; then
4365           _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4366           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4367         fi
4368         _initpath "$d" "$_isEcc"
4369         if [ -f "$DOMAIN_CONF" ]; then
4370           . "$DOMAIN_CONF"
4371           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
4372         fi
4373       )
4374     done
4375   else
4376     if _exists column; then
4377       list "raw" | column -t -s "$_sep"
4378     else
4379       list "raw" | tr "$_sep" '\t'
4380     fi
4381   fi
4382
4383 }
4384
4385 _deploy() {
4386   _d="$1"
4387   _hooks="$2"
4388
4389   for _d_api in $(echo "$_hooks" | tr ',' " "); do
4390     _deployApi="$(_findHook "$_d" deploy "$_d_api")"
4391     if [ -z "$_deployApi" ]; then
4392       _err "The deploy hook $_d_api is not found."
4393       return 1
4394     fi
4395     _debug _deployApi "$_deployApi"
4396
4397     if ! (
4398       if ! . "$_deployApi"; then
4399         _err "Load file $_deployApi error. Please check your api file and try again."
4400         return 1
4401       fi
4402
4403       d_command="${_d_api}_deploy"
4404       if ! _exists "$d_command"; then
4405         _err "It seems that your api file is not correct, it must have a function named: $d_command"
4406         return 1
4407       fi
4408
4409       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
4410         _err "Error deploy for domain:$_d"
4411         return 1
4412       fi
4413     ); then
4414       _err "Deploy error."
4415       return 1
4416     else
4417       _info "$(__green Success)"
4418     fi
4419   done
4420 }
4421
4422 #domain hooks
4423 deploy() {
4424   _d="$1"
4425   _hooks="$2"
4426   _isEcc="$3"
4427   if [ -z "$_hooks" ]; then
4428     _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
4429     return 1
4430   fi
4431
4432   _initpath "$_d" "$_isEcc"
4433   if [ ! -d "$DOMAIN_PATH" ]; then
4434     _err "Domain is not valid:'$_d'"
4435     return 1
4436   fi
4437
4438   . "$DOMAIN_CONF"
4439
4440   _savedomainconf Le_DeployHook "$_hooks"
4441
4442   _deploy "$_d" "$_hooks"
4443 }
4444
4445 installcert() {
4446   _main_domain="$1"
4447   if [ -z "$_main_domain" ]; then
4448     _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
4449     return 1
4450   fi
4451
4452   _real_cert="$2"
4453   _real_key="$3"
4454   _real_ca="$4"
4455   _reload_cmd="$5"
4456   _real_fullchain="$6"
4457   _isEcc="$7"
4458
4459   _initpath "$_main_domain" "$_isEcc"
4460   if [ ! -d "$DOMAIN_PATH" ]; then
4461     _err "Domain is not valid:'$_main_domain'"
4462     return 1
4463   fi
4464
4465   _savedomainconf "Le_RealCertPath" "$_real_cert"
4466   _savedomainconf "Le_RealCACertPath" "$_real_ca"
4467   _savedomainconf "Le_RealKeyPath" "$_real_key"
4468   _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4469   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4470
4471   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4472 }
4473
4474 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
4475 _installcert() {
4476   _main_domain="$1"
4477   _real_cert="$2"
4478   _real_key="$3"
4479   _real_ca="$4"
4480   _real_fullchain="$5"
4481   _reload_cmd="$6"
4482   _backup_prefix="$7"
4483
4484   if [ "$_real_cert" = "$NO_VALUE" ]; then
4485     _real_cert=""
4486   fi
4487   if [ "$_real_key" = "$NO_VALUE" ]; then
4488     _real_key=""
4489   fi
4490   if [ "$_real_ca" = "$NO_VALUE" ]; then
4491     _real_ca=""
4492   fi
4493   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
4494     _reload_cmd=""
4495   fi
4496   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
4497     _real_fullchain=""
4498   fi
4499
4500   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
4501   mkdir -p "$_backup_path"
4502
4503   if [ "$_real_cert" ]; then
4504     _info "Installing cert to:$_real_cert"
4505     if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
4506       cp "$_real_cert" "$_backup_path/cert.bak"
4507     fi
4508     cat "$CERT_PATH" >"$_real_cert"
4509   fi
4510
4511   if [ "$_real_ca" ]; then
4512     _info "Installing CA to:$_real_ca"
4513     if [ "$_real_ca" = "$_real_cert" ]; then
4514       echo "" >>"$_real_ca"
4515       cat "$CA_CERT_PATH" >>"$_real_ca"
4516     else
4517       if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
4518         cp "$_real_ca" "$_backup_path/ca.bak"
4519       fi
4520       cat "$CA_CERT_PATH" >"$_real_ca"
4521     fi
4522   fi
4523
4524   if [ "$_real_key" ]; then
4525     _info "Installing key to:$_real_key"
4526     if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
4527       cp "$_real_key" "$_backup_path/key.bak"
4528     fi
4529     if [ -f "$_real_key" ]; then
4530       cat "$CERT_KEY_PATH" >"$_real_key"
4531     else
4532       cat "$CERT_KEY_PATH" >"$_real_key"
4533       chmod 700 "$_real_key"
4534     fi
4535   fi
4536
4537   if [ "$_real_fullchain" ]; then
4538     _info "Installing full chain to:$_real_fullchain"
4539     if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
4540       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
4541     fi
4542     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain"
4543   fi
4544
4545   if [ "$_reload_cmd" ]; then
4546     _info "Run reload cmd: $_reload_cmd"
4547     if (
4548       export CERT_PATH
4549       export CERT_KEY_PATH
4550       export CA_CERT_PATH
4551       export CERT_FULLCHAIN_PATH
4552       export Le_Domain
4553       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
4554     ); then
4555       _info "$(__green "Reload success")"
4556     else
4557       _err "Reload error for :$Le_Domain"
4558     fi
4559   fi
4560
4561 }
4562
4563 #confighome
4564 installcronjob() {
4565   _c_home="$1"
4566   _initpath
4567   _CRONTAB="crontab"
4568   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
4569     _CRONTAB="fcrontab"
4570   fi
4571   if ! _exists "$_CRONTAB"; then
4572     _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
4573     _err "All your certs will not be renewed automatically."
4574     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
4575     return 1
4576   fi
4577
4578   _info "Installing cron job"
4579   if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
4580     if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
4581       lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
4582     else
4583       _err "Can not install cronjob, $PROJECT_ENTRY not found."
4584       return 1
4585     fi
4586
4587     if [ "$_c_home" ]; then
4588       _c_entry="--config-home \"$_c_home\" "
4589     fi
4590     _t=$(_time)
4591     random_minute=$(_math $_t % 60)
4592     if _exists uname && uname -a | grep SunOS >/dev/null; then
4593       $_CRONTAB -l | {
4594         cat
4595         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4596       } | $_CRONTAB --
4597     else
4598       $_CRONTAB -l | {
4599         cat
4600         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4601       } | $_CRONTAB -
4602     fi
4603   fi
4604   if [ "$?" != "0" ]; then
4605     _err "Install cron job failed. You need to manually renew your certs."
4606     _err "Or you can add cronjob by yourself:"
4607     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
4608     return 1
4609   fi
4610 }
4611
4612 uninstallcronjob() {
4613   _CRONTAB="crontab"
4614   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
4615     _CRONTAB="fcrontab"
4616   fi
4617
4618   if ! _exists "$_CRONTAB"; then
4619     return
4620   fi
4621   _info "Removing cron job"
4622   cr="$($_CRONTAB -l | grep "$PROJECT_ENTRY --cron")"
4623   if [ "$cr" ]; then
4624     if _exists uname && uname -a | grep solaris >/dev/null; then
4625       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB --
4626     else
4627       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB -
4628     fi
4629     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
4630     _info LE_WORKING_DIR "$LE_WORKING_DIR"
4631     if _contains "$cr" "--config-home"; then
4632       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
4633       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
4634     fi
4635   fi
4636   _initpath
4637
4638 }
4639
4640 revoke() {
4641   Le_Domain="$1"
4642   if [ -z "$Le_Domain" ]; then
4643     _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]"
4644     return 1
4645   fi
4646
4647   _isEcc="$2"
4648
4649   _initpath "$Le_Domain" "$_isEcc"
4650   if [ ! -f "$DOMAIN_CONF" ]; then
4651     _err "$Le_Domain is not a issued domain, skip."
4652     return 1
4653   fi
4654
4655   if [ ! -f "$CERT_PATH" ]; then
4656     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
4657     return 1
4658   fi
4659
4660   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
4661
4662   if [ -z "$cert" ]; then
4663     _err "Cert for $Le_Domain is empty found, skip."
4664     return 1
4665   fi
4666
4667   _initAPI
4668
4669   if [ "$ACME_VERSION" = "2" ]; then
4670     data="{\"certificate\": \"$cert\"}"
4671   else
4672     data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
4673   fi
4674   uri="${ACME_REVOKE_CERT}"
4675
4676   if [ -f "$CERT_KEY_PATH" ]; then
4677     _info "Try domain key first."
4678     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
4679       if [ -z "$response" ]; then
4680         _info "Revoke success."
4681         rm -f "$CERT_PATH"
4682         return 0
4683       else
4684         _err "Revoke error by domain key."
4685         _err "$response"
4686       fi
4687     fi
4688   else
4689     _info "Domain key file doesn't exists."
4690   fi
4691
4692   _info "Try account key."
4693
4694   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
4695     if [ -z "$response" ]; then
4696       _info "Revoke success."
4697       rm -f "$CERT_PATH"
4698       return 0
4699     else
4700       _err "Revoke error."
4701       _debug "$response"
4702     fi
4703   fi
4704   return 1
4705 }
4706
4707 #domain  ecc
4708 remove() {
4709   Le_Domain="$1"
4710   if [ -z "$Le_Domain" ]; then
4711     _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
4712     return 1
4713   fi
4714
4715   _isEcc="$2"
4716
4717   _initpath "$Le_Domain" "$_isEcc"
4718   _removed_conf="$DOMAIN_CONF.removed"
4719   if [ ! -f "$DOMAIN_CONF" ]; then
4720     if [ -f "$_removed_conf" ]; then
4721       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
4722     else
4723       _err "$Le_Domain is not a issued domain, skip."
4724     fi
4725     return 1
4726   fi
4727
4728   if mv "$DOMAIN_CONF" "$_removed_conf"; then
4729     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
4730     _info "You can remove them by yourself."
4731     return 0
4732   else
4733     _err "Remove $Le_Domain failed."
4734     return 1
4735   fi
4736 }
4737
4738 #domain vtype
4739 _deactivate() {
4740   _d_domain="$1"
4741   _d_type="$2"
4742   _initpath
4743
4744   if [ "$ACME_VERSION" = "2" ]; then
4745     _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
4746     if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
4747       _err "Can not get domain new order."
4748       return 1
4749     fi
4750     _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
4751     _debug2 _authorizations_seg "$_authorizations_seg"
4752     if [ -z "$_authorizations_seg" ]; then
4753       _err "_authorizations_seg not found."
4754       _clearup
4755       _on_issue_err "$_post_hook"
4756       return 1
4757     fi
4758
4759     authzUri="$_authorizations_seg"
4760     _debug2 "authzUri" "$authzUri"
4761     if ! response="$(_get "$authzUri")"; then
4762       _err "get to authz error."
4763       _clearup
4764       _on_issue_err "$_post_hook"
4765       return 1
4766     fi
4767
4768     response="$(echo "$response" | _normalizeJson)"
4769     _debug2 response "$response"
4770     _URL_NAME="url"
4771   else
4772     if ! __get_domain_new_authz "$_d_domain"; then
4773       _err "Can not get domain new authz token."
4774       return 1
4775     fi
4776
4777     authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
4778     _debug "authzUri" "$authzUri"
4779     if [ "$code" ] && [ ! "$code" = '201' ]; then
4780       _err "new-authz error: $response"
4781       return 1
4782     fi
4783     _URL_NAME="uri"
4784   fi
4785
4786   entries="$(echo "$response" | _egrep_o "{ *\"type\":\"[^\"]*\", *\"status\": *\"valid\", *\"$_URL_NAME\"[^}]*")"
4787   if [ -z "$entries" ]; then
4788     _info "No valid entries found."
4789     if [ -z "$thumbprint" ]; then
4790       thumbprint="$(__calc_account_thumbprint)"
4791     fi
4792     _debug "Trigger validation."
4793     vtype="$VTYPE_DNS"
4794     entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
4795     _debug entry "$entry"
4796     if [ -z "$entry" ]; then
4797       _err "Error, can not get domain token $d"
4798       return 1
4799     fi
4800     token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
4801     _debug token "$token"
4802
4803     uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
4804     _debug uri "$uri"
4805
4806     keyauthorization="$token.$thumbprint"
4807     _debug keyauthorization "$keyauthorization"
4808     __trigger_validation "$uri" "$keyauthorization"
4809
4810   fi
4811
4812   _d_i=0
4813   _d_max_retry=$(echo "$entries" | wc -l)
4814   while [ "$_d_i" -lt "$_d_max_retry" ]; do
4815     _info "Deactivate: $_d_domain"
4816     _d_i="$(_math $_d_i + 1)"
4817     entry="$(echo "$entries" | sed -n "${_d_i}p")"
4818     _debug entry "$entry"
4819
4820     if [ -z "$entry" ]; then
4821       _info "No more valid entry found."
4822       break
4823     fi
4824
4825     _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
4826     _debug _vtype "$_vtype"
4827     _info "Found $_vtype"
4828
4829     uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
4830     _debug uri "$uri"
4831
4832     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
4833       _info "Skip $_vtype"
4834       continue
4835     fi
4836
4837     _info "Deactivate: $_vtype"
4838
4839     if [ "$ACME_VERSION" = "2" ]; then
4840       _djson="{\"status\":\"deactivated\"}"
4841     else
4842       _djson="{\"resource\": \"authz\", \"status\":\"deactivated\"}"
4843     fi
4844
4845     if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
4846       _info "Deactivate: $_vtype success."
4847     else
4848       _err "Can not deactivate $_vtype."
4849       break
4850     fi
4851
4852   done
4853   _debug "$_d_i"
4854   if [ "$_d_i" -eq "$_d_max_retry" ]; then
4855     _info "Deactivated success!"
4856   else
4857     _err "Deactivate failed."
4858   fi
4859
4860 }
4861
4862 deactivate() {
4863   _d_domain_list="$1"
4864   _d_type="$2"
4865   _initpath
4866   _initAPI
4867   _debug _d_domain_list "$_d_domain_list"
4868   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
4869     _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
4870     return 1
4871   fi
4872   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
4873     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
4874       continue
4875     fi
4876     if ! _deactivate "$_d_dm" "$_d_type"; then
4877       return 1
4878     fi
4879   done
4880 }
4881
4882 # Detect profile file if not specified as environment variable
4883 _detect_profile() {
4884   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
4885     echo "$PROFILE"
4886     return
4887   fi
4888
4889   DETECTED_PROFILE=''
4890   SHELLTYPE="$(basename "/$SHELL")"
4891
4892   if [ "$SHELLTYPE" = "bash" ]; then
4893     if [ -f "$HOME/.bashrc" ]; then
4894       DETECTED_PROFILE="$HOME/.bashrc"
4895     elif [ -f "$HOME/.bash_profile" ]; then
4896       DETECTED_PROFILE="$HOME/.bash_profile"
4897     fi
4898   elif [ "$SHELLTYPE" = "zsh" ]; then
4899     DETECTED_PROFILE="$HOME/.zshrc"
4900   fi
4901
4902   if [ -z "$DETECTED_PROFILE" ]; then
4903     if [ -f "$HOME/.profile" ]; then
4904       DETECTED_PROFILE="$HOME/.profile"
4905     elif [ -f "$HOME/.bashrc" ]; then
4906       DETECTED_PROFILE="$HOME/.bashrc"
4907     elif [ -f "$HOME/.bash_profile" ]; then
4908       DETECTED_PROFILE="$HOME/.bash_profile"
4909     elif [ -f "$HOME/.zshrc" ]; then
4910       DETECTED_PROFILE="$HOME/.zshrc"
4911     fi
4912   fi
4913
4914   echo "$DETECTED_PROFILE"
4915 }
4916
4917 _initconf() {
4918   _initpath
4919   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4920     echo "
4921
4922 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
4923 #LOG_LEVEL=1
4924
4925 #AUTO_UPGRADE=\"1\"
4926
4927 #NO_TIMESTAMP=1
4928
4929     " >"$ACCOUNT_CONF_PATH"
4930   fi
4931 }
4932
4933 # nocron
4934 _precheck() {
4935   _nocron="$1"
4936
4937   if ! _exists "curl" && ! _exists "wget"; then
4938     _err "Please install curl or wget first, we need to access http resources."
4939     return 1
4940   fi
4941
4942   if [ -z "$_nocron" ]; then
4943     if ! _exists "crontab" && ! _exists "fcrontab"; then
4944       _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
4945       _err "We need to set cron job to renew the certs automatically."
4946       _err "Otherwise, your certs will not be able to be renewed automatically."
4947       if [ -z "$FORCE" ]; then
4948         _err "Please add '--force' and try install again to go without crontab."
4949         _err "./$PROJECT_ENTRY --install --force"
4950         return 1
4951       fi
4952     fi
4953   fi
4954
4955   if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
4956     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
4957     _err "We need openssl to generate keys."
4958     return 1
4959   fi
4960
4961   if ! _exists "socat"; then
4962     _err "It is recommended to install socat first."
4963     _err "We use socat for standalone server if you use standalone mode."
4964     _err "If you don't use standalone mode, just ignore this warning."
4965   fi
4966
4967   return 0
4968 }
4969
4970 _setShebang() {
4971   _file="$1"
4972   _shebang="$2"
4973   if [ -z "$_shebang" ]; then
4974     _usage "Usage: file shebang"
4975     return 1
4976   fi
4977   cp "$_file" "$_file.tmp"
4978   echo "$_shebang" >"$_file"
4979   sed -n 2,99999p "$_file.tmp" >>"$_file"
4980   rm -f "$_file.tmp"
4981 }
4982
4983 #confighome
4984 _installalias() {
4985   _c_home="$1"
4986   _initpath
4987
4988   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4989   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
4990     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
4991     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
4992     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
4993   fi
4994
4995   if [ "$_c_home" ]; then
4996     _c_entry=" --config-home '$_c_home'"
4997   fi
4998
4999   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
5000   if [ "$_c_home" ]; then
5001     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
5002   else
5003     _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
5004   fi
5005   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
5006
5007   _profile="$(_detect_profile)"
5008   if [ "$_profile" ]; then
5009     _debug "Found profile: $_profile"
5010     _info "Installing alias to '$_profile'"
5011     _setopt "$_profile" ". \"$_envfile\""
5012     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
5013   else
5014     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
5015   fi
5016
5017   #for csh
5018   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
5019   _csh_profile="$HOME/.cshrc"
5020   if [ -f "$_csh_profile" ]; then
5021     _info "Installing alias to '$_csh_profile'"
5022     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
5023     if [ "$_c_home" ]; then
5024       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
5025     else
5026       _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
5027     fi
5028     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
5029     _setopt "$_csh_profile" "source \"$_cshfile\""
5030   fi
5031
5032   #for tcsh
5033   _tcsh_profile="$HOME/.tcshrc"
5034   if [ -f "$_tcsh_profile" ]; then
5035     _info "Installing alias to '$_tcsh_profile'"
5036     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
5037     if [ "$_c_home" ]; then
5038       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
5039     fi
5040     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
5041     _setopt "$_tcsh_profile" "source \"$_cshfile\""
5042   fi
5043
5044 }
5045
5046 # nocron confighome
5047 install() {
5048
5049   if [ -z "$LE_WORKING_DIR" ]; then
5050     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
5051   fi
5052
5053   _nocron="$1"
5054   _c_home="$2"
5055   if ! _initpath; then
5056     _err "Install failed."
5057     return 1
5058   fi
5059   if [ "$_nocron" ]; then
5060     _debug "Skip install cron job"
5061   fi
5062
5063   if [ "$IN_CRON" != "1" ]; then
5064     if ! _precheck "$_nocron"; then
5065       _err "Pre-check failed, can not install."
5066       return 1
5067     fi
5068   fi
5069
5070   if [ -z "$_c_home" ] && [ "$LE_CONFIG_HOME" != "$LE_WORKING_DIR" ]; then
5071     _info "Using config home: $LE_CONFIG_HOME"
5072     _c_home="$LE_CONFIG_HOME"
5073   fi
5074
5075   #convert from le
5076   if [ -d "$HOME/.le" ]; then
5077     for envfile in "le.env" "le.sh.env"; do
5078       if [ -f "$HOME/.le/$envfile" ]; then
5079         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
5080           _upgrading="1"
5081           _info "You are upgrading from le.sh"
5082           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
5083           mv "$HOME/.le" "$LE_WORKING_DIR"
5084           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
5085           break
5086         fi
5087       fi
5088     done
5089   fi
5090
5091   _info "Installing to $LE_WORKING_DIR"
5092
5093   if [ ! -d "$LE_WORKING_DIR" ]; then
5094     if ! mkdir -p "$LE_WORKING_DIR"; then
5095       _err "Can not create working dir: $LE_WORKING_DIR"
5096       return 1
5097     fi
5098
5099     chmod 700 "$LE_WORKING_DIR"
5100   fi
5101
5102   if [ ! -d "$LE_CONFIG_HOME" ]; then
5103     if ! mkdir -p "$LE_CONFIG_HOME"; then
5104       _err "Can not create config dir: $LE_CONFIG_HOME"
5105       return 1
5106     fi
5107
5108     chmod 700 "$LE_CONFIG_HOME"
5109   fi
5110
5111   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
5112
5113   if [ "$?" != "0" ]; then
5114     _err "Install failed, can not copy $PROJECT_ENTRY"
5115     return 1
5116   fi
5117
5118   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
5119
5120   if [ "$IN_CRON" != "1" ]; then
5121     _installalias "$_c_home"
5122   fi
5123
5124   for subf in $_SUB_FOLDERS; do
5125     if [ -d "$subf" ]; then
5126       mkdir -p "$LE_WORKING_DIR/$subf"
5127       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
5128     fi
5129   done
5130
5131   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
5132     _initconf
5133   fi
5134
5135   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
5136     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
5137   fi
5138
5139   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
5140     _saveaccountconf "CERT_HOME" "$CERT_HOME"
5141   fi
5142
5143   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
5144     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
5145   fi
5146
5147   if [ -z "$_nocron" ]; then
5148     installcronjob "$_c_home"
5149   fi
5150
5151   if [ -z "$NO_DETECT_SH" ]; then
5152     #Modify shebang
5153     if _exists bash; then
5154       _info "Good, bash is found, so change the shebang to use bash as preferred."
5155       _shebang='#!'"$(bash -c "command -v bash")"
5156       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
5157       for subf in $_SUB_FOLDERS; do
5158         if [ -d "$LE_WORKING_DIR/$subf" ]; then
5159           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
5160             _setShebang "$_apifile" "$_shebang"
5161           done
5162         fi
5163       done
5164     fi
5165   fi
5166
5167   _info OK
5168 }
5169
5170 # nocron
5171 uninstall() {
5172   _nocron="$1"
5173   if [ -z "$_nocron" ]; then
5174     uninstallcronjob
5175   fi
5176   _initpath
5177
5178   _uninstallalias
5179
5180   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
5181   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
5182
5183 }
5184
5185 _uninstallalias() {
5186   _initpath
5187
5188   _profile="$(_detect_profile)"
5189   if [ "$_profile" ]; then
5190     _info "Uninstalling alias from: '$_profile'"
5191     text="$(cat "$_profile")"
5192     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
5193   fi
5194
5195   _csh_profile="$HOME/.cshrc"
5196   if [ -f "$_csh_profile" ]; then
5197     _info "Uninstalling alias from: '$_csh_profile'"
5198     text="$(cat "$_csh_profile")"
5199     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
5200   fi
5201
5202   _tcsh_profile="$HOME/.tcshrc"
5203   if [ -f "$_tcsh_profile" ]; then
5204     _info "Uninstalling alias from: '$_csh_profile'"
5205     text="$(cat "$_tcsh_profile")"
5206     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
5207   fi
5208
5209 }
5210
5211 cron() {
5212   export IN_CRON=1
5213   _initpath
5214   _info "$(__green "===Starting cron===")"
5215   if [ "$AUTO_UPGRADE" = "1" ]; then
5216     export LE_WORKING_DIR
5217     (
5218       if ! upgrade; then
5219         _err "Cron:Upgrade failed!"
5220         return 1
5221       fi
5222     )
5223     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
5224
5225     if [ -t 1 ]; then
5226       __INTERACTIVE="1"
5227     fi
5228
5229     _info "Auto upgraded to: $VER"
5230   fi
5231   renewAll
5232   _ret="$?"
5233   IN_CRON=""
5234   _info "$(__green "===End cron===")"
5235   exit $_ret
5236 }
5237
5238 version() {
5239   echo "$PROJECT"
5240   echo "v$VER"
5241 }
5242
5243 showhelp() {
5244   _initpath
5245   version
5246   echo "Usage: $PROJECT_ENTRY  command ...[parameters]....
5247 Commands:
5248   --help, -h               Show this help message.
5249   --version, -v            Show version info.
5250   --install                Install $PROJECT_NAME to your system.
5251   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
5252   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
5253   --issue                  Issue a cert.
5254   --signcsr                Issue a cert from an existing csr.
5255   --deploy                 Deploy the cert to your server.
5256   --install-cert           Install the issued cert to apache/nginx or any other server.
5257   --renew, -r              Renew a cert.
5258   --renew-all              Renew all the certs.
5259   --revoke                 Revoke a cert.
5260   --remove                 Remove the cert from list of certs known to $PROJECT_NAME.
5261   --list                   List all the certs.
5262   --showcsr                Show the content of a csr.
5263   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
5264   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
5265   --cron                   Run cron job to renew all the certs.
5266   --toPkcs                 Export the certificate and key to a pfx file.
5267   --toPkcs8                Convert to pkcs8 format.
5268   --update-account         Update account info.
5269   --register-account       Register account key.
5270   --deactivate-account     Deactivate the account.
5271   --create-account-key     Create an account private key, professional use.
5272   --create-domain-key      Create an domain private key, professional use.
5273   --createCSR, -ccsr       Create CSR , professional use.
5274   --deactivate             Deactivate the domain authz, professional use.
5275
5276 Parameters:
5277   --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
5278   --force, -f                       Used to force to install or force to renew a cert immediately.
5279   --staging, --test                 Use staging server, just for test.
5280   --debug                           Output debug info.
5281   --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
5282   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
5283   --standalone                      Use standalone mode.
5284   --stateless                       Use stateless mode, see: $_STATELESS_WIKI
5285   --tls                             Use standalone tls mode.
5286   --apache                          Use apache mode.
5287   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
5288   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
5289
5290   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
5291   --accountkeylength, -ak [2048]    Specifies the account key length.
5292   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
5293   --log-level 1|2                   Specifies the log level, default is 1.
5294   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
5295
5296   These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
5297
5298   --cert-file                       After issue/renew, the cert will be copied to this path.
5299   --key-file                        After issue/renew, the key will be copied to this path.
5300   --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
5301   --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.
5302
5303   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
5304
5305   --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
5306   --accountconf                     Specifies a customized account config file.
5307   --home                            Specifies the home dir for $PROJECT_NAME .
5308   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
5309   --config-home                     Specifies the home dir to save all the configurations.
5310   --useragent                       Specifies the user agent string. it will be saved for future use too.
5311   --accountemail                    Specifies the account email for registering, Only valid for the '--install' command.
5312   --accountkey                      Specifies the account key path, Only valid for the '--install' command.
5313   --days                            Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
5314   --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
5315   --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
5316   --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
5317   --listraw                         Only used for '--list' command, list the certs in raw format.
5318   --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
5319   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
5320   --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
5321   --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
5322   --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
5323   --no-color                        Do not output color text.
5324   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
5325   --csr                             Specifies the input csr.
5326   --pre-hook                        Command to be run before obtaining any certificates.
5327   --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
5328   --renew-hook                      Command to be run once for each successfully renewed certificate.
5329   --deploy-hook                     The hook file to deploy cert
5330   --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
5331   --always-force-new-domain-key     Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
5332   --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
5333   --listen-v4                       Force standalone/tls server to listen at ipv4.
5334   --listen-v6                       Force standalone/tls server to listen at ipv6.
5335   --openssl-bin                     Specifies a custom openssl bin location.
5336   --use-wget                        Force to use wget, if you have both curl and wget installed.
5337   "
5338 }
5339
5340 # nocron
5341 _installOnline() {
5342   _info "Installing from online archive."
5343   _nocron="$1"
5344   if [ ! "$BRANCH" ]; then
5345     BRANCH="master"
5346   fi
5347
5348   target="$PROJECT/archive/$BRANCH.tar.gz"
5349   _info "Downloading $target"
5350   localname="$BRANCH.tar.gz"
5351   if ! _get "$target" >$localname; then
5352     _err "Download error."
5353     return 1
5354   fi
5355   (
5356     _info "Extracting $localname"
5357     if ! (tar xzf $localname || gtar xzf $localname); then
5358       _err "Extraction error."
5359       exit 1
5360     fi
5361
5362     cd "$PROJECT_NAME-$BRANCH"
5363     chmod +x $PROJECT_ENTRY
5364     if ./$PROJECT_ENTRY install "$_nocron"; then
5365       _info "Install success!"
5366     fi
5367
5368     cd ..
5369
5370     rm -rf "$PROJECT_NAME-$BRANCH"
5371     rm -f "$localname"
5372   )
5373 }
5374
5375 upgrade() {
5376   if (
5377     _initpath
5378     export LE_WORKING_DIR
5379     cd "$LE_WORKING_DIR"
5380     _installOnline "nocron"
5381   ); then
5382     _info "Upgrade success!"
5383     exit 0
5384   else
5385     _err "Upgrade failed!"
5386     exit 1
5387   fi
5388 }
5389
5390 _processAccountConf() {
5391   if [ "$_useragent" ]; then
5392     _saveaccountconf "USER_AGENT" "$_useragent"
5393   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
5394     _saveaccountconf "USER_AGENT" "$USER_AGENT"
5395   fi
5396
5397   if [ "$_accountemail" ]; then
5398     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
5399   elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
5400     _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
5401   fi
5402
5403   if [ "$_openssl_bin" ]; then
5404     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
5405   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
5406     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
5407   fi
5408
5409   if [ "$_auto_upgrade" ]; then
5410     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
5411   elif [ "$AUTO_UPGRADE" ]; then
5412     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
5413   fi
5414
5415   if [ "$_use_wget" ]; then
5416     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
5417   elif [ "$ACME_USE_WGET" ]; then
5418     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
5419   fi
5420
5421 }
5422
5423 _process() {
5424   _CMD=""
5425   _domain=""
5426   _altdomains="$NO_VALUE"
5427   _webroot=""
5428   _keylength=""
5429   _accountkeylength=""
5430   _cert_file=""
5431   _key_file=""
5432   _ca_file=""
5433   _fullchain_file=""
5434   _reloadcmd=""
5435   _password=""
5436   _accountconf=""
5437   _useragent=""
5438   _accountemail=""
5439   _accountkey=""
5440   _certhome=""
5441   _confighome=""
5442   _httpport=""
5443   _tlsport=""
5444   _dnssleep=""
5445   _listraw=""
5446   _stopRenewOnError=""
5447   #_insecure=""
5448   _ca_bundle=""
5449   _ca_path=""
5450   _nocron=""
5451   _ecc=""
5452   _csr=""
5453   _pre_hook=""
5454   _post_hook=""
5455   _renew_hook=""
5456   _deploy_hook=""
5457   _logfile=""
5458   _log=""
5459   _local_address=""
5460   _log_level=""
5461   _auto_upgrade=""
5462   _listen_v4=""
5463   _listen_v6=""
5464   _openssl_bin=""
5465   _syslog=""
5466   _use_wget=""
5467   _server=""
5468   while [ ${#} -gt 0 ]; do
5469     case "${1}" in
5470
5471       --help | -h)
5472         showhelp
5473         return
5474         ;;
5475       --version | -v)
5476         version
5477         return
5478         ;;
5479       --install)
5480         _CMD="install"
5481         ;;
5482       --uninstall)
5483         _CMD="uninstall"
5484         ;;
5485       --upgrade)
5486         _CMD="upgrade"
5487         ;;
5488       --issue)
5489         _CMD="issue"
5490         ;;
5491       --deploy)
5492         _CMD="deploy"
5493         ;;
5494       --signcsr)
5495         _CMD="signcsr"
5496         ;;
5497       --showcsr)
5498         _CMD="showcsr"
5499         ;;
5500       --installcert | -i | --install-cert)
5501         _CMD="installcert"
5502         ;;
5503       --renew | -r)
5504         _CMD="renew"
5505         ;;
5506       --renewAll | --renewall | --renew-all)
5507         _CMD="renewAll"
5508         ;;
5509       --revoke)
5510         _CMD="revoke"
5511         ;;
5512       --remove)
5513         _CMD="remove"
5514         ;;
5515       --list)
5516         _CMD="list"
5517         ;;
5518       --installcronjob | --install-cronjob)
5519         _CMD="installcronjob"
5520         ;;
5521       --uninstallcronjob | --uninstall-cronjob)
5522         _CMD="uninstallcronjob"
5523         ;;
5524       --cron)
5525         _CMD="cron"
5526         ;;
5527       --toPkcs)
5528         _CMD="toPkcs"
5529         ;;
5530       --toPkcs8)
5531         _CMD="toPkcs8"
5532         ;;
5533       --createAccountKey | --createaccountkey | -cak | --create-account-key)
5534         _CMD="createAccountKey"
5535         ;;
5536       --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
5537         _CMD="createDomainKey"
5538         ;;
5539       --createCSR | --createcsr | -ccr)
5540         _CMD="createCSR"
5541         ;;
5542       --deactivate)
5543         _CMD="deactivate"
5544         ;;
5545       --updateaccount | --update-account)
5546         _CMD="updateaccount"
5547         ;;
5548       --registeraccount | --register-account)
5549         _CMD="registeraccount"
5550         ;;
5551       --deactivate-account)
5552         _CMD="deactivateaccount"
5553         ;;
5554       --domain | -d)
5555         _dvalue="$2"
5556
5557         if [ "$_dvalue" ]; then
5558           if _startswith "$_dvalue" "-"; then
5559             _err "'$_dvalue' is not a valid domain for parameter '$1'"
5560             return 1
5561           fi
5562           if _is_idn "$_dvalue" && ! _exists idn; then
5563             _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
5564             return 1
5565           fi
5566
5567           if _startswith "$_dvalue" "*."; then
5568             _debug "Wildcard domain"
5569             export ACME_VERSION=2
5570           fi
5571           if [ -z "$_domain" ]; then
5572             _domain="$_dvalue"
5573           else
5574             if [ "$_altdomains" = "$NO_VALUE" ]; then
5575               _altdomains="$_dvalue"
5576             else
5577               _altdomains="$_altdomains,$_dvalue"
5578             fi
5579           fi
5580         fi
5581
5582         shift
5583         ;;
5584
5585       --force | -f)
5586         FORCE="1"
5587         ;;
5588       --staging | --test)
5589         STAGE="1"
5590         ;;
5591       --server)
5592         ACME_DIRECTORY="$2"
5593         _server="$ACME_DIRECTORY"
5594         export ACME_DIRECTORY
5595         shift
5596         ;;
5597       --debug)
5598         if [ -z "$2" ] || _startswith "$2" "-"; then
5599           DEBUG="$DEBUG_LEVEL_DEFAULT"
5600         else
5601           DEBUG="$2"
5602           shift
5603         fi
5604         ;;
5605       --output-insecure)
5606         export OUTPUT_INSECURE=1
5607         ;;
5608       --webroot | -w)
5609         wvalue="$2"
5610         if [ -z "$_webroot" ]; then
5611           _webroot="$wvalue"
5612         else
5613           _webroot="$_webroot,$wvalue"
5614         fi
5615         shift
5616         ;;
5617       --standalone)
5618         wvalue="$NO_VALUE"
5619         if [ -z "$_webroot" ]; then
5620           _webroot="$wvalue"
5621         else
5622           _webroot="$_webroot,$wvalue"
5623         fi
5624         ;;
5625       --stateless)
5626         wvalue="$MODE_STATELESS"
5627         if [ -z "$_webroot" ]; then
5628           _webroot="$wvalue"
5629         else
5630           _webroot="$_webroot,$wvalue"
5631         fi
5632         ;;
5633       --local-address)
5634         lvalue="$2"
5635         _local_address="$_local_address$lvalue,"
5636         shift
5637         ;;
5638       --apache)
5639         wvalue="apache"
5640         if [ -z "$_webroot" ]; then
5641           _webroot="$wvalue"
5642         else
5643           _webroot="$_webroot,$wvalue"
5644         fi
5645         ;;
5646       --nginx)
5647         wvalue="$NGINX"
5648         if [ -z "$_webroot" ]; then
5649           _webroot="$wvalue"
5650         else
5651           _webroot="$_webroot,$wvalue"
5652         fi
5653         ;;
5654       --tls)
5655         wvalue="$W_TLS"
5656         if [ -z "$_webroot" ]; then
5657           _webroot="$wvalue"
5658         else
5659           _webroot="$_webroot,$wvalue"
5660         fi
5661         ;;
5662       --dns)
5663         wvalue="dns"
5664         if [ "$2" ] && ! _startswith "$2" "-"; then
5665           wvalue="$2"
5666           shift
5667         fi
5668         if [ -z "$_webroot" ]; then
5669           _webroot="$wvalue"
5670         else
5671           _webroot="$_webroot,$wvalue"
5672         fi
5673         ;;
5674       --dnssleep)
5675         _dnssleep="$2"
5676         Le_DNSSleep="$_dnssleep"
5677         shift
5678         ;;
5679
5680       --keylength | -k)
5681         _keylength="$2"
5682         shift
5683         ;;
5684       --accountkeylength | -ak)
5685         _accountkeylength="$2"
5686         shift
5687         ;;
5688
5689       --cert-file | --certpath)
5690         _cert_file="$2"
5691         shift
5692         ;;
5693       --key-file | --keypath)
5694         _key_file="$2"
5695         shift
5696         ;;
5697       --ca-file | --capath)
5698         _ca_file="$2"
5699         shift
5700         ;;
5701       --fullchain-file | --fullchainpath)
5702         _fullchain_file="$2"
5703         shift
5704         ;;
5705       --reloadcmd | --reloadCmd)
5706         _reloadcmd="$2"
5707         shift
5708         ;;
5709       --password)
5710         _password="$2"
5711         shift
5712         ;;
5713       --accountconf)
5714         _accountconf="$2"
5715         ACCOUNT_CONF_PATH="$_accountconf"
5716         shift
5717         ;;
5718       --home)
5719         LE_WORKING_DIR="$2"
5720         shift
5721         ;;
5722       --certhome | --cert-home)
5723         _certhome="$2"
5724         CERT_HOME="$_certhome"
5725         shift
5726         ;;
5727       --config-home)
5728         _confighome="$2"
5729         LE_CONFIG_HOME="$_confighome"
5730         shift
5731         ;;
5732       --useragent)
5733         _useragent="$2"
5734         USER_AGENT="$_useragent"
5735         shift
5736         ;;
5737       --accountemail)
5738         _accountemail="$2"
5739         ACCOUNT_EMAIL="$_accountemail"
5740         shift
5741         ;;
5742       --accountkey)
5743         _accountkey="$2"
5744         ACCOUNT_KEY_PATH="$_accountkey"
5745         shift
5746         ;;
5747       --days)
5748         _days="$2"
5749         Le_RenewalDays="$_days"
5750         shift
5751         ;;
5752       --httpport)
5753         _httpport="$2"
5754         Le_HTTPPort="$_httpport"
5755         shift
5756         ;;
5757       --tlsport)
5758         _tlsport="$2"
5759         Le_TLSPort="$_tlsport"
5760         shift
5761         ;;
5762
5763       --listraw)
5764         _listraw="raw"
5765         ;;
5766       --stopRenewOnError | --stoprenewonerror | -se)
5767         _stopRenewOnError="1"
5768         ;;
5769       --insecure)
5770         #_insecure="1"
5771         HTTPS_INSECURE="1"
5772         ;;
5773       --ca-bundle)
5774         _ca_bundle="$(_readlink "$2")"
5775         CA_BUNDLE="$_ca_bundle"
5776         shift
5777         ;;
5778       --ca-path)
5779         _ca_path="$2"
5780         CA_PATH="$_ca_path"
5781         shift
5782         ;;
5783       --nocron)
5784         _nocron="1"
5785         ;;
5786       --no-color)
5787         export ACME_NO_COLOR=1
5788         ;;
5789       --ecc)
5790         _ecc="isEcc"
5791         ;;
5792       --csr)
5793         _csr="$2"
5794         shift
5795         ;;
5796       --pre-hook)
5797         _pre_hook="$2"
5798         shift
5799         ;;
5800       --post-hook)
5801         _post_hook="$2"
5802         shift
5803         ;;
5804       --renew-hook)
5805         _renew_hook="$2"
5806         shift
5807         ;;
5808       --deploy-hook)
5809         if [ -z "$2" ] || _startswith "$2" "-"; then
5810           _usage "Please specify a value for '--deploy-hook'"
5811           return 1
5812         fi
5813         _deploy_hook="$_deploy_hook$2,"
5814         shift
5815         ;;
5816       --ocsp-must-staple | --ocsp)
5817         Le_OCSP_Staple="1"
5818         ;;
5819       --always-force-new-domain-key)
5820         if [ -z "$2" ] || _startswith "$2" "-"; then
5821           Le_ForceNewDomainKey=1
5822         else
5823           Le_ForceNewDomainKey="$2"
5824           shift
5825         fi
5826         ;;
5827       --log | --logfile)
5828         _log="1"
5829         _logfile="$2"
5830         if _startswith "$_logfile" '-'; then
5831           _logfile=""
5832         else
5833           shift
5834         fi
5835         LOG_FILE="$_logfile"
5836         if [ -z "$LOG_LEVEL" ]; then
5837           LOG_LEVEL="$DEFAULT_LOG_LEVEL"
5838         fi
5839         ;;
5840       --log-level)
5841         _log_level="$2"
5842         LOG_LEVEL="$_log_level"
5843         shift
5844         ;;
5845       --syslog)
5846         if ! _startswith "$2" '-'; then
5847           _syslog="$2"
5848           shift
5849         fi
5850         if [ -z "$_syslog" ]; then
5851           _syslog="$SYSLOG_LEVEL_DEFAULT"
5852         fi
5853         ;;
5854       --auto-upgrade)
5855         _auto_upgrade="$2"
5856         if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
5857           _auto_upgrade="1"
5858         else
5859           shift
5860         fi
5861         AUTO_UPGRADE="$_auto_upgrade"
5862         ;;
5863       --listen-v4)
5864         _listen_v4="1"
5865         Le_Listen_V4="$_listen_v4"
5866         ;;
5867       --listen-v6)
5868         _listen_v6="1"
5869         Le_Listen_V6="$_listen_v6"
5870         ;;
5871       --openssl-bin)
5872         _openssl_bin="$2"
5873         ACME_OPENSSL_BIN="$_openssl_bin"
5874         shift
5875         ;;
5876       --use-wget)
5877         _use_wget="1"
5878         ACME_USE_WGET="1"
5879         ;;
5880       *)
5881         _err "Unknown parameter : $1"
5882         return 1
5883         ;;
5884     esac
5885
5886     shift 1
5887   done
5888
5889   if [ "${_CMD}" != "install" ]; then
5890     __initHome
5891     if [ "$_log" ]; then
5892       if [ -z "$_logfile" ]; then
5893         _logfile="$DEFAULT_LOG_FILE"
5894       fi
5895     fi
5896     if [ "$_logfile" ]; then
5897       _saveaccountconf "LOG_FILE" "$_logfile"
5898       LOG_FILE="$_logfile"
5899     fi
5900
5901     if [ "$_log_level" ]; then
5902       _saveaccountconf "LOG_LEVEL" "$_log_level"
5903       LOG_LEVEL="$_log_level"
5904     fi
5905
5906     if [ "$_syslog" ]; then
5907       if _exists logger; then
5908         if [ "$_syslog" = "0" ]; then
5909           _clearaccountconf "SYS_LOG"
5910         else
5911           _saveaccountconf "SYS_LOG" "$_syslog"
5912         fi
5913         SYS_LOG="$_syslog"
5914       else
5915         _err "The 'logger' command is not found, can not enable syslog."
5916         _clearaccountconf "SYS_LOG"
5917         SYS_LOG=""
5918       fi
5919     fi
5920
5921     _processAccountConf
5922   fi
5923
5924   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
5925
5926   if [ "$DEBUG" ]; then
5927     version
5928     if [ "$_server" ]; then
5929       _debug "Using server: $_server"
5930     fi
5931   fi
5932
5933   case "${_CMD}" in
5934     install) install "$_nocron" "$_confighome" ;;
5935     uninstall) uninstall "$_nocron" ;;
5936     upgrade) upgrade ;;
5937     issue)
5938       issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address"
5939       ;;
5940     deploy)
5941       deploy "$_domain" "$_deploy_hook" "$_ecc"
5942       ;;
5943     signcsr)
5944       signcsr "$_csr" "$_webroot"
5945       ;;
5946     showcsr)
5947       showcsr "$_csr" "$_domain"
5948       ;;
5949     installcert)
5950       installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
5951       ;;
5952     renew)
5953       renew "$_domain" "$_ecc"
5954       ;;
5955     renewAll)
5956       renewAll "$_stopRenewOnError"
5957       ;;
5958     revoke)
5959       revoke "$_domain" "$_ecc"
5960       ;;
5961     remove)
5962       remove "$_domain" "$_ecc"
5963       ;;
5964     deactivate)
5965       deactivate "$_domain,$_altdomains"
5966       ;;
5967     registeraccount)
5968       registeraccount "$_accountkeylength"
5969       ;;
5970     updateaccount)
5971       updateaccount
5972       ;;
5973     deactivateaccount)
5974       deactivateaccount
5975       ;;
5976     list)
5977       list "$_listraw"
5978       ;;
5979     installcronjob) installcronjob "$_confighome" ;;
5980     uninstallcronjob) uninstallcronjob ;;
5981     cron) cron ;;
5982     toPkcs)
5983       toPkcs "$_domain" "$_password" "$_ecc"
5984       ;;
5985     toPkcs8)
5986       toPkcs8 "$_domain" "$_ecc"
5987       ;;
5988     createAccountKey)
5989       createAccountKey "$_accountkeylength"
5990       ;;
5991     createDomainKey)
5992       createDomainKey "$_domain" "$_keylength"
5993       ;;
5994     createCSR)
5995       createCSR "$_domain" "$_altdomains" "$_ecc"
5996       ;;
5997
5998     *)
5999       if [ "$_CMD" ]; then
6000         _err "Invalid command: $_CMD"
6001       fi
6002       showhelp
6003       return 1
6004       ;;
6005   esac
6006   _ret="$?"
6007   if [ "$_ret" != "0" ]; then
6008     return $_ret
6009   fi
6010
6011   if [ "${_CMD}" = "install" ]; then
6012     if [ "$_log" ]; then
6013       if [ -z "$LOG_FILE" ]; then
6014         LOG_FILE="$DEFAULT_LOG_FILE"
6015       fi
6016       _saveaccountconf "LOG_FILE" "$LOG_FILE"
6017     fi
6018
6019     if [ "$_log_level" ]; then
6020       _saveaccountconf "LOG_LEVEL" "$_log_level"
6021     fi
6022
6023     if [ "$_syslog" ]; then
6024       if _exists logger; then
6025         if [ "$_syslog" = "0" ]; then
6026           _clearaccountconf "SYS_LOG"
6027         else
6028           _saveaccountconf "SYS_LOG" "$_syslog"
6029         fi
6030       else
6031         _err "The 'logger' command is not found, can not enable syslog."
6032         _clearaccountconf "SYS_LOG"
6033         SYS_LOG=""
6034       fi
6035     fi
6036
6037     _processAccountConf
6038   fi
6039
6040 }
6041
6042 if [ "$INSTALLONLINE" ]; then
6043   INSTALLONLINE=""
6044   _installOnline
6045   exit
6046 fi
6047
6048 main() {
6049   [ -z "$1" ] && showhelp && return
6050   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
6051 }
6052
6053 main "$@"