acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.7.3
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12 _SCRIPT_="$0"
  13
  14 _SUB_FOLDERS="dnsapi deploy"
  15
  16 _OLD_CA_HOST="https://acme-v01.api.letsencrypt.org"
  17 DEFAULT_CA="https://acme-v01.api.letsencrypt.org/directory"
  18 DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
  19
  20 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  21 DEFAULT_ACCOUNT_EMAIL=""
  22
  23 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  24 DEFAULT_DOMAIN_KEY_LENGTH=2048
  25
  26 DEFAULT_OPENSSL_BIN="openssl"
  27
  28 STAGE_CA="https://acme-staging.api.letsencrypt.org/directory"
  29 _OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
  30
  31 VTYPE_HTTP="http-01"
  32 VTYPE_DNS="dns-01"
  33 VTYPE_TLS="tls-sni-01"
  34 #VTYPE_TLS2="tls-sni-02"
  35
  36 LOCAL_ANY_ADDRESS="0.0.0.0"
  37
  38 MAX_RENEW=60
  39
  40 DEFAULT_DNS_SLEEP=120
  41
  42 NO_VALUE="no"
  43
  44 W_TLS="tls"
  45
  46 MODE_STATELESS="stateless"
  47
  48 STATE_VERIFIED="verified_ok"
  49
  50 NGINX="nginx:"
  51 NGINX_START="#ACME_NGINX_START"
  52 NGINX_END="#ACME_NGINX_END"
  53
  54 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  55 END_CSR="-----END CERTIFICATE REQUEST-----"
  56
  57 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  58 END_CERT="-----END CERTIFICATE-----"
  59
  60 RENEW_SKIP=2
  61
  62 ECC_SEP="_"
  63 ECC_SUFFIX="${ECC_SEP}ecc"
  64
  65 LOG_LEVEL_1=1
  66 LOG_LEVEL_2=2
  67 LOG_LEVEL_3=3
  68 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  69
  70 DEBUG_LEVEL_1=1
  71 DEBUG_LEVEL_2=2
  72 DEBUG_LEVEL_3=3
  73 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  74 DEBUG_LEVEL_NONE=0
  75
  76 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  77
  78 SYSLOG_ERROR="user.error"
  79 SYSLOG_INFO="user.info"
  80 SYSLOG_DEBUG="user.debug"
  81
  82 #error
  83 SYSLOG_LEVEL_ERROR=3
  84 #info
  85 SYSLOG_LEVEL_INFO=6
  86 #debug
  87 SYSLOG_LEVEL_DEBUG=7
  88 #debug2
  89 SYSLOG_LEVEL_DEBUG_2=8
  90 #debug3
  91 SYSLOG_LEVEL_DEBUG_3=9
  92
  93 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  94 #none
  95 SYSLOG_LEVEL_NONE=0
  96
  97 _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
  98
  99 _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
 100
 101 _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
 102
 103 __INTERACTIVE=""
 104 if [ -t 1 ]; then
 105   __INTERACTIVE="1"
 106 fi
 107
 108 __green() {
 109   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 110     printf '\033[1;31;32m'
 111   fi
 112   printf -- "%b" "$1"
 113   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 114     printf '\033[0m'
 115   fi
 116 }
 117
 118 __red() {
 119   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 120     printf '\033[1;31;40m'
 121   fi
 122   printf -- "%b" "$1"
 123   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 124     printf '\033[0m'
 125   fi
 126 }
 127
 128 _printargs() {
 129   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 130     printf -- "%s" "[$(date)] "
 131   fi
 132   if [ -z "$2" ]; then
 133     printf -- "%s" "$1"
 134   else
 135     printf -- "%s" "$1='$2'"
 136   fi
 137   printf "\n"
 138 }
 139
 140 _dlg_versions() {
 141   echo "Diagnosis versions: "
 142   echo "openssl:$ACME_OPENSSL_BIN"
 143   if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
 144     ${ACME_OPENSSL_BIN:-openssl} version 2>&1
 145   else
 146     echo "$ACME_OPENSSL_BIN doesn't exists."
 147   fi
 148
 149   echo "apache:"
 150   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 151     $_APACHECTL -V 2>&1
 152   else
 153     echo "apache doesn't exists."
 154   fi
 155
 156   echo "nginx:"
 157   if _exists "nginx"; then
 158     nginx -V 2>&1
 159   else
 160     echo "nginx doesn't exists."
 161   fi
 162
 163   echo "nc:"
 164   if _exists "nc"; then
 165     nc -h 2>&1
 166   else
 167     _debug "nc doesn't exists."
 168   fi
 169 }
 170
 171 #class
 172 _syslog() {
 173   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 174     return
 175   fi
 176   _logclass="$1"
 177   shift
 178   if [ -z "$__logger_i" ]; then
 179     if _contains "$(logger --help 2>&1)" "-i"; then
 180       __logger_i="logger -i"
 181     else
 182       __logger_i="logger"
 183     fi
 184   fi
 185   $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 186 }
 187
 188 _log() {
 189   [ -z "$LOG_FILE" ] && return
 190   _printargs "$@" >>"$LOG_FILE"
 191 }
 192
 193 _info() {
 194   _log "$@"
 195   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 196     _syslog "$SYSLOG_INFO" "$@"
 197   fi
 198   _printargs "$@"
 199 }
 200
 201 _err() {
 202   _syslog "$SYSLOG_ERROR" "$@"
 203   _log "$@"
 204   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 205     printf -- "%s" "[$(date)] " >&2
 206   fi
 207   if [ -z "$2" ]; then
 208     __red "$1" >&2
 209   else
 210     __red "$1='$2'" >&2
 211   fi
 212   printf "\n" >&2
 213   return 1
 214 }
 215
 216 _usage() {
 217   __red "$@" >&2
 218   printf "\n" >&2
 219 }
 220
 221 _debug() {
 222   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 223     _log "$@"
 224   fi
 225   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 226     _syslog "$SYSLOG_DEBUG" "$@"
 227   fi
 228   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 229     _printargs "$@" >&2
 230   fi
 231 }
 232
 233 #output the sensitive messages
 234 _secure_debug() {
 235   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 236     if [ "$OUTPUT_INSECURE" = "1" ]; then
 237       _log "$@"
 238     else
 239       _log "$1" "$HIDDEN_VALUE"
 240     fi
 241   fi
 242   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 243     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 244   fi
 245   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 246     if [ "$OUTPUT_INSECURE" = "1" ]; then
 247       _printargs "$@" >&2
 248     else
 249       _printargs "$1" "$HIDDEN_VALUE" >&2
 250     fi
 251   fi
 252 }
 253
 254 _debug2() {
 255   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 256     _log "$@"
 257   fi
 258   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 259     _syslog "$SYSLOG_DEBUG" "$@"
 260   fi
 261   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 262     _printargs "$@" >&2
 263   fi
 264 }
 265
 266 _secure_debug2() {
 267   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 268     if [ "$OUTPUT_INSECURE" = "1" ]; then
 269       _log "$@"
 270     else
 271       _log "$1" "$HIDDEN_VALUE"
 272     fi
 273   fi
 274   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 275     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 276   fi
 277   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 278     if [ "$OUTPUT_INSECURE" = "1" ]; then
 279       _printargs "$@" >&2
 280     else
 281       _printargs "$1" "$HIDDEN_VALUE" >&2
 282     fi
 283   fi
 284 }
 285
 286 _debug3() {
 287   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 288     _log "$@"
 289   fi
 290   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 291     _syslog "$SYSLOG_DEBUG" "$@"
 292   fi
 293   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 294     _printargs "$@" >&2
 295   fi
 296 }
 297
 298 _secure_debug3() {
 299   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 300     if [ "$OUTPUT_INSECURE" = "1" ]; then
 301       _log "$@"
 302     else
 303       _log "$1" "$HIDDEN_VALUE"
 304     fi
 305   fi
 306   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 307     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 308   fi
 309   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 310     if [ "$OUTPUT_INSECURE" = "1" ]; then
 311       _printargs "$@" >&2
 312     else
 313       _printargs "$1" "$HIDDEN_VALUE" >&2
 314     fi
 315   fi
 316 }
 317
 318 _upper_case() {
 319   # shellcheck disable=SC2018,SC2019
 320   tr 'a-z' 'A-Z'
 321 }
 322
 323 _lower_case() {
 324   # shellcheck disable=SC2018,SC2019
 325   tr 'A-Z' 'a-z'
 326 }
 327
 328 _startswith() {
 329   _str="$1"
 330   _sub="$2"
 331   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 332 }
 333
 334 _endswith() {
 335   _str="$1"
 336   _sub="$2"
 337   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 338 }
 339
 340 _contains() {
 341   _str="$1"
 342   _sub="$2"
 343   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 344 }
 345
 346 _hasfield() {
 347   _str="$1"
 348   _field="$2"
 349   _sep="$3"
 350   if [ -z "$_field" ]; then
 351     _usage "Usage: str field  [sep]"
 352     return 1
 353   fi
 354
 355   if [ -z "$_sep" ]; then
 356     _sep=","
 357   fi
 358
 359   for f in $(echo "$_str" | tr "$_sep" ' '); do
 360     if [ "$f" = "$_field" ]; then
 361       _debug2 "'$_str' contains '$_field'"
 362       return 0 #contains ok
 363     fi
 364   done
 365   _debug2 "'$_str' does not contain '$_field'"
 366   return 1 #not contains
 367 }
 368
 369 # str index [sep]
 370 _getfield() {
 371   _str="$1"
 372   _findex="$2"
 373   _sep="$3"
 374
 375   if [ -z "$_findex" ]; then
 376     _usage "Usage: str field  [sep]"
 377     return 1
 378   fi
 379
 380   if [ -z "$_sep" ]; then
 381     _sep=","
 382   fi
 383
 384   _ffi="$_findex"
 385   while [ "$_ffi" -gt "0" ]; do
 386     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 387     if [ "$_fv" ]; then
 388       printf -- "%s" "$_fv"
 389       return 0
 390     fi
 391     _ffi="$(_math "$_ffi" - 1)"
 392   done
 393
 394   printf -- "%s" "$_str"
 395
 396 }
 397
 398 _exists() {
 399   cmd="$1"
 400   if [ -z "$cmd" ]; then
 401     _usage "Usage: _exists cmd"
 402     return 1
 403   fi
 404
 405   if eval type type >/dev/null 2>&1; then
 406     eval type "$cmd" >/dev/null 2>&1
 407   elif command >/dev/null 2>&1; then
 408     command -v "$cmd" >/dev/null 2>&1
 409   else
 410     which "$cmd" >/dev/null 2>&1
 411   fi
 412   ret="$?"
 413   _debug3 "$cmd exists=$ret"
 414   return $ret
 415 }
 416
 417 #a + b
 418 _math() {
 419   _m_opts="$@"
 420   printf "%s" "$(($_m_opts))"
 421 }
 422
 423 _h_char_2_dec() {
 424   _ch=$1
 425   case "${_ch}" in
 426     a | A)
 427       printf "10"
 428       ;;
 429     b | B)
 430       printf "11"
 431       ;;
 432     c | C)
 433       printf "12"
 434       ;;
 435     d | D)
 436       printf "13"
 437       ;;
 438     e | E)
 439       printf "14"
 440       ;;
 441     f | F)
 442       printf "15"
 443       ;;
 444     *)
 445       printf "%s" "$_ch"
 446       ;;
 447   esac
 448
 449 }
 450
 451 _URGLY_PRINTF=""
 452 if [ "$(printf '\x41')" != 'A' ]; then
 453   _URGLY_PRINTF=1
 454 fi
 455
 456 _ESCAPE_XARGS=""
 457 if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
 458   _ESCAPE_XARGS=1
 459 fi
 460
 461 _h2b() {
 462   if _exists xxd; then
 463     xxd -r -p
 464     return
 465   fi
 466
 467   hex=$(cat)
 468   ic=""
 469   jc=""
 470   _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
 471   if [ -z "$_URGLY_PRINTF" ]; then
 472     if [ "$_ESCAPE_XARGS" ] && _exists xargs; then
 473       _debug2 "xargs"
 474       echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
 475     else
 476       for h in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
 477         if [ -z "$h" ]; then
 478           break
 479         fi
 480         printf "\x$h%s"
 481       done
 482     fi
 483   else
 484     for c in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
 485       if [ -z "$ic" ]; then
 486         ic=$c
 487         continue
 488       fi
 489       jc=$c
 490       ic="$(_h_char_2_dec "$ic")"
 491       jc="$(_h_char_2_dec "$jc")"
 492       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 493       ic=""
 494       jc=""
 495     done
 496   fi
 497
 498 }
 499
 500 _is_solaris() {
 501   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 502 }
 503
 504 #_ascii_hex str
 505 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 506 _ascii_hex() {
 507   _debug2 "Using _ascii_hex"
 508   _str="$1"
 509   _str_len=${#_str}
 510   _h_i=1
 511   while [ "$_h_i" -le "$_str_len" ]; do
 512     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 513     printf " %02x" "'$_str_c"
 514     _h_i="$(_math "$_h_i" + 1)"
 515   done
 516 }
 517
 518 #stdin  output hexstr splited by one space
 519 #input:"abc"
 520 #output: " 61 62 63"
 521 _hex_dump() {
 522   if _exists od; then
 523     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 524   elif _exists hexdump; then
 525     _debug3 "using hexdump"
 526     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 527   elif _exists xxd; then
 528     _debug3 "using xxd"
 529     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 530   else
 531     _debug3 "using _ascii_hex"
 532     str=$(cat)
 533     _ascii_hex "$str"
 534   fi
 535 }
 536
 537 #url encode, no-preserved chars
 538 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 539 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 540
 541 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 542 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 543
 544 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 545 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 546
 547 #stdin stdout
 548 _url_encode() {
 549   _hex_str=$(_hex_dump)
 550   _debug3 "_url_encode"
 551   _debug3 "_hex_str" "$_hex_str"
 552   for _hex_code in $_hex_str; do
 553     #upper case
 554     case "${_hex_code}" in
 555       "41")
 556         printf "%s" "A"
 557         ;;
 558       "42")
 559         printf "%s" "B"
 560         ;;
 561       "43")
 562         printf "%s" "C"
 563         ;;
 564       "44")
 565         printf "%s" "D"
 566         ;;
 567       "45")
 568         printf "%s" "E"
 569         ;;
 570       "46")
 571         printf "%s" "F"
 572         ;;
 573       "47")
 574         printf "%s" "G"
 575         ;;
 576       "48")
 577         printf "%s" "H"
 578         ;;
 579       "49")
 580         printf "%s" "I"
 581         ;;
 582       "4a")
 583         printf "%s" "J"
 584         ;;
 585       "4b")
 586         printf "%s" "K"
 587         ;;
 588       "4c")
 589         printf "%s" "L"
 590         ;;
 591       "4d")
 592         printf "%s" "M"
 593         ;;
 594       "4e")
 595         printf "%s" "N"
 596         ;;
 597       "4f")
 598         printf "%s" "O"
 599         ;;
 600       "50")
 601         printf "%s" "P"
 602         ;;
 603       "51")
 604         printf "%s" "Q"
 605         ;;
 606       "52")
 607         printf "%s" "R"
 608         ;;
 609       "53")
 610         printf "%s" "S"
 611         ;;
 612       "54")
 613         printf "%s" "T"
 614         ;;
 615       "55")
 616         printf "%s" "U"
 617         ;;
 618       "56")
 619         printf "%s" "V"
 620         ;;
 621       "57")
 622         printf "%s" "W"
 623         ;;
 624       "58")
 625         printf "%s" "X"
 626         ;;
 627       "59")
 628         printf "%s" "Y"
 629         ;;
 630       "5a")
 631         printf "%s" "Z"
 632         ;;
 633
 634       #lower case
 635       "61")
 636         printf "%s" "a"
 637         ;;
 638       "62")
 639         printf "%s" "b"
 640         ;;
 641       "63")
 642         printf "%s" "c"
 643         ;;
 644       "64")
 645         printf "%s" "d"
 646         ;;
 647       "65")
 648         printf "%s" "e"
 649         ;;
 650       "66")
 651         printf "%s" "f"
 652         ;;
 653       "67")
 654         printf "%s" "g"
 655         ;;
 656       "68")
 657         printf "%s" "h"
 658         ;;
 659       "69")
 660         printf "%s" "i"
 661         ;;
 662       "6a")
 663         printf "%s" "j"
 664         ;;
 665       "6b")
 666         printf "%s" "k"
 667         ;;
 668       "6c")
 669         printf "%s" "l"
 670         ;;
 671       "6d")
 672         printf "%s" "m"
 673         ;;
 674       "6e")
 675         printf "%s" "n"
 676         ;;
 677       "6f")
 678         printf "%s" "o"
 679         ;;
 680       "70")
 681         printf "%s" "p"
 682         ;;
 683       "71")
 684         printf "%s" "q"
 685         ;;
 686       "72")
 687         printf "%s" "r"
 688         ;;
 689       "73")
 690         printf "%s" "s"
 691         ;;
 692       "74")
 693         printf "%s" "t"
 694         ;;
 695       "75")
 696         printf "%s" "u"
 697         ;;
 698       "76")
 699         printf "%s" "v"
 700         ;;
 701       "77")
 702         printf "%s" "w"
 703         ;;
 704       "78")
 705         printf "%s" "x"
 706         ;;
 707       "79")
 708         printf "%s" "y"
 709         ;;
 710       "7a")
 711         printf "%s" "z"
 712         ;;
 713       #numbers
 714       "30")
 715         printf "%s" "0"
 716         ;;
 717       "31")
 718         printf "%s" "1"
 719         ;;
 720       "32")
 721         printf "%s" "2"
 722         ;;
 723       "33")
 724         printf "%s" "3"
 725         ;;
 726       "34")
 727         printf "%s" "4"
 728         ;;
 729       "35")
 730         printf "%s" "5"
 731         ;;
 732       "36")
 733         printf "%s" "6"
 734         ;;
 735       "37")
 736         printf "%s" "7"
 737         ;;
 738       "38")
 739         printf "%s" "8"
 740         ;;
 741       "39")
 742         printf "%s" "9"
 743         ;;
 744       "2d")
 745         printf "%s" "-"
 746         ;;
 747       "5f")
 748         printf "%s" "_"
 749         ;;
 750       "2e")
 751         printf "%s" "."
 752         ;;
 753       "7e")
 754         printf "%s" "~"
 755         ;;
 756       #other hex
 757       *)
 758         printf '%%%s' "$_hex_code"
 759         ;;
 760     esac
 761   done
 762 }
 763
 764 #options file
 765 _sed_i() {
 766   options="$1"
 767   filename="$2"
 768   if [ -z "$filename" ]; then
 769     _usage "Usage:_sed_i options filename"
 770     return 1
 771   fi
 772   _debug2 options "$options"
 773   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 774     _debug "Using sed  -i"
 775     sed -i "$options" "$filename"
 776   else
 777     _debug "No -i support in sed"
 778     text="$(cat "$filename")"
 779     echo "$text" | sed "$options" >"$filename"
 780   fi
 781 }
 782
 783 _egrep_o() {
 784   if ! egrep -o "$1" 2>/dev/null; then
 785     sed -n 's/.*\('"$1"'\).*/\1/p'
 786   fi
 787 }
 788
 789 #Usage: file startline endline
 790 _getfile() {
 791   filename="$1"
 792   startline="$2"
 793   endline="$3"
 794   if [ -z "$endline" ]; then
 795     _usage "Usage: file startline endline"
 796     return 1
 797   fi
 798
 799   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 800   if [ -z "$i" ]; then
 801     _err "Can not find start line: $startline"
 802     return 1
 803   fi
 804   i="$(_math "$i" + 1)"
 805   _debug i "$i"
 806
 807   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 808   if [ -z "$j" ]; then
 809     _err "Can not find end line: $endline"
 810     return 1
 811   fi
 812   j="$(_math "$j" - 1)"
 813   _debug j "$j"
 814
 815   sed -n "$i,${j}p" "$filename"
 816
 817 }
 818
 819 #Usage: multiline
 820 _base64() {
 821   [ "" ] #urgly
 822   if [ "$1" ]; then
 823     _debug3 "base64 multiline:'$1'"
 824     ${ACME_OPENSSL_BIN:-openssl} base64 -e
 825   else
 826     _debug3 "base64 single line."
 827     ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
 828   fi
 829 }
 830
 831 #Usage: multiline
 832 _dbase64() {
 833   if [ "$1" ]; then
 834     ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
 835   else
 836     ${ACME_OPENSSL_BIN:-openssl} base64 -d
 837   fi
 838 }
 839
 840 #Usage: hashalg  [outputhex]
 841 #Output Base64-encoded digest
 842 _digest() {
 843   alg="$1"
 844   if [ -z "$alg" ]; then
 845     _usage "Usage: _digest hashalg"
 846     return 1
 847   fi
 848
 849   outputhex="$2"
 850
 851   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 852     if [ "$outputhex" ]; then
 853       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 854     else
 855       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
 856     fi
 857   else
 858     _err "$alg is not supported yet"
 859     return 1
 860   fi
 861
 862 }
 863
 864 #Usage: hashalg  secret_hex  [outputhex]
 865 #Output binary hmac
 866 _hmac() {
 867   alg="$1"
 868   secret_hex="$2"
 869   outputhex="$3"
 870
 871   if [ -z "$secret_hex" ]; then
 872     _usage "Usage: _hmac hashalg secret [outputhex]"
 873     return 1
 874   fi
 875
 876   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
 877     if [ "$outputhex" ]; then
 878       (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
 879     else
 880       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
 881     fi
 882   else
 883     _err "$alg is not supported yet"
 884     return 1
 885   fi
 886
 887 }
 888
 889 #Usage: keyfile hashalg
 890 #Output: Base64-encoded signature value
 891 _sign() {
 892   keyfile="$1"
 893   alg="$2"
 894   if [ -z "$alg" ]; then
 895     _usage "Usage: _sign keyfile hashalg"
 896     return 1
 897   fi
 898
 899   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
 900   if [ "$alg" = "sha256" ]; then
 901     _sign_openssl="$_sign_openssl -$alg"
 902   else
 903     _err "$alg is not supported yet"
 904     return 1
 905   fi
 906
 907   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 908     $_sign_openssl | _base64
 909   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 910     if ! _signedECText="$($_sign_openssl | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
 911       _err "Sign failed: $_sign_openssl"
 912       _err "Key file: $keyfile"
 913       _err "Key content:$(wc -l <"$keyfile") lines"
 914       return 1
 915     fi
 916     _debug3 "_signedECText" "$_signedECText"
 917     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 918     _debug3 "_ec_r" "$_ec_r"
 919     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 920     _debug3 "_ec_s" "$_ec_s"
 921     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
 922   else
 923     _err "Unknown key file format."
 924     return 1
 925   fi
 926
 927 }
 928
 929 #keylength or isEcc flag (empty str => not ecc)
 930 _isEccKey() {
 931   _length="$1"
 932
 933   if [ -z "$_length" ]; then
 934     return 1
 935   fi
 936
 937   [ "$_length" != "1024" ] \
 938     && [ "$_length" != "2048" ] \
 939     && [ "$_length" != "3072" ] \
 940     && [ "$_length" != "4096" ] \
 941     && [ "$_length" != "8192" ]
 942 }
 943
 944 # _createkey  2048|ec-256   file
 945 _createkey() {
 946   length="$1"
 947   f="$2"
 948   _debug2 "_createkey for file:$f"
 949   eccname="$length"
 950   if _startswith "$length" "ec-"; then
 951     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
 952
 953     if [ "$length" = "256" ]; then
 954       eccname="prime256v1"
 955     fi
 956     if [ "$length" = "384" ]; then
 957       eccname="secp384r1"
 958     fi
 959     if [ "$length" = "521" ]; then
 960       eccname="secp521r1"
 961     fi
 962
 963   fi
 964
 965   if [ -z "$length" ]; then
 966     length=2048
 967   fi
 968
 969   _debug "Use length $length"
 970
 971   if ! touch "$f" >/dev/null 2>&1; then
 972     _f_path="$(dirname "$f")"
 973     _debug _f_path "$_f_path"
 974     if ! mkdir -p "$_f_path"; then
 975       _err "Can not create path: $_f_path"
 976       return 1
 977     fi
 978   fi
 979
 980   if _isEccKey "$length"; then
 981     _debug "Using ec name: $eccname"
 982     ${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null >"$f"
 983   else
 984     _debug "Using RSA: $length"
 985     ${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null >"$f"
 986   fi
 987
 988   if [ "$?" != "0" ]; then
 989     _err "Create key error."
 990     return 1
 991   fi
 992 }
 993
 994 #domain
 995 _is_idn() {
 996   _is_idn_d="$1"
 997   _debug2 _is_idn_d "$_is_idn_d"
 998   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '.,-')
 999   _debug2 _idn_temp "$_idn_temp"
1000   [ "$_idn_temp" ]
1001 }
1002
1003 #aa.com
1004 #aa.com,bb.com,cc.com
1005 _idn() {
1006   __idn_d="$1"
1007   if ! _is_idn "$__idn_d"; then
1008     printf "%s" "$__idn_d"
1009     return 0
1010   fi
1011
1012   if _exists idn; then
1013     if _contains "$__idn_d" ','; then
1014       _i_first="1"
1015       for f in $(echo "$__idn_d" | tr ',' ' '); do
1016         [ -z "$f" ] && continue
1017         if [ -z "$_i_first" ]; then
1018           printf "%s" ","
1019         else
1020           _i_first=""
1021         fi
1022         idn --quiet "$f" | tr -d "\r\n"
1023       done
1024     else
1025       idn "$__idn_d" | tr -d "\r\n"
1026     fi
1027   else
1028     _err "Please install idn to process IDN names."
1029   fi
1030 }
1031
1032 #_createcsr  cn  san_list  keyfile csrfile conf
1033 _createcsr() {
1034   _debug _createcsr
1035   domain="$1"
1036   domainlist="$2"
1037   csrkey="$3"
1038   csr="$4"
1039   csrconf="$5"
1040   _debug2 domain "$domain"
1041   _debug2 domainlist "$domainlist"
1042   _debug2 csrkey "$csrkey"
1043   _debug2 csr "$csr"
1044   _debug2 csrconf "$csrconf"
1045
1046   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1047
1048   if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1049     #single domain
1050     _info "Single domain" "$domain"
1051   else
1052     domainlist="$(_idn "$domainlist")"
1053     _debug2 domainlist "$domainlist"
1054     if _contains "$domainlist" ","; then
1055       alt="DNS:$(echo "$domainlist" | sed "s/,/,DNS:/g")"
1056     else
1057       alt="DNS:$domainlist"
1058     fi
1059     #multi
1060     _info "Multi domain" "$alt"
1061     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1062   fi
1063   if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
1064     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1065     _cleardomainconf Le_OCSP_Stable
1066     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1067   fi
1068
1069   _csr_cn="$(_idn "$domain")"
1070   _debug2 _csr_cn "$_csr_cn"
1071   if _contains "$(uname -a)" "MINGW"; then
1072     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1073   else
1074     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1075   fi
1076 }
1077
1078 #_signcsr key  csr  conf cert
1079 _signcsr() {
1080   key="$1"
1081   csr="$2"
1082   conf="$3"
1083   cert="$4"
1084   _debug "_signcsr"
1085
1086   _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1087   _ret="$?"
1088   _debug "$_msg"
1089   return $_ret
1090 }
1091
1092 #_csrfile
1093 _readSubjectFromCSR() {
1094   _csrfile="$1"
1095   if [ -z "$_csrfile" ]; then
1096     _usage "_readSubjectFromCSR mycsr.csr"
1097     return 1
1098   fi
1099   ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | tr ',' "\n" | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
1100 }
1101
1102 #_csrfile
1103 #echo comma separated domain list
1104 _readSubjectAltNamesFromCSR() {
1105   _csrfile="$1"
1106   if [ -z "$_csrfile" ]; then
1107     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1108     return 1
1109   fi
1110
1111   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1112   _debug _csrsubj "$_csrsubj"
1113
1114   _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1115   _debug _dnsAltnames "$_dnsAltnames"
1116
1117   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1118     _debug "AltNames contains subject"
1119     _dnsAltnames="$(printf "%s" "$_dnsAltnames," | sed "s/DNS:$_csrsubj,//g")"
1120   else
1121     _debug "AltNames doesn't contain subject"
1122   fi
1123
1124   printf "%s" "$_dnsAltnames" | sed "s/DNS://g"
1125 }
1126
1127 #_csrfile
1128 _readKeyLengthFromCSR() {
1129   _csrfile="$1"
1130   if [ -z "$_csrfile" ]; then
1131     _usage "_readKeyLengthFromCSR mycsr.csr"
1132     return 1
1133   fi
1134
1135   _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
1136   _debug2 _outcsr "$_outcsr"
1137   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1138     _debug "ECC CSR"
1139     echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1140   else
1141     _debug "RSA CSR"
1142     _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
1143     if [ "$_rkl" ]; then
1144       echo "$_rkl"
1145     else
1146       echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1147     fi
1148   fi
1149 }
1150
1151 _ss() {
1152   _port="$1"
1153
1154   if _exists "ss"; then
1155     _debug "Using: ss"
1156     ss -ntpl 2>/dev/null | grep ":$_port "
1157     return 0
1158   fi
1159
1160   if _exists "netstat"; then
1161     _debug "Using: netstat"
1162     if netstat -h 2>&1 | grep "\-p proto" >/dev/null; then
1163       #for windows version netstat tool
1164       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1165     else
1166       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1167         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1168       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1169         #for solaris
1170         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1171       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1172         #for full linux
1173         netstat -ntpl | grep ":$_port "
1174       else
1175         #for busybox (embedded linux; no pid support)
1176         netstat -ntl 2>/dev/null | grep ":$_port "
1177       fi
1178     fi
1179     return 0
1180   fi
1181
1182   return 1
1183 }
1184
1185 #domain [password] [isEcc]
1186 toPkcs() {
1187   domain="$1"
1188   pfxPassword="$2"
1189   if [ -z "$domain" ]; then
1190     _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
1191     return 1
1192   fi
1193
1194   _isEcc="$3"
1195
1196   _initpath "$domain" "$_isEcc"
1197
1198   if [ "$pfxPassword" ]; then
1199     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
1200   else
1201     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
1202   fi
1203
1204   if [ "$?" = "0" ]; then
1205     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1206   fi
1207
1208 }
1209
1210 #domain [isEcc]
1211 toPkcs8() {
1212   domain="$1"
1213
1214   if [ -z "$domain" ]; then
1215     _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
1216     return 1
1217   fi
1218
1219   _isEcc="$2"
1220
1221   _initpath "$domain" "$_isEcc"
1222
1223   ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1224
1225   if [ "$?" = "0" ]; then
1226     _info "Success, $CERT_PKCS8_PATH"
1227   fi
1228
1229 }
1230
1231 #[2048]
1232 createAccountKey() {
1233   _info "Creating account key"
1234   if [ -z "$1" ]; then
1235     _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
1236     return
1237   fi
1238
1239   length=$1
1240   _create_account_key "$length"
1241
1242 }
1243
1244 _create_account_key() {
1245
1246   length=$1
1247
1248   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1249     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1250     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1251   fi
1252
1253   _debug length "$length"
1254   _initpath
1255
1256   mkdir -p "$CA_DIR"
1257   if [ -f "$ACCOUNT_KEY_PATH" ]; then
1258     _info "Account key exists, skip"
1259     return
1260   else
1261     #generate account key
1262     _createkey "$length" "$ACCOUNT_KEY_PATH"
1263   fi
1264
1265 }
1266
1267 #domain [length]
1268 createDomainKey() {
1269   _info "Creating domain key"
1270   if [ -z "$1" ]; then
1271     _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]"
1272     return
1273   fi
1274
1275   domain=$1
1276   _cdl=$2
1277
1278   if [ -z "$_cdl" ]; then
1279     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1280     _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
1281   fi
1282
1283   _initpath "$domain" "$_cdl"
1284
1285   if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
1286     if _createkey "$_cdl" "$CERT_KEY_PATH"; then
1287       _savedomainconf Le_Keylength "$_cdl"
1288       _info "The domain key is here: $(__green $CERT_KEY_PATH)"
1289     fi
1290   else
1291     if [ "$IS_RENEW" ]; then
1292       _info "Domain key exists, skip"
1293       return 0
1294     else
1295       _err "Domain key exists, do you want to overwrite the key?"
1296       _err "Add '--force', and try again."
1297       return 1
1298     fi
1299   fi
1300
1301 }
1302
1303 # domain  domainlist isEcc
1304 createCSR() {
1305   _info "Creating csr"
1306   if [ -z "$1" ]; then
1307     _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]"
1308     return
1309   fi
1310
1311   domain="$1"
1312   domainlist="$2"
1313   _isEcc="$3"
1314
1315   _initpath "$domain" "$_isEcc"
1316
1317   if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
1318     _info "CSR exists, skip"
1319     return
1320   fi
1321
1322   if [ ! -f "$CERT_KEY_PATH" ]; then
1323     _err "The key file is not found: $CERT_KEY_PATH"
1324     _err "Please create the key file first."
1325     return 1
1326   fi
1327   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1328
1329 }
1330
1331 _url_replace() {
1332   tr '/+' '_-' | tr -d '= '
1333 }
1334
1335 _time2str() {
1336   #Linux
1337   if date -u -d@"$1" 2>/dev/null; then
1338     return
1339   fi
1340
1341   #BSD
1342   if date -u -r "$1" 2>/dev/null; then
1343     return
1344   fi
1345
1346   #Soaris
1347   if _exists adb; then
1348     _t_s_a=$(echo "0t${1}=Y" | adb)
1349     echo "$_t_s_a"
1350   fi
1351
1352 }
1353
1354 _normalizeJson() {
1355   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1356 }
1357
1358 _stat() {
1359   #Linux
1360   if stat -c '%U:%G' "$1" 2>/dev/null; then
1361     return
1362   fi
1363
1364   #BSD
1365   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1366     return
1367   fi
1368
1369   return 1 #error, 'stat' not found
1370 }
1371
1372 #keyfile
1373 _calcjwk() {
1374   keyfile="$1"
1375   if [ -z "$keyfile" ]; then
1376     _usage "Usage: _calcjwk keyfile"
1377     return 1
1378   fi
1379
1380   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1381     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1382     return 0
1383   fi
1384
1385   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1386     _debug "RSA key"
1387     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1388     if [ "${#pub_exp}" = "5" ]; then
1389       pub_exp=0$pub_exp
1390     fi
1391     _debug3 pub_exp "$pub_exp"
1392
1393     e=$(echo "$pub_exp" | _h2b | _base64)
1394     _debug3 e "$e"
1395
1396     modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1397     _debug3 modulus "$modulus"
1398     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1399     _debug3 n "$n"
1400
1401     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1402     _debug3 jwk "$jwk"
1403
1404     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1405     JWK_HEADERPLACE_PART1='{"nonce": "'
1406     JWK_HEADERPLACE_PART2='", "alg": "RS256", "jwk": '$jwk'}'
1407   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1408     _debug "EC key"
1409     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1410     _debug3 crv "$crv"
1411
1412     if [ -z "$crv" ]; then
1413       _debug "Let's try ASN1 OID"
1414       crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1415       _debug3 crv_oid "$crv_oid"
1416       case "${crv_oid}" in
1417         "prime256v1")
1418           crv="P-256"
1419           ;;
1420         "secp384r1")
1421           crv="P-384"
1422           ;;
1423         "secp521r1")
1424           crv="P-521"
1425           ;;
1426         *)
1427           _err "ECC oid : $crv_oid"
1428           return 1
1429           ;;
1430       esac
1431       _debug3 crv "$crv"
1432     fi
1433
1434     pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1435     pubi=$(_math "$pubi" + 1)
1436     _debug3 pubi "$pubi"
1437
1438     pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1439     pubj=$(_math "$pubj" - 1)
1440     _debug3 pubj "$pubj"
1441
1442     pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1443     _debug3 pubtext "$pubtext"
1444
1445     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1446     xlen=$(_math "$xlen" / 4)
1447     _debug3 xlen "$xlen"
1448
1449     xend=$(_math "$xlen" + 1)
1450     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1451     _debug3 x "$x"
1452
1453     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1454     _debug3 x64 "$x64"
1455
1456     xend=$(_math "$xend" + 1)
1457     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1458     _debug3 y "$y"
1459
1460     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1461     _debug3 y64 "$y64"
1462
1463     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1464     _debug3 jwk "$jwk"
1465
1466     JWK_HEADER='{"alg": "ES256", "jwk": '$jwk'}'
1467     JWK_HEADERPLACE_PART1='{"nonce": "'
1468     JWK_HEADERPLACE_PART2='", "alg": "ES256", "jwk": '$jwk'}'
1469   else
1470     _err "Only RSA or EC key is supported."
1471     return 1
1472   fi
1473
1474   _debug3 JWK_HEADER "$JWK_HEADER"
1475   __CACHED_JWK_KEY_FILE="$keyfile"
1476 }
1477
1478 _time() {
1479   date -u "+%s"
1480 }
1481
1482 _utc_date() {
1483   date -u "+%Y-%m-%d %H:%M:%S"
1484 }
1485
1486 _mktemp() {
1487   if _exists mktemp; then
1488     if mktemp 2>/dev/null; then
1489       return 0
1490     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1491       #for Mac osx
1492       return 0
1493     fi
1494   fi
1495   if [ -d "/tmp" ]; then
1496     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1497     return 0
1498   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1499     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1500     return 0
1501   fi
1502   _err "Can not create temp file."
1503 }
1504
1505 _inithttp() {
1506
1507   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1508     HTTP_HEADER="$(_mktemp)"
1509     _debug2 HTTP_HEADER "$HTTP_HEADER"
1510   fi
1511
1512   if [ "$__HTTP_INITIALIZED" ]; then
1513     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1514       _debug2 "Http already initialized."
1515       return 0
1516     fi
1517   fi
1518
1519   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1520     _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
1521     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1522       _CURL_DUMP="$(_mktemp)"
1523       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1524     fi
1525
1526     if [ "$CA_PATH" ]; then
1527       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1528     elif [ "$CA_BUNDLE" ]; then
1529       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1530     fi
1531
1532   fi
1533
1534   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1535     _ACME_WGET="wget -q"
1536     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1537       _ACME_WGET="$_ACME_WGET -d "
1538     fi
1539     if [ "$CA_PATH" ]; then
1540       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1541     elif [ "$CA_BUNDLE" ]; then
1542       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1543     fi
1544   fi
1545
1546   #from wget 1.14: do not skip body on 404 error
1547   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1548     _ACME_WGET="$_ACME_WGET --content-on-error "
1549   fi
1550
1551   __HTTP_INITIALIZED=1
1552
1553 }
1554
1555 # body  url [needbase64] [POST|PUT]
1556 _post() {
1557   body="$1"
1558   url="$2"
1559   needbase64="$3"
1560   httpmethod="$4"
1561
1562   if [ -z "$httpmethod" ]; then
1563     httpmethod="POST"
1564   fi
1565   _debug $httpmethod
1566   _debug "url" "$url"
1567   _debug2 "body" "$body"
1568
1569   _inithttp
1570
1571   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1572     _CURL="$_ACME_CURL"
1573     if [ "$HTTPS_INSECURE" ]; then
1574       _CURL="$_CURL --insecure  "
1575     fi
1576     _debug "_CURL" "$_CURL"
1577     if [ "$needbase64" ]; then
1578       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url" | _base64)"
1579     else
1580       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url")"
1581     fi
1582     _ret="$?"
1583     if [ "$_ret" != "0" ]; then
1584       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1585       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1586         _err "Here is the curl dump log:"
1587         _err "$(cat "$_CURL_DUMP")"
1588       fi
1589     fi
1590   elif [ "$_ACME_WGET" ]; then
1591     _WGET="$_ACME_WGET"
1592     if [ "$HTTPS_INSECURE" ]; then
1593       _WGET="$_WGET --no-check-certificate "
1594     fi
1595     _debug "_WGET" "$_WGET"
1596     if [ "$needbase64" ]; then
1597       if [ "$httpmethod" = "POST" ]; then
1598         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1599       else
1600         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1601       fi
1602     else
1603       if [ "$httpmethod" = "POST" ]; then
1604         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER")"
1605       else
1606         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER")"
1607       fi
1608     fi
1609     _ret="$?"
1610     if [ "$_ret" = "8" ]; then
1611       _ret=0
1612       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1613     fi
1614     if [ "$_ret" != "0" ]; then
1615       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1616     fi
1617     _sed_i "s/^ *//g" "$HTTP_HEADER"
1618   else
1619     _ret="$?"
1620     _err "Neither curl nor wget is found, can not do $httpmethod."
1621   fi
1622   _debug "_ret" "$_ret"
1623   printf "%s" "$response"
1624   return $_ret
1625 }
1626
1627 # url getheader timeout
1628 _get() {
1629   _debug GET
1630   url="$1"
1631   onlyheader="$2"
1632   t="$3"
1633   _debug url "$url"
1634   _debug "timeout" "$t"
1635
1636   _inithttp
1637
1638   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1639     _CURL="$_ACME_CURL"
1640     if [ "$HTTPS_INSECURE" ]; then
1641       _CURL="$_CURL --insecure  "
1642     fi
1643     if [ "$t" ]; then
1644       _CURL="$_CURL --connect-timeout $t"
1645     fi
1646     _debug "_CURL" "$_CURL"
1647     if [ "$onlyheader" ]; then
1648       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1649     else
1650       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1651     fi
1652     ret=$?
1653     if [ "$ret" != "0" ]; then
1654       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1655       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1656         _err "Here is the curl dump log:"
1657         _err "$(cat "$_CURL_DUMP")"
1658       fi
1659     fi
1660   elif [ "$_ACME_WGET" ]; then
1661     _WGET="$_ACME_WGET"
1662     if [ "$HTTPS_INSECURE" ]; then
1663       _WGET="$_WGET --no-check-certificate "
1664     fi
1665     if [ "$t" ]; then
1666       _WGET="$_WGET --timeout=$t"
1667     fi
1668     _debug "_WGET" "$_WGET"
1669     if [ "$onlyheader" ]; then
1670       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1671     else
1672       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1673     fi
1674     ret=$?
1675     if [ "$ret" = "8" ]; then
1676       ret=0
1677       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1678     fi
1679     if [ "$ret" != "0" ]; then
1680       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1681     fi
1682   else
1683     ret=$?
1684     _err "Neither curl nor wget is found, can not do GET."
1685   fi
1686   _debug "ret" "$ret"
1687   return $ret
1688 }
1689
1690 _head_n() {
1691   head -n "$1"
1692 }
1693
1694 _tail_n() {
1695   if ! tail -n "$1" 2>/dev/null; then
1696     #fix for solaris
1697     tail -"$1"
1698   fi
1699 }
1700
1701 # url  payload needbase64  keyfile
1702 _send_signed_request() {
1703   url=$1
1704   payload=$2
1705   needbase64=$3
1706   keyfile=$4
1707   if [ -z "$keyfile" ]; then
1708     keyfile="$ACCOUNT_KEY_PATH"
1709   fi
1710   _debug url "$url"
1711   _debug payload "$payload"
1712
1713   if ! _calcjwk "$keyfile"; then
1714     return 1
1715   fi
1716
1717   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
1718   _debug3 payload64 "$payload64"
1719
1720   MAX_REQUEST_RETRY_TIMES=5
1721   _request_retry_times=0
1722   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
1723     _debug3 _request_retry_times "$_request_retry_times"
1724     if [ -z "$_CACHED_NONCE" ]; then
1725       _headers=""
1726       if [ "$ACME_NEW_NONCE" ]; then
1727         _debug2 "Get nonce. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
1728         nonceurl="$ACME_NEW_NONCE"
1729         if _post "" "$nonceurl" "" "HEAD"; then
1730           _headers="$(cat "$HTTP_HEADER")"
1731         fi
1732       fi
1733       if [ -z "$_headers" ]; then
1734         _debug2 "Get nonce. ACME_DIRECTORY" "$ACME_DIRECTORY"
1735         nonceurl="$ACME_DIRECTORY"
1736         _headers="$(_get "$nonceurl" "onlyheader")"
1737       fi
1738
1739       if [ "$?" != "0" ]; then
1740         _err "Can not connect to $nonceurl to get nonce."
1741         return 1
1742       fi
1743
1744       _debug2 _headers "$_headers"
1745
1746       _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1747       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
1748     else
1749       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
1750     fi
1751     nonce="$_CACHED_NONCE"
1752     _debug2 nonce "$nonce"
1753
1754     protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2"
1755     _debug3 protected "$protected"
1756
1757     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
1758     _debug3 protected64 "$protected64"
1759
1760     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
1761       _err "Sign request failed."
1762       return 1
1763     fi
1764     _debug3 _sig_t "$_sig_t"
1765
1766     sig="$(printf "%s" "$_sig_t" | _url_replace)"
1767     _debug3 sig "$sig"
1768
1769     body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1770     _debug3 body "$body"
1771
1772     response="$(_post "$body" "$url" "$needbase64")"
1773     _CACHED_NONCE=""
1774
1775     if [ "$?" != "0" ]; then
1776       _err "Can not post to $url"
1777       return 1
1778     fi
1779     _debug2 original "$response"
1780     response="$(echo "$response" | _normalizeJson)"
1781
1782     responseHeaders="$(cat "$HTTP_HEADER")"
1783
1784     _debug2 responseHeaders "$responseHeaders"
1785     _debug2 response "$response"
1786     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
1787     _debug code "$code"
1788
1789     _CACHED_NONCE="$(echo "$responseHeaders" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1790
1791     if _contains "$response" "JWS has invalid anti-replay nonce"; then
1792       _info "It seems the CA server is busy now, let's wait and retry."
1793       _request_retry_times=$(_math "$_request_retry_times" + 1)
1794       _sleep 5
1795       continue
1796     fi
1797     break
1798   done
1799
1800 }
1801
1802 #setopt "file"  "opt"  "="  "value" [";"]
1803 _setopt() {
1804   __conf="$1"
1805   __opt="$2"
1806   __sep="$3"
1807   __val="$4"
1808   __end="$5"
1809   if [ -z "$__opt" ]; then
1810     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
1811     return
1812   fi
1813   if [ ! -f "$__conf" ]; then
1814     touch "$__conf"
1815   fi
1816
1817   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
1818     _debug3 OK
1819     if _contains "$__val" "&"; then
1820       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1821     fi
1822     text="$(cat "$__conf")"
1823     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1824
1825   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
1826     if _contains "$__val" "&"; then
1827       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1828     fi
1829     text="$(cat "$__conf")"
1830     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1831
1832   else
1833     _debug3 APP
1834     echo "$__opt$__sep$__val$__end" >>"$__conf"
1835   fi
1836   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
1837 }
1838
1839 #_save_conf  file key  value
1840 #save to conf
1841 _save_conf() {
1842   _s_c_f="$1"
1843   _sdkey="$2"
1844   _sdvalue="$3"
1845   if [ "$_s_c_f" ]; then
1846     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
1847   else
1848     _err "config file is empty, can not save $_sdkey=$_sdvalue"
1849   fi
1850 }
1851
1852 #_clear_conf file  key
1853 _clear_conf() {
1854   _c_c_f="$1"
1855   _sdkey="$2"
1856   if [ "$_c_c_f" ]; then
1857     _conf_data="$(cat "$_c_c_f")"
1858     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
1859   else
1860     _err "config file is empty, can not clear"
1861   fi
1862 }
1863
1864 #_read_conf file  key
1865 _read_conf() {
1866   _r_c_f="$1"
1867   _sdkey="$2"
1868   if [ -f "$_r_c_f" ]; then
1869     (
1870       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
1871       eval "printf \"%s\" \"\$$_sdkey\""
1872     )
1873   else
1874     _debug "config file is empty, can not read $_sdkey"
1875   fi
1876 }
1877
1878 #_savedomainconf   key  value
1879 #save to domain.conf
1880 _savedomainconf() {
1881   _save_conf "$DOMAIN_CONF" "$1" "$2"
1882 }
1883
1884 #_cleardomainconf   key
1885 _cleardomainconf() {
1886   _clear_conf "$DOMAIN_CONF" "$1"
1887 }
1888
1889 #_readdomainconf   key
1890 _readdomainconf() {
1891   _read_conf "$DOMAIN_CONF" "$1"
1892 }
1893
1894 #_saveaccountconf  key  value
1895 _saveaccountconf() {
1896   _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
1897 }
1898
1899 #key  value
1900 _saveaccountconf_mutable() {
1901   _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2"
1902   #remove later
1903   _clearaccountconf "$1"
1904 }
1905
1906 #key
1907 _readaccountconf() {
1908   _read_conf "$ACCOUNT_CONF_PATH" "$1"
1909 }
1910
1911 #key
1912 _readaccountconf_mutable() {
1913   _rac_key="$1"
1914   _readaccountconf "SAVED_$_rac_key"
1915 }
1916
1917 #_clearaccountconf   key
1918 _clearaccountconf() {
1919   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
1920 }
1921
1922 #_savecaconf  key  value
1923 _savecaconf() {
1924   _save_conf "$CA_CONF" "$1" "$2"
1925 }
1926
1927 #_readcaconf   key
1928 _readcaconf() {
1929   _read_conf "$CA_CONF" "$1"
1930 }
1931
1932 #_clearaccountconf   key
1933 _clearcaconf() {
1934   _clear_conf "$CA_CONF" "$1"
1935 }
1936
1937 # content localaddress
1938 _startserver() {
1939   content="$1"
1940   ncaddr="$2"
1941   _debug "ncaddr" "$ncaddr"
1942
1943   _debug "startserver: $$"
1944   nchelp="$(nc -h 2>&1)"
1945
1946   _debug Le_HTTPPort "$Le_HTTPPort"
1947   _debug Le_Listen_V4 "$Le_Listen_V4"
1948   _debug Le_Listen_V6 "$Le_Listen_V6"
1949   _NC="nc"
1950
1951   if [ "$Le_Listen_V4" ]; then
1952     _NC="$_NC -4"
1953   elif [ "$Le_Listen_V6" ]; then
1954     _NC="$_NC -6"
1955   fi
1956
1957   if [ "$Le_Listen_V4$Le_Listen_V6$ncaddr" ]; then
1958     if ! _contains "$nchelp" "-4"; then
1959       _err "The nc doesn't support '-4', '-6' or local-address, please install 'netcat-openbsd' and try again."
1960       _err "See $(__green $_PREPARE_LINK)"
1961       return 1
1962     fi
1963   fi
1964
1965   if echo "$nchelp" | grep "\-q[ ,]" >/dev/null; then
1966     _NC="$_NC -q 1 -l $ncaddr"
1967   else
1968     if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null; then
1969       _NC="$_NC -c -l $ncaddr"
1970     elif echo "$nchelp" | grep "\-N" | grep "Shutdown the network socket after EOF on stdin" >/dev/null; then
1971       _NC="$_NC -N -l $ncaddr"
1972     else
1973       _NC="$_NC -l $ncaddr"
1974     fi
1975   fi
1976
1977   _debug "_NC" "$_NC"
1978
1979   #for centos ncat
1980   if _contains "$nchelp" "nmap.org"; then
1981     _debug "Using ncat: nmap.org"
1982     if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"; then
1983       _exec_err
1984       return 1
1985     fi
1986     if [ "$DEBUG" ]; then
1987       _exec_err
1988     fi
1989     return
1990   fi
1991
1992   #  while true ; do
1993   if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC -p \"$Le_HTTPPort\" >&2"; then
1994     _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"
1995   fi
1996
1997   if [ "$?" != "0" ]; then
1998     _err "nc listen error."
1999     _exec_err
2000     exit 1
2001   fi
2002   if [ "$DEBUG" ]; then
2003     _exec_err
2004   fi
2005   #  done
2006 }
2007
2008 _stopserver() {
2009   pid="$1"
2010   _debug "pid" "$pid"
2011   if [ -z "$pid" ]; then
2012     return
2013   fi
2014
2015   _debug2 "Le_HTTPPort" "$Le_HTTPPort"
2016   if [ "$Le_HTTPPort" ]; then
2017     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
2018       _get "http://localhost:$Le_HTTPPort" "" 1
2019     else
2020       _get "http://localhost:$Le_HTTPPort" "" 1 >/dev/null 2>&1
2021     fi
2022   fi
2023
2024   _debug2 "Le_TLSPort" "$Le_TLSPort"
2025   if [ "$Le_TLSPort" ]; then
2026     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
2027       _get "https://localhost:$Le_TLSPort" "" 1
2028       _get "https://localhost:$Le_TLSPort" "" 1
2029     else
2030       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
2031       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
2032     fi
2033   fi
2034 }
2035
2036 # sleep sec
2037 _sleep() {
2038   _sleep_sec="$1"
2039   if [ "$__INTERACTIVE" ]; then
2040     _sleep_c="$_sleep_sec"
2041     while [ "$_sleep_c" -ge "0" ]; do
2042       printf "\r      \r"
2043       __green "$_sleep_c"
2044       _sleep_c="$(_math "$_sleep_c" - 1)"
2045       sleep 1
2046     done
2047     printf "\r"
2048   else
2049     sleep "$_sleep_sec"
2050   fi
2051 }
2052
2053 # _starttlsserver  san_a  san_b port content _ncaddr
2054 _starttlsserver() {
2055   _info "Starting tls server."
2056   san_a="$1"
2057   san_b="$2"
2058   port="$3"
2059   content="$4"
2060   opaddr="$5"
2061
2062   _debug san_a "$san_a"
2063   _debug san_b "$san_b"
2064   _debug port "$port"
2065
2066   #create key TLS_KEY
2067   if ! _createkey "2048" "$TLS_KEY"; then
2068     _err "Create tls validation key error."
2069     return 1
2070   fi
2071
2072   #create csr
2073   alt="$san_a"
2074   if [ "$san_b" ]; then
2075     alt="$alt,$san_b"
2076   fi
2077   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF"; then
2078     _err "Create tls validation csr error."
2079     return 1
2080   fi
2081
2082   #self signed
2083   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2084     _err "Create tls validation cert error."
2085     return 1
2086   fi
2087
2088   __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -cert $TLS_CERT  -key $TLS_KEY "
2089   if [ "$opaddr" ]; then
2090     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2091   else
2092     __S_OPENSSL="$__S_OPENSSL -accept $port"
2093   fi
2094
2095   _debug Le_Listen_V4 "$Le_Listen_V4"
2096   _debug Le_Listen_V6 "$Le_Listen_V6"
2097   if [ "$Le_Listen_V4" ]; then
2098     __S_OPENSSL="$__S_OPENSSL -4"
2099   elif [ "$Le_Listen_V6" ]; then
2100     __S_OPENSSL="$__S_OPENSSL -6"
2101   fi
2102
2103   _debug "$__S_OPENSSL"
2104   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2105     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL -tlsextdebug) &
2106   else
2107     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL >/dev/null 2>&1) &
2108   fi
2109
2110   serverproc="$!"
2111   sleep 1
2112   _debug serverproc "$serverproc"
2113 }
2114
2115 #file
2116 _readlink() {
2117   _rf="$1"
2118   if ! readlink -f "$_rf" 2>/dev/null; then
2119     if _startswith "$_rf" "/"; then
2120       echo "$_rf"
2121       return 0
2122     fi
2123     echo "$(pwd)/$_rf" | _conapath
2124   fi
2125 }
2126
2127 _conapath() {
2128   sed "s#/\./#/#g"
2129 }
2130
2131 __initHome() {
2132   if [ -z "$_SCRIPT_HOME" ]; then
2133     if _exists readlink && _exists dirname; then
2134       _debug "Lets find script dir."
2135       _debug "_SCRIPT_" "$_SCRIPT_"
2136       _script="$(_readlink "$_SCRIPT_")"
2137       _debug "_script" "$_script"
2138       _script_home="$(dirname "$_script")"
2139       _debug "_script_home" "$_script_home"
2140       if [ -d "$_script_home" ]; then
2141         _SCRIPT_HOME="$_script_home"
2142       else
2143         _err "It seems the script home is not correct:$_script_home"
2144       fi
2145     fi
2146   fi
2147
2148   #  if [ -z "$LE_WORKING_DIR" ]; then
2149   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2150   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2151   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2152   #    else
2153   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2154   #    fi
2155   #  fi
2156
2157   if [ -z "$LE_WORKING_DIR" ]; then
2158     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2159     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2160   fi
2161   export LE_WORKING_DIR
2162
2163   if [ -z "$LE_CONFIG_HOME" ]; then
2164     LE_CONFIG_HOME="$LE_WORKING_DIR"
2165   fi
2166   _debug "Using config home:$LE_CONFIG_HOME"
2167   export LE_CONFIG_HOME
2168
2169   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2170
2171   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2172     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2173       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2174     fi
2175   fi
2176
2177   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2178     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2179   fi
2180
2181   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2182
2183   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2184
2185   if [ -z "$LE_TEMP_DIR" ]; then
2186     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2187   fi
2188 }
2189
2190 #server
2191 _initAPI() {
2192   _api_server="${1:-$ACME_DIRECTORY}"
2193   _debug "_init api for server: $_api_server"
2194
2195   if [ "$_api_server" = "$DEFAULT_CA" ]; then
2196     #just for performance, hardcode the default entry points
2197     export ACME_KEY_CHANGE="https://acme-v01.api.letsencrypt.org/acme/key-change"
2198     export ACME_NEW_AUTHZ="https://acme-v01.api.letsencrypt.org/acme/new-authz"
2199     export ACME_NEW_ORDER="https://acme-v01.api.letsencrypt.org/acme/new-cert"
2200     export ACME_NEW_ORDER_RES="new-cert"
2201     export ACME_NEW_ACCOUNT="https://acme-v01.api.letsencrypt.org/acme/new-reg"
2202     export ACME_NEW_ACCOUNT_RES="new-reg"
2203     export ACME_REVOKE_CERT="https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
2204   fi
2205
2206   if [ -z "$ACME_NEW_ACCOUNT" ]; then
2207     response=$(_get "$_api_server")
2208     if [ "$?" != "0" ]; then
2209       _debug2 "response" "$response"
2210       _err "Can not init api."
2211       return 1
2212     fi
2213     _debug2 "response" "$response"
2214
2215     ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
2216     export ACME_KEY_CHANGE
2217
2218     ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
2219     export ACME_NEW_AUTHZ
2220
2221     ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2222     ACME_NEW_ORDER_RES="new-cert"
2223     if [ -z "$ACME_NEW_ORDER" ]; then
2224       ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
2225       ACME_NEW_ORDER_RES="new-order"
2226     fi
2227     export ACME_NEW_ORDER
2228     export ACME_NEW_ORDER_RES
2229
2230     ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
2231     ACME_NEW_ACCOUNT_RES="new-reg"
2232     if [ -z "$ACME_NEW_ACCOUNT" ]; then
2233       ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
2234       ACME_NEW_ACCOUNT_RES="new-account"
2235     fi
2236     export ACME_NEW_ACCOUNT
2237     export ACME_NEW_ACCOUNT_RES
2238
2239     ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2240     export ACME_REVOKE_CERT
2241
2242     ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
2243     export ACME_NEW_NONCE
2244
2245   fi
2246
2247   _debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
2248   _debug "ACME_NEW_AUTHZ" "$ACME_NEW_AUTHZ"
2249   _debug "ACME_NEW_ORDER" "$ACME_NEW_ORDER"
2250   _debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
2251   _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
2252 }
2253
2254 #[domain]  [keylength or isEcc flag]
2255 _initpath() {
2256
2257   __initHome
2258
2259   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2260     . "$ACCOUNT_CONF_PATH"
2261   fi
2262
2263   if [ "$IN_CRON" ]; then
2264     if [ ! "$_USER_PATH_EXPORTED" ]; then
2265       _USER_PATH_EXPORTED=1
2266       export PATH="$USER_PATH:$PATH"
2267     fi
2268   fi
2269
2270   if [ -z "$CA_HOME" ]; then
2271     CA_HOME="$DEFAULT_CA_HOME"
2272   fi
2273
2274   if [ -z "$ACME_DIRECTORY" ]; then
2275     if [ -z "$STAGE" ]; then
2276       ACME_DIRECTORY="$DEFAULT_CA"
2277     else
2278       ACME_DIRECTORY="$STAGE_CA"
2279       _info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
2280     fi
2281   fi
2282
2283   _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
2284   _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
2285
2286   CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
2287
2288   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2289
2290   if [ -z "$CA_CONF" ]; then
2291     CA_CONF="$_DEFAULT_CA_CONF"
2292   fi
2293   _debug3 CA_CONF "$CA_CONF"
2294
2295   if [ -f "$CA_CONF" ]; then
2296     . "$CA_CONF"
2297   fi
2298
2299   if [ -z "$ACME_DIR" ]; then
2300     ACME_DIR="/home/.acme"
2301   fi
2302
2303   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2304     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2305   fi
2306
2307   if [ -z "$USER_AGENT" ]; then
2308     USER_AGENT="$DEFAULT_USER_AGENT"
2309   fi
2310
2311   if [ -z "$HTTP_HEADER" ]; then
2312     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2313   fi
2314
2315   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2316   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2317
2318   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2319   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2320   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2321     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2322   fi
2323
2324   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2325     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2326   fi
2327
2328   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2329   if [ -z "$CERT_HOME" ]; then
2330     CERT_HOME="$_DEFAULT_CERT_HOME"
2331   fi
2332
2333   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2334     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2335   fi
2336
2337   if [ -z "$1" ]; then
2338     return 0
2339   fi
2340
2341   domain="$1"
2342   _ilength="$2"
2343
2344   if [ -z "$DOMAIN_PATH" ]; then
2345     domainhome="$CERT_HOME/$domain"
2346     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2347
2348     DOMAIN_PATH="$domainhome"
2349
2350     if _isEccKey "$_ilength"; then
2351       DOMAIN_PATH="$domainhomeecc"
2352     else
2353       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2354         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2355       fi
2356     fi
2357     _debug DOMAIN_PATH "$DOMAIN_PATH"
2358   fi
2359
2360   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2361     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2362   fi
2363
2364   if [ -z "$DOMAIN_CONF" ]; then
2365     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2366   fi
2367
2368   if [ -z "$DOMAIN_SSL_CONF" ]; then
2369     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2370   fi
2371
2372   if [ -z "$CSR_PATH" ]; then
2373     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2374   fi
2375   if [ -z "$CERT_KEY_PATH" ]; then
2376     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2377   fi
2378   if [ -z "$CERT_PATH" ]; then
2379     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2380   fi
2381   if [ -z "$CA_CERT_PATH" ]; then
2382     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2383   fi
2384   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2385     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2386   fi
2387   if [ -z "$CERT_PFX_PATH" ]; then
2388     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2389   fi
2390   if [ -z "$CERT_PKCS8_PATH" ]; then
2391     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2392   fi
2393
2394   if [ -z "$TLS_CONF" ]; then
2395     TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
2396   fi
2397   if [ -z "$TLS_CERT" ]; then
2398     TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
2399   fi
2400   if [ -z "$TLS_KEY" ]; then
2401     TLS_KEY="$DOMAIN_PATH/tls.validation.key"
2402   fi
2403   if [ -z "$TLS_CSR" ]; then
2404     TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
2405   fi
2406
2407 }
2408
2409 _exec() {
2410   if [ -z "$_EXEC_TEMP_ERR" ]; then
2411     _EXEC_TEMP_ERR="$(_mktemp)"
2412   fi
2413
2414   if [ "$_EXEC_TEMP_ERR" ]; then
2415     eval "$@ 2>>$_EXEC_TEMP_ERR"
2416   else
2417     eval "$@"
2418   fi
2419 }
2420
2421 _exec_err() {
2422   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2423 }
2424
2425 _apachePath() {
2426   _APACHECTL="apachectl"
2427   if ! _exists apachectl; then
2428     if _exists apache2ctl; then
2429       _APACHECTL="apache2ctl"
2430     else
2431       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2432       _err "Please use webroot mode to try again."
2433       return 1
2434     fi
2435   fi
2436
2437   if ! _exec $_APACHECTL -V >/dev/null; then
2438     _exec_err
2439     return 1
2440   fi
2441
2442   if [ "$APACHE_HTTPD_CONF" ]; then
2443     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2444     httpdconf="$APACHE_HTTPD_CONF"
2445     httpdconfname="$(basename "$httpdconfname")"
2446   else
2447     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2448     _debug httpdconfname "$httpdconfname"
2449
2450     if [ -z "$httpdconfname" ]; then
2451       _err "Can not read apache config file."
2452       return 1
2453     fi
2454
2455     if _startswith "$httpdconfname" '/'; then
2456       httpdconf="$httpdconfname"
2457       httpdconfname="$(basename "$httpdconfname")"
2458     else
2459       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2460       _debug httpdroot "$httpdroot"
2461       httpdconf="$httpdroot/$httpdconfname"
2462       httpdconfname="$(basename "$httpdconfname")"
2463     fi
2464   fi
2465   _debug httpdconf "$httpdconf"
2466   _debug httpdconfname "$httpdconfname"
2467   if [ ! -f "$httpdconf" ]; then
2468     _err "Apache Config file not found" "$httpdconf"
2469     return 1
2470   fi
2471   return 0
2472 }
2473
2474 _restoreApache() {
2475   if [ -z "$usingApache" ]; then
2476     return 0
2477   fi
2478   _initpath
2479   if ! _apachePath; then
2480     return 1
2481   fi
2482
2483   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2484     _debug "No config file to restore."
2485     return 0
2486   fi
2487
2488   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2489   _debug "Restored: $httpdconf."
2490   if ! _exec $_APACHECTL -t; then
2491     _exec_err
2492     _err "Sorry, restore apache config error, please contact me."
2493     return 1
2494   fi
2495   _debug "Restored successfully."
2496   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2497   return 0
2498 }
2499
2500 _setApache() {
2501   _initpath
2502   if ! _apachePath; then
2503     return 1
2504   fi
2505
2506   #test the conf first
2507   _info "Checking if there is an error in the apache config file before starting."
2508
2509   if ! _exec "$_APACHECTL" -t >/dev/null; then
2510     _exec_err
2511     _err "The apache config file has error, please fix it first, then try again."
2512     _err "Don't worry, there is nothing changed to your system."
2513     return 1
2514   else
2515     _info "OK"
2516   fi
2517
2518   #backup the conf
2519   _debug "Backup apache config file" "$httpdconf"
2520   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2521     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2522     _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
2523     return 1
2524   fi
2525   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2526   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2527   _info "The backup file will be deleted on success, just forget it."
2528
2529   #add alias
2530
2531   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2532   _debug "apacheVer" "$apacheVer"
2533   apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
2534   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2535
2536   if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
2537     echo "
2538 Alias /.well-known/acme-challenge  $ACME_DIR
2539
2540 <Directory $ACME_DIR >
2541 Require all granted
2542 </Directory>
2543   " >>"$httpdconf"
2544   else
2545     echo "
2546 Alias /.well-known/acme-challenge  $ACME_DIR
2547
2548 <Directory $ACME_DIR >
2549 Order allow,deny
2550 Allow from all
2551 </Directory>
2552   " >>"$httpdconf"
2553   fi
2554
2555   _msg="$($_APACHECTL -t 2>&1)"
2556   if [ "$?" != "0" ]; then
2557     _err "Sorry, apache config error"
2558     if _restoreApache; then
2559       _err "The apache config file is restored."
2560     else
2561       _err "Sorry, The apache config file can not be restored, please report bug."
2562     fi
2563     return 1
2564   fi
2565
2566   if [ ! -d "$ACME_DIR" ]; then
2567     mkdir -p "$ACME_DIR"
2568     chmod 755 "$ACME_DIR"
2569   fi
2570
2571   if ! _exec "$_APACHECTL" graceful; then
2572     _exec_err
2573     _err "$_APACHECTL  graceful error, please contact me."
2574     _restoreApache
2575     return 1
2576   fi
2577   usingApache="1"
2578   return 0
2579 }
2580
2581 #find the real nginx conf file
2582 #backup
2583 #set the nginx conf
2584 #returns the real nginx conf file
2585 _setNginx() {
2586   _d="$1"
2587   _croot="$2"
2588   _thumbpt="$3"
2589   if ! _exists "nginx"; then
2590     _err "nginx command is not found."
2591     return 1
2592   fi
2593   FOUND_REAL_NGINX_CONF=""
2594   FOUND_REAL_NGINX_CONF_LN=""
2595   BACKUP_NGINX_CONF=""
2596   _debug _croot "$_croot"
2597   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2598   _debug _start_f "$_start_f"
2599   if [ -z "$_start_f" ]; then
2600     _debug "find start conf from nginx command"
2601     if [ -z "$NGINX_CONF" ]; then
2602       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2603       _debug NGINX_CONF "$NGINX_CONF"
2604       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2605       _debug NGINX_CONF "$NGINX_CONF"
2606       if [ ! -f "$NGINX_CONF" ]; then
2607         _err "'$NGINX_CONF' doesn't exist."
2608         NGINX_CONF=""
2609         return 1
2610       fi
2611       _debug "Found nginx conf file:$NGINX_CONF"
2612     fi
2613     _start_f="$NGINX_CONF"
2614   fi
2615   _debug "Start detect nginx conf for $_d from:$_start_f"
2616   if ! _checkConf "$_d" "$_start_f"; then
2617     _err "Can not find conf file for domain $d"
2618     return 1
2619   fi
2620   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2621
2622   _ln=$FOUND_REAL_NGINX_CONF_LN
2623   _debug "_ln" "$_ln"
2624
2625   _lnn=$(_math $_ln + 1)
2626   _debug _lnn "$_lnn"
2627   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2628   _debug "_start_tag" "$_start_tag"
2629   if [ "$_start_tag" = "$NGINX_START" ]; then
2630     _info "The domain $_d is already configured, skip"
2631     FOUND_REAL_NGINX_CONF=""
2632     return 0
2633   fi
2634
2635   mkdir -p "$DOMAIN_BACKUP_PATH"
2636   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2637   _debug _backup_conf "$_backup_conf"
2638   BACKUP_NGINX_CONF="$_backup_conf"
2639   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2640   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2641     _err "backup error."
2642     FOUND_REAL_NGINX_CONF=""
2643     return 1
2644   fi
2645
2646   _info "Check the nginx conf before setting up."
2647   if ! _exec "nginx -t" >/dev/null; then
2648     _exec_err
2649     return 1
2650   fi
2651
2652   _info "OK, Set up nginx config file"
2653
2654   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2655     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2656     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2657     return 1
2658   fi
2659
2660   echo "$NGINX_START
2661 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
2662   default_type text/plain;
2663   return 200 \"\$1.$_thumbpt\";
2664 }
2665 #NGINX_START
2666 " >>"$FOUND_REAL_NGINX_CONF"
2667
2668   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
2669     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2670     _err "write nginx conf error, but don't worry, the file is restored."
2671     return 1
2672   fi
2673   _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
2674   _info "nginx conf is done, let's check it again."
2675   if ! _exec "nginx -t" >/dev/null; then
2676     _exec_err
2677     _err "It seems that nginx conf was broken, let's restore."
2678     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2679     return 1
2680   fi
2681
2682   _info "Reload nginx"
2683   if ! _exec "nginx -s reload" >/dev/null; then
2684     _exec_err
2685     _err "It seems that nginx reload error, let's restore."
2686     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2687     return 1
2688   fi
2689
2690   return 0
2691 }
2692
2693 #d , conf
2694 _checkConf() {
2695   _d="$1"
2696   _c_file="$2"
2697   _debug "Start _checkConf from:$_c_file"
2698   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
2699     _debug "wildcard"
2700     for _w_f in $2; do
2701       if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
2702         return 0
2703       fi
2704     done
2705     #not found
2706     return 1
2707   elif [ -f "$2" ]; then
2708     _debug "single"
2709     if _isRealNginxConf "$1" "$2"; then
2710       _debug "$2 is found."
2711       FOUND_REAL_NGINX_CONF="$2"
2712       return 0
2713     fi
2714     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
2715       _debug "Try include files"
2716       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
2717         _debug "check included $included"
2718         if _checkConf "$1" "$included"; then
2719           return 0
2720         fi
2721       done
2722     fi
2723     return 1
2724   else
2725     _debug "$2 not found."
2726     return 1
2727   fi
2728   return 1
2729 }
2730
2731 #d , conf
2732 _isRealNginxConf() {
2733   _debug "_isRealNginxConf $1 $2"
2734   if [ -f "$2" ]; then
2735     for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
2736       _debug _fln "$_fln"
2737       if [ "$_fln" ]; then
2738         _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *{" | _tail_n 1)
2739         _debug "_start" "$_start"
2740         _start_n=$(echo "$_start" | cut -d : -f 1)
2741         _start_nn=$(_math $_start_n + 1)
2742         _debug "_start_n" "$_start_n"
2743         _debug "_start_nn" "$_start_nn"
2744
2745         _left="$(sed -n "${_start_nn},99999p" "$2")"
2746         _debug2 _left "$_left"
2747         if echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" >/dev/null; then
2748           _end=$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" | _head_n 1)
2749           _debug "_end" "$_end"
2750           _end_n=$(echo "$_end" | cut -d : -f 1)
2751           _debug "_end_n" "$_end_n"
2752           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
2753         else
2754           _seg_n="$_left"
2755         fi
2756
2757         _debug "_seg_n" "$_seg_n"
2758
2759         if [ "$(echo "$_seg_n" | _egrep_o "^ *ssl  *on *;")" ] \
2760           || [ "$(echo "$_seg_n" | _egrep_o "listen .* ssl[ |;]")" ]; then
2761           _debug "ssl on, skip"
2762         else
2763           FOUND_REAL_NGINX_CONF_LN=$_fln
2764           _debug3 "found FOUND_REAL_NGINX_CONF_LN" "$FOUND_REAL_NGINX_CONF_LN"
2765           return 0
2766         fi
2767       fi
2768     done
2769   fi
2770   return 1
2771 }
2772
2773 #restore all the nginx conf
2774 _restoreNginx() {
2775   if [ -z "$NGINX_RESTORE_VLIST" ]; then
2776     _debug "No need to restore nginx, skip."
2777     return
2778   fi
2779   _debug "_restoreNginx"
2780   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
2781
2782   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
2783     _debug "ng_entry" "$ng_entry"
2784     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
2785     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
2786     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
2787     _info "Restoring from $_ngbackupconf to $_ngconf"
2788     cat "$_ngbackupconf" >"$_ngconf"
2789   done
2790
2791   _info "Reload nginx"
2792   if ! _exec "nginx -s reload" >/dev/null; then
2793     _exec_err
2794     _err "It seems that nginx reload error, please report bug."
2795     return 1
2796   fi
2797   return 0
2798 }
2799
2800 _clearup() {
2801   _stopserver "$serverproc"
2802   serverproc=""
2803   _restoreApache
2804   _restoreNginx
2805   _clearupdns
2806   if [ -z "$DEBUG" ]; then
2807     rm -f "$TLS_CONF"
2808     rm -f "$TLS_CERT"
2809     rm -f "$TLS_KEY"
2810     rm -f "$TLS_CSR"
2811   fi
2812 }
2813
2814 _clearupdns() {
2815   _debug "_clearupdns"
2816   if [ "$dnsadded" != 1 ] || [ -z "$vlist" ]; then
2817     _debug "skip dns."
2818     return
2819   fi
2820
2821   ventries=$(echo "$vlist" | tr ',' ' ')
2822   for ventry in $ventries; do
2823     d=$(echo "$ventry" | cut -d "$sep" -f 1)
2824     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2825     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2826     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2827     txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
2828     _debug txt "$txt"
2829     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
2830       _debug "$d is already verified, skip $vtype."
2831       continue
2832     fi
2833
2834     if [ "$vtype" != "$VTYPE_DNS" ]; then
2835       _info "Skip $d for $vtype"
2836       continue
2837     fi
2838
2839     d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
2840     _debug d_api "$d_api"
2841
2842     if [ -z "$d_api" ]; then
2843       _info "Not Found domain api file: $d_api"
2844       continue
2845     fi
2846
2847     (
2848       if ! . "$d_api"; then
2849         _err "Load file $d_api error. Please check your api file and try again."
2850         return 1
2851       fi
2852
2853       rmcommand="${_currentRoot}_rm"
2854       if ! _exists "$rmcommand"; then
2855         _err "It seems that your api file doesn't define $rmcommand"
2856         return 1
2857       fi
2858
2859       txtdomain="_acme-challenge.$d"
2860
2861       if ! $rmcommand "$txtdomain" "$txt"; then
2862         _err "Error removing txt for domain:$txtdomain"
2863         return 1
2864       fi
2865     )
2866
2867   done
2868 }
2869
2870 # webroot  removelevel tokenfile
2871 _clearupwebbroot() {
2872   __webroot="$1"
2873   if [ -z "$__webroot" ]; then
2874     _debug "no webroot specified, skip"
2875     return 0
2876   fi
2877
2878   _rmpath=""
2879   if [ "$2" = '1' ]; then
2880     _rmpath="$__webroot/.well-known"
2881   elif [ "$2" = '2' ]; then
2882     _rmpath="$__webroot/.well-known/acme-challenge"
2883   elif [ "$2" = '3' ]; then
2884     _rmpath="$__webroot/.well-known/acme-challenge/$3"
2885   else
2886     _debug "Skip for removelevel:$2"
2887   fi
2888
2889   if [ "$_rmpath" ]; then
2890     if [ "$DEBUG" ]; then
2891       _debug "Debugging, skip removing: $_rmpath"
2892     else
2893       rm -rf "$_rmpath"
2894     fi
2895   fi
2896
2897   return 0
2898
2899 }
2900
2901 _on_before_issue() {
2902   _chk_web_roots="$1"
2903   _chk_main_domain="$2"
2904   _chk_alt_domains="$3"
2905   _chk_pre_hook="$4"
2906   _chk_local_addr="$5"
2907   _debug _on_before_issue
2908   #run pre hook
2909   if [ "$_chk_pre_hook" ]; then
2910     _info "Run pre hook:'$_chk_pre_hook'"
2911     if ! (
2912       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
2913     ); then
2914       _err "Error when run pre hook."
2915       return 1
2916     fi
2917   fi
2918
2919   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
2920     if ! _exists "nc"; then
2921       _err "Please install netcat(nc) tools first."
2922       return 1
2923     fi
2924   fi
2925
2926   _debug Le_LocalAddress "$_chk_local_addr"
2927
2928   alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
2929   _index=1
2930   _currentRoot=""
2931   _addrIndex=1
2932   for d in $alldomains; do
2933     _debug "Check for domain" "$d"
2934     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
2935     _debug "_currentRoot" "$_currentRoot"
2936     _index=$(_math $_index + 1)
2937     _checkport=""
2938     if [ "$_currentRoot" = "$NO_VALUE" ]; then
2939       _info "Standalone mode."
2940       if [ -z "$Le_HTTPPort" ]; then
2941         Le_HTTPPort=80
2942       else
2943         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
2944       fi
2945       _checkport="$Le_HTTPPort"
2946     elif [ "$_currentRoot" = "$W_TLS" ]; then
2947       _info "Standalone tls mode."
2948       if [ -z "$Le_TLSPort" ]; then
2949         Le_TLSPort=443
2950       else
2951         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
2952       fi
2953       _checkport="$Le_TLSPort"
2954     fi
2955
2956     if [ "$_checkport" ]; then
2957       _debug _checkport "$_checkport"
2958       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
2959       _debug _checkaddr "$_checkaddr"
2960
2961       _addrIndex="$(_math $_addrIndex + 1)"
2962
2963       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
2964       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
2965       if [ -z "$netprc" ]; then
2966         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
2967       fi
2968       if [ "$netprc" ]; then
2969         _err "$netprc"
2970         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
2971         _err "Please stop it first"
2972         return 1
2973       fi
2974     fi
2975   done
2976
2977   if _hasfield "$_chk_web_roots" "apache"; then
2978     if ! _setApache; then
2979       _err "set up apache error. Report error to me."
2980       return 1
2981     fi
2982   else
2983     usingApache=""
2984   fi
2985
2986 }
2987
2988 _on_issue_err() {
2989   _chk_post_hook="$1"
2990   _chk_vlist="$2"
2991   _debug _on_issue_err
2992   if [ "$LOG_FILE" ]; then
2993     _err "Please check log file for more details: $LOG_FILE"
2994   else
2995     _err "Please add '--debug' or '--log' to check more details."
2996     _err "See: $_DEBUG_WIKI"
2997   fi
2998
2999   #run the post hook
3000   if [ "$_chk_post_hook" ]; then
3001     _info "Run post hook:'$_chk_post_hook'"
3002     if ! (
3003       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3004     ); then
3005       _err "Error when run post hook."
3006       return 1
3007     fi
3008   fi
3009
3010   #trigger the validation to flush the pending authz
3011   _debug2 "_chk_vlist" "$_chk_vlist"
3012   if [ "$_chk_vlist" ]; then
3013     (
3014       _debug2 "start to deactivate authz"
3015       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
3016       for ventry in $ventries; do
3017         d=$(echo "$ventry" | cut -d "$sep" -f 1)
3018         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3019         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3020         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3021         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3022         __trigger_validation "$uri" "$keyauthorization"
3023       done
3024     )
3025   fi
3026
3027   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
3028     _debug "$(_dlg_versions)"
3029   fi
3030
3031 }
3032
3033 _on_issue_success() {
3034   _chk_post_hook="$1"
3035   _chk_renew_hook="$2"
3036   _debug _on_issue_success
3037   #run the post hook
3038   if [ "$_chk_post_hook" ]; then
3039     _info "Run post hook:'$_chk_post_hook'"
3040     if ! (
3041       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3042     ); then
3043       _err "Error when run post hook."
3044       return 1
3045     fi
3046   fi
3047
3048   #run renew hook
3049   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
3050     _info "Run renew hook:'$_chk_renew_hook'"
3051     if ! (
3052       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
3053     ); then
3054       _err "Error when run renew hook."
3055       return 1
3056     fi
3057   fi
3058
3059 }
3060
3061 updateaccount() {
3062   _initpath
3063   _regAccount
3064 }
3065
3066 registeraccount() {
3067   _reg_length="$1"
3068   _initpath
3069   _regAccount "$_reg_length"
3070 }
3071
3072 __calcAccountKeyHash() {
3073   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
3074 }
3075
3076 __calc_account_thumbprint() {
3077   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
3078 }
3079
3080 #keylength
3081 _regAccount() {
3082   _initpath
3083   _reg_length="$1"
3084
3085   mkdir -p "$CA_DIR"
3086   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3087     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3088     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3089   fi
3090
3091   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3092     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3093     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3094   fi
3095
3096   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3097     if ! _create_account_key "$_reg_length"; then
3098       _err "Create account key error."
3099       return 1
3100     fi
3101   fi
3102
3103   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3104     return 1
3105   fi
3106   _initAPI
3107   _updateTos=""
3108   _reg_res="$ACME_NEW_ACCOUNT_RES"
3109   while true; do
3110     _debug AGREEMENT "$AGREEMENT"
3111
3112     regjson='{"resource": "'$_reg_res'", "agreement": "'$AGREEMENT'"}'
3113
3114     if [ "$ACCOUNT_EMAIL" ]; then
3115       regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
3116     fi
3117
3118     if [ -z "$_updateTos" ]; then
3119       _info "Registering account"
3120
3121       if ! _send_signed_request "${ACME_NEW_ACCOUNT}" "$regjson"; then
3122         _err "Register account Error: $response"
3123         return 1
3124       fi
3125
3126       if [ "$code" = "" ] || [ "$code" = '201' ]; then
3127         echo "$response" >"$ACCOUNT_JSON_PATH"
3128         _info "Registered"
3129       elif [ "$code" = '409' ]; then
3130         _info "Already registered"
3131       else
3132         _err "Register account Error: $response"
3133         return 1
3134       fi
3135
3136       _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
3137       _debug "_accUri" "$_accUri"
3138       _savecaconf "ACCOUNT_URL" "$_accUri"
3139       _tos="$(echo "$responseHeaders" | grep "^Link:.*rel=\"terms-of-service\"" | _head_n 1 | _egrep_o "<.*>" | tr -d '<>')"
3140       _debug "_tos" "$_tos"
3141       if [ -z "$_tos" ]; then
3142         _debug "Use default tos: $DEFAULT_AGREEMENT"
3143         _tos="$DEFAULT_AGREEMENT"
3144       fi
3145       if [ "$_tos" != "$AGREEMENT" ]; then
3146         _updateTos=1
3147         AGREEMENT="$_tos"
3148         _reg_res="reg"
3149         continue
3150       fi
3151
3152     else
3153       _debug "Update tos: $_tos"
3154       if ! _send_signed_request "$_accUri" "$regjson"; then
3155         _err "Update tos error."
3156         return 1
3157       fi
3158       if [ "$code" = '202' ]; then
3159         _info "Update account tos info success."
3160
3161         CA_KEY_HASH="$(__calcAccountKeyHash)"
3162         _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3163         _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3164       elif [ "$code" = '403' ]; then
3165         _err "It seems that the account key is already deactivated, please use a new account key."
3166         return 1
3167       else
3168         _err "Update account error."
3169         return 1
3170       fi
3171     fi
3172     ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3173     _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3174     return 0
3175   done
3176
3177 }
3178
3179 #Implement deactivate account
3180 deactivateaccount() {
3181   _initpath
3182
3183   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3184     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3185     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3186   fi
3187
3188   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3189     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3190     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3191   fi
3192
3193   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3194     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
3195     return 1
3196   fi
3197
3198   _accUri=$(_readcaconf "ACCOUNT_URL")
3199   _debug _accUri "$_accUri"
3200
3201   if [ -z "$_accUri" ]; then
3202     _err "The account url is empty, please run '--update-account' first to update the account info first,"
3203     _err "Then try again."
3204     return 1
3205   fi
3206
3207   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3208     return 1
3209   fi
3210   _initAPI
3211
3212   if _send_signed_request "$_accUri" "{\"resource\": \"reg\", \"status\":\"deactivated\"}" && _contains "$response" '"deactivated"'; then
3213     _info "Deactivate account success for $_accUri."
3214     _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
3215   elif [ "$code" = "403" ]; then
3216     _info "The account is already deactivated."
3217     _accid=$(_getfield "$_accUri" "999" "/")
3218   else
3219     _err "Deactivate: account failed for $_accUri."
3220     return 1
3221   fi
3222
3223   _debug "Account id: $_accid"
3224   if [ "$_accid" ]; then
3225     _deactivated_account_path="$CA_DIR/deactivated/$_accid"
3226     _debug _deactivated_account_path "$_deactivated_account_path"
3227     if mkdir -p "$_deactivated_account_path"; then
3228       _info "Moving deactivated account info to $_deactivated_account_path/"
3229       mv "$CA_CONF" "$_deactivated_account_path/"
3230       mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
3231       mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
3232     else
3233       _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
3234       rm -f "$CA_CONF"
3235       rm -f "$ACCOUNT_JSON_PATH"
3236       rm -f "$ACCOUNT_KEY_PATH"
3237     fi
3238   fi
3239 }
3240
3241 # domain folder  file
3242 _findHook() {
3243   _hookdomain="$1"
3244   _hookcat="$2"
3245   _hookname="$3"
3246
3247   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3248     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3249   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3250     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3251   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3252     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3253   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3254     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3255   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3256     d_api="$LE_WORKING_DIR/$_hookname"
3257   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3258     d_api="$LE_WORKING_DIR/$_hookname.sh"
3259   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3260     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3261   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3262     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3263   fi
3264
3265   printf "%s" "$d_api"
3266 }
3267
3268 #domain
3269 __get_domain_new_authz() {
3270   _gdnd="$1"
3271   _info "Getting new-authz for domain" "$_gdnd"
3272   _initAPI
3273   _Max_new_authz_retry_times=5
3274   _authz_i=0
3275   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3276     _debug "Try new-authz for the $_authz_i time."
3277     if ! _send_signed_request "${ACME_NEW_AUTHZ}" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3278       _err "Can not get domain new authz."
3279       return 1
3280     fi
3281     if _contains "$response" "No registration exists matching provided key"; then
3282       _err "It seems there is an error, but it's recovered now, please try again."
3283       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3284       _clearcaconf "CA_KEY_HASH"
3285       break
3286     fi
3287     if ! _contains "$response" "An error occurred while processing your request"; then
3288       _info "The new-authz request is ok."
3289       break
3290     fi
3291     _authz_i="$(_math "$_authz_i" + 1)"
3292     _info "The server is busy, Sleep $_authz_i to retry."
3293     _sleep "$_authz_i"
3294   done
3295
3296   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3297     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3298   fi
3299
3300   if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
3301     _err "new-authz error: $response"
3302     return 1
3303   fi
3304
3305 }
3306
3307 #uri keyAuthorization
3308 __trigger_validation() {
3309   _debug2 "tigger domain validation."
3310   _t_url="$1"
3311   _debug2 _t_url "$_t_url"
3312   _t_key_authz="$2"
3313   _debug2 _t_key_authz "$_t_key_authz"
3314   _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
3315 }
3316
3317 #webroot, domain domainlist  keylength
3318 issue() {
3319   if [ -z "$2" ]; then
3320     _usage "Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ "
3321     return 1
3322   fi
3323   if [ -z "$1" ]; then
3324     _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
3325     return 1
3326   fi
3327   _web_roots="$1"
3328   _main_domain="$2"
3329   _alt_domains="$3"
3330   if _contains "$_main_domain" ","; then
3331     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
3332     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
3333   fi
3334   _key_length="$4"
3335   _real_cert="$5"
3336   _real_key="$6"
3337   _real_ca="$7"
3338   _reload_cmd="$8"
3339   _real_fullchain="$9"
3340   _pre_hook="${10}"
3341   _post_hook="${11}"
3342   _renew_hook="${12}"
3343   _local_addr="${13}"
3344
3345   #remove these later.
3346   if [ "$_web_roots" = "dns-cf" ]; then
3347     _web_roots="dns_cf"
3348   fi
3349   if [ "$_web_roots" = "dns-dp" ]; then
3350     _web_roots="dns_dp"
3351   fi
3352   if [ "$_web_roots" = "dns-cx" ]; then
3353     _web_roots="dns_cx"
3354   fi
3355
3356   if [ ! "$IS_RENEW" ]; then
3357     _initpath "$_main_domain" "$_key_length"
3358     mkdir -p "$DOMAIN_PATH"
3359   fi
3360
3361   _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
3362
3363   _initAPI
3364
3365   if [ -f "$DOMAIN_CONF" ]; then
3366     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
3367     _debug Le_NextRenewTime "$Le_NextRenewTime"
3368     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3369       _saved_domain=$(_readdomainconf Le_Domain)
3370       _debug _saved_domain "$_saved_domain"
3371       _saved_alt=$(_readdomainconf Le_Alt)
3372       _debug _saved_alt "$_saved_alt"
3373       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
3374         _info "Domains not changed."
3375         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
3376         _info "Add '$(__red '--force')' to force to renew."
3377         return $RENEW_SKIP
3378       else
3379         _info "Domains have changed."
3380       fi
3381     fi
3382   fi
3383
3384   _savedomainconf "Le_Domain" "$_main_domain"
3385   _savedomainconf "Le_Alt" "$_alt_domains"
3386   _savedomainconf "Le_Webroot" "$_web_roots"
3387
3388   _savedomainconf "Le_PreHook" "$_pre_hook"
3389   _savedomainconf "Le_PostHook" "$_post_hook"
3390   _savedomainconf "Le_RenewHook" "$_renew_hook"
3391
3392   if [ "$_local_addr" ]; then
3393     _savedomainconf "Le_LocalAddress" "$_local_addr"
3394   else
3395     _cleardomainconf "Le_LocalAddress"
3396   fi
3397
3398   Le_API="$ACME_DIRECTORY"
3399   _savedomainconf "Le_API" "$Le_API"
3400
3401   if [ "$_alt_domains" = "$NO_VALUE" ]; then
3402     _alt_domains=""
3403   fi
3404
3405   if [ "$_key_length" = "$NO_VALUE" ]; then
3406     _key_length=""
3407   fi
3408
3409   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
3410     _err "_on_before_issue."
3411     return 1
3412   fi
3413
3414   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
3415   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
3416
3417   if [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
3418     if ! _regAccount "$_accountkeylength"; then
3419       _on_issue_err "$_post_hook"
3420       return 1
3421     fi
3422   else
3423     _debug "_saved_account_key_hash is not changed, skip register account."
3424   fi
3425
3426   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
3427     _info "Signing from existing CSR."
3428   else
3429     _key=$(_readdomainconf Le_Keylength)
3430     _debug "Read key length:$_key"
3431     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
3432       if ! createDomainKey "$_main_domain" "$_key_length"; then
3433         _err "Create domain key error."
3434         _clearup
3435         _on_issue_err "$_post_hook"
3436         return 1
3437       fi
3438     fi
3439
3440     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
3441       _err "Create CSR error."
3442       _clearup
3443       _on_issue_err "$_post_hook"
3444       return 1
3445     fi
3446   fi
3447
3448   _savedomainconf "Le_Keylength" "$_key_length"
3449
3450   vlist="$Le_Vlist"
3451
3452   _info "Getting domain auth token for each domain"
3453   sep='#'
3454   dvsep=','
3455   if [ -z "$vlist" ]; then
3456     alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
3457     _index=1
3458     _currentRoot=""
3459     for d in $alldomains; do
3460       _info "Getting webroot for domain" "$d"
3461       _w="$(echo $_web_roots | cut -d , -f $_index)"
3462       _debug _w "$_w"
3463       if [ "$_w" ]; then
3464         _currentRoot="$_w"
3465       fi
3466       _debug "_currentRoot" "$_currentRoot"
3467       _index=$(_math $_index + 1)
3468
3469       vtype="$VTYPE_HTTP"
3470       if _startswith "$_currentRoot" "dns"; then
3471         vtype="$VTYPE_DNS"
3472       fi
3473
3474       if [ "$_currentRoot" = "$W_TLS" ]; then
3475         vtype="$VTYPE_TLS"
3476       fi
3477
3478       if ! __get_domain_new_authz "$d"; then
3479         _clearup
3480         _on_issue_err "$_post_hook"
3481         return 1
3482       fi
3483
3484       if [ -z "$thumbprint" ]; then
3485         thumbprint="$(__calc_account_thumbprint)"
3486       fi
3487
3488       entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
3489       _debug entry "$entry"
3490       if [ -z "$entry" ]; then
3491         _err "Error, can not get domain token $d"
3492         _clearup
3493         _on_issue_err "$_post_hook"
3494         return 1
3495       fi
3496       token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
3497       _debug token "$token"
3498
3499       uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
3500       _debug uri "$uri"
3501
3502       keyauthorization="$token.$thumbprint"
3503       _debug keyauthorization "$keyauthorization"
3504
3505       if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
3506         _debug "$d is already verified, skip."
3507         keyauthorization="$STATE_VERIFIED"
3508         _debug keyauthorization "$keyauthorization"
3509       fi
3510
3511       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
3512       _debug dvlist "$dvlist"
3513
3514       vlist="$vlist$dvlist$dvsep"
3515
3516     done
3517     _debug vlist "$vlist"
3518     #add entry
3519     dnsadded=""
3520     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3521     for ventry in $ventries; do
3522       d=$(echo "$ventry" | cut -d "$sep" -f 1)
3523       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3524       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3525       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3526
3527       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3528         _debug "$d is already verified, skip $vtype."
3529         continue
3530       fi
3531
3532       if [ "$vtype" = "$VTYPE_DNS" ]; then
3533         dnsadded='0'
3534         txtdomain="_acme-challenge.$d"
3535         _debug txtdomain "$txtdomain"
3536         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
3537         _debug txt "$txt"
3538
3539         d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
3540
3541         _debug d_api "$d_api"
3542
3543         if [ "$d_api" ]; then
3544           _info "Found domain api file: $d_api"
3545         else
3546           _info "$(__red "Add the following TXT record:")"
3547           _info "$(__red "Domain: '$(__green "$txtdomain")'")"
3548           _info "$(__red "TXT value: '$(__green "$txt")'")"
3549           _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
3550           _info "$(__red "so the resulting subdomain will be: $txtdomain")"
3551           continue
3552         fi
3553
3554         (
3555           if ! . "$d_api"; then
3556             _err "Load file $d_api error. Please check your api file and try again."
3557             return 1
3558           fi
3559
3560           addcommand="${_currentRoot}_add"
3561           if ! _exists "$addcommand"; then
3562             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
3563             return 1
3564           fi
3565
3566           if ! $addcommand "$txtdomain" "$txt"; then
3567             _err "Error add txt for domain:$txtdomain"
3568             return 1
3569           fi
3570         )
3571
3572         if [ "$?" != "0" ]; then
3573           _clearup
3574           _on_issue_err "$_post_hook" "$vlist"
3575           return 1
3576         fi
3577         dnsadded='1'
3578       fi
3579     done
3580
3581     if [ "$dnsadded" = '0' ]; then
3582       _savedomainconf "Le_Vlist" "$vlist"
3583       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
3584       _err "Please add the TXT records to the domains, and retry again."
3585       _clearup
3586       _on_issue_err "$_post_hook"
3587       return 1
3588     fi
3589
3590   fi
3591
3592   if [ "$dnsadded" = '1' ]; then
3593     if [ -z "$Le_DNSSleep" ]; then
3594       Le_DNSSleep="$DEFAULT_DNS_SLEEP"
3595     else
3596       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
3597     fi
3598
3599     _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
3600     _sleep "$Le_DNSSleep"
3601   fi
3602
3603   NGINX_RESTORE_VLIST=""
3604   _debug "ok, let's start to verify"
3605
3606   _ncIndex=1
3607   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3608   for ventry in $ventries; do
3609     d=$(echo "$ventry" | cut -d "$sep" -f 1)
3610     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3611     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3612     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3613     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3614
3615     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3616       _info "$d is already verified, skip $vtype."
3617       continue
3618     fi
3619
3620     _info "Verifying:$d"
3621     _debug "d" "$d"
3622     _debug "keyauthorization" "$keyauthorization"
3623     _debug "uri" "$uri"
3624     removelevel=""
3625     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
3626
3627     _debug "_currentRoot" "$_currentRoot"
3628
3629     if [ "$vtype" = "$VTYPE_HTTP" ]; then
3630       if [ "$_currentRoot" = "$NO_VALUE" ]; then
3631         _info "Standalone mode server"
3632         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3633         _ncIndex="$(_math $_ncIndex + 1)"
3634         _startserver "$keyauthorization" "$_ncaddr" &
3635         if [ "$?" != "0" ]; then
3636           _clearup
3637           _on_issue_err "$_post_hook" "$vlist"
3638           return 1
3639         fi
3640         serverproc="$!"
3641         sleep 1
3642         _debug serverproc "$serverproc"
3643       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
3644         _info "Stateless mode for domain:$d"
3645         _sleep 1
3646       elif _startswith "$_currentRoot" "$NGINX"; then
3647         _info "Nginx mode for domain:$d"
3648         #set up nginx server
3649         FOUND_REAL_NGINX_CONF=""
3650         BACKUP_NGINX_CONF=""
3651         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
3652           _clearup
3653           _on_issue_err "$_post_hook" "$vlist"
3654           return 1
3655         fi
3656
3657         if [ "$FOUND_REAL_NGINX_CONF" ]; then
3658           _realConf="$FOUND_REAL_NGINX_CONF"
3659           _backup="$BACKUP_NGINX_CONF"
3660           _debug _realConf "$_realConf"
3661           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
3662         fi
3663         _sleep 1
3664       else
3665         if [ "$_currentRoot" = "apache" ]; then
3666           wellknown_path="$ACME_DIR"
3667         else
3668           wellknown_path="$_currentRoot/.well-known/acme-challenge"
3669           if [ ! -d "$_currentRoot/.well-known" ]; then
3670             removelevel='1'
3671           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
3672             removelevel='2'
3673           else
3674             removelevel='3'
3675           fi
3676         fi
3677
3678         _debug wellknown_path "$wellknown_path"
3679
3680         _debug "writing token:$token to $wellknown_path/$token"
3681
3682         mkdir -p "$wellknown_path"
3683
3684         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
3685           _err "$d:Can not write token to file : $wellknown_path/$token"
3686           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3687           _clearup
3688           _on_issue_err "$_post_hook" "$vlist"
3689           return 1
3690         fi
3691
3692         if [ ! "$usingApache" ]; then
3693           if webroot_owner=$(_stat "$_currentRoot"); then
3694             _debug "Changing owner/group of .well-known to $webroot_owner"
3695             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
3696               _debug "$(cat "$_EXEC_TEMP_ERR")"
3697               _exec_err >/dev/null 2>&1
3698             fi
3699           else
3700             _debug "not changing owner/group of webroot"
3701           fi
3702         fi
3703
3704       fi
3705
3706     elif [ "$vtype" = "$VTYPE_TLS" ]; then
3707       #create A
3708       #_hash_A="$(printf "%s" $token | _digest "sha256" "hex" )"
3709       #_debug2 _hash_A "$_hash_A"
3710       #_x="$(echo $_hash_A | cut -c 1-32)"
3711       #_debug2 _x "$_x"
3712       #_y="$(echo $_hash_A | cut -c 33-64)"
3713       #_debug2 _y "$_y"
3714       #_SAN_A="$_x.$_y.token.acme.invalid"
3715       #_debug2 _SAN_A "$_SAN_A"
3716
3717       #create B
3718       _hash_B="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
3719       _debug2 _hash_B "$_hash_B"
3720       _x="$(echo "$_hash_B" | cut -c 1-32)"
3721       _debug2 _x "$_x"
3722       _y="$(echo "$_hash_B" | cut -c 33-64)"
3723       _debug2 _y "$_y"
3724
3725       #_SAN_B="$_x.$_y.ka.acme.invalid"
3726
3727       _SAN_B="$_x.$_y.acme.invalid"
3728       _debug2 _SAN_B "$_SAN_B"
3729
3730       _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3731       _ncIndex="$(_math "$_ncIndex" + 1)"
3732       if ! _starttlsserver "$_SAN_B" "$_SAN_A" "$Le_TLSPort" "$keyauthorization" "$_ncaddr"; then
3733         _err "Start tls server error."
3734         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3735         _clearup
3736         _on_issue_err "$_post_hook" "$vlist"
3737         return 1
3738       fi
3739     fi
3740
3741     if ! __trigger_validation "$uri" "$keyauthorization"; then
3742       _err "$d:Can not get challenge: $response"
3743       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3744       _clearup
3745       _on_issue_err "$_post_hook" "$vlist"
3746       return 1
3747     fi
3748
3749     if [ ! -z "$code" ] && [ ! "$code" = '202' ]; then
3750       _err "$d:Challenge error: $response"
3751       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3752       _clearup
3753       _on_issue_err "$_post_hook" "$vlist"
3754       return 1
3755     fi
3756
3757     waittimes=0
3758     if [ -z "$MAX_RETRY_TIMES" ]; then
3759       MAX_RETRY_TIMES=30
3760     fi
3761
3762     while true; do
3763       waittimes=$(_math "$waittimes" + 1)
3764       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
3765         _err "$d:Timeout"
3766         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3767         _clearup
3768         _on_issue_err "$_post_hook" "$vlist"
3769         return 1
3770       fi
3771
3772       _debug "sleep 2 secs to verify"
3773       sleep 2
3774       _debug "checking"
3775       response="$(_get "$uri")"
3776       if [ "$?" != "0" ]; then
3777         _err "$d:Verify error:$response"
3778         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3779         _clearup
3780         _on_issue_err "$_post_hook" "$vlist"
3781         return 1
3782       fi
3783       _debug2 original "$response"
3784
3785       response="$(echo "$response" | _normalizeJson)"
3786       _debug2 response "$response"
3787
3788       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
3789       if [ "$status" = "valid" ]; then
3790         _info "$(__green Success)"
3791         _stopserver "$serverproc"
3792         serverproc=""
3793         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3794         break
3795       fi
3796
3797       if [ "$status" = "invalid" ]; then
3798         error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
3799         _debug2 error "$error"
3800         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
3801         _debug2 errordetail "$errordetail"
3802         if [ "$errordetail" ]; then
3803           _err "$d:Verify error:$errordetail"
3804         else
3805           _err "$d:Verify error:$error"
3806         fi
3807         if [ "$DEBUG" ]; then
3808           if [ "$vtype" = "$VTYPE_HTTP" ]; then
3809             _debug "Debug: get token url."
3810             _get "http://$d/.well-known/acme-challenge/$token" "" 1
3811           fi
3812         fi
3813         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3814         _clearup
3815         _on_issue_err "$_post_hook" "$vlist"
3816         return 1
3817       fi
3818
3819       if [ "$status" = "pending" ]; then
3820         _info "Pending"
3821       else
3822         _err "$d:Verify error:$response"
3823         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3824         _clearup
3825         _on_issue_err "$_post_hook" "$vlist"
3826         return 1
3827       fi
3828
3829     done
3830
3831   done
3832
3833   _clearup
3834   _info "Verify finished, start to sign."
3835   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
3836
3837   if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
3838     _err "Sign failed."
3839     _on_issue_err "$_post_hook"
3840     return 1
3841   fi
3842
3843   _rcert="$response"
3844   Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
3845   _debug "Le_LinkCert" "$Le_LinkCert"
3846   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
3847
3848   if [ "$Le_LinkCert" ]; then
3849     echo "$BEGIN_CERT" >"$CERT_PATH"
3850
3851     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
3852     #  _debug "Get cert failed. Let's try last response."
3853     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
3854     #fi
3855
3856     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
3857       _debug "Try cert link."
3858       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
3859     fi
3860
3861     echo "$END_CERT" >>"$CERT_PATH"
3862     _info "$(__green "Cert success.")"
3863     cat "$CERT_PATH"
3864
3865     _info "Your cert is in $(__green " $CERT_PATH ")"
3866
3867     if [ -f "$CERT_KEY_PATH" ]; then
3868       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
3869     fi
3870
3871     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
3872
3873     if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
3874       USER_PATH="$PATH"
3875       _saveaccountconf "USER_PATH" "$USER_PATH"
3876     fi
3877   fi
3878
3879   if [ -z "$Le_LinkCert" ]; then
3880     response="$(echo "$response" | _dbase64 "multiline" | _normalizeJson)"
3881     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
3882     _on_issue_err "$_post_hook"
3883     return 1
3884   fi
3885
3886   _cleardomainconf "Le_Vlist"
3887
3888   Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
3889   if ! _contains "$Le_LinkIssuer" ":"; then
3890     _info "$(__red "Relative issuer link found.")"
3891     Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
3892   fi
3893   _debug Le_LinkIssuer "$Le_LinkIssuer"
3894   _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
3895
3896   if [ "$Le_LinkIssuer" ]; then
3897     _link_issuer_retry=0
3898     _MAX_ISSUER_RETRY=5
3899     while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
3900       _debug _link_issuer_retry "$_link_issuer_retry"
3901       if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
3902         echo "$BEGIN_CERT" >"$CA_CERT_PATH"
3903         _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
3904         echo "$END_CERT" >>"$CA_CERT_PATH"
3905
3906         _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
3907         cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
3908         _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
3909
3910         rm -f "$CA_CERT_PATH.der"
3911         break
3912       fi
3913       _link_issuer_retry=$(_math $_link_issuer_retry + 1)
3914       _sleep "$_link_issuer_retry"
3915     done
3916     if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
3917       _err "Max retry for issuer ca cert is reached."
3918     fi
3919   else
3920     _debug "No Le_LinkIssuer header found."
3921   fi
3922
3923   Le_CertCreateTime=$(_time)
3924   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
3925
3926   Le_CertCreateTimeStr=$(date -u)
3927   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
3928
3929   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "$MAX_RENEW" ]; then
3930     Le_RenewalDays="$MAX_RENEW"
3931   else
3932     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
3933   fi
3934
3935   if [ "$CA_BUNDLE" ]; then
3936     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
3937   else
3938     _clearaccountconf "CA_BUNDLE"
3939   fi
3940
3941   if [ "$CA_PATH" ]; then
3942     _saveaccountconf CA_PATH "$CA_PATH"
3943   else
3944     _clearaccountconf "CA_PATH"
3945   fi
3946
3947   if [ "$HTTPS_INSECURE" ]; then
3948     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
3949   else
3950     _clearaccountconf "HTTPS_INSECURE"
3951   fi
3952
3953   if [ "$Le_Listen_V4" ]; then
3954     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
3955     _cleardomainconf Le_Listen_V6
3956   elif [ "$Le_Listen_V6" ]; then
3957     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
3958     _cleardomainconf Le_Listen_V4
3959   fi
3960
3961   if [ "$Le_ForceNewDomainKey" = "1" ]; then
3962     _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
3963   else
3964     _cleardomainconf Le_ForceNewDomainKey
3965   fi
3966
3967   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
3968
3969   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
3970   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
3971
3972   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
3973   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
3974
3975   _on_issue_success "$_post_hook" "$_renew_hook"
3976
3977   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
3978     _savedomainconf "Le_RealCertPath" "$_real_cert"
3979     _savedomainconf "Le_RealCACertPath" "$_real_ca"
3980     _savedomainconf "Le_RealKeyPath" "$_real_key"
3981     _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
3982     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
3983     _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
3984   fi
3985
3986 }
3987
3988 #domain  [isEcc]
3989 renew() {
3990   Le_Domain="$1"
3991   if [ -z "$Le_Domain" ]; then
3992     _usage "Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]"
3993     return 1
3994   fi
3995
3996   _isEcc="$2"
3997
3998   _initpath "$Le_Domain" "$_isEcc"
3999
4000   _info "$(__green "Renew: '$Le_Domain'")"
4001   if [ ! -f "$DOMAIN_CONF" ]; then
4002     _info "'$Le_Domain' is not a issued domain, skip."
4003     return 0
4004   fi
4005
4006   if [ "$Le_RenewalDays" ]; then
4007     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
4008   fi
4009
4010   . "$DOMAIN_CONF"
4011
4012   if [ "$Le_API" ]; then
4013     if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
4014       export Le_API="$DEFAULT_CA"
4015       _savedomainconf Le_API "$Le_API"
4016     fi
4017     if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
4018       export Le_API="$STAGE_CA"
4019       _savedomainconf Le_API "$Le_API"
4020     fi
4021     export ACME_DIRECTORY="$Le_API"
4022     #reload ca configs
4023     ACCOUNT_KEY_PATH=""
4024     ACCOUNT_JSON_PATH=""
4025     CA_CONF=""
4026     _debug3 "initpath again."
4027     _initpath "$Le_Domain" "$_isEcc"
4028   fi
4029
4030   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
4031     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
4032     _info "Add '$(__red '--force')' to force to renew."
4033     return "$RENEW_SKIP"
4034   fi
4035
4036   if [ "$IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
4037     _info "Skip invalid cert for: $Le_Domain"
4038     return 0
4039   fi
4040
4041   IS_RENEW="1"
4042   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
4043   res="$?"
4044   if [ "$res" != "0" ]; then
4045     return "$res"
4046   fi
4047
4048   if [ "$Le_DeployHook" ]; then
4049     _deploy "$Le_Domain" "$Le_DeployHook"
4050     res="$?"
4051   fi
4052
4053   IS_RENEW=""
4054
4055   return "$res"
4056 }
4057
4058 #renewAll  [stopRenewOnError]
4059 renewAll() {
4060   _initpath
4061   _stopRenewOnError="$1"
4062   _debug "_stopRenewOnError" "$_stopRenewOnError"
4063   _ret="0"
4064
4065   for di in "${CERT_HOME}"/*.*/; do
4066     _debug di "$di"
4067     if ! [ -d "$di" ]; then
4068       _debug "Not directory, skip: $di"
4069       continue
4070     fi
4071     d=$(basename "$di")
4072     _debug d "$d"
4073     (
4074       if _endswith "$d" "$ECC_SUFFIX"; then
4075         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4076         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4077       fi
4078       renew "$d" "$_isEcc"
4079     )
4080     rc="$?"
4081     _debug "Return code: $rc"
4082     if [ "$rc" != "0" ]; then
4083       if [ "$rc" = "$RENEW_SKIP" ]; then
4084         _info "Skipped $d"
4085       elif [ "$_stopRenewOnError" ]; then
4086         _err "Error renew $d,  stop now."
4087         return "$rc"
4088       else
4089         _ret="$rc"
4090         _err "Error renew $d."
4091       fi
4092     fi
4093   done
4094   return "$_ret"
4095 }
4096
4097 #csr webroot
4098 signcsr() {
4099   _csrfile="$1"
4100   _csrW="$2"
4101   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
4102     _usage "Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ "
4103     return 1
4104   fi
4105
4106   _initpath
4107
4108   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4109   if [ "$?" != "0" ]; then
4110     _err "Can not read subject from csr: $_csrfile"
4111     return 1
4112   fi
4113   _debug _csrsubj "$_csrsubj"
4114   if _contains "$_csrsubj" ' ' || ! _contains "$_csrsubj" '.'; then
4115     _info "It seems that the subject: $_csrsubj is not a valid domain name. Drop it."
4116     _csrsubj=""
4117   fi
4118
4119   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4120   if [ "$?" != "0" ]; then
4121     _err "Can not read domain list from csr: $_csrfile"
4122     return 1
4123   fi
4124   _debug "_csrdomainlist" "$_csrdomainlist"
4125
4126   if [ -z "$_csrsubj" ]; then
4127     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
4128     _debug _csrsubj "$_csrsubj"
4129     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
4130     _debug "_csrdomainlist" "$_csrdomainlist"
4131   fi
4132
4133   if [ -z "$_csrsubj" ]; then
4134     _err "Can not read subject from csr: $_csrfile"
4135     return 1
4136   fi
4137
4138   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4139   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4140     _err "Can not read key length from csr: $_csrfile"
4141     return 1
4142   fi
4143
4144   _initpath "$_csrsubj" "$_csrkeylength"
4145   mkdir -p "$DOMAIN_PATH"
4146
4147   _info "Copy csr to: $CSR_PATH"
4148   cp "$_csrfile" "$CSR_PATH"
4149
4150   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength"
4151
4152 }
4153
4154 showcsr() {
4155   _csrfile="$1"
4156   _csrd="$2"
4157   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
4158     _usage "Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr"
4159     return 1
4160   fi
4161
4162   _initpath
4163
4164   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4165   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
4166     _err "Can not read subject from csr: $_csrfile"
4167     return 1
4168   fi
4169
4170   _info "Subject=$_csrsubj"
4171
4172   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4173   if [ "$?" != "0" ]; then
4174     _err "Can not read domain list from csr: $_csrfile"
4175     return 1
4176   fi
4177   _debug "_csrdomainlist" "$_csrdomainlist"
4178
4179   _info "SubjectAltNames=$_csrdomainlist"
4180
4181   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4182   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4183     _err "Can not read key length from csr: $_csrfile"
4184     return 1
4185   fi
4186   _info "KeyLength=$_csrkeylength"
4187 }
4188
4189 list() {
4190   _raw="$1"
4191   _initpath
4192
4193   _sep="|"
4194   if [ "$_raw" ]; then
4195     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
4196     for di in "${CERT_HOME}"/*.*/; do
4197       if ! [ -d "$di" ]; then
4198         _debug "Not directory, skip: $di"
4199         continue
4200       fi
4201       d=$(basename "$di")
4202       _debug d "$d"
4203       (
4204         if _endswith "$d" "$ECC_SUFFIX"; then
4205           _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4206           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4207         fi
4208         _initpath "$d" "$_isEcc"
4209         if [ -f "$DOMAIN_CONF" ]; then
4210           . "$DOMAIN_CONF"
4211           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
4212         fi
4213       )
4214     done
4215   else
4216     if _exists column; then
4217       list "raw" | column -t -s "$_sep"
4218     else
4219       list "raw" | tr "$_sep" '\t'
4220     fi
4221   fi
4222
4223 }
4224
4225 _deploy() {
4226   _d="$1"
4227   _hooks="$2"
4228
4229   for _d_api in $(echo "$_hooks" | tr ',' " "); do
4230     _deployApi="$(_findHook "$_d" deploy "$_d_api")"
4231     if [ -z "$_deployApi" ]; then
4232       _err "The deploy hook $_d_api is not found."
4233       return 1
4234     fi
4235     _debug _deployApi "$_deployApi"
4236
4237     if ! (
4238       if ! . "$_deployApi"; then
4239         _err "Load file $_deployApi error. Please check your api file and try again."
4240         return 1
4241       fi
4242
4243       d_command="${_d_api}_deploy"
4244       if ! _exists "$d_command"; then
4245         _err "It seems that your api file is not correct, it must have a function named: $d_command"
4246         return 1
4247       fi
4248
4249       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
4250         _err "Error deploy for domain:$_d"
4251         return 1
4252       fi
4253     ); then
4254       _err "Deploy error."
4255       return 1
4256     else
4257       _info "$(__green Success)"
4258     fi
4259   done
4260 }
4261
4262 #domain hooks
4263 deploy() {
4264   _d="$1"
4265   _hooks="$2"
4266   _isEcc="$3"
4267   if [ -z "$_hooks" ]; then
4268     _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
4269     return 1
4270   fi
4271
4272   _initpath "$_d" "$_isEcc"
4273   if [ ! -d "$DOMAIN_PATH" ]; then
4274     _err "Domain is not valid:'$_d'"
4275     return 1
4276   fi
4277
4278   . "$DOMAIN_CONF"
4279
4280   _savedomainconf Le_DeployHook "$_hooks"
4281
4282   _deploy "$_d" "$_hooks"
4283 }
4284
4285 installcert() {
4286   _main_domain="$1"
4287   if [ -z "$_main_domain" ]; then
4288     _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
4289     return 1
4290   fi
4291
4292   _real_cert="$2"
4293   _real_key="$3"
4294   _real_ca="$4"
4295   _reload_cmd="$5"
4296   _real_fullchain="$6"
4297   _isEcc="$7"
4298
4299   _initpath "$_main_domain" "$_isEcc"
4300   if [ ! -d "$DOMAIN_PATH" ]; then
4301     _err "Domain is not valid:'$_main_domain'"
4302     return 1
4303   fi
4304
4305   _savedomainconf "Le_RealCertPath" "$_real_cert"
4306   _savedomainconf "Le_RealCACertPath" "$_real_ca"
4307   _savedomainconf "Le_RealKeyPath" "$_real_key"
4308   _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4309   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4310
4311   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4312 }
4313
4314 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
4315 _installcert() {
4316   _main_domain="$1"
4317   _real_cert="$2"
4318   _real_key="$3"
4319   _real_ca="$4"
4320   _real_fullchain="$5"
4321   _reload_cmd="$6"
4322   _backup_prefix="$7"
4323
4324   if [ "$_real_cert" = "$NO_VALUE" ]; then
4325     _real_cert=""
4326   fi
4327   if [ "$_real_key" = "$NO_VALUE" ]; then
4328     _real_key=""
4329   fi
4330   if [ "$_real_ca" = "$NO_VALUE" ]; then
4331     _real_ca=""
4332   fi
4333   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
4334     _reload_cmd=""
4335   fi
4336   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
4337     _real_fullchain=""
4338   fi
4339
4340   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
4341   mkdir -p "$_backup_path"
4342
4343   if [ "$_real_cert" ]; then
4344     _info "Installing cert to:$_real_cert"
4345     if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
4346       cp "$_real_cert" "$_backup_path/cert.bak"
4347     fi
4348     cat "$CERT_PATH" >"$_real_cert"
4349   fi
4350
4351   if [ "$_real_ca" ]; then
4352     _info "Installing CA to:$_real_ca"
4353     if [ "$_real_ca" = "$_real_cert" ]; then
4354       echo "" >>"$_real_ca"
4355       cat "$CA_CERT_PATH" >>"$_real_ca"
4356     else
4357       if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
4358         cp "$_real_ca" "$_backup_path/ca.bak"
4359       fi
4360       cat "$CA_CERT_PATH" >"$_real_ca"
4361     fi
4362   fi
4363
4364   if [ "$_real_key" ]; then
4365     _info "Installing key to:$_real_key"
4366     if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
4367       cp "$_real_key" "$_backup_path/key.bak"
4368     fi
4369     cat "$CERT_KEY_PATH" >"$_real_key"
4370   fi
4371
4372   if [ "$_real_fullchain" ]; then
4373     _info "Installing full chain to:$_real_fullchain"
4374     if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
4375       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
4376     fi
4377     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain"
4378   fi
4379
4380   if [ "$_reload_cmd" ]; then
4381     _info "Run reload cmd: $_reload_cmd"
4382     if (
4383       export CERT_PATH
4384       export CERT_KEY_PATH
4385       export CA_CERT_PATH
4386       export CERT_FULLCHAIN_PATH
4387       export Le_Domain
4388       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
4389     ); then
4390       _info "$(__green "Reload success")"
4391     else
4392       _err "Reload error for :$Le_Domain"
4393     fi
4394   fi
4395
4396 }
4397
4398 #confighome
4399 installcronjob() {
4400   _c_home="$1"
4401   _initpath
4402   if ! _exists "crontab"; then
4403     _err "crontab doesn't exist, so, we can not install cron jobs."
4404     _err "All your certs will not be renewed automatically."
4405     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
4406     return 1
4407   fi
4408
4409   _info "Installing cron job"
4410   if ! crontab -l | grep "$PROJECT_ENTRY --cron"; then
4411     if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
4412       lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
4413     else
4414       _err "Can not install cronjob, $PROJECT_ENTRY not found."
4415       return 1
4416     fi
4417
4418     if [ "$_c_home" ]; then
4419       _c_entry="--config-home \"$_c_home\" "
4420     fi
4421     _t=$(_time)
4422     random_minute=$(_math $_t % 60)
4423     if _exists uname && uname -a | grep SunOS >/dev/null; then
4424       crontab -l | {
4425         cat
4426         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4427       } | crontab --
4428     else
4429       crontab -l | {
4430         cat
4431         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4432       } | crontab -
4433     fi
4434   fi
4435   if [ "$?" != "0" ]; then
4436     _err "Install cron job failed. You need to manually renew your certs."
4437     _err "Or you can add cronjob by yourself:"
4438     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
4439     return 1
4440   fi
4441 }
4442
4443 uninstallcronjob() {
4444   if ! _exists "crontab"; then
4445     return
4446   fi
4447   _info "Removing cron job"
4448   cr="$(crontab -l | grep "$PROJECT_ENTRY --cron")"
4449   if [ "$cr" ]; then
4450     if _exists uname && uname -a | grep solaris >/dev/null; then
4451       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab --
4452     else
4453       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab -
4454     fi
4455     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
4456     _info LE_WORKING_DIR "$LE_WORKING_DIR"
4457     if _contains "$cr" "--config-home"; then
4458       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
4459       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
4460     fi
4461   fi
4462   _initpath
4463
4464 }
4465
4466 revoke() {
4467   Le_Domain="$1"
4468   if [ -z "$Le_Domain" ]; then
4469     _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]"
4470     return 1
4471   fi
4472
4473   _isEcc="$2"
4474
4475   _initpath "$Le_Domain" "$_isEcc"
4476   if [ ! -f "$DOMAIN_CONF" ]; then
4477     _err "$Le_Domain is not a issued domain, skip."
4478     return 1
4479   fi
4480
4481   if [ ! -f "$CERT_PATH" ]; then
4482     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
4483     return 1
4484   fi
4485
4486   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
4487
4488   if [ -z "$cert" ]; then
4489     _err "Cert for $Le_Domain is empty found, skip."
4490     return 1
4491   fi
4492
4493   _initAPI
4494
4495   data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
4496   uri="${ACME_REVOKE_CERT}"
4497
4498   if [ -f "$CERT_KEY_PATH" ]; then
4499     _info "Try domain key first."
4500     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
4501       if [ -z "$response" ]; then
4502         _info "Revoke success."
4503         rm -f "$CERT_PATH"
4504         return 0
4505       else
4506         _err "Revoke error by domain key."
4507         _err "$response"
4508       fi
4509     fi
4510   else
4511     _info "Domain key file doesn't exists."
4512   fi
4513
4514   _info "Try account key."
4515
4516   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
4517     if [ -z "$response" ]; then
4518       _info "Revoke success."
4519       rm -f "$CERT_PATH"
4520       return 0
4521     else
4522       _err "Revoke error."
4523       _debug "$response"
4524     fi
4525   fi
4526   return 1
4527 }
4528
4529 #domain  ecc
4530 remove() {
4531   Le_Domain="$1"
4532   if [ -z "$Le_Domain" ]; then
4533     _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
4534     return 1
4535   fi
4536
4537   _isEcc="$2"
4538
4539   _initpath "$Le_Domain" "$_isEcc"
4540   _removed_conf="$DOMAIN_CONF.removed"
4541   if [ ! -f "$DOMAIN_CONF" ]; then
4542     if [ -f "$_removed_conf" ]; then
4543       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
4544     else
4545       _err "$Le_Domain is not a issued domain, skip."
4546     fi
4547     return 1
4548   fi
4549
4550   if mv "$DOMAIN_CONF" "$_removed_conf"; then
4551     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
4552     _info "You can remove them by yourself."
4553     return 0
4554   else
4555     _err "Remove $Le_Domain failed."
4556     return 1
4557   fi
4558 }
4559
4560 #domain vtype
4561 _deactivate() {
4562   _d_domain="$1"
4563   _d_type="$2"
4564   _initpath
4565
4566   if ! __get_domain_new_authz "$_d_domain"; then
4567     _err "Can not get domain new authz token."
4568     return 1
4569   fi
4570
4571   authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
4572   _debug "authzUri" "$authzUri"
4573
4574   if [ "$code" ] && [ ! "$code" = '201' ]; then
4575     _err "new-authz error: $response"
4576     return 1
4577   fi
4578
4579   entries="$(echo "$response" | _egrep_o '{ *"type":"[^"]*", *"status": *"valid", *"uri"[^}]*')"
4580   if [ -z "$entries" ]; then
4581     _info "No valid entries found."
4582     if [ -z "$thumbprint" ]; then
4583       thumbprint="$(__calc_account_thumbprint)"
4584     fi
4585     _debug "Trigger validation."
4586     vtype="$VTYPE_HTTP"
4587     entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
4588     _debug entry "$entry"
4589     if [ -z "$entry" ]; then
4590       _err "Error, can not get domain token $d"
4591       return 1
4592     fi
4593     token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
4594     _debug token "$token"
4595
4596     uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
4597     _debug uri "$uri"
4598
4599     keyauthorization="$token.$thumbprint"
4600     _debug keyauthorization "$keyauthorization"
4601     __trigger_validation "$uri" "$keyauthorization"
4602
4603   fi
4604
4605   _d_i=0
4606   _d_max_retry=$(echo "$entries" | wc -l)
4607   while [ "$_d_i" -lt "$_d_max_retry" ]; do
4608     _info "Deactivate: $_d_domain"
4609     _d_i="$(_math $_d_i + 1)"
4610     entry="$(echo "$entries" | sed -n "${_d_i}p")"
4611     _debug entry "$entry"
4612
4613     if [ -z "$entry" ]; then
4614       _info "No more valid entry found."
4615       break
4616     fi
4617
4618     _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
4619     _debug _vtype "$_vtype"
4620     _info "Found $_vtype"
4621
4622     uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
4623     _debug uri "$uri"
4624
4625     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
4626       _info "Skip $_vtype"
4627       continue
4628     fi
4629
4630     _info "Deactivate: $_vtype"
4631
4632     if _send_signed_request "$authzUri" "{\"resource\": \"authz\", \"status\":\"deactivated\"}" && _contains "$response" '"deactivated"'; then
4633       _info "Deactivate: $_vtype success."
4634     else
4635       _err "Can not deactivate $_vtype."
4636       break
4637     fi
4638
4639   done
4640   _debug "$_d_i"
4641   if [ "$_d_i" -eq "$_d_max_retry" ]; then
4642     _info "Deactivated success!"
4643   else
4644     _err "Deactivate failed."
4645   fi
4646
4647 }
4648
4649 deactivate() {
4650   _d_domain_list="$1"
4651   _d_type="$2"
4652   _initpath
4653   _initAPI
4654   _debug _d_domain_list "$_d_domain_list"
4655   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
4656     _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
4657     return 1
4658   fi
4659   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
4660     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
4661       continue
4662     fi
4663     if ! _deactivate "$_d_dm" "$_d_type"; then
4664       return 1
4665     fi
4666   done
4667 }
4668
4669 # Detect profile file if not specified as environment variable
4670 _detect_profile() {
4671   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
4672     echo "$PROFILE"
4673     return
4674   fi
4675
4676   DETECTED_PROFILE=''
4677   SHELLTYPE="$(basename "/$SHELL")"
4678
4679   if [ "$SHELLTYPE" = "bash" ]; then
4680     if [ -f "$HOME/.bashrc" ]; then
4681       DETECTED_PROFILE="$HOME/.bashrc"
4682     elif [ -f "$HOME/.bash_profile" ]; then
4683       DETECTED_PROFILE="$HOME/.bash_profile"
4684     fi
4685   elif [ "$SHELLTYPE" = "zsh" ]; then
4686     DETECTED_PROFILE="$HOME/.zshrc"
4687   fi
4688
4689   if [ -z "$DETECTED_PROFILE" ]; then
4690     if [ -f "$HOME/.profile" ]; then
4691       DETECTED_PROFILE="$HOME/.profile"
4692     elif [ -f "$HOME/.bashrc" ]; then
4693       DETECTED_PROFILE="$HOME/.bashrc"
4694     elif [ -f "$HOME/.bash_profile" ]; then
4695       DETECTED_PROFILE="$HOME/.bash_profile"
4696     elif [ -f "$HOME/.zshrc" ]; then
4697       DETECTED_PROFILE="$HOME/.zshrc"
4698     fi
4699   fi
4700
4701   echo "$DETECTED_PROFILE"
4702 }
4703
4704 _initconf() {
4705   _initpath
4706   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4707     echo "
4708
4709 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
4710 #LOG_LEVEL=1
4711
4712 #AUTO_UPGRADE=\"1\"
4713
4714 #NO_TIMESTAMP=1
4715
4716     " >"$ACCOUNT_CONF_PATH"
4717   fi
4718 }
4719
4720 # nocron
4721 _precheck() {
4722   _nocron="$1"
4723
4724   if ! _exists "curl" && ! _exists "wget"; then
4725     _err "Please install curl or wget first, we need to access http resources."
4726     return 1
4727   fi
4728
4729   if [ -z "$_nocron" ]; then
4730     if ! _exists "crontab"; then
4731       _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
4732       _err "We need to set cron job to renew the certs automatically."
4733       _err "Otherwise, your certs will not be able to be renewed automatically."
4734       if [ -z "$FORCE" ]; then
4735         _err "Please add '--force' and try install again to go without crontab."
4736         _err "./$PROJECT_ENTRY --install --force"
4737         return 1
4738       fi
4739     fi
4740   fi
4741
4742   if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
4743     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
4744     _err "We need openssl to generate keys."
4745     return 1
4746   fi
4747
4748   if ! _exists "nc"; then
4749     _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
4750     _err "We use nc for standalone server if you use standalone mode."
4751     _err "If you don't use standalone mode, just ignore this warning."
4752   fi
4753
4754   return 0
4755 }
4756
4757 _setShebang() {
4758   _file="$1"
4759   _shebang="$2"
4760   if [ -z "$_shebang" ]; then
4761     _usage "Usage: file shebang"
4762     return 1
4763   fi
4764   cp "$_file" "$_file.tmp"
4765   echo "$_shebang" >"$_file"
4766   sed -n 2,99999p "$_file.tmp" >>"$_file"
4767   rm -f "$_file.tmp"
4768 }
4769
4770 #confighome
4771 _installalias() {
4772   _c_home="$1"
4773   _initpath
4774
4775   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4776   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
4777     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
4778     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
4779     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
4780   fi
4781
4782   if [ "$_c_home" ]; then
4783     _c_entry=" --config-home '$_c_home'"
4784   fi
4785
4786   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
4787   if [ "$_c_home" ]; then
4788     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
4789   else
4790     _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
4791   fi
4792   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4793
4794   _profile="$(_detect_profile)"
4795   if [ "$_profile" ]; then
4796     _debug "Found profile: $_profile"
4797     _info "Installing alias to '$_profile'"
4798     _setopt "$_profile" ". \"$_envfile\""
4799     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
4800   else
4801     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
4802   fi
4803
4804   #for csh
4805   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
4806   _csh_profile="$HOME/.cshrc"
4807   if [ -f "$_csh_profile" ]; then
4808     _info "Installing alias to '$_csh_profile'"
4809     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4810     if [ "$_c_home" ]; then
4811       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4812     else
4813       _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
4814     fi
4815     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4816     _setopt "$_csh_profile" "source \"$_cshfile\""
4817   fi
4818
4819   #for tcsh
4820   _tcsh_profile="$HOME/.tcshrc"
4821   if [ -f "$_tcsh_profile" ]; then
4822     _info "Installing alias to '$_tcsh_profile'"
4823     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4824     if [ "$_c_home" ]; then
4825       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4826     fi
4827     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4828     _setopt "$_tcsh_profile" "source \"$_cshfile\""
4829   fi
4830
4831 }
4832
4833 # nocron confighome
4834 install() {
4835
4836   if [ -z "$LE_WORKING_DIR" ]; then
4837     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
4838   fi
4839
4840   _nocron="$1"
4841   _c_home="$2"
4842   if ! _initpath; then
4843     _err "Install failed."
4844     return 1
4845   fi
4846   if [ "$_nocron" ]; then
4847     _debug "Skip install cron job"
4848   fi
4849
4850   if ! _precheck "$_nocron"; then
4851     _err "Pre-check failed, can not install."
4852     return 1
4853   fi
4854
4855   if [ -z "$_c_home" ] && [ "$LE_CONFIG_HOME" != "$LE_WORKING_DIR" ]; then
4856     _info "Using config home: $LE_CONFIG_HOME"
4857     _c_home="$LE_CONFIG_HOME"
4858   fi
4859
4860   #convert from le
4861   if [ -d "$HOME/.le" ]; then
4862     for envfile in "le.env" "le.sh.env"; do
4863       if [ -f "$HOME/.le/$envfile" ]; then
4864         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
4865           _upgrading="1"
4866           _info "You are upgrading from le.sh"
4867           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
4868           mv "$HOME/.le" "$LE_WORKING_DIR"
4869           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4870           break
4871         fi
4872       fi
4873     done
4874   fi
4875
4876   _info "Installing to $LE_WORKING_DIR"
4877
4878   if [ ! -d "$LE_WORKING_DIR" ]; then
4879     if ! mkdir -p "$LE_WORKING_DIR"; then
4880       _err "Can not create working dir: $LE_WORKING_DIR"
4881       return 1
4882     fi
4883
4884     chmod 700 "$LE_WORKING_DIR"
4885   fi
4886
4887   if [ ! -d "$LE_CONFIG_HOME" ]; then
4888     if ! mkdir -p "$LE_CONFIG_HOME"; then
4889       _err "Can not create config dir: $LE_CONFIG_HOME"
4890       return 1
4891     fi
4892
4893     chmod 700 "$LE_CONFIG_HOME"
4894   fi
4895
4896   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
4897
4898   if [ "$?" != "0" ]; then
4899     _err "Install failed, can not copy $PROJECT_ENTRY"
4900     return 1
4901   fi
4902
4903   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
4904
4905   _installalias "$_c_home"
4906
4907   for subf in $_SUB_FOLDERS; do
4908     if [ -d "$subf" ]; then
4909       mkdir -p "$LE_WORKING_DIR/$subf"
4910       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
4911     fi
4912   done
4913
4914   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4915     _initconf
4916   fi
4917
4918   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
4919     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
4920   fi
4921
4922   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
4923     _saveaccountconf "CERT_HOME" "$CERT_HOME"
4924   fi
4925
4926   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
4927     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
4928   fi
4929
4930   if [ -z "$_nocron" ]; then
4931     installcronjob "$_c_home"
4932   fi
4933
4934   if [ -z "$NO_DETECT_SH" ]; then
4935     #Modify shebang
4936     if _exists bash; then
4937       _info "Good, bash is found, so change the shebang to use bash as preferred."
4938       _shebang='#!'"$(env bash -c "command -v bash")"
4939       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
4940       for subf in $_SUB_FOLDERS; do
4941         if [ -d "$LE_WORKING_DIR/$subf" ]; then
4942           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
4943             _setShebang "$_apifile" "$_shebang"
4944           done
4945         fi
4946       done
4947     fi
4948   fi
4949
4950   _info OK
4951 }
4952
4953 # nocron
4954 uninstall() {
4955   _nocron="$1"
4956   if [ -z "$_nocron" ]; then
4957     uninstallcronjob
4958   fi
4959   _initpath
4960
4961   _uninstallalias
4962
4963   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
4964   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
4965
4966 }
4967
4968 _uninstallalias() {
4969   _initpath
4970
4971   _profile="$(_detect_profile)"
4972   if [ "$_profile" ]; then
4973     _info "Uninstalling alias from: '$_profile'"
4974     text="$(cat "$_profile")"
4975     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
4976   fi
4977
4978   _csh_profile="$HOME/.cshrc"
4979   if [ -f "$_csh_profile" ]; then
4980     _info "Uninstalling alias from: '$_csh_profile'"
4981     text="$(cat "$_csh_profile")"
4982     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
4983   fi
4984
4985   _tcsh_profile="$HOME/.tcshrc"
4986   if [ -f "$_tcsh_profile" ]; then
4987     _info "Uninstalling alias from: '$_csh_profile'"
4988     text="$(cat "$_tcsh_profile")"
4989     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
4990   fi
4991
4992 }
4993
4994 cron() {
4995   IN_CRON=1
4996   _initpath
4997   _info "$(__green "===Starting cron===")"
4998   if [ "$AUTO_UPGRADE" = "1" ]; then
4999     export LE_WORKING_DIR
5000     (
5001       if ! upgrade; then
5002         _err "Cron:Upgrade failed!"
5003         return 1
5004       fi
5005     )
5006     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
5007
5008     if [ -t 1 ]; then
5009       __INTERACTIVE="1"
5010     fi
5011
5012     _info "Auto upgraded to: $VER"
5013   fi
5014   renewAll
5015   _ret="$?"
5016   IN_CRON=""
5017   _info "$(__green "===End cron===")"
5018   exit $_ret
5019 }
5020
5021 version() {
5022   echo "$PROJECT"
5023   echo "v$VER"
5024 }
5025
5026 showhelp() {
5027   _initpath
5028   version
5029   echo "Usage: $PROJECT_ENTRY  command ...[parameters]....
5030 Commands:
5031   --help, -h               Show this help message.
5032   --version, -v            Show version info.
5033   --install                Install $PROJECT_NAME to your system.
5034   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
5035   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
5036   --issue                  Issue a cert.
5037   --signcsr                Issue a cert from an existing csr.
5038   --deploy                 Deploy the cert to your server.
5039   --install-cert           Install the issued cert to apache/nginx or any other server.
5040   --renew, -r              Renew a cert.
5041   --renew-all              Renew all the certs.
5042   --revoke                 Revoke a cert.
5043   --remove                 Remove the cert from $PROJECT
5044   --list                   List all the certs.
5045   --showcsr                Show the content of a csr.
5046   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
5047   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
5048   --cron                   Run cron job to renew all the certs.
5049   --toPkcs                 Export the certificate and key to a pfx file.
5050   --toPkcs8                Convert to pkcs8 format.
5051   --update-account         Update account info.
5052   --register-account       Register account key.
5053   --deactivate-account     Deactivate the account.
5054   --create-account-key     Create an account private key, professional use.
5055   --create-domain-key      Create an domain private key, professional use.
5056   --createCSR, -ccsr       Create CSR , professional use.
5057   --deactivate             Deactivate the domain authz, professional use.
5058
5059 Parameters:
5060   --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
5061   --force, -f                       Used to force to install or force to renew a cert immediately.
5062   --staging, --test                 Use staging server, just for test.
5063   --debug                           Output debug info.
5064   --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
5065   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
5066   --standalone                      Use standalone mode.
5067   --stateless                       Use stateless mode, see: $_STATELESS_WIKI
5068   --tls                             Use standalone tls mode.
5069   --apache                          Use apache mode.
5070   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
5071   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
5072
5073   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
5074   --accountkeylength, -ak [2048]    Specifies the account key length.
5075   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
5076   --log-level 1|2                   Specifies the log level, default is 1.
5077   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
5078
5079   These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
5080
5081   --cert-file                       After issue/renew, the cert will be copied to this path.
5082   --key-file                        After issue/renew, the key will be copied to this path.
5083   --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
5084   --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.
5085
5086   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
5087
5088   --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
5089   --accountconf                     Specifies a customized account config file.
5090   --home                            Specifies the home dir for $PROJECT_NAME .
5091   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
5092   --config-home                     Specifies the home dir to save all the configurations.
5093   --useragent                       Specifies the user agent string. it will be saved for future use too.
5094   --accountemail                    Specifies the account email for registering, Only valid for the '--install' command.
5095   --accountkey                      Specifies the account key path, Only valid for the '--install' command.
5096   --days                            Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
5097   --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
5098   --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
5099   --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
5100   --listraw                         Only used for '--list' command, list the certs in raw format.
5101   --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
5102   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
5103   --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
5104   --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
5105   --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
5106   --no-color                        Do not output color text.
5107   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
5108   --csr                             Specifies the input csr.
5109   --pre-hook                        Command to be run before obtaining any certificates.
5110   --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
5111   --renew-hook                      Command to be run once for each successfully renewed certificate.
5112   --deploy-hook                     The hook file to deploy cert
5113   --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
5114   --always-force-new-domain-key     Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
5115   --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
5116   --listen-v4                       Force standalone/tls server to listen at ipv4.
5117   --listen-v6                       Force standalone/tls server to listen at ipv6.
5118   --openssl-bin                     Specifies a custom openssl bin location.
5119   --use-wget                        Force to use wget, if you have both curl and wget installed.
5120   "
5121 }
5122
5123 # nocron
5124 _installOnline() {
5125   _info "Installing from online archive."
5126   _nocron="$1"
5127   if [ ! "$BRANCH" ]; then
5128     BRANCH="master"
5129   fi
5130
5131   target="$PROJECT/archive/$BRANCH.tar.gz"
5132   _info "Downloading $target"
5133   localname="$BRANCH.tar.gz"
5134   if ! _get "$target" >$localname; then
5135     _err "Download error."
5136     return 1
5137   fi
5138   (
5139     _info "Extracting $localname"
5140     if ! (tar xzf $localname || gtar xzf $localname); then
5141       _err "Extraction error."
5142       exit 1
5143     fi
5144
5145     cd "$PROJECT_NAME-$BRANCH"
5146     chmod +x $PROJECT_ENTRY
5147     if ./$PROJECT_ENTRY install "$_nocron"; then
5148       _info "Install success!"
5149     fi
5150
5151     cd ..
5152
5153     rm -rf "$PROJECT_NAME-$BRANCH"
5154     rm -f "$localname"
5155   )
5156 }
5157
5158 upgrade() {
5159   if (
5160     _initpath
5161     export LE_WORKING_DIR
5162     cd "$LE_WORKING_DIR"
5163     _installOnline "nocron"
5164   ); then
5165     _info "Upgrade success!"
5166     exit 0
5167   else
5168     _err "Upgrade failed!"
5169     exit 1
5170   fi
5171 }
5172
5173 _processAccountConf() {
5174   if [ "$_useragent" ]; then
5175     _saveaccountconf "USER_AGENT" "$_useragent"
5176   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
5177     _saveaccountconf "USER_AGENT" "$USER_AGENT"
5178   fi
5179
5180   if [ "$_accountemail" ]; then
5181     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
5182   elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
5183     _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
5184   fi
5185
5186   if [ "$_openssl_bin" ]; then
5187     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
5188   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
5189     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
5190   fi
5191
5192   if [ "$_auto_upgrade" ]; then
5193     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
5194   elif [ "$AUTO_UPGRADE" ]; then
5195     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
5196   fi
5197
5198   if [ "$_use_wget" ]; then
5199     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
5200   elif [ "$ACME_USE_WGET" ]; then
5201     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
5202   fi
5203
5204 }
5205
5206 _process() {
5207   _CMD=""
5208   _domain=""
5209   _altdomains="$NO_VALUE"
5210   _webroot=""
5211   _keylength=""
5212   _accountkeylength=""
5213   _cert_file=""
5214   _key_file=""
5215   _ca_file=""
5216   _fullchain_file=""
5217   _reloadcmd=""
5218   _password=""
5219   _accountconf=""
5220   _useragent=""
5221   _accountemail=""
5222   _accountkey=""
5223   _certhome=""
5224   _confighome=""
5225   _httpport=""
5226   _tlsport=""
5227   _dnssleep=""
5228   _listraw=""
5229   _stopRenewOnError=""
5230   #_insecure=""
5231   _ca_bundle=""
5232   _ca_path=""
5233   _nocron=""
5234   _ecc=""
5235   _csr=""
5236   _pre_hook=""
5237   _post_hook=""
5238   _renew_hook=""
5239   _deploy_hook=""
5240   _logfile=""
5241   _log=""
5242   _local_address=""
5243   _log_level=""
5244   _auto_upgrade=""
5245   _listen_v4=""
5246   _listen_v6=""
5247   _openssl_bin=""
5248   _syslog=""
5249   _use_wget=""
5250   _server=""
5251   while [ ${#} -gt 0 ]; do
5252     case "${1}" in
5253
5254       --help | -h)
5255         showhelp
5256         return
5257         ;;
5258       --version | -v)
5259         version
5260         return
5261         ;;
5262       --install)
5263         _CMD="install"
5264         ;;
5265       --uninstall)
5266         _CMD="uninstall"
5267         ;;
5268       --upgrade)
5269         _CMD="upgrade"
5270         ;;
5271       --issue)
5272         _CMD="issue"
5273         ;;
5274       --deploy)
5275         _CMD="deploy"
5276         ;;
5277       --signcsr)
5278         _CMD="signcsr"
5279         ;;
5280       --showcsr)
5281         _CMD="showcsr"
5282         ;;
5283       --installcert | -i | --install-cert)
5284         _CMD="installcert"
5285         ;;
5286       --renew | -r)
5287         _CMD="renew"
5288         ;;
5289       --renewAll | --renewall | --renew-all)
5290         _CMD="renewAll"
5291         ;;
5292       --revoke)
5293         _CMD="revoke"
5294         ;;
5295       --remove)
5296         _CMD="remove"
5297         ;;
5298       --list)
5299         _CMD="list"
5300         ;;
5301       --installcronjob | --install-cronjob)
5302         _CMD="installcronjob"
5303         ;;
5304       --uninstallcronjob | --uninstall-cronjob)
5305         _CMD="uninstallcronjob"
5306         ;;
5307       --cron)
5308         _CMD="cron"
5309         ;;
5310       --toPkcs)
5311         _CMD="toPkcs"
5312         ;;
5313       --toPkcs8)
5314         _CMD="toPkcs8"
5315         ;;
5316       --createAccountKey | --createaccountkey | -cak | --create-account-key)
5317         _CMD="createAccountKey"
5318         ;;
5319       --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
5320         _CMD="createDomainKey"
5321         ;;
5322       --createCSR | --createcsr | -ccr)
5323         _CMD="createCSR"
5324         ;;
5325       --deactivate)
5326         _CMD="deactivate"
5327         ;;
5328       --updateaccount | --update-account)
5329         _CMD="updateaccount"
5330         ;;
5331       --registeraccount | --register-account)
5332         _CMD="registeraccount"
5333         ;;
5334       --deactivate-account)
5335         _CMD="deactivateaccount"
5336         ;;
5337       --domain | -d)
5338         _dvalue="$2"
5339
5340         if [ "$_dvalue" ]; then
5341           if _startswith "$_dvalue" "-"; then
5342             _err "'$_dvalue' is not a valid domain for parameter '$1'"
5343             return 1
5344           fi
5345           if _is_idn "$_dvalue" && ! _exists idn; then
5346             _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
5347             return 1
5348           fi
5349
5350           if [ -z "$_domain" ]; then
5351             _domain="$_dvalue"
5352           else
5353             if [ "$_altdomains" = "$NO_VALUE" ]; then
5354               _altdomains="$_dvalue"
5355             else
5356               _altdomains="$_altdomains,$_dvalue"
5357             fi
5358           fi
5359         fi
5360
5361         shift
5362         ;;
5363
5364       --force | -f)
5365         FORCE="1"
5366         ;;
5367       --staging | --test)
5368         STAGE="1"
5369         ;;
5370       --server)
5371         ACME_DIRECTORY="$2"
5372         _server="$ACME_DIRECTORY"
5373         export ACME_DIRECTORY
5374         shift
5375         ;;
5376       --debug)
5377         if [ -z "$2" ] || _startswith "$2" "-"; then
5378           DEBUG="$DEBUG_LEVEL_DEFAULT"
5379         else
5380           DEBUG="$2"
5381           shift
5382         fi
5383         ;;
5384       --output-insecure)
5385         export OUTPUT_INSECURE=1
5386         ;;
5387       --webroot | -w)
5388         wvalue="$2"
5389         if [ -z "$_webroot" ]; then
5390           _webroot="$wvalue"
5391         else
5392           _webroot="$_webroot,$wvalue"
5393         fi
5394         shift
5395         ;;
5396       --standalone)
5397         wvalue="$NO_VALUE"
5398         if [ -z "$_webroot" ]; then
5399           _webroot="$wvalue"
5400         else
5401           _webroot="$_webroot,$wvalue"
5402         fi
5403         ;;
5404       --stateless)
5405         wvalue="$MODE_STATELESS"
5406         if [ -z "$_webroot" ]; then
5407           _webroot="$wvalue"
5408         else
5409           _webroot="$_webroot,$wvalue"
5410         fi
5411         ;;
5412       --local-address)
5413         lvalue="$2"
5414         _local_address="$_local_address$lvalue,"
5415         shift
5416         ;;
5417       --apache)
5418         wvalue="apache"
5419         if [ -z "$_webroot" ]; then
5420           _webroot="$wvalue"
5421         else
5422           _webroot="$_webroot,$wvalue"
5423         fi
5424         ;;
5425       --nginx)
5426         wvalue="$NGINX"
5427         if [ -z "$_webroot" ]; then
5428           _webroot="$wvalue"
5429         else
5430           _webroot="$_webroot,$wvalue"
5431         fi
5432         ;;
5433       --tls)
5434         wvalue="$W_TLS"
5435         if [ -z "$_webroot" ]; then
5436           _webroot="$wvalue"
5437         else
5438           _webroot="$_webroot,$wvalue"
5439         fi
5440         ;;
5441       --dns)
5442         wvalue="dns"
5443         if [ "$2" ] && ! _startswith "$2" "-"; then
5444           wvalue="$2"
5445           shift
5446         fi
5447         if [ -z "$_webroot" ]; then
5448           _webroot="$wvalue"
5449         else
5450           _webroot="$_webroot,$wvalue"
5451         fi
5452         ;;
5453       --dnssleep)
5454         _dnssleep="$2"
5455         Le_DNSSleep="$_dnssleep"
5456         shift
5457         ;;
5458
5459       --keylength | -k)
5460         _keylength="$2"
5461         shift
5462         ;;
5463       --accountkeylength | -ak)
5464         _accountkeylength="$2"
5465         shift
5466         ;;
5467
5468       --cert-file | --certpath)
5469         _cert_file="$2"
5470         shift
5471         ;;
5472       --key-file | --keypath)
5473         _key_file="$2"
5474         shift
5475         ;;
5476       --ca-file | --capath)
5477         _ca_file="$2"
5478         shift
5479         ;;
5480       --fullchain-file | --fullchainpath)
5481         _fullchain_file="$2"
5482         shift
5483         ;;
5484       --reloadcmd | --reloadCmd)
5485         _reloadcmd="$2"
5486         shift
5487         ;;
5488       --password)
5489         _password="$2"
5490         shift
5491         ;;
5492       --accountconf)
5493         _accountconf="$2"
5494         ACCOUNT_CONF_PATH="$_accountconf"
5495         shift
5496         ;;
5497       --home)
5498         LE_WORKING_DIR="$2"
5499         shift
5500         ;;
5501       --certhome | --cert-home)
5502         _certhome="$2"
5503         CERT_HOME="$_certhome"
5504         shift
5505         ;;
5506       --config-home)
5507         _confighome="$2"
5508         LE_CONFIG_HOME="$_confighome"
5509         shift
5510         ;;
5511       --useragent)
5512         _useragent="$2"
5513         USER_AGENT="$_useragent"
5514         shift
5515         ;;
5516       --accountemail)
5517         _accountemail="$2"
5518         ACCOUNT_EMAIL="$_accountemail"
5519         shift
5520         ;;
5521       --accountkey)
5522         _accountkey="$2"
5523         ACCOUNT_KEY_PATH="$_accountkey"
5524         shift
5525         ;;
5526       --days)
5527         _days="$2"
5528         Le_RenewalDays="$_days"
5529         shift
5530         ;;
5531       --httpport)
5532         _httpport="$2"
5533         Le_HTTPPort="$_httpport"
5534         shift
5535         ;;
5536       --tlsport)
5537         _tlsport="$2"
5538         Le_TLSPort="$_tlsport"
5539         shift
5540         ;;
5541
5542       --listraw)
5543         _listraw="raw"
5544         ;;
5545       --stopRenewOnError | --stoprenewonerror | -se)
5546         _stopRenewOnError="1"
5547         ;;
5548       --insecure)
5549         #_insecure="1"
5550         HTTPS_INSECURE="1"
5551         ;;
5552       --ca-bundle)
5553         _ca_bundle="$(_readlink -f "$2")"
5554         CA_BUNDLE="$_ca_bundle"
5555         shift
5556         ;;
5557       --ca-path)
5558         _ca_path="$2"
5559         CA_PATH="$_ca_path"
5560         shift
5561         ;;
5562       --nocron)
5563         _nocron="1"
5564         ;;
5565       --no-color)
5566         export ACME_NO_COLOR=1
5567         ;;
5568       --ecc)
5569         _ecc="isEcc"
5570         ;;
5571       --csr)
5572         _csr="$2"
5573         shift
5574         ;;
5575       --pre-hook)
5576         _pre_hook="$2"
5577         shift
5578         ;;
5579       --post-hook)
5580         _post_hook="$2"
5581         shift
5582         ;;
5583       --renew-hook)
5584         _renew_hook="$2"
5585         shift
5586         ;;
5587       --deploy-hook)
5588         if [ -z "$2" ] || _startswith "$2" "-"; then
5589           _usage "Please specify a value for '--deploy-hook'"
5590           return 1
5591         fi
5592         _deploy_hook="$_deploy_hook$2,"
5593         shift
5594         ;;
5595       --ocsp-must-staple | --ocsp)
5596         Le_OCSP_Staple="1"
5597         ;;
5598       --always-force-new-domain-key)
5599         if [ -z "$2" ] || _startswith "$2" "-"; then
5600           Le_ForceNewDomainKey=1
5601         else
5602           Le_ForceNewDomainKey="$2"
5603           shift
5604         fi
5605         ;;
5606       --log | --logfile)
5607         _log="1"
5608         _logfile="$2"
5609         if _startswith "$_logfile" '-'; then
5610           _logfile=""
5611         else
5612           shift
5613         fi
5614         LOG_FILE="$_logfile"
5615         if [ -z "$LOG_LEVEL" ]; then
5616           LOG_LEVEL="$DEFAULT_LOG_LEVEL"
5617         fi
5618         ;;
5619       --log-level)
5620         _log_level="$2"
5621         LOG_LEVEL="$_log_level"
5622         shift
5623         ;;
5624       --syslog)
5625         if ! _startswith "$2" '-'; then
5626           _syslog="$2"
5627           shift
5628         fi
5629         if [ -z "$_syslog" ]; then
5630           _syslog="$SYSLOG_LEVEL_DEFAULT"
5631         fi
5632         ;;
5633       --auto-upgrade)
5634         _auto_upgrade="$2"
5635         if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
5636           _auto_upgrade="1"
5637         else
5638           shift
5639         fi
5640         AUTO_UPGRADE="$_auto_upgrade"
5641         ;;
5642       --listen-v4)
5643         _listen_v4="1"
5644         Le_Listen_V4="$_listen_v4"
5645         ;;
5646       --listen-v6)
5647         _listen_v6="1"
5648         Le_Listen_V6="$_listen_v6"
5649         ;;
5650       --openssl-bin)
5651         _openssl_bin="$2"
5652         ACME_OPENSSL_BIN="$_openssl_bin"
5653         shift
5654         ;;
5655       --use-wget)
5656         _use_wget="1"
5657         ACME_USE_WGET="1"
5658         ;;
5659       *)
5660         _err "Unknown parameter : $1"
5661         return 1
5662         ;;
5663     esac
5664
5665     shift 1
5666   done
5667
5668   if [ "${_CMD}" != "install" ]; then
5669     __initHome
5670     if [ "$_log" ]; then
5671       if [ -z "$_logfile" ]; then
5672         _logfile="$DEFAULT_LOG_FILE"
5673       fi
5674     fi
5675     if [ "$_logfile" ]; then
5676       _saveaccountconf "LOG_FILE" "$_logfile"
5677       LOG_FILE="$_logfile"
5678     fi
5679
5680     if [ "$_log_level" ]; then
5681       _saveaccountconf "LOG_LEVEL" "$_log_level"
5682       LOG_LEVEL="$_log_level"
5683     fi
5684
5685     if [ "$_syslog" ]; then
5686       if _exists logger; then
5687         if [ "$_syslog" = "0" ]; then
5688           _clearaccountconf "SYS_LOG"
5689         else
5690           _saveaccountconf "SYS_LOG" "$_syslog"
5691         fi
5692         SYS_LOG="$_syslog"
5693       else
5694         _err "The 'logger' command is not found, can not enable syslog."
5695         _clearaccountconf "SYS_LOG"
5696         SYS_LOG=""
5697       fi
5698     fi
5699
5700     _processAccountConf
5701   fi
5702
5703   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
5704
5705   if [ "$DEBUG" ]; then
5706     version
5707     if [ "$_server" ]; then
5708       _debug "Using server: $_server"
5709     fi
5710   fi
5711
5712   case "${_CMD}" in
5713     install) install "$_nocron" "$_confighome" ;;
5714     uninstall) uninstall "$_nocron" ;;
5715     upgrade) upgrade ;;
5716     issue)
5717       issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address"
5718       ;;
5719     deploy)
5720       deploy "$_domain" "$_deploy_hook" "$_ecc"
5721       ;;
5722     signcsr)
5723       signcsr "$_csr" "$_webroot"
5724       ;;
5725     showcsr)
5726       showcsr "$_csr" "$_domain"
5727       ;;
5728     installcert)
5729       installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
5730       ;;
5731     renew)
5732       renew "$_domain" "$_ecc"
5733       ;;
5734     renewAll)
5735       renewAll "$_stopRenewOnError"
5736       ;;
5737     revoke)
5738       revoke "$_domain" "$_ecc"
5739       ;;
5740     remove)
5741       remove "$_domain" "$_ecc"
5742       ;;
5743     deactivate)
5744       deactivate "$_domain,$_altdomains"
5745       ;;
5746     registeraccount)
5747       registeraccount "$_accountkeylength"
5748       ;;
5749     updateaccount)
5750       updateaccount
5751       ;;
5752     deactivateaccount)
5753       deactivateaccount
5754       ;;
5755     list)
5756       list "$_listraw"
5757       ;;
5758     installcronjob) installcronjob "$_confighome" ;;
5759     uninstallcronjob) uninstallcronjob ;;
5760     cron) cron ;;
5761     toPkcs)
5762       toPkcs "$_domain" "$_password" "$_ecc"
5763       ;;
5764     toPkcs8)
5765       toPkcs8 "$_domain" "$_ecc"
5766       ;;
5767     createAccountKey)
5768       createAccountKey "$_accountkeylength"
5769       ;;
5770     createDomainKey)
5771       createDomainKey "$_domain" "$_keylength"
5772       ;;
5773     createCSR)
5774       createCSR "$_domain" "$_altdomains" "$_ecc"
5775       ;;
5776
5777     *)
5778       if [ "$_CMD" ]; then
5779         _err "Invalid command: $_CMD"
5780       fi
5781       showhelp
5782       return 1
5783       ;;
5784   esac
5785   _ret="$?"
5786   if [ "$_ret" != "0" ]; then
5787     return $_ret
5788   fi
5789
5790   if [ "${_CMD}" = "install" ]; then
5791     if [ "$_log" ]; then
5792       if [ -z "$LOG_FILE" ]; then
5793         LOG_FILE="$DEFAULT_LOG_FILE"
5794       fi
5795       _saveaccountconf "LOG_FILE" "$LOG_FILE"
5796     fi
5797
5798     if [ "$_log_level" ]; then
5799       _saveaccountconf "LOG_LEVEL" "$_log_level"
5800     fi
5801
5802     if [ "$_syslog" ]; then
5803       if _exists logger; then
5804         if [ "$_syslog" = "0" ]; then
5805           _clearaccountconf "SYS_LOG"
5806         else
5807           _saveaccountconf "SYS_LOG" "$_syslog"
5808         fi
5809       else
5810         _err "The 'logger' command is not found, can not enable syslog."
5811         _clearaccountconf "SYS_LOG"
5812         SYS_LOG=""
5813       fi
5814     fi
5815
5816     _processAccountConf
5817   fi
5818
5819 }
5820
5821 if [ "$INSTALLONLINE" ]; then
5822   INSTALLONLINE=""
5823   _installOnline
5824   exit
5825 fi
5826
5827 main() {
5828   [ -z "$1" ] && showhelp && return
5829   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
5830 }
5831
5832 main "$@"