acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.7.6
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12 _SCRIPT_="$0"
  13
  14 _SUB_FOLDERS="dnsapi deploy"
  15
  16 LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
  17 LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
  18
  19 LETSENCRYPT_CA_V2="https://acme-v02.api.letsencrypt.org/directory"
  20 LETSENCRYPT_STAGING_CA_V2="https://acme-staging-v02.api.letsencrypt.org/directory"
  21
  22 DEFAULT_CA=$LETSENCRYPT_CA_V1
  23 DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V1
  24
  25 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  26 DEFAULT_ACCOUNT_EMAIL=""
  27
  28 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  29 DEFAULT_DOMAIN_KEY_LENGTH=2048
  30
  31 DEFAULT_OPENSSL_BIN="openssl"
  32
  33 _OLD_CA_HOST="https://acme-v01.api.letsencrypt.org"
  34 _OLD_STAGE_CA_HOST="https://acme-staging.api.letsencrypt.org"
  35
  36 VTYPE_HTTP="http-01"
  37 VTYPE_DNS="dns-01"
  38 VTYPE_TLS="tls-sni-01"
  39 VTYPE_TLS2="tls-sni-02"
  40
  41 LOCAL_ANY_ADDRESS="0.0.0.0"
  42
  43 MAX_RENEW=60
  44
  45 DEFAULT_DNS_SLEEP=120
  46
  47 NO_VALUE="no"
  48
  49 W_TLS="tls"
  50
  51 MODE_STATELESS="stateless"
  52
  53 STATE_VERIFIED="verified_ok"
  54
  55 NGINX="nginx:"
  56 NGINX_START="#ACME_NGINX_START"
  57 NGINX_END="#ACME_NGINX_END"
  58
  59 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  60 END_CSR="-----END CERTIFICATE REQUEST-----"
  61
  62 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  63 END_CERT="-----END CERTIFICATE-----"
  64
  65 RENEW_SKIP=2
  66
  67 ECC_SEP="_"
  68 ECC_SUFFIX="${ECC_SEP}ecc"
  69
  70 LOG_LEVEL_1=1
  71 LOG_LEVEL_2=2
  72 LOG_LEVEL_3=3
  73 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  74
  75 DEBUG_LEVEL_1=1
  76 DEBUG_LEVEL_2=2
  77 DEBUG_LEVEL_3=3
  78 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  79 DEBUG_LEVEL_NONE=0
  80
  81 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  82
  83 SYSLOG_ERROR="user.error"
  84 SYSLOG_INFO="user.info"
  85 SYSLOG_DEBUG="user.debug"
  86
  87 #error
  88 SYSLOG_LEVEL_ERROR=3
  89 #info
  90 SYSLOG_LEVEL_INFO=6
  91 #debug
  92 SYSLOG_LEVEL_DEBUG=7
  93 #debug2
  94 SYSLOG_LEVEL_DEBUG_2=8
  95 #debug3
  96 SYSLOG_LEVEL_DEBUG_3=9
  97
  98 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  99 #none
 100 SYSLOG_LEVEL_NONE=0
 101
 102 _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
 103
 104 _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
 105
 106 _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
 107
 108 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 109
 110 _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
 111
 112 __INTERACTIVE=""
 113 if [ -t 1 ]; then
 114   __INTERACTIVE="1"
 115 fi
 116
 117 __green() {
 118   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 119     printf '\033[1;31;32m'
 120   fi
 121   printf -- "%b" "$1"
 122   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 123     printf '\033[0m'
 124   fi
 125 }
 126
 127 __red() {
 128   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 129     printf '\033[1;31;40m'
 130   fi
 131   printf -- "%b" "$1"
 132   if [ "$__INTERACTIVE${ACME_NO_COLOR}" = "1" ]; then
 133     printf '\033[0m'
 134   fi
 135 }
 136
 137 _printargs() {
 138   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 139     printf -- "%s" "[$(date)] "
 140   fi
 141   if [ -z "$2" ]; then
 142     printf -- "%s" "$1"
 143   else
 144     printf -- "%s" "$1='$2'"
 145   fi
 146   printf "\n"
 147 }
 148
 149 _dlg_versions() {
 150   echo "Diagnosis versions: "
 151   echo "openssl:$ACME_OPENSSL_BIN"
 152   if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
 153     ${ACME_OPENSSL_BIN:-openssl} version 2>&1
 154   else
 155     echo "$ACME_OPENSSL_BIN doesn't exists."
 156   fi
 157
 158   echo "apache:"
 159   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 160     $_APACHECTL -V 2>&1
 161   else
 162     echo "apache doesn't exists."
 163   fi
 164
 165   echo "nginx:"
 166   if _exists "nginx"; then
 167     nginx -V 2>&1
 168   else
 169     echo "nginx doesn't exists."
 170   fi
 171
 172   echo "socat:"
 173   if _exists "socat"; then
 174     socat -h 2>&1
 175   else
 176     _debug "socat doesn't exists."
 177   fi
 178 }
 179
 180 #class
 181 _syslog() {
 182   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 183     return
 184   fi
 185   _logclass="$1"
 186   shift
 187   if [ -z "$__logger_i" ]; then
 188     if _contains "$(logger --help 2>&1)" "-i"; then
 189       __logger_i="logger -i"
 190     else
 191       __logger_i="logger"
 192     fi
 193   fi
 194   $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 195 }
 196
 197 _log() {
 198   [ -z "$LOG_FILE" ] && return
 199   _printargs "$@" >>"$LOG_FILE"
 200 }
 201
 202 _info() {
 203   _log "$@"
 204   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 205     _syslog "$SYSLOG_INFO" "$@"
 206   fi
 207   _printargs "$@"
 208 }
 209
 210 _err() {
 211   _syslog "$SYSLOG_ERROR" "$@"
 212   _log "$@"
 213   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 214     printf -- "%s" "[$(date)] " >&2
 215   fi
 216   if [ -z "$2" ]; then
 217     __red "$1" >&2
 218   else
 219     __red "$1='$2'" >&2
 220   fi
 221   printf "\n" >&2
 222   return 1
 223 }
 224
 225 _usage() {
 226   __red "$@" >&2
 227   printf "\n" >&2
 228 }
 229
 230 _debug() {
 231   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 232     _log "$@"
 233   fi
 234   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 235     _syslog "$SYSLOG_DEBUG" "$@"
 236   fi
 237   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 238     _printargs "$@" >&2
 239   fi
 240 }
 241
 242 #output the sensitive messages
 243 _secure_debug() {
 244   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 245     if [ "$OUTPUT_INSECURE" = "1" ]; then
 246       _log "$@"
 247     else
 248       _log "$1" "$HIDDEN_VALUE"
 249     fi
 250   fi
 251   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 252     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 253   fi
 254   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 255     if [ "$OUTPUT_INSECURE" = "1" ]; then
 256       _printargs "$@" >&2
 257     else
 258       _printargs "$1" "$HIDDEN_VALUE" >&2
 259     fi
 260   fi
 261 }
 262
 263 _debug2() {
 264   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 265     _log "$@"
 266   fi
 267   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 268     _syslog "$SYSLOG_DEBUG" "$@"
 269   fi
 270   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 271     _printargs "$@" >&2
 272   fi
 273 }
 274
 275 _secure_debug2() {
 276   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 277     if [ "$OUTPUT_INSECURE" = "1" ]; then
 278       _log "$@"
 279     else
 280       _log "$1" "$HIDDEN_VALUE"
 281     fi
 282   fi
 283   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 284     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 285   fi
 286   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 287     if [ "$OUTPUT_INSECURE" = "1" ]; then
 288       _printargs "$@" >&2
 289     else
 290       _printargs "$1" "$HIDDEN_VALUE" >&2
 291     fi
 292   fi
 293 }
 294
 295 _debug3() {
 296   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 297     _log "$@"
 298   fi
 299   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 300     _syslog "$SYSLOG_DEBUG" "$@"
 301   fi
 302   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 303     _printargs "$@" >&2
 304   fi
 305 }
 306
 307 _secure_debug3() {
 308   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 309     if [ "$OUTPUT_INSECURE" = "1" ]; then
 310       _log "$@"
 311     else
 312       _log "$1" "$HIDDEN_VALUE"
 313     fi
 314   fi
 315   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 316     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 317   fi
 318   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 319     if [ "$OUTPUT_INSECURE" = "1" ]; then
 320       _printargs "$@" >&2
 321     else
 322       _printargs "$1" "$HIDDEN_VALUE" >&2
 323     fi
 324   fi
 325 }
 326
 327 _upper_case() {
 328   # shellcheck disable=SC2018,SC2019
 329   tr 'a-z' 'A-Z'
 330 }
 331
 332 _lower_case() {
 333   # shellcheck disable=SC2018,SC2019
 334   tr 'A-Z' 'a-z'
 335 }
 336
 337 _startswith() {
 338   _str="$1"
 339   _sub="$2"
 340   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 341 }
 342
 343 _endswith() {
 344   _str="$1"
 345   _sub="$2"
 346   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 347 }
 348
 349 _contains() {
 350   _str="$1"
 351   _sub="$2"
 352   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 353 }
 354
 355 _hasfield() {
 356   _str="$1"
 357   _field="$2"
 358   _sep="$3"
 359   if [ -z "$_field" ]; then
 360     _usage "Usage: str field  [sep]"
 361     return 1
 362   fi
 363
 364   if [ -z "$_sep" ]; then
 365     _sep=","
 366   fi
 367
 368   for f in $(echo "$_str" | tr "$_sep" ' '); do
 369     if [ "$f" = "$_field" ]; then
 370       _debug2 "'$_str' contains '$_field'"
 371       return 0 #contains ok
 372     fi
 373   done
 374   _debug2 "'$_str' does not contain '$_field'"
 375   return 1 #not contains
 376 }
 377
 378 # str index [sep]
 379 _getfield() {
 380   _str="$1"
 381   _findex="$2"
 382   _sep="$3"
 383
 384   if [ -z "$_findex" ]; then
 385     _usage "Usage: str field  [sep]"
 386     return 1
 387   fi
 388
 389   if [ -z "$_sep" ]; then
 390     _sep=","
 391   fi
 392
 393   _ffi="$_findex"
 394   while [ "$_ffi" -gt "0" ]; do
 395     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 396     if [ "$_fv" ]; then
 397       printf -- "%s" "$_fv"
 398       return 0
 399     fi
 400     _ffi="$(_math "$_ffi" - 1)"
 401   done
 402
 403   printf -- "%s" "$_str"
 404
 405 }
 406
 407 _exists() {
 408   cmd="$1"
 409   if [ -z "$cmd" ]; then
 410     _usage "Usage: _exists cmd"
 411     return 1
 412   fi
 413
 414   if eval type type >/dev/null 2>&1; then
 415     eval type "$cmd" >/dev/null 2>&1
 416   elif command >/dev/null 2>&1; then
 417     command -v "$cmd" >/dev/null 2>&1
 418   else
 419     which "$cmd" >/dev/null 2>&1
 420   fi
 421   ret="$?"
 422   _debug3 "$cmd exists=$ret"
 423   return $ret
 424 }
 425
 426 #a + b
 427 _math() {
 428   _m_opts="$@"
 429   printf "%s" "$(($_m_opts))"
 430 }
 431
 432 _h_char_2_dec() {
 433   _ch=$1
 434   case "${_ch}" in
 435     a | A)
 436       printf "10"
 437       ;;
 438     b | B)
 439       printf "11"
 440       ;;
 441     c | C)
 442       printf "12"
 443       ;;
 444     d | D)
 445       printf "13"
 446       ;;
 447     e | E)
 448       printf "14"
 449       ;;
 450     f | F)
 451       printf "15"
 452       ;;
 453     *)
 454       printf "%s" "$_ch"
 455       ;;
 456   esac
 457
 458 }
 459
 460 _URGLY_PRINTF=""
 461 if [ "$(printf '\x41')" != 'A' ]; then
 462   _URGLY_PRINTF=1
 463 fi
 464
 465 _ESCAPE_XARGS=""
 466 if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
 467   _ESCAPE_XARGS=1
 468 fi
 469
 470 _h2b() {
 471   if _exists xxd && xxd -r -p 2>/dev/null; then
 472     return
 473   fi
 474
 475   hex=$(cat)
 476   ic=""
 477   jc=""
 478   _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
 479   if [ -z "$_URGLY_PRINTF" ]; then
 480     if [ "$_ESCAPE_XARGS" ] && _exists xargs; then
 481       _debug2 "xargs"
 482       echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
 483     else
 484       for h in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
 485         if [ -z "$h" ]; then
 486           break
 487         fi
 488         printf "\x$h%s"
 489       done
 490     fi
 491   else
 492     for c in $(echo "$hex" | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
 493       if [ -z "$ic" ]; then
 494         ic=$c
 495         continue
 496       fi
 497       jc=$c
 498       ic="$(_h_char_2_dec "$ic")"
 499       jc="$(_h_char_2_dec "$jc")"
 500       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 501       ic=""
 502       jc=""
 503     done
 504   fi
 505
 506 }
 507
 508 _is_solaris() {
 509   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 510 }
 511
 512 #_ascii_hex str
 513 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 514 _ascii_hex() {
 515   _debug2 "Using _ascii_hex"
 516   _str="$1"
 517   _str_len=${#_str}
 518   _h_i=1
 519   while [ "$_h_i" -le "$_str_len" ]; do
 520     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 521     printf " %02x" "'$_str_c"
 522     _h_i="$(_math "$_h_i" + 1)"
 523   done
 524 }
 525
 526 #stdin  output hexstr splited by one space
 527 #input:"abc"
 528 #output: " 61 62 63"
 529 _hex_dump() {
 530   if _exists od; then
 531     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 532   elif _exists hexdump; then
 533     _debug3 "using hexdump"
 534     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 535   elif _exists xxd; then
 536     _debug3 "using xxd"
 537     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 538   else
 539     _debug3 "using _ascii_hex"
 540     str=$(cat)
 541     _ascii_hex "$str"
 542   fi
 543 }
 544
 545 #url encode, no-preserved chars
 546 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 547 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 548
 549 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 550 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 551
 552 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 553 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 554
 555 #stdin stdout
 556 _url_encode() {
 557   _hex_str=$(_hex_dump)
 558   _debug3 "_url_encode"
 559   _debug3 "_hex_str" "$_hex_str"
 560   for _hex_code in $_hex_str; do
 561     #upper case
 562     case "${_hex_code}" in
 563       "41")
 564         printf "%s" "A"
 565         ;;
 566       "42")
 567         printf "%s" "B"
 568         ;;
 569       "43")
 570         printf "%s" "C"
 571         ;;
 572       "44")
 573         printf "%s" "D"
 574         ;;
 575       "45")
 576         printf "%s" "E"
 577         ;;
 578       "46")
 579         printf "%s" "F"
 580         ;;
 581       "47")
 582         printf "%s" "G"
 583         ;;
 584       "48")
 585         printf "%s" "H"
 586         ;;
 587       "49")
 588         printf "%s" "I"
 589         ;;
 590       "4a")
 591         printf "%s" "J"
 592         ;;
 593       "4b")
 594         printf "%s" "K"
 595         ;;
 596       "4c")
 597         printf "%s" "L"
 598         ;;
 599       "4d")
 600         printf "%s" "M"
 601         ;;
 602       "4e")
 603         printf "%s" "N"
 604         ;;
 605       "4f")
 606         printf "%s" "O"
 607         ;;
 608       "50")
 609         printf "%s" "P"
 610         ;;
 611       "51")
 612         printf "%s" "Q"
 613         ;;
 614       "52")
 615         printf "%s" "R"
 616         ;;
 617       "53")
 618         printf "%s" "S"
 619         ;;
 620       "54")
 621         printf "%s" "T"
 622         ;;
 623       "55")
 624         printf "%s" "U"
 625         ;;
 626       "56")
 627         printf "%s" "V"
 628         ;;
 629       "57")
 630         printf "%s" "W"
 631         ;;
 632       "58")
 633         printf "%s" "X"
 634         ;;
 635       "59")
 636         printf "%s" "Y"
 637         ;;
 638       "5a")
 639         printf "%s" "Z"
 640         ;;
 641
 642       #lower case
 643       "61")
 644         printf "%s" "a"
 645         ;;
 646       "62")
 647         printf "%s" "b"
 648         ;;
 649       "63")
 650         printf "%s" "c"
 651         ;;
 652       "64")
 653         printf "%s" "d"
 654         ;;
 655       "65")
 656         printf "%s" "e"
 657         ;;
 658       "66")
 659         printf "%s" "f"
 660         ;;
 661       "67")
 662         printf "%s" "g"
 663         ;;
 664       "68")
 665         printf "%s" "h"
 666         ;;
 667       "69")
 668         printf "%s" "i"
 669         ;;
 670       "6a")
 671         printf "%s" "j"
 672         ;;
 673       "6b")
 674         printf "%s" "k"
 675         ;;
 676       "6c")
 677         printf "%s" "l"
 678         ;;
 679       "6d")
 680         printf "%s" "m"
 681         ;;
 682       "6e")
 683         printf "%s" "n"
 684         ;;
 685       "6f")
 686         printf "%s" "o"
 687         ;;
 688       "70")
 689         printf "%s" "p"
 690         ;;
 691       "71")
 692         printf "%s" "q"
 693         ;;
 694       "72")
 695         printf "%s" "r"
 696         ;;
 697       "73")
 698         printf "%s" "s"
 699         ;;
 700       "74")
 701         printf "%s" "t"
 702         ;;
 703       "75")
 704         printf "%s" "u"
 705         ;;
 706       "76")
 707         printf "%s" "v"
 708         ;;
 709       "77")
 710         printf "%s" "w"
 711         ;;
 712       "78")
 713         printf "%s" "x"
 714         ;;
 715       "79")
 716         printf "%s" "y"
 717         ;;
 718       "7a")
 719         printf "%s" "z"
 720         ;;
 721       #numbers
 722       "30")
 723         printf "%s" "0"
 724         ;;
 725       "31")
 726         printf "%s" "1"
 727         ;;
 728       "32")
 729         printf "%s" "2"
 730         ;;
 731       "33")
 732         printf "%s" "3"
 733         ;;
 734       "34")
 735         printf "%s" "4"
 736         ;;
 737       "35")
 738         printf "%s" "5"
 739         ;;
 740       "36")
 741         printf "%s" "6"
 742         ;;
 743       "37")
 744         printf "%s" "7"
 745         ;;
 746       "38")
 747         printf "%s" "8"
 748         ;;
 749       "39")
 750         printf "%s" "9"
 751         ;;
 752       "2d")
 753         printf "%s" "-"
 754         ;;
 755       "5f")
 756         printf "%s" "_"
 757         ;;
 758       "2e")
 759         printf "%s" "."
 760         ;;
 761       "7e")
 762         printf "%s" "~"
 763         ;;
 764       #other hex
 765       *)
 766         printf '%%%s' "$_hex_code"
 767         ;;
 768     esac
 769   done
 770 }
 771
 772 #options file
 773 _sed_i() {
 774   options="$1"
 775   filename="$2"
 776   if [ -z "$filename" ]; then
 777     _usage "Usage:_sed_i options filename"
 778     return 1
 779   fi
 780   _debug2 options "$options"
 781   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 782     _debug "Using sed  -i"
 783     sed -i "$options" "$filename"
 784   else
 785     _debug "No -i support in sed"
 786     text="$(cat "$filename")"
 787     echo "$text" | sed "$options" >"$filename"
 788   fi
 789 }
 790
 791 _egrep_o() {
 792   if ! egrep -o "$1" 2>/dev/null; then
 793     sed -n 's/.*\('"$1"'\).*/\1/p'
 794   fi
 795 }
 796
 797 #Usage: file startline endline
 798 _getfile() {
 799   filename="$1"
 800   startline="$2"
 801   endline="$3"
 802   if [ -z "$endline" ]; then
 803     _usage "Usage: file startline endline"
 804     return 1
 805   fi
 806
 807   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 808   if [ -z "$i" ]; then
 809     _err "Can not find start line: $startline"
 810     return 1
 811   fi
 812   i="$(_math "$i" + 1)"
 813   _debug i "$i"
 814
 815   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 816   if [ -z "$j" ]; then
 817     _err "Can not find end line: $endline"
 818     return 1
 819   fi
 820   j="$(_math "$j" - 1)"
 821   _debug j "$j"
 822
 823   sed -n "$i,${j}p" "$filename"
 824
 825 }
 826
 827 #Usage: multiline
 828 _base64() {
 829   [ "" ] #urgly
 830   if [ "$1" ]; then
 831     _debug3 "base64 multiline:'$1'"
 832     ${ACME_OPENSSL_BIN:-openssl} base64 -e
 833   else
 834     _debug3 "base64 single line."
 835     ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
 836   fi
 837 }
 838
 839 #Usage: multiline
 840 _dbase64() {
 841   if [ "$1" ]; then
 842     ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
 843   else
 844     ${ACME_OPENSSL_BIN:-openssl} base64 -d
 845   fi
 846 }
 847
 848 #Usage: hashalg  [outputhex]
 849 #Output Base64-encoded digest
 850 _digest() {
 851   alg="$1"
 852   if [ -z "$alg" ]; then
 853     _usage "Usage: _digest hashalg"
 854     return 1
 855   fi
 856
 857   outputhex="$2"
 858
 859   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 860     if [ "$outputhex" ]; then
 861       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 862     else
 863       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
 864     fi
 865   else
 866     _err "$alg is not supported yet"
 867     return 1
 868   fi
 869
 870 }
 871
 872 #Usage: hashalg  secret_hex  [outputhex]
 873 #Output binary hmac
 874 _hmac() {
 875   alg="$1"
 876   secret_hex="$2"
 877   outputhex="$3"
 878
 879   if [ -z "$secret_hex" ]; then
 880     _usage "Usage: _hmac hashalg secret [outputhex]"
 881     return 1
 882   fi
 883
 884   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
 885     if [ "$outputhex" ]; then
 886       (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
 887     else
 888       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
 889     fi
 890   else
 891     _err "$alg is not supported yet"
 892     return 1
 893   fi
 894
 895 }
 896
 897 #Usage: keyfile hashalg
 898 #Output: Base64-encoded signature value
 899 _sign() {
 900   keyfile="$1"
 901   alg="$2"
 902   if [ -z "$alg" ]; then
 903     _usage "Usage: _sign keyfile hashalg"
 904     return 1
 905   fi
 906
 907   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
 908
 909   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 910     $_sign_openssl -$alg | _base64
 911   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 912     if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
 913       _err "Sign failed: $_sign_openssl"
 914       _err "Key file: $keyfile"
 915       _err "Key content:$(wc -l <"$keyfile") lines"
 916       return 1
 917     fi
 918     _debug3 "_signedECText" "$_signedECText"
 919     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 920     _debug3 "_ec_r" "$_ec_r"
 921     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 922     _debug3 "_ec_s" "$_ec_s"
 923     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
 924   else
 925     _err "Unknown key file format."
 926     return 1
 927   fi
 928
 929 }
 930
 931 #keylength or isEcc flag (empty str => not ecc)
 932 _isEccKey() {
 933   _length="$1"
 934
 935   if [ -z "$_length" ]; then
 936     return 1
 937   fi
 938
 939   [ "$_length" != "1024" ] \
 940     && [ "$_length" != "2048" ] \
 941     && [ "$_length" != "3072" ] \
 942     && [ "$_length" != "4096" ] \
 943     && [ "$_length" != "8192" ]
 944 }
 945
 946 # _createkey  2048|ec-256   file
 947 _createkey() {
 948   length="$1"
 949   f="$2"
 950   _debug2 "_createkey for file:$f"
 951   eccname="$length"
 952   if _startswith "$length" "ec-"; then
 953     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
 954
 955     if [ "$length" = "256" ]; then
 956       eccname="prime256v1"
 957     fi
 958     if [ "$length" = "384" ]; then
 959       eccname="secp384r1"
 960     fi
 961     if [ "$length" = "521" ]; then
 962       eccname="secp521r1"
 963     fi
 964
 965   fi
 966
 967   if [ -z "$length" ]; then
 968     length=2048
 969   fi
 970
 971   _debug "Use length $length"
 972
 973   if ! touch "$f" >/dev/null 2>&1; then
 974     _f_path="$(dirname "$f")"
 975     _debug _f_path "$_f_path"
 976     if ! mkdir -p "$_f_path"; then
 977       _err "Can not create path: $_f_path"
 978       return 1
 979     fi
 980   fi
 981
 982   if _isEccKey "$length"; then
 983     _debug "Using ec name: $eccname"
 984     ${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null >"$f"
 985   else
 986     _debug "Using RSA: $length"
 987     ${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null >"$f"
 988   fi
 989
 990   if [ "$?" != "0" ]; then
 991     _err "Create key error."
 992     return 1
 993   fi
 994 }
 995
 996 #domain
 997 _is_idn() {
 998   _is_idn_d="$1"
 999   _debug2 _is_idn_d "$_is_idn_d"
1000   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '*.,-')
1001   _debug2 _idn_temp "$_idn_temp"
1002   [ "$_idn_temp" ]
1003 }
1004
1005 #aa.com
1006 #aa.com,bb.com,cc.com
1007 _idn() {
1008   __idn_d="$1"
1009   if ! _is_idn "$__idn_d"; then
1010     printf "%s" "$__idn_d"
1011     return 0
1012   fi
1013
1014   if _exists idn; then
1015     if _contains "$__idn_d" ','; then
1016       _i_first="1"
1017       for f in $(echo "$__idn_d" | tr ',' ' '); do
1018         [ -z "$f" ] && continue
1019         if [ -z "$_i_first" ]; then
1020           printf "%s" ","
1021         else
1022           _i_first=""
1023         fi
1024         idn --quiet "$f" | tr -d "\r\n"
1025       done
1026     else
1027       idn "$__idn_d" | tr -d "\r\n"
1028     fi
1029   else
1030     _err "Please install idn to process IDN names."
1031   fi
1032 }
1033
1034 #_createcsr  cn  san_list  keyfile csrfile conf
1035 _createcsr() {
1036   _debug _createcsr
1037   domain="$1"
1038   domainlist="$2"
1039   csrkey="$3"
1040   csr="$4"
1041   csrconf="$5"
1042   _debug2 domain "$domain"
1043   _debug2 domainlist "$domainlist"
1044   _debug2 csrkey "$csrkey"
1045   _debug2 csr "$csr"
1046   _debug2 csrconf "$csrconf"
1047
1048   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1049
1050   if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1051     #single domain
1052     _info "Single domain" "$domain"
1053     printf -- "\nsubjectAltName=DNS:$domain" >>"$csrconf"
1054   else
1055     domainlist="$(_idn "$domainlist")"
1056     _debug2 domainlist "$domainlist"
1057     if _contains "$domainlist" ","; then
1058       alt="DNS:$domain,DNS:$(echo "$domainlist" | sed "s/,,/,/g" | sed "s/,/,DNS:/g")"
1059     else
1060       alt="DNS:$domain,DNS:$domainlist"
1061     fi
1062     #multi
1063     _info "Multi domain" "$alt"
1064     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1065   fi
1066   if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
1067     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1068     _cleardomainconf Le_OCSP_Stable
1069     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1070   fi
1071
1072   _csr_cn="$(_idn "$domain")"
1073   _debug2 _csr_cn "$_csr_cn"
1074   if _contains "$(uname -a)" "MINGW"; then
1075     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1076   else
1077     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1078   fi
1079 }
1080
1081 #_signcsr key  csr  conf cert
1082 _signcsr() {
1083   key="$1"
1084   csr="$2"
1085   conf="$3"
1086   cert="$4"
1087   _debug "_signcsr"
1088
1089   _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1090   _ret="$?"
1091   _debug "$_msg"
1092   return $_ret
1093 }
1094
1095 #_csrfile
1096 _readSubjectFromCSR() {
1097   _csrfile="$1"
1098   if [ -z "$_csrfile" ]; then
1099     _usage "_readSubjectFromCSR mycsr.csr"
1100     return 1
1101   fi
1102   ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | tr ',' "\n" | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
1103 }
1104
1105 #_csrfile
1106 #echo comma separated domain list
1107 _readSubjectAltNamesFromCSR() {
1108   _csrfile="$1"
1109   if [ -z "$_csrfile" ]; then
1110     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1111     return 1
1112   fi
1113
1114   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1115   _debug _csrsubj "$_csrsubj"
1116
1117   _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1118   _debug _dnsAltnames "$_dnsAltnames"
1119
1120   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1121     _debug "AltNames contains subject"
1122     _dnsAltnames="$(printf "%s" "$_dnsAltnames," | sed "s/DNS:$_csrsubj,//g")"
1123   else
1124     _debug "AltNames doesn't contain subject"
1125   fi
1126
1127   printf "%s" "$_dnsAltnames" | sed "s/DNS://g"
1128 }
1129
1130 #_csrfile
1131 _readKeyLengthFromCSR() {
1132   _csrfile="$1"
1133   if [ -z "$_csrfile" ]; then
1134     _usage "_readKeyLengthFromCSR mycsr.csr"
1135     return 1
1136   fi
1137
1138   _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
1139   _debug2 _outcsr "$_outcsr"
1140   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1141     _debug "ECC CSR"
1142     echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1143   else
1144     _debug "RSA CSR"
1145     _rkl="$(echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1)"
1146     if [ "$_rkl" ]; then
1147       echo "$_rkl"
1148     else
1149       echo "$_outcsr" | tr "\t" " " | _egrep_o "RSA Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1150     fi
1151   fi
1152 }
1153
1154 _ss() {
1155   _port="$1"
1156
1157   if _exists "ss"; then
1158     _debug "Using: ss"
1159     ss -ntpl 2>/dev/null | grep ":$_port "
1160     return 0
1161   fi
1162
1163   if _exists "netstat"; then
1164     _debug "Using: netstat"
1165     if netstat -h 2>&1 | grep "\-p proto" >/dev/null; then
1166       #for windows version netstat tool
1167       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1168     else
1169       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1170         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1171       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1172         #for solaris
1173         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1174       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1175         #for full linux
1176         netstat -ntpl | grep ":$_port "
1177       else
1178         #for busybox (embedded linux; no pid support)
1179         netstat -ntl 2>/dev/null | grep ":$_port "
1180       fi
1181     fi
1182     return 0
1183   fi
1184
1185   return 1
1186 }
1187
1188 #outfile key cert cacert [password [name [caname]]]
1189 _toPkcs() {
1190   _cpfx="$1"
1191   _ckey="$2"
1192   _ccert="$3"
1193   _cca="$4"
1194   pfxPassword="$5"
1195   pfxName="$6"
1196   pfxCaname="$7"
1197
1198   if [ "$pfxCaname" ]; then
1199     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName" -caname "$pfxCaname"
1200   elif [ "$pfxName" ]; then
1201     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword" -name "$pfxName"
1202   elif [ "$pfxPassword" ]; then
1203     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca" -password "pass:$pfxPassword"
1204   else
1205     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$_cpfx" -inkey "$_ckey" -in "$_ccert" -certfile "$_cca"
1206   fi
1207
1208 }
1209
1210 #domain [password] [isEcc]
1211 toPkcs() {
1212   domain="$1"
1213   pfxPassword="$2"
1214   if [ -z "$domain" ]; then
1215     _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
1216     return 1
1217   fi
1218
1219   _isEcc="$3"
1220
1221   _initpath "$domain" "$_isEcc"
1222
1223   _toPkcs "$CERT_PFX_PATH" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$pfxPassword"
1224
1225   if [ "$?" = "0" ]; then
1226     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1227   fi
1228
1229 }
1230
1231 #domain [isEcc]
1232 toPkcs8() {
1233   domain="$1"
1234
1235   if [ -z "$domain" ]; then
1236     _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
1237     return 1
1238   fi
1239
1240   _isEcc="$2"
1241
1242   _initpath "$domain" "$_isEcc"
1243
1244   ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1245
1246   if [ "$?" = "0" ]; then
1247     _info "Success, $CERT_PKCS8_PATH"
1248   fi
1249
1250 }
1251
1252 #[2048]
1253 createAccountKey() {
1254   _info "Creating account key"
1255   if [ -z "$1" ]; then
1256     _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
1257     return
1258   fi
1259
1260   length=$1
1261   _create_account_key "$length"
1262
1263 }
1264
1265 _create_account_key() {
1266
1267   length=$1
1268
1269   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1270     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1271     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1272   fi
1273
1274   _debug length "$length"
1275   _initpath
1276
1277   mkdir -p "$CA_DIR"
1278   if [ -f "$ACCOUNT_KEY_PATH" ]; then
1279     _info "Account key exists, skip"
1280     return
1281   else
1282     #generate account key
1283     _createkey "$length" "$ACCOUNT_KEY_PATH"
1284   fi
1285
1286 }
1287
1288 #domain [length]
1289 createDomainKey() {
1290   _info "Creating domain key"
1291   if [ -z "$1" ]; then
1292     _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]"
1293     return
1294   fi
1295
1296   domain=$1
1297   _cdl=$2
1298
1299   if [ -z "$_cdl" ]; then
1300     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1301     _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
1302   fi
1303
1304   _initpath "$domain" "$_cdl"
1305
1306   if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]) || [ "$Le_ForceNewDomainKey" = "1" ]; then
1307     if _createkey "$_cdl" "$CERT_KEY_PATH"; then
1308       _savedomainconf Le_Keylength "$_cdl"
1309       _info "The domain key is here: $(__green $CERT_KEY_PATH)"
1310     fi
1311   else
1312     if [ "$IS_RENEW" ]; then
1313       _info "Domain key exists, skip"
1314       return 0
1315     else
1316       _err "Domain key exists, do you want to overwrite the key?"
1317       _err "Add '--force', and try again."
1318       return 1
1319     fi
1320   fi
1321
1322 }
1323
1324 # domain  domainlist isEcc
1325 createCSR() {
1326   _info "Creating csr"
1327   if [ -z "$1" ]; then
1328     _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]"
1329     return
1330   fi
1331
1332   domain="$1"
1333   domainlist="$2"
1334   _isEcc="$3"
1335
1336   _initpath "$domain" "$_isEcc"
1337
1338   if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
1339     _info "CSR exists, skip"
1340     return
1341   fi
1342
1343   if [ ! -f "$CERT_KEY_PATH" ]; then
1344     _err "The key file is not found: $CERT_KEY_PATH"
1345     _err "Please create the key file first."
1346     return 1
1347   fi
1348   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1349
1350 }
1351
1352 _url_replace() {
1353   tr '/+' '_-' | tr -d '= '
1354 }
1355
1356 _time2str() {
1357   #Linux
1358   if date -u -d@"$1" 2>/dev/null; then
1359     return
1360   fi
1361
1362   #BSD
1363   if date -u -r "$1" 2>/dev/null; then
1364     return
1365   fi
1366
1367   #Soaris
1368   if _exists adb; then
1369     _t_s_a=$(echo "0t${1}=Y" | adb)
1370     echo "$_t_s_a"
1371   fi
1372
1373   #Busybox
1374   if echo "$1" | awk '{ print strftime("%c", $0); }' 2>/dev/null; then
1375     return
1376   fi
1377 }
1378
1379 _normalizeJson() {
1380   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1381 }
1382
1383 _stat() {
1384   #Linux
1385   if stat -c '%U:%G' "$1" 2>/dev/null; then
1386     return
1387   fi
1388
1389   #BSD
1390   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1391     return
1392   fi
1393
1394   return 1 #error, 'stat' not found
1395 }
1396
1397 #keyfile
1398 _calcjwk() {
1399   keyfile="$1"
1400   if [ -z "$keyfile" ]; then
1401     _usage "Usage: _calcjwk keyfile"
1402     return 1
1403   fi
1404
1405   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1406     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1407     return 0
1408   fi
1409
1410   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1411     _debug "RSA key"
1412     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1413     if [ "${#pub_exp}" = "5" ]; then
1414       pub_exp=0$pub_exp
1415     fi
1416     _debug3 pub_exp "$pub_exp"
1417
1418     e=$(echo "$pub_exp" | _h2b | _base64)
1419     _debug3 e "$e"
1420
1421     modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1422     _debug3 modulus "$modulus"
1423     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1424     _debug3 n "$n"
1425
1426     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1427     _debug3 jwk "$jwk"
1428
1429     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1430     JWK_HEADERPLACE_PART1='{"nonce": "'
1431     JWK_HEADERPLACE_PART2='", "alg": "RS256"'
1432   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1433     _debug "EC key"
1434     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1435     _debug3 crv "$crv"
1436     __ECC_KEY_LEN=$(echo "$crv" | cut -d "-" -f 2)
1437     if [ "$__ECC_KEY_LEN" = "521" ]; then
1438       __ECC_KEY_LEN=512
1439     fi
1440     _debug3 __ECC_KEY_LEN "$__ECC_KEY_LEN"
1441     if [ -z "$crv" ]; then
1442       _debug "Let's try ASN1 OID"
1443       crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1444       _debug3 crv_oid "$crv_oid"
1445       case "${crv_oid}" in
1446         "prime256v1")
1447           crv="P-256"
1448           __ECC_KEY_LEN=256
1449           ;;
1450         "secp384r1")
1451           crv="P-384"
1452           __ECC_KEY_LEN=384
1453           ;;
1454         "secp521r1")
1455           crv="P-521"
1456           __ECC_KEY_LEN=512
1457           ;;
1458         *)
1459           _err "ECC oid : $crv_oid"
1460           return 1
1461           ;;
1462       esac
1463       _debug3 crv "$crv"
1464     fi
1465
1466     pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1467     pubi=$(_math "$pubi" + 1)
1468     _debug3 pubi "$pubi"
1469
1470     pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1471     pubj=$(_math "$pubj" - 1)
1472     _debug3 pubj "$pubj"
1473
1474     pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1475     _debug3 pubtext "$pubtext"
1476
1477     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1478     xlen=$(_math "$xlen" / 4)
1479     _debug3 xlen "$xlen"
1480
1481     xend=$(_math "$xlen" + 1)
1482     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1483     _debug3 x "$x"
1484
1485     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1486     _debug3 x64 "$x64"
1487
1488     xend=$(_math "$xend" + 1)
1489     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1490     _debug3 y "$y"
1491
1492     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1493     _debug3 y64 "$y64"
1494
1495     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1496     _debug3 jwk "$jwk"
1497
1498     JWK_HEADER='{"alg": "ES'$__ECC_KEY_LEN'", "jwk": '$jwk'}'
1499     JWK_HEADERPLACE_PART1='{"nonce": "'
1500     JWK_HEADERPLACE_PART2='", "alg": "ES'$__ECC_KEY_LEN'"'
1501   else
1502     _err "Only RSA or EC key is supported."
1503     return 1
1504   fi
1505
1506   _debug3 JWK_HEADER "$JWK_HEADER"
1507   __CACHED_JWK_KEY_FILE="$keyfile"
1508 }
1509
1510 _time() {
1511   date -u "+%s"
1512 }
1513
1514 _utc_date() {
1515   date -u "+%Y-%m-%d %H:%M:%S"
1516 }
1517
1518 _mktemp() {
1519   if _exists mktemp; then
1520     if mktemp 2>/dev/null; then
1521       return 0
1522     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1523       #for Mac osx
1524       return 0
1525     fi
1526   fi
1527   if [ -d "/tmp" ]; then
1528     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1529     return 0
1530   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1531     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1532     return 0
1533   fi
1534   _err "Can not create temp file."
1535 }
1536
1537 _inithttp() {
1538
1539   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1540     HTTP_HEADER="$(_mktemp)"
1541     _debug2 HTTP_HEADER "$HTTP_HEADER"
1542   fi
1543
1544   if [ "$__HTTP_INITIALIZED" ]; then
1545     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1546       _debug2 "Http already initialized."
1547       return 0
1548     fi
1549   fi
1550
1551   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1552     _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
1553     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1554       _CURL_DUMP="$(_mktemp)"
1555       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1556     fi
1557
1558     if [ "$CA_PATH" ]; then
1559       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1560     elif [ "$CA_BUNDLE" ]; then
1561       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1562     fi
1563
1564   fi
1565
1566   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1567     _ACME_WGET="wget -q"
1568     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1569       _ACME_WGET="$_ACME_WGET -d "
1570     fi
1571     if [ "$CA_PATH" ]; then
1572       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1573     elif [ "$CA_BUNDLE" ]; then
1574       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1575     fi
1576   fi
1577
1578   #from wget 1.14: do not skip body on 404 error
1579   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1580     _ACME_WGET="$_ACME_WGET --content-on-error "
1581   fi
1582
1583   __HTTP_INITIALIZED=1
1584
1585 }
1586
1587 # body  url [needbase64] [POST|PUT]
1588 _post() {
1589   body="$1"
1590   _post_url="$2"
1591   needbase64="$3"
1592   httpmethod="$4"
1593
1594   if [ -z "$httpmethod" ]; then
1595     httpmethod="POST"
1596   fi
1597   _debug $httpmethod
1598   _debug "_post_url" "$_post_url"
1599   _debug2 "body" "$body"
1600
1601   _inithttp
1602
1603   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1604     _CURL="$_ACME_CURL"
1605     if [ "$HTTPS_INSECURE" ]; then
1606       _CURL="$_CURL --insecure  "
1607     fi
1608     _debug "_CURL" "$_CURL"
1609     if [ "$needbase64" ]; then
1610       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
1611     else
1612       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
1613     fi
1614     _ret="$?"
1615     if [ "$_ret" != "0" ]; then
1616       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1617       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1618         _err "Here is the curl dump log:"
1619         _err "$(cat "$_CURL_DUMP")"
1620       fi
1621     fi
1622   elif [ "$_ACME_WGET" ]; then
1623     _WGET="$_ACME_WGET"
1624     if [ "$HTTPS_INSECURE" ]; then
1625       _WGET="$_WGET --no-check-certificate "
1626     fi
1627     _debug "_WGET" "$_WGET"
1628     if [ "$needbase64" ]; then
1629       if [ "$httpmethod" = "POST" ]; then
1630         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1631       else
1632         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
1633       fi
1634     else
1635       if [ "$httpmethod" = "POST" ]; then
1636         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1637       else
1638         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
1639       fi
1640     fi
1641     _ret="$?"
1642     if [ "$_ret" = "8" ]; then
1643       _ret=0
1644       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1645     fi
1646     if [ "$_ret" != "0" ]; then
1647       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1648     fi
1649     _sed_i "s/^ *//g" "$HTTP_HEADER"
1650   else
1651     _ret="$?"
1652     _err "Neither curl nor wget is found, can not do $httpmethod."
1653   fi
1654   _debug "_ret" "$_ret"
1655   printf "%s" "$response"
1656   return $_ret
1657 }
1658
1659 # url getheader timeout
1660 _get() {
1661   _debug GET
1662   url="$1"
1663   onlyheader="$2"
1664   t="$3"
1665   _debug url "$url"
1666   _debug "timeout=$t"
1667
1668   _inithttp
1669
1670   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1671     _CURL="$_ACME_CURL"
1672     if [ "$HTTPS_INSECURE" ]; then
1673       _CURL="$_CURL --insecure  "
1674     fi
1675     if [ "$t" ]; then
1676       _CURL="$_CURL --connect-timeout $t"
1677     fi
1678     _debug "_CURL" "$_CURL"
1679     if [ "$onlyheader" ]; then
1680       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1681     else
1682       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1683     fi
1684     ret=$?
1685     if [ "$ret" != "0" ]; then
1686       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1687       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1688         _err "Here is the curl dump log:"
1689         _err "$(cat "$_CURL_DUMP")"
1690       fi
1691     fi
1692   elif [ "$_ACME_WGET" ]; then
1693     _WGET="$_ACME_WGET"
1694     if [ "$HTTPS_INSECURE" ]; then
1695       _WGET="$_WGET --no-check-certificate "
1696     fi
1697     if [ "$t" ]; then
1698       _WGET="$_WGET --timeout=$t"
1699     fi
1700     _debug "_WGET" "$_WGET"
1701     if [ "$onlyheader" ]; then
1702       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1703     else
1704       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1705     fi
1706     ret=$?
1707     if [ "$ret" = "8" ]; then
1708       ret=0
1709       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1710     fi
1711     if [ "$ret" != "0" ]; then
1712       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1713     fi
1714   else
1715     ret=$?
1716     _err "Neither curl nor wget is found, can not do GET."
1717   fi
1718   _debug "ret" "$ret"
1719   return $ret
1720 }
1721
1722 _head_n() {
1723   head -n "$1"
1724 }
1725
1726 _tail_n() {
1727   if ! tail -n "$1" 2>/dev/null; then
1728     #fix for solaris
1729     tail -"$1"
1730   fi
1731 }
1732
1733 # url  payload needbase64  keyfile
1734 _send_signed_request() {
1735   url=$1
1736   payload=$2
1737   needbase64=$3
1738   keyfile=$4
1739   if [ -z "$keyfile" ]; then
1740     keyfile="$ACCOUNT_KEY_PATH"
1741   fi
1742   _debug url "$url"
1743   _debug payload "$payload"
1744
1745   if ! _calcjwk "$keyfile"; then
1746     return 1
1747   fi
1748
1749   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
1750   _debug3 payload64 "$payload64"
1751
1752   MAX_REQUEST_RETRY_TIMES=5
1753   _request_retry_times=0
1754   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
1755     _debug3 _request_retry_times "$_request_retry_times"
1756     if [ -z "$_CACHED_NONCE" ]; then
1757       _headers=""
1758       if [ "$ACME_NEW_NONCE" ]; then
1759         _debug2 "Get nonce. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
1760         nonceurl="$ACME_NEW_NONCE"
1761         if _post "" "$nonceurl" "" "HEAD"; then
1762           _headers="$(cat "$HTTP_HEADER")"
1763         fi
1764       fi
1765       if [ -z "$_headers" ]; then
1766         _debug2 "Get nonce. ACME_DIRECTORY" "$ACME_DIRECTORY"
1767         nonceurl="$ACME_DIRECTORY"
1768         _headers="$(_get "$nonceurl" "onlyheader")"
1769       fi
1770
1771       if [ "$?" != "0" ]; then
1772         _err "Can not connect to $nonceurl to get nonce."
1773         return 1
1774       fi
1775
1776       _debug2 _headers "$_headers"
1777
1778       _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1779       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
1780     else
1781       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
1782     fi
1783     nonce="$_CACHED_NONCE"
1784     _debug2 nonce "$nonce"
1785
1786     if [ "$ACME_VERSION" = "2" ]; then
1787       if [ "$url" = "$ACME_NEW_ACCOUNT" ] || [ "$url" = "$ACME_REVOKE_CERT" ]; then
1788         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
1789       else
1790         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"$ACCOUNT_URL\""'}'
1791       fi
1792     else
1793       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
1794     fi
1795     _debug3 protected "$protected"
1796
1797     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
1798     _debug3 protected64 "$protected64"
1799
1800     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
1801       _err "Sign request failed."
1802       return 1
1803     fi
1804     _debug3 _sig_t "$_sig_t"
1805
1806     sig="$(printf "%s" "$_sig_t" | _url_replace)"
1807     _debug3 sig "$sig"
1808
1809     if [ "$ACME_VERSION" = "2" ]; then
1810       body="{\"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1811     else
1812       body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1813     fi
1814     _debug3 body "$body"
1815
1816     response="$(_post "$body" "$url" "$needbase64")"
1817     _CACHED_NONCE=""
1818
1819     if [ "$?" != "0" ]; then
1820       _err "Can not post to $url"
1821       return 1
1822     fi
1823     _debug2 original "$response"
1824     response="$(echo "$response" | _normalizeJson)"
1825
1826     responseHeaders="$(cat "$HTTP_HEADER")"
1827
1828     _debug2 responseHeaders "$responseHeaders"
1829     _debug2 response "$response"
1830     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
1831     _debug code "$code"
1832
1833     _CACHED_NONCE="$(echo "$responseHeaders" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1834
1835     _body="$response"
1836     if [ "$needbase64" ]; then
1837       _body="$(echo "$_body" | _dbase64)"
1838       _debug2 _body "$_body"
1839     fi
1840
1841     if _contains "$_body" "JWS has invalid anti-replay nonce"; then
1842       _info "It seems the CA server is busy now, let's wait and retry."
1843       _request_retry_times=$(_math "$_request_retry_times" + 1)
1844       _sleep 5
1845       continue
1846     fi
1847     break
1848   done
1849
1850 }
1851
1852 #setopt "file"  "opt"  "="  "value" [";"]
1853 _setopt() {
1854   __conf="$1"
1855   __opt="$2"
1856   __sep="$3"
1857   __val="$4"
1858   __end="$5"
1859   if [ -z "$__opt" ]; then
1860     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
1861     return
1862   fi
1863   if [ ! -f "$__conf" ]; then
1864     touch "$__conf"
1865   fi
1866
1867   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
1868     _debug3 OK
1869     if _contains "$__val" "&"; then
1870       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1871     fi
1872     text="$(cat "$__conf")"
1873     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1874
1875   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
1876     if _contains "$__val" "&"; then
1877       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1878     fi
1879     text="$(cat "$__conf")"
1880     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1881
1882   else
1883     _debug3 APP
1884     echo "$__opt$__sep$__val$__end" >>"$__conf"
1885   fi
1886   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
1887 }
1888
1889 #_save_conf  file key  value
1890 #save to conf
1891 _save_conf() {
1892   _s_c_f="$1"
1893   _sdkey="$2"
1894   _sdvalue="$3"
1895   if [ "$_s_c_f" ]; then
1896     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
1897   else
1898     _err "config file is empty, can not save $_sdkey=$_sdvalue"
1899   fi
1900 }
1901
1902 #_clear_conf file  key
1903 _clear_conf() {
1904   _c_c_f="$1"
1905   _sdkey="$2"
1906   if [ "$_c_c_f" ]; then
1907     _conf_data="$(cat "$_c_c_f")"
1908     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
1909   else
1910     _err "config file is empty, can not clear"
1911   fi
1912 }
1913
1914 #_read_conf file  key
1915 _read_conf() {
1916   _r_c_f="$1"
1917   _sdkey="$2"
1918   if [ -f "$_r_c_f" ]; then
1919     (
1920       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
1921       eval "printf \"%s\" \"\$$_sdkey\""
1922     )
1923   else
1924     _debug "config file is empty, can not read $_sdkey"
1925   fi
1926 }
1927
1928 #_savedomainconf   key  value
1929 #save to domain.conf
1930 _savedomainconf() {
1931   _save_conf "$DOMAIN_CONF" "$1" "$2"
1932 }
1933
1934 #_cleardomainconf   key
1935 _cleardomainconf() {
1936   _clear_conf "$DOMAIN_CONF" "$1"
1937 }
1938
1939 #_readdomainconf   key
1940 _readdomainconf() {
1941   _read_conf "$DOMAIN_CONF" "$1"
1942 }
1943
1944 #_saveaccountconf  key  value
1945 _saveaccountconf() {
1946   _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
1947 }
1948
1949 #key  value
1950 _saveaccountconf_mutable() {
1951   _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2"
1952   #remove later
1953   _clearaccountconf "$1"
1954 }
1955
1956 #key
1957 _readaccountconf() {
1958   _read_conf "$ACCOUNT_CONF_PATH" "$1"
1959 }
1960
1961 #key
1962 _readaccountconf_mutable() {
1963   _rac_key="$1"
1964   _readaccountconf "SAVED_$_rac_key"
1965 }
1966
1967 #_clearaccountconf   key
1968 _clearaccountconf() {
1969   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
1970 }
1971
1972 #_savecaconf  key  value
1973 _savecaconf() {
1974   _save_conf "$CA_CONF" "$1" "$2"
1975 }
1976
1977 #_readcaconf   key
1978 _readcaconf() {
1979   _read_conf "$CA_CONF" "$1"
1980 }
1981
1982 #_clearaccountconf   key
1983 _clearcaconf() {
1984   _clear_conf "$CA_CONF" "$1"
1985 }
1986
1987 # content localaddress
1988 _startserver() {
1989   content="$1"
1990   ncaddr="$2"
1991   _debug "ncaddr" "$ncaddr"
1992
1993   _debug "startserver: $$"
1994
1995   _debug Le_HTTPPort "$Le_HTTPPort"
1996   _debug Le_Listen_V4 "$Le_Listen_V4"
1997   _debug Le_Listen_V6 "$Le_Listen_V6"
1998
1999   _NC="socat"
2000   if [ "$Le_Listen_V4" ]; then
2001     _NC="$_NC -4"
2002   elif [ "$Le_Listen_V6" ]; then
2003     _NC="$_NC -6"
2004   fi
2005
2006   _debug "_NC" "$_NC"
2007   #todo  listen address
2008   $_NC TCP-LISTEN:$Le_HTTPPort,crlf,reuseaddr,fork SYSTEM:"sleep 0.5; echo HTTP/1.1 200 OK; echo ; echo  $content; echo;" &
2009   serverproc="$!"
2010 }
2011
2012 _stopserver() {
2013   pid="$1"
2014   _debug "pid" "$pid"
2015   if [ -z "$pid" ]; then
2016     return
2017   fi
2018
2019   kill $pid
2020
2021 }
2022
2023 # sleep sec
2024 _sleep() {
2025   _sleep_sec="$1"
2026   if [ "$__INTERACTIVE" ]; then
2027     _sleep_c="$_sleep_sec"
2028     while [ "$_sleep_c" -ge "0" ]; do
2029       printf "\r      \r"
2030       __green "$_sleep_c"
2031       _sleep_c="$(_math "$_sleep_c" - 1)"
2032       sleep 1
2033     done
2034     printf "\r"
2035   else
2036     sleep "$_sleep_sec"
2037   fi
2038 }
2039
2040 # _starttlsserver  san_a  san_b port content _ncaddr
2041 _starttlsserver() {
2042   _info "Starting tls server."
2043   san_a="$1"
2044   san_b="$2"
2045   port="$3"
2046   content="$4"
2047   opaddr="$5"
2048
2049   _debug san_a "$san_a"
2050   _debug san_b "$san_b"
2051   _debug port "$port"
2052
2053   #create key TLS_KEY
2054   if ! _createkey "2048" "$TLS_KEY"; then
2055     _err "Create tls validation key error."
2056     return 1
2057   fi
2058
2059   #create csr
2060   alt="$san_a"
2061   if [ "$san_b" ]; then
2062     alt="$alt,$san_b"
2063   fi
2064   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF"; then
2065     _err "Create tls validation csr error."
2066     return 1
2067   fi
2068
2069   #self signed
2070   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2071     _err "Create tls validation cert error."
2072     return 1
2073   fi
2074
2075   __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -www -cert $TLS_CERT  -key $TLS_KEY "
2076   if [ "$opaddr" ]; then
2077     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2078   else
2079     __S_OPENSSL="$__S_OPENSSL -accept $port"
2080   fi
2081
2082   _debug Le_Listen_V4 "$Le_Listen_V4"
2083   _debug Le_Listen_V6 "$Le_Listen_V6"
2084   if [ "$Le_Listen_V4" ]; then
2085     __S_OPENSSL="$__S_OPENSSL -4"
2086   elif [ "$Le_Listen_V6" ]; then
2087     __S_OPENSSL="$__S_OPENSSL -6"
2088   fi
2089
2090   _debug "$__S_OPENSSL"
2091   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2092     $__S_OPENSSL -tlsextdebug &
2093   else
2094     $__S_OPENSSL >/dev/null 2>&1 &
2095   fi
2096
2097   serverproc="$!"
2098   sleep 1
2099   _debug serverproc "$serverproc"
2100 }
2101
2102 #file
2103 _readlink() {
2104   _rf="$1"
2105   if ! readlink -f "$_rf" 2>/dev/null; then
2106     if _startswith "$_rf" "/"; then
2107       echo "$_rf"
2108       return 0
2109     fi
2110     echo "$(pwd)/$_rf" | _conapath
2111   fi
2112 }
2113
2114 _conapath() {
2115   sed "s#/\./#/#g"
2116 }
2117
2118 __initHome() {
2119   if [ -z "$_SCRIPT_HOME" ]; then
2120     if _exists readlink && _exists dirname; then
2121       _debug "Lets find script dir."
2122       _debug "_SCRIPT_" "$_SCRIPT_"
2123       _script="$(_readlink "$_SCRIPT_")"
2124       _debug "_script" "$_script"
2125       _script_home="$(dirname "$_script")"
2126       _debug "_script_home" "$_script_home"
2127       if [ -d "$_script_home" ]; then
2128         _SCRIPT_HOME="$_script_home"
2129       else
2130         _err "It seems the script home is not correct:$_script_home"
2131       fi
2132     fi
2133   fi
2134
2135   #  if [ -z "$LE_WORKING_DIR" ]; then
2136   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2137   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2138   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2139   #    else
2140   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2141   #    fi
2142   #  fi
2143
2144   if [ -z "$LE_WORKING_DIR" ]; then
2145     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2146     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2147   fi
2148   export LE_WORKING_DIR
2149
2150   if [ -z "$LE_CONFIG_HOME" ]; then
2151     LE_CONFIG_HOME="$LE_WORKING_DIR"
2152   fi
2153   _debug "Using config home:$LE_CONFIG_HOME"
2154   export LE_CONFIG_HOME
2155
2156   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2157
2158   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2159     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2160       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2161     fi
2162   fi
2163
2164   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2165     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2166   fi
2167
2168   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2169
2170   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2171
2172   if [ -z "$LE_TEMP_DIR" ]; then
2173     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2174   fi
2175 }
2176
2177 #server
2178 _initAPI() {
2179   _api_server="${1:-$ACME_DIRECTORY}"
2180   _debug "_init api for server: $_api_server"
2181
2182   if [ -z "$ACME_NEW_ACCOUNT" ]; then
2183     response=$(_get "$_api_server")
2184     if [ "$?" != "0" ]; then
2185       _debug2 "response" "$response"
2186       _err "Can not init api."
2187       return 1
2188     fi
2189     _debug2 "response" "$response"
2190
2191     ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
2192     if [ -z "$ACME_KEY_CHANGE" ]; then
2193       ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
2194     fi
2195     export ACME_KEY_CHANGE
2196
2197     ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
2198     if [ -z "$ACME_NEW_AUTHZ" ]; then
2199       ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
2200     fi
2201     export ACME_NEW_AUTHZ
2202
2203     ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2204     ACME_NEW_ORDER_RES="new-cert"
2205     if [ -z "$ACME_NEW_ORDER" ]; then
2206       ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
2207       ACME_NEW_ORDER_RES="new-order"
2208       if [ -z "$ACME_NEW_ORDER" ]; then
2209         ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
2210       fi
2211     fi
2212     export ACME_NEW_ORDER
2213     export ACME_NEW_ORDER_RES
2214
2215     ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
2216     ACME_NEW_ACCOUNT_RES="new-reg"
2217     if [ -z "$ACME_NEW_ACCOUNT" ]; then
2218       ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
2219       ACME_NEW_ACCOUNT_RES="new-account"
2220       if [ -z "$ACME_NEW_ACCOUNT" ]; then
2221         ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
2222         if [ "$ACME_NEW_ACCOUNT" ]; then
2223           export ACME_VERSION=2
2224         fi
2225       fi
2226     fi
2227     export ACME_NEW_ACCOUNT
2228     export ACME_NEW_ACCOUNT_RES
2229
2230     ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
2231     if [ -z "$ACME_REVOKE_CERT" ]; then
2232       ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
2233     fi
2234     export ACME_REVOKE_CERT
2235
2236     ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
2237     if [ -z "$ACME_NEW_NONCE" ]; then
2238       ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
2239     fi
2240     export ACME_NEW_NONCE
2241
2242     ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
2243     if [ -z "$ACME_AGREEMENT" ]; then
2244       ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
2245     fi
2246     export ACME_AGREEMENT
2247
2248     _debug "ACME_KEY_CHANGE" "$ACME_KEY_CHANGE"
2249     _debug "ACME_NEW_AUTHZ" "$ACME_NEW_AUTHZ"
2250     _debug "ACME_NEW_ORDER" "$ACME_NEW_ORDER"
2251     _debug "ACME_NEW_ACCOUNT" "$ACME_NEW_ACCOUNT"
2252     _debug "ACME_REVOKE_CERT" "$ACME_REVOKE_CERT"
2253     _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
2254     _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
2255     _debug "ACME_VERSION" "$ACME_VERSION"
2256
2257   fi
2258 }
2259
2260 #[domain]  [keylength or isEcc flag]
2261 _initpath() {
2262
2263   __initHome
2264
2265   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2266     . "$ACCOUNT_CONF_PATH"
2267   fi
2268
2269   if [ "$IN_CRON" ]; then
2270     if [ ! "$_USER_PATH_EXPORTED" ]; then
2271       _USER_PATH_EXPORTED=1
2272       export PATH="$USER_PATH:$PATH"
2273     fi
2274   fi
2275
2276   if [ -z "$CA_HOME" ]; then
2277     CA_HOME="$DEFAULT_CA_HOME"
2278   fi
2279
2280   if [ "$ACME_VERSION" = "2" ]; then
2281     DEFAULT_CA="$LETSENCRYPT_CA_V2"
2282     DEFAULT_STAGING_CA="$LETSENCRYPT_STAGING_CA_V2"
2283   fi
2284
2285   if [ -z "$ACME_DIRECTORY" ]; then
2286     if [ -z "$STAGE" ]; then
2287       ACME_DIRECTORY="$DEFAULT_CA"
2288     else
2289       ACME_DIRECTORY="$DEFAULT_STAGING_CA"
2290       _info "Using stage ACME_DIRECTORY: $ACME_DIRECTORY"
2291     fi
2292   fi
2293
2294   _debug2 ACME_DIRECTORY "$ACME_DIRECTORY"
2295   _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
2296   _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
2297
2298   CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
2299
2300   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2301
2302   if [ -z "$CA_CONF" ]; then
2303     CA_CONF="$_DEFAULT_CA_CONF"
2304   fi
2305   _debug3 CA_CONF "$CA_CONF"
2306
2307   if [ -f "$CA_CONF" ]; then
2308     . "$CA_CONF"
2309   fi
2310
2311   if [ -z "$ACME_DIR" ]; then
2312     ACME_DIR="/home/.acme"
2313   fi
2314
2315   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2316     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2317   fi
2318
2319   if [ -z "$USER_AGENT" ]; then
2320     USER_AGENT="$DEFAULT_USER_AGENT"
2321   fi
2322
2323   if [ -z "$HTTP_HEADER" ]; then
2324     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2325   fi
2326
2327   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2328   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2329
2330   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2331   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2332   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2333     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2334   fi
2335
2336   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2337     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2338   fi
2339
2340   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2341   if [ -z "$CERT_HOME" ]; then
2342     CERT_HOME="$_DEFAULT_CERT_HOME"
2343   fi
2344
2345   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2346     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2347   fi
2348
2349   if [ -z "$1" ]; then
2350     return 0
2351   fi
2352
2353   domain="$1"
2354   _ilength="$2"
2355
2356   if [ -z "$DOMAIN_PATH" ]; then
2357     domainhome="$CERT_HOME/$domain"
2358     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2359
2360     DOMAIN_PATH="$domainhome"
2361
2362     if _isEccKey "$_ilength"; then
2363       DOMAIN_PATH="$domainhomeecc"
2364     else
2365       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2366         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2367       fi
2368     fi
2369     _debug DOMAIN_PATH "$DOMAIN_PATH"
2370   fi
2371
2372   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2373     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2374   fi
2375
2376   if [ -z "$DOMAIN_CONF" ]; then
2377     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2378   fi
2379
2380   if [ -z "$DOMAIN_SSL_CONF" ]; then
2381     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2382   fi
2383
2384   if [ -z "$CSR_PATH" ]; then
2385     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2386   fi
2387   if [ -z "$CERT_KEY_PATH" ]; then
2388     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2389   fi
2390   if [ -z "$CERT_PATH" ]; then
2391     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2392   fi
2393   if [ -z "$CA_CERT_PATH" ]; then
2394     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2395   fi
2396   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2397     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2398   fi
2399   if [ -z "$CERT_PFX_PATH" ]; then
2400     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2401   fi
2402   if [ -z "$CERT_PKCS8_PATH" ]; then
2403     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2404   fi
2405
2406   if [ -z "$TLS_CONF" ]; then
2407     TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
2408   fi
2409   if [ -z "$TLS_CERT" ]; then
2410     TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
2411   fi
2412   if [ -z "$TLS_KEY" ]; then
2413     TLS_KEY="$DOMAIN_PATH/tls.validation.key"
2414   fi
2415   if [ -z "$TLS_CSR" ]; then
2416     TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
2417   fi
2418
2419 }
2420
2421 _exec() {
2422   if [ -z "$_EXEC_TEMP_ERR" ]; then
2423     _EXEC_TEMP_ERR="$(_mktemp)"
2424   fi
2425
2426   if [ "$_EXEC_TEMP_ERR" ]; then
2427     eval "$@ 2>>$_EXEC_TEMP_ERR"
2428   else
2429     eval "$@"
2430   fi
2431 }
2432
2433 _exec_err() {
2434   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2435 }
2436
2437 _apachePath() {
2438   _APACHECTL="apachectl"
2439   if ! _exists apachectl; then
2440     if _exists apache2ctl; then
2441       _APACHECTL="apache2ctl"
2442     else
2443       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2444       _err "Please use webroot mode to try again."
2445       return 1
2446     fi
2447   fi
2448
2449   if ! _exec $_APACHECTL -V >/dev/null; then
2450     _exec_err
2451     return 1
2452   fi
2453
2454   if [ "$APACHE_HTTPD_CONF" ]; then
2455     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2456     httpdconf="$APACHE_HTTPD_CONF"
2457     httpdconfname="$(basename "$httpdconfname")"
2458   else
2459     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2460     _debug httpdconfname "$httpdconfname"
2461
2462     if [ -z "$httpdconfname" ]; then
2463       _err "Can not read apache config file."
2464       return 1
2465     fi
2466
2467     if _startswith "$httpdconfname" '/'; then
2468       httpdconf="$httpdconfname"
2469       httpdconfname="$(basename "$httpdconfname")"
2470     else
2471       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2472       _debug httpdroot "$httpdroot"
2473       httpdconf="$httpdroot/$httpdconfname"
2474       httpdconfname="$(basename "$httpdconfname")"
2475     fi
2476   fi
2477   _debug httpdconf "$httpdconf"
2478   _debug httpdconfname "$httpdconfname"
2479   if [ ! -f "$httpdconf" ]; then
2480     _err "Apache Config file not found" "$httpdconf"
2481     return 1
2482   fi
2483   return 0
2484 }
2485
2486 _restoreApache() {
2487   if [ -z "$usingApache" ]; then
2488     return 0
2489   fi
2490   _initpath
2491   if ! _apachePath; then
2492     return 1
2493   fi
2494
2495   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2496     _debug "No config file to restore."
2497     return 0
2498   fi
2499
2500   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2501   _debug "Restored: $httpdconf."
2502   if ! _exec $_APACHECTL -t; then
2503     _exec_err
2504     _err "Sorry, restore apache config error, please contact me."
2505     return 1
2506   fi
2507   _debug "Restored successfully."
2508   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2509   return 0
2510 }
2511
2512 _setApache() {
2513   _initpath
2514   if ! _apachePath; then
2515     return 1
2516   fi
2517
2518   #test the conf first
2519   _info "Checking if there is an error in the apache config file before starting."
2520
2521   if ! _exec "$_APACHECTL" -t >/dev/null; then
2522     _exec_err
2523     _err "The apache config file has error, please fix it first, then try again."
2524     _err "Don't worry, there is nothing changed to your system."
2525     return 1
2526   else
2527     _info "OK"
2528   fi
2529
2530   #backup the conf
2531   _debug "Backup apache config file" "$httpdconf"
2532   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2533     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2534     _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
2535     return 1
2536   fi
2537   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2538   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2539   _info "The backup file will be deleted on success, just forget it."
2540
2541   #add alias
2542
2543   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2544   _debug "apacheVer" "$apacheVer"
2545   apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
2546   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2547
2548   if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
2549     echo "
2550 Alias /.well-known/acme-challenge  $ACME_DIR
2551
2552 <Directory $ACME_DIR >
2553 Require all granted
2554 </Directory>
2555   " >>"$httpdconf"
2556   else
2557     echo "
2558 Alias /.well-known/acme-challenge  $ACME_DIR
2559
2560 <Directory $ACME_DIR >
2561 Order allow,deny
2562 Allow from all
2563 </Directory>
2564   " >>"$httpdconf"
2565   fi
2566
2567   _msg="$($_APACHECTL -t 2>&1)"
2568   if [ "$?" != "0" ]; then
2569     _err "Sorry, apache config error"
2570     if _restoreApache; then
2571       _err "The apache config file is restored."
2572     else
2573       _err "Sorry, The apache config file can not be restored, please report bug."
2574     fi
2575     return 1
2576   fi
2577
2578   if [ ! -d "$ACME_DIR" ]; then
2579     mkdir -p "$ACME_DIR"
2580     chmod 755 "$ACME_DIR"
2581   fi
2582
2583   if ! _exec "$_APACHECTL" graceful; then
2584     _exec_err
2585     _err "$_APACHECTL  graceful error, please contact me."
2586     _restoreApache
2587     return 1
2588   fi
2589   usingApache="1"
2590   return 0
2591 }
2592
2593 #find the real nginx conf file
2594 #backup
2595 #set the nginx conf
2596 #returns the real nginx conf file
2597 _setNginx() {
2598   _d="$1"
2599   _croot="$2"
2600   _thumbpt="$3"
2601   if ! _exists "nginx"; then
2602     _err "nginx command is not found."
2603     return 1
2604   fi
2605   FOUND_REAL_NGINX_CONF=""
2606   FOUND_REAL_NGINX_CONF_LN=""
2607   BACKUP_NGINX_CONF=""
2608   _debug _croot "$_croot"
2609   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2610   _debug _start_f "$_start_f"
2611   if [ -z "$_start_f" ]; then
2612     _debug "find start conf from nginx command"
2613     if [ -z "$NGINX_CONF" ]; then
2614       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2615       _debug NGINX_CONF "$NGINX_CONF"
2616       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2617       _debug NGINX_CONF "$NGINX_CONF"
2618       if [ ! -f "$NGINX_CONF" ]; then
2619         _err "'$NGINX_CONF' doesn't exist."
2620         NGINX_CONF=""
2621         return 1
2622       fi
2623       _debug "Found nginx conf file:$NGINX_CONF"
2624     fi
2625     _start_f="$NGINX_CONF"
2626   fi
2627   _debug "Start detect nginx conf for $_d from:$_start_f"
2628   if ! _checkConf "$_d" "$_start_f"; then
2629     _err "Can not find conf file for domain $d"
2630     return 1
2631   fi
2632   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2633
2634   _ln=$FOUND_REAL_NGINX_CONF_LN
2635   _debug "_ln" "$_ln"
2636
2637   _lnn=$(_math $_ln + 1)
2638   _debug _lnn "$_lnn"
2639   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2640   _debug "_start_tag" "$_start_tag"
2641   if [ "$_start_tag" = "$NGINX_START" ]; then
2642     _info "The domain $_d is already configured, skip"
2643     FOUND_REAL_NGINX_CONF=""
2644     return 0
2645   fi
2646
2647   mkdir -p "$DOMAIN_BACKUP_PATH"
2648   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2649   _debug _backup_conf "$_backup_conf"
2650   BACKUP_NGINX_CONF="$_backup_conf"
2651   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2652   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2653     _err "backup error."
2654     FOUND_REAL_NGINX_CONF=""
2655     return 1
2656   fi
2657
2658   _info "Check the nginx conf before setting up."
2659   if ! _exec "nginx -t" >/dev/null; then
2660     _exec_err
2661     return 1
2662   fi
2663
2664   _info "OK, Set up nginx config file"
2665
2666   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2667     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2668     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2669     return 1
2670   fi
2671
2672   echo "$NGINX_START
2673 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
2674   default_type text/plain;
2675   return 200 \"\$1.$_thumbpt\";
2676 }
2677 #NGINX_START
2678 " >>"$FOUND_REAL_NGINX_CONF"
2679
2680   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
2681     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2682     _err "write nginx conf error, but don't worry, the file is restored."
2683     return 1
2684   fi
2685   _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
2686   _info "nginx conf is done, let's check it again."
2687   if ! _exec "nginx -t" >/dev/null; then
2688     _exec_err
2689     _err "It seems that nginx conf was broken, let's restore."
2690     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2691     return 1
2692   fi
2693
2694   _info "Reload nginx"
2695   if ! _exec "nginx -s reload" >/dev/null; then
2696     _exec_err
2697     _err "It seems that nginx reload error, let's restore."
2698     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2699     return 1
2700   fi
2701
2702   return 0
2703 }
2704
2705 #d , conf
2706 _checkConf() {
2707   _d="$1"
2708   _c_file="$2"
2709   _debug "Start _checkConf from:$_c_file"
2710   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
2711     _debug "wildcard"
2712     for _w_f in $2; do
2713       if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
2714         return 0
2715       fi
2716     done
2717     #not found
2718     return 1
2719   elif [ -f "$2" ]; then
2720     _debug "single"
2721     if _isRealNginxConf "$1" "$2"; then
2722       _debug "$2 is found."
2723       FOUND_REAL_NGINX_CONF="$2"
2724       return 0
2725     fi
2726     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
2727       _debug "Try include files"
2728       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
2729         _debug "check included $included"
2730         if _checkConf "$1" "$included"; then
2731           return 0
2732         fi
2733       done
2734     fi
2735     return 1
2736   else
2737     _debug "$2 not found."
2738     return 1
2739   fi
2740   return 1
2741 }
2742
2743 #d , conf
2744 _isRealNginxConf() {
2745   _debug "_isRealNginxConf $1 $2"
2746   if [ -f "$2" ]; then
2747     for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
2748       _debug _fln "$_fln"
2749       if [ "$_fln" ]; then
2750         _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *{" | _tail_n 1)
2751         _debug "_start" "$_start"
2752         _start_n=$(echo "$_start" | cut -d : -f 1)
2753         _start_nn=$(_math $_start_n + 1)
2754         _debug "_start_n" "$_start_n"
2755         _debug "_start_nn" "$_start_nn"
2756
2757         _left="$(sed -n "${_start_nn},99999p" "$2")"
2758         _debug2 _left "$_left"
2759         if echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" >/dev/null; then
2760           _end=$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" | _head_n 1)
2761           _debug "_end" "$_end"
2762           _end_n=$(echo "$_end" | cut -d : -f 1)
2763           _debug "_end_n" "$_end_n"
2764           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
2765         else
2766           _seg_n="$_left"
2767         fi
2768
2769         _debug "_seg_n" "$_seg_n"
2770
2771         if [ "$(echo "$_seg_n" | _egrep_o "^ *ssl  *on *;")" ] \
2772           || [ "$(echo "$_seg_n" | _egrep_o "listen .* ssl[ |;]")" ]; then
2773           _debug "ssl on, skip"
2774         else
2775           FOUND_REAL_NGINX_CONF_LN=$_fln
2776           _debug3 "found FOUND_REAL_NGINX_CONF_LN" "$FOUND_REAL_NGINX_CONF_LN"
2777           return 0
2778         fi
2779       fi
2780     done
2781   fi
2782   return 1
2783 }
2784
2785 #restore all the nginx conf
2786 _restoreNginx() {
2787   if [ -z "$NGINX_RESTORE_VLIST" ]; then
2788     _debug "No need to restore nginx, skip."
2789     return
2790   fi
2791   _debug "_restoreNginx"
2792   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
2793
2794   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
2795     _debug "ng_entry" "$ng_entry"
2796     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
2797     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
2798     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
2799     _info "Restoring from $_ngbackupconf to $_ngconf"
2800     cat "$_ngbackupconf" >"$_ngconf"
2801   done
2802
2803   _info "Reload nginx"
2804   if ! _exec "nginx -s reload" >/dev/null; then
2805     _exec_err
2806     _err "It seems that nginx reload error, please report bug."
2807     return 1
2808   fi
2809   return 0
2810 }
2811
2812 _clearup() {
2813   _stopserver "$serverproc"
2814   serverproc=""
2815   _restoreApache
2816   _restoreNginx
2817   _clearupdns
2818   if [ -z "$DEBUG" ]; then
2819     rm -f "$TLS_CONF"
2820     rm -f "$TLS_CERT"
2821     rm -f "$TLS_KEY"
2822     rm -f "$TLS_CSR"
2823   fi
2824 }
2825
2826 _clearupdns() {
2827   _debug "_clearupdns"
2828   if [ "$dnsadded" != 1 ] || [ -z "$vlist" ]; then
2829     _debug "skip dns."
2830     return
2831   fi
2832
2833   ventries=$(echo "$vlist" | tr ',' ' ')
2834   for ventry in $ventries; do
2835     d=$(echo "$ventry" | cut -d "$sep" -f 1)
2836     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2837     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2838     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2839     txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
2840     _debug txt "$txt"
2841     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
2842       _debug "$d is already verified, skip $vtype."
2843       continue
2844     fi
2845
2846     if [ "$vtype" != "$VTYPE_DNS" ]; then
2847       _info "Skip $d for $vtype"
2848       continue
2849     fi
2850
2851     d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
2852     _debug d_api "$d_api"
2853
2854     if [ -z "$d_api" ]; then
2855       _info "Not Found domain api file: $d_api"
2856       continue
2857     fi
2858
2859     (
2860       if ! . "$d_api"; then
2861         _err "Load file $d_api error. Please check your api file and try again."
2862         return 1
2863       fi
2864
2865       rmcommand="${_currentRoot}_rm"
2866       if ! _exists "$rmcommand"; then
2867         _err "It seems that your api file doesn't define $rmcommand"
2868         return 1
2869       fi
2870
2871       _dns_root_d="$d"
2872       if _startswith "$_dns_root_d" "*."; then
2873         _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
2874       fi
2875       txtdomain="_acme-challenge.$_dns_root_d"
2876
2877       if ! $rmcommand "$txtdomain" "$txt"; then
2878         _err "Error removing txt for domain:$txtdomain"
2879         return 1
2880       fi
2881     )
2882
2883   done
2884 }
2885
2886 # webroot  removelevel tokenfile
2887 _clearupwebbroot() {
2888   __webroot="$1"
2889   if [ -z "$__webroot" ]; then
2890     _debug "no webroot specified, skip"
2891     return 0
2892   fi
2893
2894   _rmpath=""
2895   if [ "$2" = '1' ]; then
2896     _rmpath="$__webroot/.well-known"
2897   elif [ "$2" = '2' ]; then
2898     _rmpath="$__webroot/.well-known/acme-challenge"
2899   elif [ "$2" = '3' ]; then
2900     _rmpath="$__webroot/.well-known/acme-challenge/$3"
2901   else
2902     _debug "Skip for removelevel:$2"
2903   fi
2904
2905   if [ "$_rmpath" ]; then
2906     if [ "$DEBUG" ]; then
2907       _debug "Debugging, skip removing: $_rmpath"
2908     else
2909       rm -rf "$_rmpath"
2910     fi
2911   fi
2912
2913   return 0
2914
2915 }
2916
2917 _on_before_issue() {
2918   _chk_web_roots="$1"
2919   _chk_main_domain="$2"
2920   _chk_alt_domains="$3"
2921   _chk_pre_hook="$4"
2922   _chk_local_addr="$5"
2923   _debug _on_before_issue
2924   #run pre hook
2925   if [ "$_chk_pre_hook" ]; then
2926     _info "Run pre hook:'$_chk_pre_hook'"
2927     if ! (
2928       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
2929     ); then
2930       _err "Error when run pre hook."
2931       return 1
2932     fi
2933   fi
2934
2935   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
2936     if ! _exists "socat"; then
2937       _err "Please install socat tools first."
2938       return 1
2939     fi
2940   fi
2941
2942   _debug Le_LocalAddress "$_chk_local_addr"
2943
2944   alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
2945   _index=1
2946   _currentRoot=""
2947   _addrIndex=1
2948   for d in $alldomains; do
2949     _debug "Check for domain" "$d"
2950     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
2951     _debug "_currentRoot" "$_currentRoot"
2952     _index=$(_math $_index + 1)
2953     _checkport=""
2954     if [ "$_currentRoot" = "$NO_VALUE" ]; then
2955       _info "Standalone mode."
2956       if [ -z "$Le_HTTPPort" ]; then
2957         Le_HTTPPort=80
2958       else
2959         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
2960       fi
2961       _checkport="$Le_HTTPPort"
2962     elif [ "$_currentRoot" = "$W_TLS" ]; then
2963       _info "Standalone tls mode."
2964       if [ -z "$Le_TLSPort" ]; then
2965         Le_TLSPort=443
2966       else
2967         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
2968       fi
2969       _checkport="$Le_TLSPort"
2970     fi
2971
2972     if [ "$_checkport" ]; then
2973       _debug _checkport "$_checkport"
2974       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
2975       _debug _checkaddr "$_checkaddr"
2976
2977       _addrIndex="$(_math $_addrIndex + 1)"
2978
2979       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
2980       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
2981       if [ -z "$netprc" ]; then
2982         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
2983       fi
2984       if [ "$netprc" ]; then
2985         _err "$netprc"
2986         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
2987         _err "Please stop it first"
2988         return 1
2989       fi
2990     fi
2991   done
2992
2993   if _hasfield "$_chk_web_roots" "apache"; then
2994     if ! _setApache; then
2995       _err "set up apache error. Report error to me."
2996       return 1
2997     fi
2998   else
2999     usingApache=""
3000   fi
3001
3002 }
3003
3004 _on_issue_err() {
3005   _chk_post_hook="$1"
3006   _chk_vlist="$2"
3007   _debug _on_issue_err
3008
3009   if [ "$LOG_FILE" ]; then
3010     _err "Please check log file for more details: $LOG_FILE"
3011   else
3012     _err "Please add '--debug' or '--log' to check more details."
3013     _err "See: $_DEBUG_WIKI"
3014   fi
3015
3016   #run the post hook
3017   if [ "$_chk_post_hook" ]; then
3018     _info "Run post hook:'$_chk_post_hook'"
3019     if ! (
3020       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3021     ); then
3022       _err "Error when run post hook."
3023       return 1
3024     fi
3025   fi
3026
3027   #trigger the validation to flush the pending authz
3028   _debug2 "_chk_vlist" "$_chk_vlist"
3029   if [ "$_chk_vlist" ]; then
3030     (
3031       _debug2 "start to deactivate authz"
3032       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
3033       for ventry in $ventries; do
3034         d=$(echo "$ventry" | cut -d "$sep" -f 1)
3035         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3036         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3037         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3038         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3039         __trigger_validation "$uri" "$keyauthorization"
3040       done
3041     )
3042   fi
3043
3044   if [ "$IS_RENEW" = "1" ] && _hasfield "$Le_Webroot" "dns"; then
3045     _err "$_DNS_MANUAL_ERR"
3046   fi
3047
3048   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
3049     _debug "$(_dlg_versions)"
3050   fi
3051
3052 }
3053
3054 _on_issue_success() {
3055   _chk_post_hook="$1"
3056   _chk_renew_hook="$2"
3057   _debug _on_issue_success
3058   #run the post hook
3059   if [ "$_chk_post_hook" ]; then
3060     _info "Run post hook:'$_chk_post_hook'"
3061     if ! (
3062       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
3063     ); then
3064       _err "Error when run post hook."
3065       return 1
3066     fi
3067   fi
3068
3069   #run renew hook
3070   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
3071     _info "Run renew hook:'$_chk_renew_hook'"
3072     if ! (
3073       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
3074     ); then
3075       _err "Error when run renew hook."
3076       return 1
3077     fi
3078   fi
3079
3080   if _hasfield "$Le_Webroot" "dns"; then
3081     _err "$_DNS_MANUAL_WARN"
3082   fi
3083
3084 }
3085
3086 updateaccount() {
3087   _initpath
3088   _regAccount
3089 }
3090
3091 registeraccount() {
3092   _reg_length="$1"
3093   _initpath
3094   _regAccount "$_reg_length"
3095 }
3096
3097 __calcAccountKeyHash() {
3098   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
3099 }
3100
3101 __calc_account_thumbprint() {
3102   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
3103 }
3104
3105 #keylength
3106 _regAccount() {
3107   _initpath
3108   _reg_length="$1"
3109   _debug3 _regAccount "$_regAccount"
3110   _initAPI
3111
3112   mkdir -p "$CA_DIR"
3113   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3114     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3115     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3116   fi
3117
3118   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3119     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3120     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3121   fi
3122
3123   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3124     if ! _create_account_key "$_reg_length"; then
3125       _err "Create account key error."
3126       return 1
3127     fi
3128   fi
3129
3130   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3131     return 1
3132   fi
3133
3134   if [ "$ACME_VERSION" = "2" ]; then
3135     regjson='{"termsOfServiceAgreed": true}'
3136     if [ "$ACCOUNT_EMAIL" ]; then
3137       regjson='{"contact": ["mailto: '$ACCOUNT_EMAIL'"], "termsOfServiceAgreed": true}'
3138     fi
3139   else
3140     _reg_res="$ACME_NEW_ACCOUNT_RES"
3141     regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
3142     if [ "$ACCOUNT_EMAIL" ]; then
3143       regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
3144     fi
3145   fi
3146
3147   _info "Registering account"
3148
3149   if ! _send_signed_request "${ACME_NEW_ACCOUNT}" "$regjson"; then
3150     _err "Register account Error: $response"
3151     return 1
3152   fi
3153
3154   if [ "$code" = "" ] || [ "$code" = '201' ]; then
3155     echo "$response" >"$ACCOUNT_JSON_PATH"
3156     _info "Registered"
3157   elif [ "$code" = '409' ]; then
3158     _info "Already registered"
3159   else
3160     _err "Register account Error: $response"
3161     return 1
3162   fi
3163
3164   _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
3165   _debug "_accUri" "$_accUri"
3166   _savecaconf "ACCOUNT_URL" "$_accUri"
3167   export ACCOUNT_URL="$ACCOUNT_URL"
3168
3169   CA_KEY_HASH="$(__calcAccountKeyHash)"
3170   _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3171   _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3172
3173   if [ "$code" = '403' ]; then
3174     _err "It seems that the account key is already deactivated, please use a new account key."
3175     return 1
3176   fi
3177
3178   ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3179   _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3180 }
3181
3182 #Implement deactivate account
3183 deactivateaccount() {
3184   _initpath
3185
3186   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
3187     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
3188     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
3189   fi
3190
3191   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
3192     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
3193     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
3194   fi
3195
3196   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3197     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
3198     return 1
3199   fi
3200
3201   _accUri=$(_readcaconf "ACCOUNT_URL")
3202   _debug _accUri "$_accUri"
3203
3204   if [ -z "$_accUri" ]; then
3205     _err "The account url is empty, please run '--update-account' first to update the account info first,"
3206     _err "Then try again."
3207     return 1
3208   fi
3209
3210   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3211     return 1
3212   fi
3213   _initAPI
3214
3215   if [ "$ACME_VERSION" = "2" ]; then
3216     _djson="{\"status\":\"deactivated\"}"
3217   else
3218     _djson="{\"resource\": \"reg\", \"status\":\"deactivated\"}"
3219   fi
3220   if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
3221     _info "Deactivate account success for $_accUri."
3222     _accid=$(echo "$response" | _egrep_o "\"id\" *: *[^,]*," | cut -d : -f 2 | tr -d ' ,')
3223   elif [ "$code" = "403" ]; then
3224     _info "The account is already deactivated."
3225     _accid=$(_getfield "$_accUri" "999" "/")
3226   else
3227     _err "Deactivate: account failed for $_accUri."
3228     return 1
3229   fi
3230
3231   _debug "Account id: $_accid"
3232   if [ "$_accid" ]; then
3233     _deactivated_account_path="$CA_DIR/deactivated/$_accid"
3234     _debug _deactivated_account_path "$_deactivated_account_path"
3235     if mkdir -p "$_deactivated_account_path"; then
3236       _info "Moving deactivated account info to $_deactivated_account_path/"
3237       mv "$CA_CONF" "$_deactivated_account_path/"
3238       mv "$ACCOUNT_JSON_PATH" "$_deactivated_account_path/"
3239       mv "$ACCOUNT_KEY_PATH" "$_deactivated_account_path/"
3240     else
3241       _err "Can not create dir: $_deactivated_account_path, try to remove the deactivated account key."
3242       rm -f "$CA_CONF"
3243       rm -f "$ACCOUNT_JSON_PATH"
3244       rm -f "$ACCOUNT_KEY_PATH"
3245     fi
3246   fi
3247 }
3248
3249 # domain folder  file
3250 _findHook() {
3251   _hookdomain="$1"
3252   _hookcat="$2"
3253   _hookname="$3"
3254
3255   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3256     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3257   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3258     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3259   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3260     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3261   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3262     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3263   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3264     d_api="$LE_WORKING_DIR/$_hookname"
3265   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3266     d_api="$LE_WORKING_DIR/$_hookname.sh"
3267   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3268     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3269   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3270     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3271   fi
3272
3273   printf "%s" "$d_api"
3274 }
3275
3276 #domain
3277 __get_domain_new_authz() {
3278   _gdnd="$1"
3279   _info "Getting new-authz for domain" "$_gdnd"
3280   _initAPI
3281   _Max_new_authz_retry_times=5
3282   _authz_i=0
3283   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3284     _debug "Try new-authz for the $_authz_i time."
3285     if ! _send_signed_request "${ACME_NEW_AUTHZ}" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3286       _err "Can not get domain new authz."
3287       return 1
3288     fi
3289     if _contains "$response" "No registration exists matching provided key"; then
3290       _err "It seems there is an error, but it's recovered now, please try again."
3291       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3292       _clearcaconf "CA_KEY_HASH"
3293       break
3294     fi
3295     if ! _contains "$response" "An error occurred while processing your request"; then
3296       _info "The new-authz request is ok."
3297       break
3298     fi
3299     _authz_i="$(_math "$_authz_i" + 1)"
3300     _info "The server is busy, Sleep $_authz_i to retry."
3301     _sleep "$_authz_i"
3302   done
3303
3304   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3305     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3306   fi
3307
3308   if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
3309     _err "new-authz error: $response"
3310     return 1
3311   fi
3312
3313 }
3314
3315 #uri keyAuthorization
3316 __trigger_validation() {
3317   _debug2 "tigger domain validation."
3318   _t_url="$1"
3319   _debug2 _t_url "$_t_url"
3320   _t_key_authz="$2"
3321   _debug2 _t_key_authz "$_t_key_authz"
3322   if [ "$ACME_VERSION" = "2" ]; then
3323     _send_signed_request "$_t_url" "{\"keyAuthorization\": \"$_t_key_authz\"}"
3324   else
3325     _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
3326   fi
3327 }
3328
3329 #webroot, domain domainlist  keylength
3330 issue() {
3331   if [ -z "$2" ]; then
3332     _usage "Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ "
3333     return 1
3334   fi
3335   if [ -z "$1" ]; then
3336     _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
3337     return 1
3338   fi
3339   _web_roots="$1"
3340   _main_domain="$2"
3341   _alt_domains="$3"
3342
3343   if _startswith "$_main_domain" "*."; then
3344     _err "The first domain can not be wildcard, '$_main_domain' is a wildcard domain."
3345     return 1
3346   fi
3347   if _contains "$_main_domain" ","; then
3348     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
3349     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
3350   fi
3351   _key_length="$4"
3352   _real_cert="$5"
3353   _real_key="$6"
3354   _real_ca="$7"
3355   _reload_cmd="$8"
3356   _real_fullchain="$9"
3357   _pre_hook="${10}"
3358   _post_hook="${11}"
3359   _renew_hook="${12}"
3360   _local_addr="${13}"
3361
3362   #remove these later.
3363   if [ "$_web_roots" = "dns-cf" ]; then
3364     _web_roots="dns_cf"
3365   fi
3366   if [ "$_web_roots" = "dns-dp" ]; then
3367     _web_roots="dns_dp"
3368   fi
3369   if [ "$_web_roots" = "dns-cx" ]; then
3370     _web_roots="dns_cx"
3371   fi
3372
3373   if [ ! "$IS_RENEW" ]; then
3374     _initpath "$_main_domain" "$_key_length"
3375     mkdir -p "$DOMAIN_PATH"
3376   fi
3377
3378   _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
3379
3380   _initAPI
3381
3382   if [ -f "$DOMAIN_CONF" ]; then
3383     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
3384     _debug Le_NextRenewTime "$Le_NextRenewTime"
3385     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3386       _saved_domain=$(_readdomainconf Le_Domain)
3387       _debug _saved_domain "$_saved_domain"
3388       _saved_alt=$(_readdomainconf Le_Alt)
3389       _debug _saved_alt "$_saved_alt"
3390       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
3391         _info "Domains not changed."
3392         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
3393         _info "Add '$(__red '--force')' to force to renew."
3394         return $RENEW_SKIP
3395       else
3396         _info "Domains have changed."
3397       fi
3398     fi
3399   fi
3400
3401   _savedomainconf "Le_Domain" "$_main_domain"
3402   _savedomainconf "Le_Alt" "$_alt_domains"
3403   _savedomainconf "Le_Webroot" "$_web_roots"
3404
3405   _savedomainconf "Le_PreHook" "$_pre_hook"
3406   _savedomainconf "Le_PostHook" "$_post_hook"
3407   _savedomainconf "Le_RenewHook" "$_renew_hook"
3408
3409   if [ "$_local_addr" ]; then
3410     _savedomainconf "Le_LocalAddress" "$_local_addr"
3411   else
3412     _cleardomainconf "Le_LocalAddress"
3413   fi
3414
3415   Le_API="$ACME_DIRECTORY"
3416   _savedomainconf "Le_API" "$Le_API"
3417
3418   if [ "$_alt_domains" = "$NO_VALUE" ]; then
3419     _alt_domains=""
3420   fi
3421
3422   if [ "$_key_length" = "$NO_VALUE" ]; then
3423     _key_length=""
3424   fi
3425
3426   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
3427     _err "_on_before_issue."
3428     return 1
3429   fi
3430
3431   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
3432   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
3433
3434   if [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
3435     if ! _regAccount "$_accountkeylength"; then
3436       _on_issue_err "$_post_hook"
3437       return 1
3438     fi
3439   else
3440     _debug "_saved_account_key_hash is not changed, skip register account."
3441   fi
3442
3443   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
3444     _info "Signing from existing CSR."
3445   else
3446     _key=$(_readdomainconf Le_Keylength)
3447     _debug "Read key length:$_key"
3448     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then
3449       if ! createDomainKey "$_main_domain" "$_key_length"; then
3450         _err "Create domain key error."
3451         _clearup
3452         _on_issue_err "$_post_hook"
3453         return 1
3454       fi
3455     fi
3456
3457     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
3458       _err "Create CSR error."
3459       _clearup
3460       _on_issue_err "$_post_hook"
3461       return 1
3462     fi
3463   fi
3464
3465   _savedomainconf "Le_Keylength" "$_key_length"
3466
3467   vlist="$Le_Vlist"
3468
3469   _info "Getting domain auth token for each domain"
3470   sep='#'
3471   dvsep=','
3472   if [ -z "$vlist" ]; then
3473     if [ "$ACME_VERSION" = "2" ]; then
3474       #make new order request
3475       _identifiers="{\"type\":\"dns\",\"value\":\"$_main_domain\"}"
3476       for d in $(echo "$_alt_domains" | tr ',' ' '); do
3477         if [ "$d" ]; then
3478           _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$d\"}"
3479         fi
3480       done
3481       _debug2 _identifiers "$_identifiers"
3482       if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
3483         _err "Create new order error."
3484         _clearup
3485         _on_issue_err "$_post_hook"
3486         return 1
3487       fi
3488
3489       Le_OrderFinalize="$(echo "$response" | tr -d '\r\n' | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
3490       _debug Le_OrderFinalize "$Le_OrderFinalize"
3491       if [ -z "$Le_OrderFinalize" ]; then
3492         _err "Le_OrderFinalize not found."
3493         _clearup
3494         _on_issue_err "$_post_hook"
3495         return 1
3496       fi
3497
3498       #for dns manual mode
3499       _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
3500
3501       _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
3502       _debug2 _authorizations_seg "$_authorizations_seg"
3503       if [ -z "$_authorizations_seg" ]; then
3504         _err "_authorizations_seg not found."
3505         _clearup
3506         _on_issue_err "$_post_hook"
3507         return 1
3508       fi
3509
3510       #domain and authz map
3511       _authorizations_map=""
3512       for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
3513         _debug2 "_authz_url" "$_authz_url"
3514         if ! response="$(_get "$_authz_url")"; then
3515           _err "get to authz error."
3516           _clearup
3517           _on_issue_err "$_post_hook"
3518           return 1
3519         fi
3520
3521         response="$(echo "$response" | _normalizeJson)"
3522         _debug2 response "$response"
3523         _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
3524         if _contains "$response" "\"wildcard\" *: *true"; then
3525           _d="*.$_d"
3526         fi
3527         _debug2 _d "$_d"
3528         _authorizations_map="$_d,$response
3529 $_authorizations_map"
3530       done
3531       _debug2 _authorizations_map "$_authorizations_map"
3532     fi
3533
3534     alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
3535     _index=0
3536     _currentRoot=""
3537     for d in $alldomains; do
3538       _info "Getting webroot for domain" "$d"
3539       _index=$(_math $_index + 1)
3540       _w="$(echo $_web_roots | cut -d , -f $_index)"
3541       _debug _w "$_w"
3542       if [ "$_w" ]; then
3543         _currentRoot="$_w"
3544       fi
3545       _debug "_currentRoot" "$_currentRoot"
3546
3547       vtype="$VTYPE_HTTP"
3548       #todo, v2 wildcard force to use dns
3549       if _startswith "$_currentRoot" "dns"; then
3550         vtype="$VTYPE_DNS"
3551       fi
3552
3553       if [ "$_currentRoot" = "$W_TLS" ]; then
3554         if [ "$ACME_VERSION" = "2" ]; then
3555           vtype="$VTYPE_TLS2"
3556         else
3557           vtype="$VTYPE_TLS"
3558         fi
3559       fi
3560
3561       if [ "$ACME_VERSION" = "2" ]; then
3562         response="$(echo "$_authorizations_map" | grep "^$d," | sed "s/$d,//")"
3563         _debug2 "response" "$response"
3564         if [ -z "$response" ]; then
3565           _err "get to authz error."
3566           _clearup
3567           _on_issue_err "$_post_hook"
3568           return 1
3569         fi
3570       else
3571         if ! __get_domain_new_authz "$d"; then
3572           _clearup
3573           _on_issue_err "$_post_hook"
3574           return 1
3575         fi
3576       fi
3577
3578       if [ -z "$thumbprint" ]; then
3579         thumbprint="$(__calc_account_thumbprint)"
3580       fi
3581
3582       entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
3583       _debug entry "$entry"
3584       if [ -z "$entry" ]; then
3585         _err "Error, can not get domain token $d"
3586         _clearup
3587         _on_issue_err "$_post_hook"
3588         return 1
3589       fi
3590       token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
3591       _debug token "$token"
3592
3593       if [ "$ACME_VERSION" = "2" ]; then
3594         uri="$(printf "%s\n" "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
3595       else
3596         uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
3597       fi
3598       _debug uri "$uri"
3599
3600       keyauthorization="$token.$thumbprint"
3601       _debug keyauthorization "$keyauthorization"
3602
3603       if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
3604         _debug "$d is already verified."
3605         keyauthorization="$STATE_VERIFIED"
3606         _debug keyauthorization "$keyauthorization"
3607       fi
3608
3609       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
3610       _debug dvlist "$dvlist"
3611
3612       vlist="$vlist$dvlist$dvsep"
3613
3614     done
3615     _debug vlist "$vlist"
3616     #add entry
3617     dnsadded=""
3618     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3619     for ventry in $ventries; do
3620       d=$(echo "$ventry" | cut -d "$sep" -f 1)
3621       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3622       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3623       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3624       _debug d "$d"
3625       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3626         _debug "$d is already verified, skip $vtype."
3627         continue
3628       fi
3629
3630       if [ "$vtype" = "$VTYPE_DNS" ]; then
3631         dnsadded='0'
3632         _dns_root_d="$d"
3633         if _startswith "$_dns_root_d" "*."; then
3634           _dns_root_d="$(echo "$_dns_root_d" | sed 's/*.//')"
3635         fi
3636         txtdomain="_acme-challenge.$_dns_root_d"
3637         _debug txtdomain "$txtdomain"
3638         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
3639         _debug txt "$txt"
3640
3641         d_api="$(_findHook "$_dns_root_d" dnsapi "$_currentRoot")"
3642
3643         _debug d_api "$d_api"
3644
3645         if [ "$d_api" ]; then
3646           _info "Found domain api file: $d_api"
3647         else
3648           _info "$(__red "Add the following TXT record:")"
3649           _info "$(__red "Domain: '$(__green "$txtdomain")'")"
3650           _info "$(__red "TXT value: '$(__green "$txt")'")"
3651           _info "$(__red "Please be aware that you prepend _acme-challenge. before your domain")"
3652           _info "$(__red "so the resulting subdomain will be: $txtdomain")"
3653           continue
3654         fi
3655
3656         (
3657           if ! . "$d_api"; then
3658             _err "Load file $d_api error. Please check your api file and try again."
3659             return 1
3660           fi
3661
3662           addcommand="${_currentRoot}_add"
3663           if ! _exists "$addcommand"; then
3664             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
3665             return 1
3666           fi
3667
3668           if ! $addcommand "$txtdomain" "$txt"; then
3669             _err "Error add txt for domain:$txtdomain"
3670             return 1
3671           fi
3672         )
3673
3674         if [ "$?" != "0" ]; then
3675           _clearup
3676           _on_issue_err "$_post_hook" "$vlist"
3677           return 1
3678         fi
3679         dnsadded='1'
3680       fi
3681     done
3682
3683     if [ "$dnsadded" = '0' ]; then
3684       _savedomainconf "Le_Vlist" "$vlist"
3685       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
3686       _err "Please add the TXT records to the domains, and retry again."
3687       _clearup
3688       _on_issue_err "$_post_hook"
3689       return 1
3690     fi
3691
3692   fi
3693
3694   if [ "$dnsadded" = '1' ]; then
3695     if [ -z "$Le_DNSSleep" ]; then
3696       Le_DNSSleep="$DEFAULT_DNS_SLEEP"
3697     else
3698       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
3699     fi
3700
3701     _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
3702     _sleep "$Le_DNSSleep"
3703   fi
3704
3705   NGINX_RESTORE_VLIST=""
3706   _debug "ok, let's start to verify"
3707
3708   _ncIndex=1
3709   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3710   for ventry in $ventries; do
3711     d=$(echo "$ventry" | cut -d "$sep" -f 1)
3712     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3713     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3714     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3715     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3716
3717     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3718       _info "$d is already verified, skip $vtype."
3719       continue
3720     fi
3721
3722     _info "Verifying:$d"
3723     _debug "d" "$d"
3724     _debug "keyauthorization" "$keyauthorization"
3725     _debug "uri" "$uri"
3726     removelevel=""
3727     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
3728
3729     _debug "_currentRoot" "$_currentRoot"
3730
3731     if [ "$vtype" = "$VTYPE_HTTP" ]; then
3732       if [ "$_currentRoot" = "$NO_VALUE" ]; then
3733         _info "Standalone mode server"
3734         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3735         _ncIndex="$(_math $_ncIndex + 1)"
3736         _startserver "$keyauthorization" "$_ncaddr"
3737         if [ "$?" != "0" ]; then
3738           _clearup
3739           _on_issue_err "$_post_hook" "$vlist"
3740           return 1
3741         fi
3742         sleep 1
3743         _debug serverproc "$serverproc"
3744       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
3745         _info "Stateless mode for domain:$d"
3746         _sleep 1
3747       elif _startswith "$_currentRoot" "$NGINX"; then
3748         _info "Nginx mode for domain:$d"
3749         #set up nginx server
3750         FOUND_REAL_NGINX_CONF=""
3751         BACKUP_NGINX_CONF=""
3752         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
3753           _clearup
3754           _on_issue_err "$_post_hook" "$vlist"
3755           return 1
3756         fi
3757
3758         if [ "$FOUND_REAL_NGINX_CONF" ]; then
3759           _realConf="$FOUND_REAL_NGINX_CONF"
3760           _backup="$BACKUP_NGINX_CONF"
3761           _debug _realConf "$_realConf"
3762           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
3763         fi
3764         _sleep 1
3765       else
3766         if [ "$_currentRoot" = "apache" ]; then
3767           wellknown_path="$ACME_DIR"
3768         else
3769           wellknown_path="$_currentRoot/.well-known/acme-challenge"
3770           if [ ! -d "$_currentRoot/.well-known" ]; then
3771             removelevel='1'
3772           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
3773             removelevel='2'
3774           else
3775             removelevel='3'
3776           fi
3777         fi
3778
3779         _debug wellknown_path "$wellknown_path"
3780
3781         _debug "writing token:$token to $wellknown_path/$token"
3782
3783         mkdir -p "$wellknown_path"
3784
3785         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
3786           _err "$d:Can not write token to file : $wellknown_path/$token"
3787           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3788           _clearup
3789           _on_issue_err "$_post_hook" "$vlist"
3790           return 1
3791         fi
3792
3793         if [ ! "$usingApache" ]; then
3794           if webroot_owner=$(_stat "$_currentRoot"); then
3795             _debug "Changing owner/group of .well-known to $webroot_owner"
3796             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
3797               _debug "$(cat "$_EXEC_TEMP_ERR")"
3798               _exec_err >/dev/null 2>&1
3799             fi
3800           else
3801             _debug "not changing owner/group of webroot"
3802           fi
3803         fi
3804
3805       fi
3806
3807     elif [ "$vtype" = "$VTYPE_TLS" ]; then
3808       #create A
3809       #_hash_A="$(printf "%s" $token | _digest "sha256" "hex" )"
3810       #_debug2 _hash_A "$_hash_A"
3811       #_x="$(echo $_hash_A | cut -c 1-32)"
3812       #_debug2 _x "$_x"
3813       #_y="$(echo $_hash_A | cut -c 33-64)"
3814       #_debug2 _y "$_y"
3815       #_SAN_A="$_x.$_y.token.acme.invalid"
3816       #_debug2 _SAN_A "$_SAN_A"
3817
3818       #create B
3819       _hash_B="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
3820       _debug2 _hash_B "$_hash_B"
3821       _x="$(echo "$_hash_B" | cut -c 1-32)"
3822       _debug2 _x "$_x"
3823       _y="$(echo "$_hash_B" | cut -c 33-64)"
3824       _debug2 _y "$_y"
3825
3826       #_SAN_B="$_x.$_y.ka.acme.invalid"
3827
3828       _SAN_B="$_x.$_y.acme.invalid"
3829       _debug2 _SAN_B "$_SAN_B"
3830
3831       _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3832       _ncIndex="$(_math "$_ncIndex" + 1)"
3833       if ! _starttlsserver "$_SAN_B" "$_SAN_A" "$Le_TLSPort" "$keyauthorization" "$_ncaddr"; then
3834         _err "Start tls server error."
3835         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3836         _clearup
3837         _on_issue_err "$_post_hook" "$vlist"
3838         return 1
3839       fi
3840     fi
3841
3842     if ! __trigger_validation "$uri" "$keyauthorization"; then
3843       _err "$d:Can not get challenge: $response"
3844       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3845       _clearup
3846       _on_issue_err "$_post_hook" "$vlist"
3847       return 1
3848     fi
3849
3850     if [ "$code" ] && [ "$code" != '202' ]; then
3851       if [ "$ACME_VERSION" = "2" ] && [ "$code" = '200' ]; then
3852         _debug "trigger validation code: $code"
3853       else
3854         _err "$d:Challenge error: $response"
3855         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3856         _clearup
3857         _on_issue_err "$_post_hook" "$vlist"
3858         return 1
3859       fi
3860     fi
3861
3862     waittimes=0
3863     if [ -z "$MAX_RETRY_TIMES" ]; then
3864       MAX_RETRY_TIMES=30
3865     fi
3866
3867     while true; do
3868       waittimes=$(_math "$waittimes" + 1)
3869       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
3870         _err "$d:Timeout"
3871         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3872         _clearup
3873         _on_issue_err "$_post_hook" "$vlist"
3874         return 1
3875       fi
3876
3877       _debug "sleep 2 secs to verify"
3878       sleep 2
3879       _debug "checking"
3880       response="$(_get "$uri")"
3881       if [ "$?" != "0" ]; then
3882         _err "$d:Verify error:$response"
3883         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3884         _clearup
3885         _on_issue_err "$_post_hook" "$vlist"
3886         return 1
3887       fi
3888       _debug2 original "$response"
3889
3890       response="$(echo "$response" | _normalizeJson)"
3891       _debug2 response "$response"
3892
3893       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
3894       if [ "$status" = "valid" ]; then
3895         _info "$(__green Success)"
3896         _stopserver "$serverproc"
3897         serverproc=""
3898         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3899         break
3900       fi
3901
3902       if [ "$status" = "invalid" ]; then
3903         error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
3904         _debug2 error "$error"
3905         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
3906         _debug2 errordetail "$errordetail"
3907         if [ "$errordetail" ]; then
3908           _err "$d:Verify error:$errordetail"
3909         else
3910           _err "$d:Verify error:$error"
3911         fi
3912         if [ "$DEBUG" ]; then
3913           if [ "$vtype" = "$VTYPE_HTTP" ]; then
3914             _debug "Debug: get token url."
3915             _get "http://$d/.well-known/acme-challenge/$token" "" 1
3916           fi
3917         fi
3918         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3919         _clearup
3920         _on_issue_err "$_post_hook" "$vlist"
3921         return 1
3922       fi
3923
3924       if [ "$status" = "pending" ]; then
3925         _info "Pending"
3926       else
3927         _err "$d:Verify error:$response"
3928         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3929         _clearup
3930         _on_issue_err "$_post_hook" "$vlist"
3931         return 1
3932       fi
3933
3934     done
3935
3936   done
3937
3938   _clearup
3939   _info "Verify finished, start to sign."
3940   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
3941
3942   if [ "$ACME_VERSION" = "2" ]; then
3943     if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
3944       _err "Sign failed."
3945       _on_issue_err "$_post_hook"
3946       return 1
3947     fi
3948     if [ "$code" != "200" ]; then
3949       _err "Sign failed, code is not 200."
3950       _on_issue_err "$_post_hook"
3951       return 1
3952     fi
3953     Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
3954
3955     if ! _get "$Le_LinkCert" >"$CERT_PATH"; then
3956       _err "Sign failed, code is not 200."
3957       _on_issue_err "$_post_hook"
3958       return 1
3959     fi
3960   else
3961     if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
3962       _err "Sign failed."
3963       _on_issue_err "$_post_hook"
3964       return 1
3965     fi
3966     _rcert="$response"
3967     Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
3968     echo "$BEGIN_CERT" >"$CERT_PATH"
3969
3970     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
3971     #  _debug "Get cert failed. Let's try last response."
3972     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
3973     #fi
3974
3975     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
3976       _debug "Try cert link."
3977       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
3978     fi
3979
3980     echo "$END_CERT" >>"$CERT_PATH"
3981   fi
3982
3983   _debug "Le_LinkCert" "$Le_LinkCert"
3984   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
3985
3986   if [ "$Le_LinkCert" ]; then
3987     _info "$(__green "Cert success.")"
3988     cat "$CERT_PATH"
3989
3990     _info "Your cert is in $(__green " $CERT_PATH ")"
3991
3992     if [ -f "$CERT_KEY_PATH" ]; then
3993       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
3994     fi
3995
3996     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
3997
3998     if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
3999       USER_PATH="$PATH"
4000       _saveaccountconf "USER_PATH" "$USER_PATH"
4001     fi
4002   fi
4003
4004   if [ -z "$Le_LinkCert" ]; then
4005     response="$(echo "$response" | _dbase64 "multiline" | _normalizeJson)"
4006     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
4007     _on_issue_err "$_post_hook"
4008     return 1
4009   fi
4010
4011   _cleardomainconf "Le_Vlist"
4012
4013   Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
4014
4015   if [ "$Le_LinkIssuer" ]; then
4016     if ! _contains "$Le_LinkIssuer" ":"; then
4017       _info "$(__red "Relative issuer link found.")"
4018       Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
4019     fi
4020     _debug Le_LinkIssuer "$Le_LinkIssuer"
4021     _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
4022
4023     _link_issuer_retry=0
4024     _MAX_ISSUER_RETRY=5
4025     while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
4026       _debug _link_issuer_retry "$_link_issuer_retry"
4027       if [ "$ACME_VERSION" = "2" ]; then
4028         if _get "$Le_LinkIssuer" >"$CA_CERT_PATH"; then
4029           break
4030         fi
4031       else
4032         if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
4033           echo "$BEGIN_CERT" >"$CA_CERT_PATH"
4034           _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
4035           echo "$END_CERT" >>"$CA_CERT_PATH"
4036
4037           _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
4038           cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
4039           _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
4040
4041           rm -f "$CA_CERT_PATH.der"
4042           break
4043         fi
4044       fi
4045       _link_issuer_retry=$(_math $_link_issuer_retry + 1)
4046       _sleep "$_link_issuer_retry"
4047     done
4048     if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
4049       _err "Max retry for issuer ca cert is reached."
4050     fi
4051   else
4052     _debug "No Le_LinkIssuer header found."
4053   fi
4054
4055   Le_CertCreateTime=$(_time)
4056   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
4057
4058   Le_CertCreateTimeStr=$(date -u)
4059   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
4060
4061   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "$MAX_RENEW" ]; then
4062     Le_RenewalDays="$MAX_RENEW"
4063   else
4064     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
4065   fi
4066
4067   if [ "$CA_BUNDLE" ]; then
4068     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
4069   else
4070     _clearaccountconf "CA_BUNDLE"
4071   fi
4072
4073   if [ "$CA_PATH" ]; then
4074     _saveaccountconf CA_PATH "$CA_PATH"
4075   else
4076     _clearaccountconf "CA_PATH"
4077   fi
4078
4079   if [ "$HTTPS_INSECURE" ]; then
4080     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
4081   else
4082     _clearaccountconf "HTTPS_INSECURE"
4083   fi
4084
4085   if [ "$Le_Listen_V4" ]; then
4086     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
4087     _cleardomainconf Le_Listen_V6
4088   elif [ "$Le_Listen_V6" ]; then
4089     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
4090     _cleardomainconf Le_Listen_V4
4091   fi
4092
4093   if [ "$Le_ForceNewDomainKey" = "1" ]; then
4094     _savedomainconf "Le_ForceNewDomainKey" "$Le_ForceNewDomainKey"
4095   else
4096     _cleardomainconf Le_ForceNewDomainKey
4097   fi
4098
4099   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
4100
4101   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
4102   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
4103
4104   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
4105   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
4106
4107   if ! _on_issue_success "$_post_hook" "$_renew_hook"; then
4108     _err "Call hook error."
4109     return 1
4110   fi
4111
4112   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
4113     _savedomainconf "Le_RealCertPath" "$_real_cert"
4114     _savedomainconf "Le_RealCACertPath" "$_real_ca"
4115     _savedomainconf "Le_RealKeyPath" "$_real_key"
4116     _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4117     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4118     _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4119   fi
4120
4121 }
4122
4123 #domain  [isEcc]
4124 renew() {
4125   Le_Domain="$1"
4126   if [ -z "$Le_Domain" ]; then
4127     _usage "Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]"
4128     return 1
4129   fi
4130
4131   _isEcc="$2"
4132
4133   _initpath "$Le_Domain" "$_isEcc"
4134
4135   _info "$(__green "Renew: '$Le_Domain'")"
4136   if [ ! -f "$DOMAIN_CONF" ]; then
4137     _info "'$Le_Domain' is not a issued domain, skip."
4138     return 0
4139   fi
4140
4141   if [ "$Le_RenewalDays" ]; then
4142     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
4143   fi
4144
4145   . "$DOMAIN_CONF"
4146
4147   if [ "$Le_API" ]; then
4148     if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
4149       export Le_API="$DEFAULT_CA"
4150       _savedomainconf Le_API "$Le_API"
4151     fi
4152     if [ "$_OLD_STAGE_CA_HOST" = "$Le_API" ]; then
4153       export Le_API="$DEFAULT_STAGING_CA"
4154       _savedomainconf Le_API "$Le_API"
4155     fi
4156     export ACME_DIRECTORY="$Le_API"
4157     #reload ca configs
4158     ACCOUNT_KEY_PATH=""
4159     ACCOUNT_JSON_PATH=""
4160     CA_CONF=""
4161     _debug3 "initpath again."
4162     _initpath "$Le_Domain" "$_isEcc"
4163   fi
4164
4165   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
4166     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
4167     _info "Add '$(__red '--force')' to force to renew."
4168     return "$RENEW_SKIP"
4169   fi
4170
4171   if [ "$IN_CRON" = "1" ] && [ -z "$Le_CertCreateTime" ]; then
4172     _info "Skip invalid cert for: $Le_Domain"
4173     return 0
4174   fi
4175
4176   IS_RENEW="1"
4177   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
4178   res="$?"
4179   if [ "$res" != "0" ]; then
4180     return "$res"
4181   fi
4182
4183   if [ "$Le_DeployHook" ]; then
4184     _deploy "$Le_Domain" "$Le_DeployHook"
4185     res="$?"
4186   fi
4187
4188   IS_RENEW=""
4189
4190   return "$res"
4191 }
4192
4193 #renewAll  [stopRenewOnError]
4194 renewAll() {
4195   _initpath
4196   _stopRenewOnError="$1"
4197   _debug "_stopRenewOnError" "$_stopRenewOnError"
4198   _ret="0"
4199
4200   for di in "${CERT_HOME}"/*.*/; do
4201     _debug di "$di"
4202     if ! [ -d "$di" ]; then
4203       _debug "Not directory, skip: $di"
4204       continue
4205     fi
4206     d=$(basename "$di")
4207     _debug d "$d"
4208     (
4209       if _endswith "$d" "$ECC_SUFFIX"; then
4210         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4211         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4212       fi
4213       renew "$d" "$_isEcc"
4214     )
4215     rc="$?"
4216     _debug "Return code: $rc"
4217     if [ "$rc" != "0" ]; then
4218       if [ "$rc" = "$RENEW_SKIP" ]; then
4219         _info "Skipped $d"
4220       elif [ "$_stopRenewOnError" ]; then
4221         _err "Error renew $d,  stop now."
4222         return "$rc"
4223       else
4224         _ret="$rc"
4225         _err "Error renew $d."
4226       fi
4227     fi
4228   done
4229   return "$_ret"
4230 }
4231
4232 #csr webroot
4233 signcsr() {
4234   _csrfile="$1"
4235   _csrW="$2"
4236   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
4237     _usage "Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ "
4238     return 1
4239   fi
4240
4241   _initpath
4242
4243   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4244   if [ "$?" != "0" ]; then
4245     _err "Can not read subject from csr: $_csrfile"
4246     return 1
4247   fi
4248   _debug _csrsubj "$_csrsubj"
4249   if _contains "$_csrsubj" ' ' || ! _contains "$_csrsubj" '.'; then
4250     _info "It seems that the subject: $_csrsubj is not a valid domain name. Drop it."
4251     _csrsubj=""
4252   fi
4253
4254   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4255   if [ "$?" != "0" ]; then
4256     _err "Can not read domain list from csr: $_csrfile"
4257     return 1
4258   fi
4259   _debug "_csrdomainlist" "$_csrdomainlist"
4260
4261   if [ -z "$_csrsubj" ]; then
4262     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
4263     _debug _csrsubj "$_csrsubj"
4264     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
4265     _debug "_csrdomainlist" "$_csrdomainlist"
4266   fi
4267
4268   if [ -z "$_csrsubj" ]; then
4269     _err "Can not read subject from csr: $_csrfile"
4270     return 1
4271   fi
4272
4273   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4274   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4275     _err "Can not read key length from csr: $_csrfile"
4276     return 1
4277   fi
4278
4279   _initpath "$_csrsubj" "$_csrkeylength"
4280   mkdir -p "$DOMAIN_PATH"
4281
4282   _info "Copy csr to: $CSR_PATH"
4283   cp "$_csrfile" "$CSR_PATH"
4284
4285   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength"
4286
4287 }
4288
4289 showcsr() {
4290   _csrfile="$1"
4291   _csrd="$2"
4292   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
4293     _usage "Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr"
4294     return 1
4295   fi
4296
4297   _initpath
4298
4299   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
4300   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
4301     _err "Can not read subject from csr: $_csrfile"
4302     return 1
4303   fi
4304
4305   _info "Subject=$_csrsubj"
4306
4307   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
4308   if [ "$?" != "0" ]; then
4309     _err "Can not read domain list from csr: $_csrfile"
4310     return 1
4311   fi
4312   _debug "_csrdomainlist" "$_csrdomainlist"
4313
4314   _info "SubjectAltNames=$_csrdomainlist"
4315
4316   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
4317   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
4318     _err "Can not read key length from csr: $_csrfile"
4319     return 1
4320   fi
4321   _info "KeyLength=$_csrkeylength"
4322 }
4323
4324 list() {
4325   _raw="$1"
4326   _initpath
4327
4328   _sep="|"
4329   if [ "$_raw" ]; then
4330     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
4331     for di in "${CERT_HOME}"/*.*/; do
4332       if ! [ -d "$di" ]; then
4333         _debug "Not directory, skip: $di"
4334         continue
4335       fi
4336       d=$(basename "$di")
4337       _debug d "$d"
4338       (
4339         if _endswith "$d" "$ECC_SUFFIX"; then
4340           _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4341           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4342         fi
4343         _initpath "$d" "$_isEcc"
4344         if [ -f "$DOMAIN_CONF" ]; then
4345           . "$DOMAIN_CONF"
4346           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
4347         fi
4348       )
4349     done
4350   else
4351     if _exists column; then
4352       list "raw" | column -t -s "$_sep"
4353     else
4354       list "raw" | tr "$_sep" '\t'
4355     fi
4356   fi
4357
4358 }
4359
4360 _deploy() {
4361   _d="$1"
4362   _hooks="$2"
4363
4364   for _d_api in $(echo "$_hooks" | tr ',' " "); do
4365     _deployApi="$(_findHook "$_d" deploy "$_d_api")"
4366     if [ -z "$_deployApi" ]; then
4367       _err "The deploy hook $_d_api is not found."
4368       return 1
4369     fi
4370     _debug _deployApi "$_deployApi"
4371
4372     if ! (
4373       if ! . "$_deployApi"; then
4374         _err "Load file $_deployApi error. Please check your api file and try again."
4375         return 1
4376       fi
4377
4378       d_command="${_d_api}_deploy"
4379       if ! _exists "$d_command"; then
4380         _err "It seems that your api file is not correct, it must have a function named: $d_command"
4381         return 1
4382       fi
4383
4384       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
4385         _err "Error deploy for domain:$_d"
4386         return 1
4387       fi
4388     ); then
4389       _err "Deploy error."
4390       return 1
4391     else
4392       _info "$(__green Success)"
4393     fi
4394   done
4395 }
4396
4397 #domain hooks
4398 deploy() {
4399   _d="$1"
4400   _hooks="$2"
4401   _isEcc="$3"
4402   if [ -z "$_hooks" ]; then
4403     _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
4404     return 1
4405   fi
4406
4407   _initpath "$_d" "$_isEcc"
4408   if [ ! -d "$DOMAIN_PATH" ]; then
4409     _err "Domain is not valid:'$_d'"
4410     return 1
4411   fi
4412
4413   . "$DOMAIN_CONF"
4414
4415   _savedomainconf Le_DeployHook "$_hooks"
4416
4417   _deploy "$_d" "$_hooks"
4418 }
4419
4420 installcert() {
4421   _main_domain="$1"
4422   if [ -z "$_main_domain" ]; then
4423     _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
4424     return 1
4425   fi
4426
4427   _real_cert="$2"
4428   _real_key="$3"
4429   _real_ca="$4"
4430   _reload_cmd="$5"
4431   _real_fullchain="$6"
4432   _isEcc="$7"
4433
4434   _initpath "$_main_domain" "$_isEcc"
4435   if [ ! -d "$DOMAIN_PATH" ]; then
4436     _err "Domain is not valid:'$_main_domain'"
4437     return 1
4438   fi
4439
4440   _savedomainconf "Le_RealCertPath" "$_real_cert"
4441   _savedomainconf "Le_RealCACertPath" "$_real_ca"
4442   _savedomainconf "Le_RealKeyPath" "$_real_key"
4443   _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4444   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4445
4446   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4447 }
4448
4449 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
4450 _installcert() {
4451   _main_domain="$1"
4452   _real_cert="$2"
4453   _real_key="$3"
4454   _real_ca="$4"
4455   _real_fullchain="$5"
4456   _reload_cmd="$6"
4457   _backup_prefix="$7"
4458
4459   if [ "$_real_cert" = "$NO_VALUE" ]; then
4460     _real_cert=""
4461   fi
4462   if [ "$_real_key" = "$NO_VALUE" ]; then
4463     _real_key=""
4464   fi
4465   if [ "$_real_ca" = "$NO_VALUE" ]; then
4466     _real_ca=""
4467   fi
4468   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
4469     _reload_cmd=""
4470   fi
4471   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
4472     _real_fullchain=""
4473   fi
4474
4475   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
4476   mkdir -p "$_backup_path"
4477
4478   if [ "$_real_cert" ]; then
4479     _info "Installing cert to:$_real_cert"
4480     if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
4481       cp "$_real_cert" "$_backup_path/cert.bak"
4482     fi
4483     cat "$CERT_PATH" >"$_real_cert"
4484   fi
4485
4486   if [ "$_real_ca" ]; then
4487     _info "Installing CA to:$_real_ca"
4488     if [ "$_real_ca" = "$_real_cert" ]; then
4489       echo "" >>"$_real_ca"
4490       cat "$CA_CERT_PATH" >>"$_real_ca"
4491     else
4492       if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
4493         cp "$_real_ca" "$_backup_path/ca.bak"
4494       fi
4495       cat "$CA_CERT_PATH" >"$_real_ca"
4496     fi
4497   fi
4498
4499   if [ "$_real_key" ]; then
4500     _info "Installing key to:$_real_key"
4501     if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
4502       cp "$_real_key" "$_backup_path/key.bak"
4503     fi
4504     if [ -f "$_real_key" ]; then
4505       cat "$CERT_KEY_PATH" >"$_real_key"
4506     else
4507       cat "$CERT_KEY_PATH" >"$_real_key"
4508       chmod 700 "$_real_key"
4509     fi
4510   fi
4511
4512   if [ "$_real_fullchain" ]; then
4513     _info "Installing full chain to:$_real_fullchain"
4514     if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
4515       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
4516     fi
4517     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain"
4518   fi
4519
4520   if [ "$_reload_cmd" ]; then
4521     _info "Run reload cmd: $_reload_cmd"
4522     if (
4523       export CERT_PATH
4524       export CERT_KEY_PATH
4525       export CA_CERT_PATH
4526       export CERT_FULLCHAIN_PATH
4527       export Le_Domain
4528       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
4529     ); then
4530       _info "$(__green "Reload success")"
4531     else
4532       _err "Reload error for :$Le_Domain"
4533     fi
4534   fi
4535
4536 }
4537
4538 #confighome
4539 installcronjob() {
4540   _c_home="$1"
4541   _initpath
4542   _CRONTAB="crontab"
4543   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
4544     _CRONTAB="fcrontab"
4545   fi
4546   if ! _exists "$_CRONTAB"; then
4547     _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
4548     _err "All your certs will not be renewed automatically."
4549     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
4550     return 1
4551   fi
4552
4553   _info "Installing cron job"
4554   if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
4555     if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
4556       lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
4557     else
4558       _err "Can not install cronjob, $PROJECT_ENTRY not found."
4559       return 1
4560     fi
4561
4562     if [ "$_c_home" ]; then
4563       _c_entry="--config-home \"$_c_home\" "
4564     fi
4565     _t=$(_time)
4566     random_minute=$(_math $_t % 60)
4567     if _exists uname && uname -a | grep SunOS >/dev/null; then
4568       $_CRONTAB -l | {
4569         cat
4570         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4571       } | $_CRONTAB --
4572     else
4573       $_CRONTAB -l | {
4574         cat
4575         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4576       } | $_CRONTAB -
4577     fi
4578   fi
4579   if [ "$?" != "0" ]; then
4580     _err "Install cron job failed. You need to manually renew your certs."
4581     _err "Or you can add cronjob by yourself:"
4582     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
4583     return 1
4584   fi
4585 }
4586
4587 uninstallcronjob() {
4588   _CRONTAB="crontab"
4589   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
4590     _CRONTAB="fcrontab"
4591   fi
4592
4593   if ! _exists "$_CRONTAB"; then
4594     return
4595   fi
4596   _info "Removing cron job"
4597   cr="$($_CRONTAB -l | grep "$PROJECT_ENTRY --cron")"
4598   if [ "$cr" ]; then
4599     if _exists uname && uname -a | grep solaris >/dev/null; then
4600       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB --
4601     else
4602       $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB -
4603     fi
4604     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
4605     _info LE_WORKING_DIR "$LE_WORKING_DIR"
4606     if _contains "$cr" "--config-home"; then
4607       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
4608       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
4609     fi
4610   fi
4611   _initpath
4612
4613 }
4614
4615 revoke() {
4616   Le_Domain="$1"
4617   if [ -z "$Le_Domain" ]; then
4618     _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]"
4619     return 1
4620   fi
4621
4622   _isEcc="$2"
4623
4624   _initpath "$Le_Domain" "$_isEcc"
4625   if [ ! -f "$DOMAIN_CONF" ]; then
4626     _err "$Le_Domain is not a issued domain, skip."
4627     return 1
4628   fi
4629
4630   if [ ! -f "$CERT_PATH" ]; then
4631     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
4632     return 1
4633   fi
4634
4635   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
4636
4637   if [ -z "$cert" ]; then
4638     _err "Cert for $Le_Domain is empty found, skip."
4639     return 1
4640   fi
4641
4642   _initAPI
4643
4644   if [ "$ACME_VERSION" = "2" ]; then
4645     data="{\"certificate\": \"$cert\"}"
4646   else
4647     data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
4648   fi
4649   uri="${ACME_REVOKE_CERT}"
4650
4651   if [ -f "$CERT_KEY_PATH" ]; then
4652     _info "Try domain key first."
4653     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
4654       if [ -z "$response" ]; then
4655         _info "Revoke success."
4656         rm -f "$CERT_PATH"
4657         return 0
4658       else
4659         _err "Revoke error by domain key."
4660         _err "$response"
4661       fi
4662     fi
4663   else
4664     _info "Domain key file doesn't exists."
4665   fi
4666
4667   _info "Try account key."
4668
4669   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
4670     if [ -z "$response" ]; then
4671       _info "Revoke success."
4672       rm -f "$CERT_PATH"
4673       return 0
4674     else
4675       _err "Revoke error."
4676       _debug "$response"
4677     fi
4678   fi
4679   return 1
4680 }
4681
4682 #domain  ecc
4683 remove() {
4684   Le_Domain="$1"
4685   if [ -z "$Le_Domain" ]; then
4686     _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
4687     return 1
4688   fi
4689
4690   _isEcc="$2"
4691
4692   _initpath "$Le_Domain" "$_isEcc"
4693   _removed_conf="$DOMAIN_CONF.removed"
4694   if [ ! -f "$DOMAIN_CONF" ]; then
4695     if [ -f "$_removed_conf" ]; then
4696       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
4697     else
4698       _err "$Le_Domain is not a issued domain, skip."
4699     fi
4700     return 1
4701   fi
4702
4703   if mv "$DOMAIN_CONF" "$_removed_conf"; then
4704     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
4705     _info "You can remove them by yourself."
4706     return 0
4707   else
4708     _err "Remove $Le_Domain failed."
4709     return 1
4710   fi
4711 }
4712
4713 #domain vtype
4714 _deactivate() {
4715   _d_domain="$1"
4716   _d_type="$2"
4717   _initpath
4718
4719   if [ "$ACME_VERSION" = "2" ]; then
4720     _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
4721     if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
4722       _err "Can not get domain new order."
4723       return 1
4724     fi
4725     _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
4726     _debug2 _authorizations_seg "$_authorizations_seg"
4727     if [ -z "$_authorizations_seg" ]; then
4728       _err "_authorizations_seg not found."
4729       _clearup
4730       _on_issue_err "$_post_hook"
4731       return 1
4732     fi
4733
4734     authzUri="$_authorizations_seg"
4735     _debug2 "authzUri" "$authzUri"
4736     if ! response="$(_get "$authzUri")"; then
4737       _err "get to authz error."
4738       _clearup
4739       _on_issue_err "$_post_hook"
4740       return 1
4741     fi
4742
4743     response="$(echo "$response" | _normalizeJson)"
4744     _debug2 response "$response"
4745     _URL_NAME="url"
4746   else
4747     if ! __get_domain_new_authz "$_d_domain"; then
4748       _err "Can not get domain new authz token."
4749       return 1
4750     fi
4751
4752     authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
4753     _debug "authzUri" "$authzUri"
4754     if [ "$code" ] && [ ! "$code" = '201' ]; then
4755       _err "new-authz error: $response"
4756       return 1
4757     fi
4758     _URL_NAME="uri"
4759   fi
4760
4761   entries="$(echo "$response" | _egrep_o "{ *\"type\":\"[^\"]*\", *\"status\": *\"valid\", *\"$_URL_NAME\"[^}]*")"
4762   if [ -z "$entries" ]; then
4763     _info "No valid entries found."
4764     if [ -z "$thumbprint" ]; then
4765       thumbprint="$(__calc_account_thumbprint)"
4766     fi
4767     _debug "Trigger validation."
4768     vtype="$VTYPE_DNS"
4769     entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
4770     _debug entry "$entry"
4771     if [ -z "$entry" ]; then
4772       _err "Error, can not get domain token $d"
4773       return 1
4774     fi
4775     token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
4776     _debug token "$token"
4777
4778     uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
4779     _debug uri "$uri"
4780
4781     keyauthorization="$token.$thumbprint"
4782     _debug keyauthorization "$keyauthorization"
4783     __trigger_validation "$uri" "$keyauthorization"
4784
4785   fi
4786
4787   _d_i=0
4788   _d_max_retry=$(echo "$entries" | wc -l)
4789   while [ "$_d_i" -lt "$_d_max_retry" ]; do
4790     _info "Deactivate: $_d_domain"
4791     _d_i="$(_math $_d_i + 1)"
4792     entry="$(echo "$entries" | sed -n "${_d_i}p")"
4793     _debug entry "$entry"
4794
4795     if [ -z "$entry" ]; then
4796       _info "No more valid entry found."
4797       break
4798     fi
4799
4800     _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
4801     _debug _vtype "$_vtype"
4802     _info "Found $_vtype"
4803
4804     uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
4805     _debug uri "$uri"
4806
4807     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
4808       _info "Skip $_vtype"
4809       continue
4810     fi
4811
4812     _info "Deactivate: $_vtype"
4813
4814     if [ "$ACME_VERSION" = "2" ]; then
4815       _djson="{\"status\":\"deactivated\"}"
4816     else
4817       _djson="{\"resource\": \"authz\", \"status\":\"deactivated\"}"
4818     fi
4819
4820     if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
4821       _info "Deactivate: $_vtype success."
4822     else
4823       _err "Can not deactivate $_vtype."
4824       break
4825     fi
4826
4827   done
4828   _debug "$_d_i"
4829   if [ "$_d_i" -eq "$_d_max_retry" ]; then
4830     _info "Deactivated success!"
4831   else
4832     _err "Deactivate failed."
4833   fi
4834
4835 }
4836
4837 deactivate() {
4838   _d_domain_list="$1"
4839   _d_type="$2"
4840   _initpath
4841   _initAPI
4842   _debug _d_domain_list "$_d_domain_list"
4843   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
4844     _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
4845     return 1
4846   fi
4847   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
4848     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
4849       continue
4850     fi
4851     if ! _deactivate "$_d_dm" "$_d_type"; then
4852       return 1
4853     fi
4854   done
4855 }
4856
4857 # Detect profile file if not specified as environment variable
4858 _detect_profile() {
4859   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
4860     echo "$PROFILE"
4861     return
4862   fi
4863
4864   DETECTED_PROFILE=''
4865   SHELLTYPE="$(basename "/$SHELL")"
4866
4867   if [ "$SHELLTYPE" = "bash" ]; then
4868     if [ -f "$HOME/.bashrc" ]; then
4869       DETECTED_PROFILE="$HOME/.bashrc"
4870     elif [ -f "$HOME/.bash_profile" ]; then
4871       DETECTED_PROFILE="$HOME/.bash_profile"
4872     fi
4873   elif [ "$SHELLTYPE" = "zsh" ]; then
4874     DETECTED_PROFILE="$HOME/.zshrc"
4875   fi
4876
4877   if [ -z "$DETECTED_PROFILE" ]; then
4878     if [ -f "$HOME/.profile" ]; then
4879       DETECTED_PROFILE="$HOME/.profile"
4880     elif [ -f "$HOME/.bashrc" ]; then
4881       DETECTED_PROFILE="$HOME/.bashrc"
4882     elif [ -f "$HOME/.bash_profile" ]; then
4883       DETECTED_PROFILE="$HOME/.bash_profile"
4884     elif [ -f "$HOME/.zshrc" ]; then
4885       DETECTED_PROFILE="$HOME/.zshrc"
4886     fi
4887   fi
4888
4889   echo "$DETECTED_PROFILE"
4890 }
4891
4892 _initconf() {
4893   _initpath
4894   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4895     echo "
4896
4897 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
4898 #LOG_LEVEL=1
4899
4900 #AUTO_UPGRADE=\"1\"
4901
4902 #NO_TIMESTAMP=1
4903
4904     " >"$ACCOUNT_CONF_PATH"
4905   fi
4906 }
4907
4908 # nocron
4909 _precheck() {
4910   _nocron="$1"
4911
4912   if ! _exists "curl" && ! _exists "wget"; then
4913     _err "Please install curl or wget first, we need to access http resources."
4914     return 1
4915   fi
4916
4917   if [ -z "$_nocron" ]; then
4918     if ! _exists "crontab" && ! _exists "fcrontab"; then
4919       _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
4920       _err "We need to set cron job to renew the certs automatically."
4921       _err "Otherwise, your certs will not be able to be renewed automatically."
4922       if [ -z "$FORCE" ]; then
4923         _err "Please add '--force' and try install again to go without crontab."
4924         _err "./$PROJECT_ENTRY --install --force"
4925         return 1
4926       fi
4927     fi
4928   fi
4929
4930   if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
4931     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
4932     _err "We need openssl to generate keys."
4933     return 1
4934   fi
4935
4936   if ! _exists "socat"; then
4937     _err "It is recommended to install socat first."
4938     _err "We use socat for standalone server if you use standalone mode."
4939     _err "If you don't use standalone mode, just ignore this warning."
4940   fi
4941
4942   return 0
4943 }
4944
4945 _setShebang() {
4946   _file="$1"
4947   _shebang="$2"
4948   if [ -z "$_shebang" ]; then
4949     _usage "Usage: file shebang"
4950     return 1
4951   fi
4952   cp "$_file" "$_file.tmp"
4953   echo "$_shebang" >"$_file"
4954   sed -n 2,99999p "$_file.tmp" >>"$_file"
4955   rm -f "$_file.tmp"
4956 }
4957
4958 #confighome
4959 _installalias() {
4960   _c_home="$1"
4961   _initpath
4962
4963   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4964   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
4965     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
4966     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
4967     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
4968   fi
4969
4970   if [ "$_c_home" ]; then
4971     _c_entry=" --config-home '$_c_home'"
4972   fi
4973
4974   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
4975   if [ "$_c_home" ]; then
4976     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
4977   else
4978     _sed_i "/^export LE_CONFIG_HOME/d" "$_envfile"
4979   fi
4980   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4981
4982   _profile="$(_detect_profile)"
4983   if [ "$_profile" ]; then
4984     _debug "Found profile: $_profile"
4985     _info "Installing alias to '$_profile'"
4986     _setopt "$_profile" ". \"$_envfile\""
4987     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
4988   else
4989     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
4990   fi
4991
4992   #for csh
4993   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
4994   _csh_profile="$HOME/.cshrc"
4995   if [ -f "$_csh_profile" ]; then
4996     _info "Installing alias to '$_csh_profile'"
4997     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4998     if [ "$_c_home" ]; then
4999       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
5000     else
5001       _sed_i "/^setenv LE_CONFIG_HOME/d" "$_cshfile"
5002     fi
5003     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
5004     _setopt "$_csh_profile" "source \"$_cshfile\""
5005   fi
5006
5007   #for tcsh
5008   _tcsh_profile="$HOME/.tcshrc"
5009   if [ -f "$_tcsh_profile" ]; then
5010     _info "Installing alias to '$_tcsh_profile'"
5011     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
5012     if [ "$_c_home" ]; then
5013       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
5014     fi
5015     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
5016     _setopt "$_tcsh_profile" "source \"$_cshfile\""
5017   fi
5018
5019 }
5020
5021 # nocron confighome
5022 install() {
5023
5024   if [ -z "$LE_WORKING_DIR" ]; then
5025     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
5026   fi
5027
5028   _nocron="$1"
5029   _c_home="$2"
5030   if ! _initpath; then
5031     _err "Install failed."
5032     return 1
5033   fi
5034   if [ "$_nocron" ]; then
5035     _debug "Skip install cron job"
5036   fi
5037
5038   if [ "$IN_CRON" != "1" ]; then
5039     if ! _precheck "$_nocron"; then
5040       _err "Pre-check failed, can not install."
5041       return 1
5042     fi
5043   fi
5044
5045   if [ -z "$_c_home" ] && [ "$LE_CONFIG_HOME" != "$LE_WORKING_DIR" ]; then
5046     _info "Using config home: $LE_CONFIG_HOME"
5047     _c_home="$LE_CONFIG_HOME"
5048   fi
5049
5050   #convert from le
5051   if [ -d "$HOME/.le" ]; then
5052     for envfile in "le.env" "le.sh.env"; do
5053       if [ -f "$HOME/.le/$envfile" ]; then
5054         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
5055           _upgrading="1"
5056           _info "You are upgrading from le.sh"
5057           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
5058           mv "$HOME/.le" "$LE_WORKING_DIR"
5059           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
5060           break
5061         fi
5062       fi
5063     done
5064   fi
5065
5066   _info "Installing to $LE_WORKING_DIR"
5067
5068   if [ ! -d "$LE_WORKING_DIR" ]; then
5069     if ! mkdir -p "$LE_WORKING_DIR"; then
5070       _err "Can not create working dir: $LE_WORKING_DIR"
5071       return 1
5072     fi
5073
5074     chmod 700 "$LE_WORKING_DIR"
5075   fi
5076
5077   if [ ! -d "$LE_CONFIG_HOME" ]; then
5078     if ! mkdir -p "$LE_CONFIG_HOME"; then
5079       _err "Can not create config dir: $LE_CONFIG_HOME"
5080       return 1
5081     fi
5082
5083     chmod 700 "$LE_CONFIG_HOME"
5084   fi
5085
5086   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
5087
5088   if [ "$?" != "0" ]; then
5089     _err "Install failed, can not copy $PROJECT_ENTRY"
5090     return 1
5091   fi
5092
5093   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
5094
5095   if [ "$IN_CRON" != "1" ]; then
5096     _installalias "$_c_home"
5097   fi
5098
5099   for subf in $_SUB_FOLDERS; do
5100     if [ -d "$subf" ]; then
5101       mkdir -p "$LE_WORKING_DIR/$subf"
5102       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
5103     fi
5104   done
5105
5106   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
5107     _initconf
5108   fi
5109
5110   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
5111     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
5112   fi
5113
5114   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
5115     _saveaccountconf "CERT_HOME" "$CERT_HOME"
5116   fi
5117
5118   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
5119     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
5120   fi
5121
5122   if [ -z "$_nocron" ]; then
5123     installcronjob "$_c_home"
5124   fi
5125
5126   if [ -z "$NO_DETECT_SH" ]; then
5127     #Modify shebang
5128     if _exists bash; then
5129       _info "Good, bash is found, so change the shebang to use bash as preferred."
5130       _shebang='#!'"$(env bash -c "command -v bash")"
5131       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
5132       for subf in $_SUB_FOLDERS; do
5133         if [ -d "$LE_WORKING_DIR/$subf" ]; then
5134           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
5135             _setShebang "$_apifile" "$_shebang"
5136           done
5137         fi
5138       done
5139     fi
5140   fi
5141
5142   _info OK
5143 }
5144
5145 # nocron
5146 uninstall() {
5147   _nocron="$1"
5148   if [ -z "$_nocron" ]; then
5149     uninstallcronjob
5150   fi
5151   _initpath
5152
5153   _uninstallalias
5154
5155   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
5156   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
5157
5158 }
5159
5160 _uninstallalias() {
5161   _initpath
5162
5163   _profile="$(_detect_profile)"
5164   if [ "$_profile" ]; then
5165     _info "Uninstalling alias from: '$_profile'"
5166     text="$(cat "$_profile")"
5167     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
5168   fi
5169
5170   _csh_profile="$HOME/.cshrc"
5171   if [ -f "$_csh_profile" ]; then
5172     _info "Uninstalling alias from: '$_csh_profile'"
5173     text="$(cat "$_csh_profile")"
5174     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
5175   fi
5176
5177   _tcsh_profile="$HOME/.tcshrc"
5178   if [ -f "$_tcsh_profile" ]; then
5179     _info "Uninstalling alias from: '$_csh_profile'"
5180     text="$(cat "$_tcsh_profile")"
5181     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
5182   fi
5183
5184 }
5185
5186 cron() {
5187   export IN_CRON=1
5188   _initpath
5189   _info "$(__green "===Starting cron===")"
5190   if [ "$AUTO_UPGRADE" = "1" ]; then
5191     export LE_WORKING_DIR
5192     (
5193       if ! upgrade; then
5194         _err "Cron:Upgrade failed!"
5195         return 1
5196       fi
5197     )
5198     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
5199
5200     if [ -t 1 ]; then
5201       __INTERACTIVE="1"
5202     fi
5203
5204     _info "Auto upgraded to: $VER"
5205   fi
5206   renewAll
5207   _ret="$?"
5208   IN_CRON=""
5209   _info "$(__green "===End cron===")"
5210   exit $_ret
5211 }
5212
5213 version() {
5214   echo "$PROJECT"
5215   echo "v$VER"
5216 }
5217
5218 showhelp() {
5219   _initpath
5220   version
5221   echo "Usage: $PROJECT_ENTRY  command ...[parameters]....
5222 Commands:
5223   --help, -h               Show this help message.
5224   --version, -v            Show version info.
5225   --install                Install $PROJECT_NAME to your system.
5226   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
5227   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
5228   --issue                  Issue a cert.
5229   --signcsr                Issue a cert from an existing csr.
5230   --deploy                 Deploy the cert to your server.
5231   --install-cert           Install the issued cert to apache/nginx or any other server.
5232   --renew, -r              Renew a cert.
5233   --renew-all              Renew all the certs.
5234   --revoke                 Revoke a cert.
5235   --remove                 Remove the cert from $PROJECT
5236   --list                   List all the certs.
5237   --showcsr                Show the content of a csr.
5238   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
5239   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
5240   --cron                   Run cron job to renew all the certs.
5241   --toPkcs                 Export the certificate and key to a pfx file.
5242   --toPkcs8                Convert to pkcs8 format.
5243   --update-account         Update account info.
5244   --register-account       Register account key.
5245   --deactivate-account     Deactivate the account.
5246   --create-account-key     Create an account private key, professional use.
5247   --create-domain-key      Create an domain private key, professional use.
5248   --createCSR, -ccsr       Create CSR , professional use.
5249   --deactivate             Deactivate the domain authz, professional use.
5250
5251 Parameters:
5252   --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
5253   --force, -f                       Used to force to install or force to renew a cert immediately.
5254   --staging, --test                 Use staging server, just for test.
5255   --debug                           Output debug info.
5256   --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
5257   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
5258   --standalone                      Use standalone mode.
5259   --stateless                       Use stateless mode, see: $_STATELESS_WIKI
5260   --tls                             Use standalone tls mode.
5261   --apache                          Use apache mode.
5262   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
5263   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
5264
5265   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
5266   --accountkeylength, -ak [2048]    Specifies the account key length.
5267   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
5268   --log-level 1|2                   Specifies the log level, default is 1.
5269   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
5270
5271   These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
5272
5273   --cert-file                       After issue/renew, the cert will be copied to this path.
5274   --key-file                        After issue/renew, the key will be copied to this path.
5275   --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
5276   --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.
5277
5278   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
5279
5280   --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
5281   --accountconf                     Specifies a customized account config file.
5282   --home                            Specifies the home dir for $PROJECT_NAME .
5283   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
5284   --config-home                     Specifies the home dir to save all the configurations.
5285   --useragent                       Specifies the user agent string. it will be saved for future use too.
5286   --accountemail                    Specifies the account email for registering, Only valid for the '--install' command.
5287   --accountkey                      Specifies the account key path, Only valid for the '--install' command.
5288   --days                            Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
5289   --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
5290   --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
5291   --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
5292   --listraw                         Only used for '--list' command, list the certs in raw format.
5293   --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
5294   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
5295   --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
5296   --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
5297   --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
5298   --no-color                        Do not output color text.
5299   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
5300   --csr                             Specifies the input csr.
5301   --pre-hook                        Command to be run before obtaining any certificates.
5302   --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
5303   --renew-hook                      Command to be run once for each successfully renewed certificate.
5304   --deploy-hook                     The hook file to deploy cert
5305   --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
5306   --always-force-new-domain-key     Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
5307   --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
5308   --listen-v4                       Force standalone/tls server to listen at ipv4.
5309   --listen-v6                       Force standalone/tls server to listen at ipv6.
5310   --openssl-bin                     Specifies a custom openssl bin location.
5311   --use-wget                        Force to use wget, if you have both curl and wget installed.
5312   "
5313 }
5314
5315 # nocron
5316 _installOnline() {
5317   _info "Installing from online archive."
5318   _nocron="$1"
5319   if [ ! "$BRANCH" ]; then
5320     BRANCH="master"
5321   fi
5322
5323   target="$PROJECT/archive/$BRANCH.tar.gz"
5324   _info "Downloading $target"
5325   localname="$BRANCH.tar.gz"
5326   if ! _get "$target" >$localname; then
5327     _err "Download error."
5328     return 1
5329   fi
5330   (
5331     _info "Extracting $localname"
5332     if ! (tar xzf $localname || gtar xzf $localname); then
5333       _err "Extraction error."
5334       exit 1
5335     fi
5336
5337     cd "$PROJECT_NAME-$BRANCH"
5338     chmod +x $PROJECT_ENTRY
5339     if ./$PROJECT_ENTRY install "$_nocron"; then
5340       _info "Install success!"
5341     fi
5342
5343     cd ..
5344
5345     rm -rf "$PROJECT_NAME-$BRANCH"
5346     rm -f "$localname"
5347   )
5348 }
5349
5350 upgrade() {
5351   if (
5352     _initpath
5353     export LE_WORKING_DIR
5354     cd "$LE_WORKING_DIR"
5355     _installOnline "nocron"
5356   ); then
5357     _info "Upgrade success!"
5358     exit 0
5359   else
5360     _err "Upgrade failed!"
5361     exit 1
5362   fi
5363 }
5364
5365 _processAccountConf() {
5366   if [ "$_useragent" ]; then
5367     _saveaccountconf "USER_AGENT" "$_useragent"
5368   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
5369     _saveaccountconf "USER_AGENT" "$USER_AGENT"
5370   fi
5371
5372   if [ "$_accountemail" ]; then
5373     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
5374   elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
5375     _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
5376   fi
5377
5378   if [ "$_openssl_bin" ]; then
5379     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
5380   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
5381     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
5382   fi
5383
5384   if [ "$_auto_upgrade" ]; then
5385     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
5386   elif [ "$AUTO_UPGRADE" ]; then
5387     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
5388   fi
5389
5390   if [ "$_use_wget" ]; then
5391     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
5392   elif [ "$ACME_USE_WGET" ]; then
5393     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
5394   fi
5395
5396 }
5397
5398 _process() {
5399   _CMD=""
5400   _domain=""
5401   _altdomains="$NO_VALUE"
5402   _webroot=""
5403   _keylength=""
5404   _accountkeylength=""
5405   _cert_file=""
5406   _key_file=""
5407   _ca_file=""
5408   _fullchain_file=""
5409   _reloadcmd=""
5410   _password=""
5411   _accountconf=""
5412   _useragent=""
5413   _accountemail=""
5414   _accountkey=""
5415   _certhome=""
5416   _confighome=""
5417   _httpport=""
5418   _tlsport=""
5419   _dnssleep=""
5420   _listraw=""
5421   _stopRenewOnError=""
5422   #_insecure=""
5423   _ca_bundle=""
5424   _ca_path=""
5425   _nocron=""
5426   _ecc=""
5427   _csr=""
5428   _pre_hook=""
5429   _post_hook=""
5430   _renew_hook=""
5431   _deploy_hook=""
5432   _logfile=""
5433   _log=""
5434   _local_address=""
5435   _log_level=""
5436   _auto_upgrade=""
5437   _listen_v4=""
5438   _listen_v6=""
5439   _openssl_bin=""
5440   _syslog=""
5441   _use_wget=""
5442   _server=""
5443   while [ ${#} -gt 0 ]; do
5444     case "${1}" in
5445
5446       --help | -h)
5447         showhelp
5448         return
5449         ;;
5450       --version | -v)
5451         version
5452         return
5453         ;;
5454       --install)
5455         _CMD="install"
5456         ;;
5457       --uninstall)
5458         _CMD="uninstall"
5459         ;;
5460       --upgrade)
5461         _CMD="upgrade"
5462         ;;
5463       --issue)
5464         _CMD="issue"
5465         ;;
5466       --deploy)
5467         _CMD="deploy"
5468         ;;
5469       --signcsr)
5470         _CMD="signcsr"
5471         ;;
5472       --showcsr)
5473         _CMD="showcsr"
5474         ;;
5475       --installcert | -i | --install-cert)
5476         _CMD="installcert"
5477         ;;
5478       --renew | -r)
5479         _CMD="renew"
5480         ;;
5481       --renewAll | --renewall | --renew-all)
5482         _CMD="renewAll"
5483         ;;
5484       --revoke)
5485         _CMD="revoke"
5486         ;;
5487       --remove)
5488         _CMD="remove"
5489         ;;
5490       --list)
5491         _CMD="list"
5492         ;;
5493       --installcronjob | --install-cronjob)
5494         _CMD="installcronjob"
5495         ;;
5496       --uninstallcronjob | --uninstall-cronjob)
5497         _CMD="uninstallcronjob"
5498         ;;
5499       --cron)
5500         _CMD="cron"
5501         ;;
5502       --toPkcs)
5503         _CMD="toPkcs"
5504         ;;
5505       --toPkcs8)
5506         _CMD="toPkcs8"
5507         ;;
5508       --createAccountKey | --createaccountkey | -cak | --create-account-key)
5509         _CMD="createAccountKey"
5510         ;;
5511       --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
5512         _CMD="createDomainKey"
5513         ;;
5514       --createCSR | --createcsr | -ccr)
5515         _CMD="createCSR"
5516         ;;
5517       --deactivate)
5518         _CMD="deactivate"
5519         ;;
5520       --updateaccount | --update-account)
5521         _CMD="updateaccount"
5522         ;;
5523       --registeraccount | --register-account)
5524         _CMD="registeraccount"
5525         ;;
5526       --deactivate-account)
5527         _CMD="deactivateaccount"
5528         ;;
5529       --domain | -d)
5530         _dvalue="$2"
5531
5532         if [ "$_dvalue" ]; then
5533           if _startswith "$_dvalue" "-"; then
5534             _err "'$_dvalue' is not a valid domain for parameter '$1'"
5535             return 1
5536           fi
5537           if _is_idn "$_dvalue" && ! _exists idn; then
5538             _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
5539             return 1
5540           fi
5541
5542           if [ -z "$_domain" ]; then
5543             _domain="$_dvalue"
5544           else
5545             if _startswith "$_dvalue" "*."; then
5546               _debug "Wildcard domain"
5547               export ACME_VERSION=2
5548             fi
5549             if [ "$_altdomains" = "$NO_VALUE" ]; then
5550               _altdomains="$_dvalue"
5551             else
5552               _altdomains="$_altdomains,$_dvalue"
5553             fi
5554           fi
5555         fi
5556
5557         shift
5558         ;;
5559
5560       --force | -f)
5561         FORCE="1"
5562         ;;
5563       --staging | --test)
5564         STAGE="1"
5565         ;;
5566       --server)
5567         ACME_DIRECTORY="$2"
5568         _server="$ACME_DIRECTORY"
5569         export ACME_DIRECTORY
5570         shift
5571         ;;
5572       --debug)
5573         if [ -z "$2" ] || _startswith "$2" "-"; then
5574           DEBUG="$DEBUG_LEVEL_DEFAULT"
5575         else
5576           DEBUG="$2"
5577           shift
5578         fi
5579         ;;
5580       --output-insecure)
5581         export OUTPUT_INSECURE=1
5582         ;;
5583       --webroot | -w)
5584         wvalue="$2"
5585         if [ -z "$_webroot" ]; then
5586           _webroot="$wvalue"
5587         else
5588           _webroot="$_webroot,$wvalue"
5589         fi
5590         shift
5591         ;;
5592       --standalone)
5593         wvalue="$NO_VALUE"
5594         if [ -z "$_webroot" ]; then
5595           _webroot="$wvalue"
5596         else
5597           _webroot="$_webroot,$wvalue"
5598         fi
5599         ;;
5600       --stateless)
5601         wvalue="$MODE_STATELESS"
5602         if [ -z "$_webroot" ]; then
5603           _webroot="$wvalue"
5604         else
5605           _webroot="$_webroot,$wvalue"
5606         fi
5607         ;;
5608       --local-address)
5609         lvalue="$2"
5610         _local_address="$_local_address$lvalue,"
5611         shift
5612         ;;
5613       --apache)
5614         wvalue="apache"
5615         if [ -z "$_webroot" ]; then
5616           _webroot="$wvalue"
5617         else
5618           _webroot="$_webroot,$wvalue"
5619         fi
5620         ;;
5621       --nginx)
5622         wvalue="$NGINX"
5623         if [ -z "$_webroot" ]; then
5624           _webroot="$wvalue"
5625         else
5626           _webroot="$_webroot,$wvalue"
5627         fi
5628         ;;
5629       --tls)
5630         wvalue="$W_TLS"
5631         if [ -z "$_webroot" ]; then
5632           _webroot="$wvalue"
5633         else
5634           _webroot="$_webroot,$wvalue"
5635         fi
5636         ;;
5637       --dns)
5638         wvalue="dns"
5639         if [ "$2" ] && ! _startswith "$2" "-"; then
5640           wvalue="$2"
5641           shift
5642         fi
5643         if [ -z "$_webroot" ]; then
5644           _webroot="$wvalue"
5645         else
5646           _webroot="$_webroot,$wvalue"
5647         fi
5648         ;;
5649       --dnssleep)
5650         _dnssleep="$2"
5651         Le_DNSSleep="$_dnssleep"
5652         shift
5653         ;;
5654
5655       --keylength | -k)
5656         _keylength="$2"
5657         shift
5658         ;;
5659       --accountkeylength | -ak)
5660         _accountkeylength="$2"
5661         shift
5662         ;;
5663
5664       --cert-file | --certpath)
5665         _cert_file="$2"
5666         shift
5667         ;;
5668       --key-file | --keypath)
5669         _key_file="$2"
5670         shift
5671         ;;
5672       --ca-file | --capath)
5673         _ca_file="$2"
5674         shift
5675         ;;
5676       --fullchain-file | --fullchainpath)
5677         _fullchain_file="$2"
5678         shift
5679         ;;
5680       --reloadcmd | --reloadCmd)
5681         _reloadcmd="$2"
5682         shift
5683         ;;
5684       --password)
5685         _password="$2"
5686         shift
5687         ;;
5688       --accountconf)
5689         _accountconf="$2"
5690         ACCOUNT_CONF_PATH="$_accountconf"
5691         shift
5692         ;;
5693       --home)
5694         LE_WORKING_DIR="$2"
5695         shift
5696         ;;
5697       --certhome | --cert-home)
5698         _certhome="$2"
5699         CERT_HOME="$_certhome"
5700         shift
5701         ;;
5702       --config-home)
5703         _confighome="$2"
5704         LE_CONFIG_HOME="$_confighome"
5705         shift
5706         ;;
5707       --useragent)
5708         _useragent="$2"
5709         USER_AGENT="$_useragent"
5710         shift
5711         ;;
5712       --accountemail)
5713         _accountemail="$2"
5714         ACCOUNT_EMAIL="$_accountemail"
5715         shift
5716         ;;
5717       --accountkey)
5718         _accountkey="$2"
5719         ACCOUNT_KEY_PATH="$_accountkey"
5720         shift
5721         ;;
5722       --days)
5723         _days="$2"
5724         Le_RenewalDays="$_days"
5725         shift
5726         ;;
5727       --httpport)
5728         _httpport="$2"
5729         Le_HTTPPort="$_httpport"
5730         shift
5731         ;;
5732       --tlsport)
5733         _tlsport="$2"
5734         Le_TLSPort="$_tlsport"
5735         shift
5736         ;;
5737
5738       --listraw)
5739         _listraw="raw"
5740         ;;
5741       --stopRenewOnError | --stoprenewonerror | -se)
5742         _stopRenewOnError="1"
5743         ;;
5744       --insecure)
5745         #_insecure="1"
5746         HTTPS_INSECURE="1"
5747         ;;
5748       --ca-bundle)
5749         _ca_bundle="$(_readlink -f "$2")"
5750         CA_BUNDLE="$_ca_bundle"
5751         shift
5752         ;;
5753       --ca-path)
5754         _ca_path="$2"
5755         CA_PATH="$_ca_path"
5756         shift
5757         ;;
5758       --nocron)
5759         _nocron="1"
5760         ;;
5761       --no-color)
5762         export ACME_NO_COLOR=1
5763         ;;
5764       --ecc)
5765         _ecc="isEcc"
5766         ;;
5767       --csr)
5768         _csr="$2"
5769         shift
5770         ;;
5771       --pre-hook)
5772         _pre_hook="$2"
5773         shift
5774         ;;
5775       --post-hook)
5776         _post_hook="$2"
5777         shift
5778         ;;
5779       --renew-hook)
5780         _renew_hook="$2"
5781         shift
5782         ;;
5783       --deploy-hook)
5784         if [ -z "$2" ] || _startswith "$2" "-"; then
5785           _usage "Please specify a value for '--deploy-hook'"
5786           return 1
5787         fi
5788         _deploy_hook="$_deploy_hook$2,"
5789         shift
5790         ;;
5791       --ocsp-must-staple | --ocsp)
5792         Le_OCSP_Staple="1"
5793         ;;
5794       --always-force-new-domain-key)
5795         if [ -z "$2" ] || _startswith "$2" "-"; then
5796           Le_ForceNewDomainKey=1
5797         else
5798           Le_ForceNewDomainKey="$2"
5799           shift
5800         fi
5801         ;;
5802       --log | --logfile)
5803         _log="1"
5804         _logfile="$2"
5805         if _startswith "$_logfile" '-'; then
5806           _logfile=""
5807         else
5808           shift
5809         fi
5810         LOG_FILE="$_logfile"
5811         if [ -z "$LOG_LEVEL" ]; then
5812           LOG_LEVEL="$DEFAULT_LOG_LEVEL"
5813         fi
5814         ;;
5815       --log-level)
5816         _log_level="$2"
5817         LOG_LEVEL="$_log_level"
5818         shift
5819         ;;
5820       --syslog)
5821         if ! _startswith "$2" '-'; then
5822           _syslog="$2"
5823           shift
5824         fi
5825         if [ -z "$_syslog" ]; then
5826           _syslog="$SYSLOG_LEVEL_DEFAULT"
5827         fi
5828         ;;
5829       --auto-upgrade)
5830         _auto_upgrade="$2"
5831         if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
5832           _auto_upgrade="1"
5833         else
5834           shift
5835         fi
5836         AUTO_UPGRADE="$_auto_upgrade"
5837         ;;
5838       --listen-v4)
5839         _listen_v4="1"
5840         Le_Listen_V4="$_listen_v4"
5841         ;;
5842       --listen-v6)
5843         _listen_v6="1"
5844         Le_Listen_V6="$_listen_v6"
5845         ;;
5846       --openssl-bin)
5847         _openssl_bin="$2"
5848         ACME_OPENSSL_BIN="$_openssl_bin"
5849         shift
5850         ;;
5851       --use-wget)
5852         _use_wget="1"
5853         ACME_USE_WGET="1"
5854         ;;
5855       *)
5856         _err "Unknown parameter : $1"
5857         return 1
5858         ;;
5859     esac
5860
5861     shift 1
5862   done
5863
5864   if [ "${_CMD}" != "install" ]; then
5865     __initHome
5866     if [ "$_log" ]; then
5867       if [ -z "$_logfile" ]; then
5868         _logfile="$DEFAULT_LOG_FILE"
5869       fi
5870     fi
5871     if [ "$_logfile" ]; then
5872       _saveaccountconf "LOG_FILE" "$_logfile"
5873       LOG_FILE="$_logfile"
5874     fi
5875
5876     if [ "$_log_level" ]; then
5877       _saveaccountconf "LOG_LEVEL" "$_log_level"
5878       LOG_LEVEL="$_log_level"
5879     fi
5880
5881     if [ "$_syslog" ]; then
5882       if _exists logger; then
5883         if [ "$_syslog" = "0" ]; then
5884           _clearaccountconf "SYS_LOG"
5885         else
5886           _saveaccountconf "SYS_LOG" "$_syslog"
5887         fi
5888         SYS_LOG="$_syslog"
5889       else
5890         _err "The 'logger' command is not found, can not enable syslog."
5891         _clearaccountconf "SYS_LOG"
5892         SYS_LOG=""
5893       fi
5894     fi
5895
5896     _processAccountConf
5897   fi
5898
5899   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
5900
5901   if [ "$DEBUG" ]; then
5902     version
5903     if [ "$_server" ]; then
5904       _debug "Using server: $_server"
5905     fi
5906   fi
5907
5908   case "${_CMD}" in
5909     install) install "$_nocron" "$_confighome" ;;
5910     uninstall) uninstall "$_nocron" ;;
5911     upgrade) upgrade ;;
5912     issue)
5913       issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address"
5914       ;;
5915     deploy)
5916       deploy "$_domain" "$_deploy_hook" "$_ecc"
5917       ;;
5918     signcsr)
5919       signcsr "$_csr" "$_webroot"
5920       ;;
5921     showcsr)
5922       showcsr "$_csr" "$_domain"
5923       ;;
5924     installcert)
5925       installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
5926       ;;
5927     renew)
5928       renew "$_domain" "$_ecc"
5929       ;;
5930     renewAll)
5931       renewAll "$_stopRenewOnError"
5932       ;;
5933     revoke)
5934       revoke "$_domain" "$_ecc"
5935       ;;
5936     remove)
5937       remove "$_domain" "$_ecc"
5938       ;;
5939     deactivate)
5940       deactivate "$_domain,$_altdomains"
5941       ;;
5942     registeraccount)
5943       registeraccount "$_accountkeylength"
5944       ;;
5945     updateaccount)
5946       updateaccount
5947       ;;
5948     deactivateaccount)
5949       deactivateaccount
5950       ;;
5951     list)
5952       list "$_listraw"
5953       ;;
5954     installcronjob) installcronjob "$_confighome" ;;
5955     uninstallcronjob) uninstallcronjob ;;
5956     cron) cron ;;
5957     toPkcs)
5958       toPkcs "$_domain" "$_password" "$_ecc"
5959       ;;
5960     toPkcs8)
5961       toPkcs8 "$_domain" "$_ecc"
5962       ;;
5963     createAccountKey)
5964       createAccountKey "$_accountkeylength"
5965       ;;
5966     createDomainKey)
5967       createDomainKey "$_domain" "$_keylength"
5968       ;;
5969     createCSR)
5970       createCSR "$_domain" "$_altdomains" "$_ecc"
5971       ;;
5972
5973     *)
5974       if [ "$_CMD" ]; then
5975         _err "Invalid command: $_CMD"
5976       fi
5977       showhelp
5978       return 1
5979       ;;
5980   esac
5981   _ret="$?"
5982   if [ "$_ret" != "0" ]; then
5983     return $_ret
5984   fi
5985
5986   if [ "${_CMD}" = "install" ]; then
5987     if [ "$_log" ]; then
5988       if [ -z "$LOG_FILE" ]; then
5989         LOG_FILE="$DEFAULT_LOG_FILE"
5990       fi
5991       _saveaccountconf "LOG_FILE" "$LOG_FILE"
5992     fi
5993
5994     if [ "$_log_level" ]; then
5995       _saveaccountconf "LOG_LEVEL" "$_log_level"
5996     fi
5997
5998     if [ "$_syslog" ]; then
5999       if _exists logger; then
6000         if [ "$_syslog" = "0" ]; then
6001           _clearaccountconf "SYS_LOG"
6002         else
6003           _saveaccountconf "SYS_LOG" "$_syslog"
6004         fi
6005       else
6006         _err "The 'logger' command is not found, can not enable syslog."
6007         _clearaccountconf "SYS_LOG"
6008         SYS_LOG=""
6009       fi
6010     fi
6011
6012     _processAccountConf
6013   fi
6014
6015 }
6016
6017 if [ "$INSTALLONLINE" ]; then
6018   INSTALLONLINE=""
6019   _installOnline
6020   exit
6021 fi
6022
6023 main() {
6024   [ -z "$1" ] && showhelp && return
6025   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
6026 }
6027
6028 main "$@"