acme.sh

   1 #!/usr/bin/env sh
   2
   3 VER=2.7.0
   4
   5 PROJECT_NAME="acme.sh"
   6
   7 PROJECT_ENTRY="acme.sh"
   8
   9 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
  10
  11 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
  12 _SCRIPT_="$0"
  13
  14 _SUB_FOLDERS="dnsapi deploy"
  15
  16 DEFAULT_CA="https://acme-v01.api.letsencrypt.org"
  17 DEFAULT_AGREEMENT="https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf"
  18
  19 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
  20 DEFAULT_ACCOUNT_EMAIL=""
  21
  22 DEFAULT_ACCOUNT_KEY_LENGTH=2048
  23 DEFAULT_DOMAIN_KEY_LENGTH=2048
  24
  25 DEFAULT_OPENSSL_BIN="openssl"
  26
  27 STAGE_CA="https://acme-staging.api.letsencrypt.org"
  28
  29 VTYPE_HTTP="http-01"
  30 VTYPE_DNS="dns-01"
  31 VTYPE_TLS="tls-sni-01"
  32 #VTYPE_TLS2="tls-sni-02"
  33
  34 LOCAL_ANY_ADDRESS="0.0.0.0"
  35
  36 MAX_RENEW=60
  37
  38 DEFAULT_DNS_SLEEP=120
  39
  40 NO_VALUE="no"
  41
  42 W_TLS="tls"
  43
  44 MODE_STATELESS="stateless"
  45
  46 STATE_VERIFIED="verified_ok"
  47
  48 NGINX="nginx:"
  49 NGINX_START="#ACME_NGINX_START"
  50 NGINX_END="#ACME_NGINX_END"
  51
  52 BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
  53 END_CSR="-----END CERTIFICATE REQUEST-----"
  54
  55 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
  56 END_CERT="-----END CERTIFICATE-----"
  57
  58 RENEW_SKIP=2
  59
  60 ECC_SEP="_"
  61 ECC_SUFFIX="${ECC_SEP}ecc"
  62
  63 LOG_LEVEL_1=1
  64 LOG_LEVEL_2=2
  65 LOG_LEVEL_3=3
  66 DEFAULT_LOG_LEVEL="$LOG_LEVEL_1"
  67
  68 DEBUG_LEVEL_1=1
  69 DEBUG_LEVEL_2=2
  70 DEBUG_LEVEL_3=3
  71 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
  72 DEBUG_LEVEL_NONE=0
  73
  74 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
  75
  76 SYSLOG_ERROR="user.error"
  77 SYSLOG_INFO="user.info"
  78 SYSLOG_DEBUG="user.debug"
  79
  80 #error
  81 SYSLOG_LEVEL_ERROR=3
  82 #info
  83 SYSLOG_LEVEL_INFO=6
  84 #debug
  85 SYSLOG_LEVEL_DEBUG=7
  86 #debug2
  87 SYSLOG_LEVEL_DEBUG_2=8
  88 #debug3
  89 SYSLOG_LEVEL_DEBUG_3=9
  90
  91 SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
  92 #none
  93 SYSLOG_LEVEL_NONE=0
  94
  95 _DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
  96
  97 _PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
  98
  99 _STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
 100
 101 __INTERACTIVE=""
 102 if [ -t 1 ]; then
 103   __INTERACTIVE="1"
 104 fi
 105
 106 __green() {
 107   if [ "$__INTERACTIVE" ]; then
 108     printf '\033[1;31;32m'
 109   fi
 110   printf -- "%b" "$1"
 111   if [ "$__INTERACTIVE" ]; then
 112     printf '\033[0m'
 113   fi
 114 }
 115
 116 __red() {
 117   if [ "$__INTERACTIVE" ]; then
 118     printf '\033[1;31;40m'
 119   fi
 120   printf -- "%b" "$1"
 121   if [ "$__INTERACTIVE" ]; then
 122     printf '\033[0m'
 123   fi
 124 }
 125
 126 _printargs() {
 127   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 128     printf -- "%s" "[$(date)] "
 129   fi
 130   if [ -z "$2" ]; then
 131     printf -- "%s" "$1"
 132   else
 133     printf -- "%s" "$1='$2'"
 134   fi
 135   printf "\n"
 136 }
 137
 138 _dlg_versions() {
 139   echo "Diagnosis versions: "
 140   echo "openssl:$ACME_OPENSSL_BIN"
 141   if _exists "${ACME_OPENSSL_BIN:-openssl}"; then
 142     ${ACME_OPENSSL_BIN:-openssl} version 2>&1
 143   else
 144     echo "$ACME_OPENSSL_BIN doesn't exists."
 145   fi
 146
 147   echo "apache:"
 148   if [ "$_APACHECTL" ] && _exists "$_APACHECTL"; then
 149     $_APACHECTL -V 2>&1
 150   else
 151     echo "apache doesn't exists."
 152   fi
 153
 154   echo "nc:"
 155   if _exists "nc"; then
 156     nc -h 2>&1
 157   else
 158     _debug "nc doesn't exists."
 159   fi
 160 }
 161
 162 #class
 163 _syslog() {
 164   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" = "$SYSLOG_LEVEL_NONE" ]; then
 165     return
 166   fi
 167   _logclass="$1"
 168   shift
 169   if [ -z "$__logger_i" ]; then
 170     if _contains "$(logger --help 2>&1)" "-i"; then
 171       __logger_i="logger -i"
 172     else
 173       __logger_i="logger"
 174     fi
 175   fi
 176   $__logger_i -t "$PROJECT_NAME" -p "$_logclass" "$(_printargs "$@")" >/dev/null 2>&1
 177 }
 178
 179 _log() {
 180   [ -z "$LOG_FILE" ] && return
 181   _printargs "$@" >>"$LOG_FILE"
 182 }
 183
 184 _info() {
 185   _log "$@"
 186   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_INFO" ]; then
 187     _syslog "$SYSLOG_INFO" "$@"
 188   fi
 189   _printargs "$@"
 190 }
 191
 192 _err() {
 193   _syslog "$SYSLOG_ERROR" "$@"
 194   _log "$@"
 195   if [ -z "$NO_TIMESTAMP" ] || [ "$NO_TIMESTAMP" = "0" ]; then
 196     printf -- "%s" "[$(date)] " >&2
 197   fi
 198   if [ -z "$2" ]; then
 199     __red "$1" >&2
 200   else
 201     __red "$1='$2'" >&2
 202   fi
 203   printf "\n" >&2
 204   return 1
 205 }
 206
 207 _usage() {
 208   __red "$@" >&2
 209   printf "\n" >&2
 210 }
 211
 212 _debug() {
 213   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 214     _log "$@"
 215   fi
 216   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 217     _syslog "$SYSLOG_DEBUG" "$@"
 218   fi
 219   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 220     _printargs "$@" >&2
 221   fi
 222 }
 223
 224 #output the sensitive messages
 225 _secure_debug() {
 226   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
 227     if [ "$OUTPUT_INSECURE" = "1" ]; then
 228       _log "$@"
 229     else
 230       _log "$1" "$HIDDEN_VALUE"
 231     fi
 232   fi
 233   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG" ]; then
 234     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 235   fi
 236   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
 237     if [ "$OUTPUT_INSECURE" = "1" ]; then
 238       _printargs "$@" >&2
 239     else
 240       _printargs "$1" "$HIDDEN_VALUE" >&2
 241     fi
 242   fi
 243 }
 244
 245 _debug2() {
 246   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 247     _log "$@"
 248   fi
 249   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 250     _syslog "$SYSLOG_DEBUG" "$@"
 251   fi
 252   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 253     _printargs "$@" >&2
 254   fi
 255 }
 256
 257 _secure_debug2() {
 258   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_2" ]; then
 259     if [ "$OUTPUT_INSECURE" = "1" ]; then
 260       _log "$@"
 261     else
 262       _log "$1" "$HIDDEN_VALUE"
 263     fi
 264   fi
 265   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_2" ]; then
 266     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 267   fi
 268   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
 269     if [ "$OUTPUT_INSECURE" = "1" ]; then
 270       _printargs "$@" >&2
 271     else
 272       _printargs "$1" "$HIDDEN_VALUE" >&2
 273     fi
 274   fi
 275 }
 276
 277 _debug3() {
 278   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 279     _log "$@"
 280   fi
 281   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 282     _syslog "$SYSLOG_DEBUG" "$@"
 283   fi
 284   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 285     _printargs "$@" >&2
 286   fi
 287 }
 288
 289 _secure_debug3() {
 290   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_3" ]; then
 291     if [ "$OUTPUT_INSECURE" = "1" ]; then
 292       _log "$@"
 293     else
 294       _log "$1" "$HIDDEN_VALUE"
 295     fi
 296   fi
 297   if [ "${SYS_LOG:-$SYSLOG_LEVEL_NONE}" -ge "$SYSLOG_LEVEL_DEBUG_3" ]; then
 298     _syslog "$SYSLOG_DEBUG" "$1" "$HIDDEN_VALUE"
 299   fi
 300   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
 301     if [ "$OUTPUT_INSECURE" = "1" ]; then
 302       _printargs "$@" >&2
 303     else
 304       _printargs "$1" "$HIDDEN_VALUE" >&2
 305     fi
 306   fi
 307 }
 308
 309 _upper_case() {
 310   # shellcheck disable=SC2018,SC2019
 311   tr 'a-z' 'A-Z'
 312 }
 313
 314 _lower_case() {
 315   # shellcheck disable=SC2018,SC2019
 316   tr 'A-Z' 'a-z'
 317 }
 318
 319 _startswith() {
 320   _str="$1"
 321   _sub="$2"
 322   echo "$_str" | grep "^$_sub" >/dev/null 2>&1
 323 }
 324
 325 _endswith() {
 326   _str="$1"
 327   _sub="$2"
 328   echo "$_str" | grep -- "$_sub\$" >/dev/null 2>&1
 329 }
 330
 331 _contains() {
 332   _str="$1"
 333   _sub="$2"
 334   echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
 335 }
 336
 337 _hasfield() {
 338   _str="$1"
 339   _field="$2"
 340   _sep="$3"
 341   if [ -z "$_field" ]; then
 342     _usage "Usage: str field  [sep]"
 343     return 1
 344   fi
 345
 346   if [ -z "$_sep" ]; then
 347     _sep=","
 348   fi
 349
 350   for f in $(echo "$_str" | tr "$_sep" ' '); do
 351     if [ "$f" = "$_field" ]; then
 352       _debug2 "'$_str' contains '$_field'"
 353       return 0 #contains ok
 354     fi
 355   done
 356   _debug2 "'$_str' does not contain '$_field'"
 357   return 1 #not contains
 358 }
 359
 360 _getfield() {
 361   _str="$1"
 362   _findex="$2"
 363   _sep="$3"
 364
 365   if [ -z "$_findex" ]; then
 366     _usage "Usage: str field  [sep]"
 367     return 1
 368   fi
 369
 370   if [ -z "$_sep" ]; then
 371     _sep=","
 372   fi
 373
 374   _ffi="$_findex"
 375   while [ "$_ffi" -gt "0" ]; do
 376     _fv="$(echo "$_str" | cut -d "$_sep" -f "$_ffi")"
 377     if [ "$_fv" ]; then
 378       printf -- "%s" "$_fv"
 379       return 0
 380     fi
 381     _ffi="$(_math "$_ffi" - 1)"
 382   done
 383
 384   printf -- "%s" "$_str"
 385
 386 }
 387
 388 _exists() {
 389   cmd="$1"
 390   if [ -z "$cmd" ]; then
 391     _usage "Usage: _exists cmd"
 392     return 1
 393   fi
 394
 395   if eval type type >/dev/null 2>&1; then
 396     eval type "$cmd" >/dev/null 2>&1
 397   elif command >/dev/null 2>&1; then
 398     command -v "$cmd" >/dev/null 2>&1
 399   else
 400     which "$cmd" >/dev/null 2>&1
 401   fi
 402   ret="$?"
 403   _debug3 "$cmd exists=$ret"
 404   return $ret
 405 }
 406
 407 #a + b
 408 _math() {
 409   _m_opts="$@"
 410   printf "%s" "$(($_m_opts))"
 411 }
 412
 413 _h_char_2_dec() {
 414   _ch=$1
 415   case "${_ch}" in
 416     a | A)
 417       printf "10"
 418       ;;
 419     b | B)
 420       printf "11"
 421       ;;
 422     c | C)
 423       printf "12"
 424       ;;
 425     d | D)
 426       printf "13"
 427       ;;
 428     e | E)
 429       printf "14"
 430       ;;
 431     f | F)
 432       printf "15"
 433       ;;
 434     *)
 435       printf "%s" "$_ch"
 436       ;;
 437   esac
 438
 439 }
 440
 441 _URGLY_PRINTF=""
 442 if [ "$(printf '\x41')" != 'A' ]; then
 443   _URGLY_PRINTF=1
 444 fi
 445
 446 _h2b() {
 447   if _exists xxd; then
 448     xxd -r -p
 449     return
 450   fi
 451
 452   hex=$(cat)
 453   ic=""
 454   jc=""
 455   _debug2 _URGLY_PRINTF "$_URGLY_PRINTF"
 456   if [ -z "$_URGLY_PRINTF" ]; then
 457     if _exists xargs; then
 458       _debug2 "xargs"
 459       echo "$hex" | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI' | xargs printf
 460     else
 461       for h in $(echo "$hex" | sed 's/\([0-9A-F]\{2\}\)/ \1/gI'); do
 462         if [ -z "$h" ]; then
 463           break
 464         fi
 465         printf "\x$h%s"
 466       done
 467     fi
 468   else
 469     for c in $(echo "$hex" | sed 's/\([0-9A-F]\)/ \1/gI'); do
 470       if [ -z "$ic" ]; then
 471         ic=$c
 472         continue
 473       fi
 474       jc=$c
 475       ic="$(_h_char_2_dec "$ic")"
 476       jc="$(_h_char_2_dec "$jc")"
 477       printf '\'"$(printf "%o" "$(_math "$ic" \* 16 + $jc)")""%s"
 478       ic=""
 479       jc=""
 480     done
 481   fi
 482
 483 }
 484
 485 _is_solaris() {
 486   _contains "${__OS__:=$(uname -a)}" "solaris" || _contains "${__OS__:=$(uname -a)}" "SunOS"
 487 }
 488
 489 #_ascii_hex str
 490 #this can only process ascii chars, should only be used when od command is missing as a backup way.
 491 _ascii_hex() {
 492   _debug2 "Using _ascii_hex"
 493   _str="$1"
 494   _str_len=${#_str}
 495   _h_i=1
 496   while [ "$_h_i" -le "$_str_len" ]; do
 497     _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
 498     printf " %02x" "'$_str_c"
 499     _h_i="$(_math "$_h_i" + 1)"
 500   done
 501 }
 502
 503 #stdin  output hexstr splited by one space
 504 #input:"abc"
 505 #output: " 61 62 63"
 506 _hex_dump() {
 507   if _exists od; then
 508     od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
 509   elif _exists hexdump; then
 510     _debug3 "using hexdump"
 511     hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
 512   elif _exists xxd; then
 513     _debug3 "using xxd"
 514     xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
 515   else
 516     _debug3 "using _ascii_hex"
 517     str=$(cat)
 518     _ascii_hex "$str"
 519   fi
 520 }
 521
 522 #url encode, no-preserved chars
 523 #A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
 524 #41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
 525
 526 #a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
 527 #61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
 528
 529 #0  1  2  3  4  5  6  7  8  9  -  _  .  ~
 530 #30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
 531
 532 #stdin stdout
 533 _url_encode() {
 534   _hex_str=$(_hex_dump)
 535   _debug3 "_url_encode"
 536   _debug3 "_hex_str" "$_hex_str"
 537   for _hex_code in $_hex_str; do
 538     #upper case
 539     case "${_hex_code}" in
 540       "41")
 541         printf "%s" "A"
 542         ;;
 543       "42")
 544         printf "%s" "B"
 545         ;;
 546       "43")
 547         printf "%s" "C"
 548         ;;
 549       "44")
 550         printf "%s" "D"
 551         ;;
 552       "45")
 553         printf "%s" "E"
 554         ;;
 555       "46")
 556         printf "%s" "F"
 557         ;;
 558       "47")
 559         printf "%s" "G"
 560         ;;
 561       "48")
 562         printf "%s" "H"
 563         ;;
 564       "49")
 565         printf "%s" "I"
 566         ;;
 567       "4a")
 568         printf "%s" "J"
 569         ;;
 570       "4b")
 571         printf "%s" "K"
 572         ;;
 573       "4c")
 574         printf "%s" "L"
 575         ;;
 576       "4d")
 577         printf "%s" "M"
 578         ;;
 579       "4e")
 580         printf "%s" "N"
 581         ;;
 582       "4f")
 583         printf "%s" "O"
 584         ;;
 585       "50")
 586         printf "%s" "P"
 587         ;;
 588       "51")
 589         printf "%s" "Q"
 590         ;;
 591       "52")
 592         printf "%s" "R"
 593         ;;
 594       "53")
 595         printf "%s" "S"
 596         ;;
 597       "54")
 598         printf "%s" "T"
 599         ;;
 600       "55")
 601         printf "%s" "U"
 602         ;;
 603       "56")
 604         printf "%s" "V"
 605         ;;
 606       "57")
 607         printf "%s" "W"
 608         ;;
 609       "58")
 610         printf "%s" "X"
 611         ;;
 612       "59")
 613         printf "%s" "Y"
 614         ;;
 615       "5a")
 616         printf "%s" "Z"
 617         ;;
 618
 619       #lower case
 620       "61")
 621         printf "%s" "a"
 622         ;;
 623       "62")
 624         printf "%s" "b"
 625         ;;
 626       "63")
 627         printf "%s" "c"
 628         ;;
 629       "64")
 630         printf "%s" "d"
 631         ;;
 632       "65")
 633         printf "%s" "e"
 634         ;;
 635       "66")
 636         printf "%s" "f"
 637         ;;
 638       "67")
 639         printf "%s" "g"
 640         ;;
 641       "68")
 642         printf "%s" "h"
 643         ;;
 644       "69")
 645         printf "%s" "i"
 646         ;;
 647       "6a")
 648         printf "%s" "j"
 649         ;;
 650       "6b")
 651         printf "%s" "k"
 652         ;;
 653       "6c")
 654         printf "%s" "l"
 655         ;;
 656       "6d")
 657         printf "%s" "m"
 658         ;;
 659       "6e")
 660         printf "%s" "n"
 661         ;;
 662       "6f")
 663         printf "%s" "o"
 664         ;;
 665       "70")
 666         printf "%s" "p"
 667         ;;
 668       "71")
 669         printf "%s" "q"
 670         ;;
 671       "72")
 672         printf "%s" "r"
 673         ;;
 674       "73")
 675         printf "%s" "s"
 676         ;;
 677       "74")
 678         printf "%s" "t"
 679         ;;
 680       "75")
 681         printf "%s" "u"
 682         ;;
 683       "76")
 684         printf "%s" "v"
 685         ;;
 686       "77")
 687         printf "%s" "w"
 688         ;;
 689       "78")
 690         printf "%s" "x"
 691         ;;
 692       "79")
 693         printf "%s" "y"
 694         ;;
 695       "7a")
 696         printf "%s" "z"
 697         ;;
 698       #numbers
 699       "30")
 700         printf "%s" "0"
 701         ;;
 702       "31")
 703         printf "%s" "1"
 704         ;;
 705       "32")
 706         printf "%s" "2"
 707         ;;
 708       "33")
 709         printf "%s" "3"
 710         ;;
 711       "34")
 712         printf "%s" "4"
 713         ;;
 714       "35")
 715         printf "%s" "5"
 716         ;;
 717       "36")
 718         printf "%s" "6"
 719         ;;
 720       "37")
 721         printf "%s" "7"
 722         ;;
 723       "38")
 724         printf "%s" "8"
 725         ;;
 726       "39")
 727         printf "%s" "9"
 728         ;;
 729       "2d")
 730         printf "%s" "-"
 731         ;;
 732       "5f")
 733         printf "%s" "_"
 734         ;;
 735       "2e")
 736         printf "%s" "."
 737         ;;
 738       "7e")
 739         printf "%s" "~"
 740         ;;
 741       #other hex
 742       *)
 743         printf '%%%s' "$_hex_code"
 744         ;;
 745     esac
 746   done
 747 }
 748
 749 #options file
 750 _sed_i() {
 751   options="$1"
 752   filename="$2"
 753   if [ -z "$filename" ]; then
 754     _usage "Usage:_sed_i options filename"
 755     return 1
 756   fi
 757   _debug2 options "$options"
 758   if sed -h 2>&1 | grep "\-i\[SUFFIX]" >/dev/null 2>&1; then
 759     _debug "Using sed  -i"
 760     sed -i "$options" "$filename"
 761   else
 762     _debug "No -i support in sed"
 763     text="$(cat "$filename")"
 764     echo "$text" | sed "$options" >"$filename"
 765   fi
 766 }
 767
 768 _egrep_o() {
 769   if ! egrep -o "$1" 2>/dev/null; then
 770     sed -n 's/.*\('"$1"'\).*/\1/p'
 771   fi
 772 }
 773
 774 #Usage: file startline endline
 775 _getfile() {
 776   filename="$1"
 777   startline="$2"
 778   endline="$3"
 779   if [ -z "$endline" ]; then
 780     _usage "Usage: file startline endline"
 781     return 1
 782   fi
 783
 784   i="$(grep -n -- "$startline" "$filename" | cut -d : -f 1)"
 785   if [ -z "$i" ]; then
 786     _err "Can not find start line: $startline"
 787     return 1
 788   fi
 789   i="$(_math "$i" + 1)"
 790   _debug i "$i"
 791
 792   j="$(grep -n -- "$endline" "$filename" | cut -d : -f 1)"
 793   if [ -z "$j" ]; then
 794     _err "Can not find end line: $endline"
 795     return 1
 796   fi
 797   j="$(_math "$j" - 1)"
 798   _debug j "$j"
 799
 800   sed -n "$i,${j}p" "$filename"
 801
 802 }
 803
 804 #Usage: multiline
 805 _base64() {
 806   [ "" ] #urgly
 807   if [ "$1" ]; then
 808     _debug3 "base64 multiline:'$1'"
 809     ${ACME_OPENSSL_BIN:-openssl} base64 -e
 810   else
 811     _debug3 "base64 single line."
 812     ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
 813   fi
 814 }
 815
 816 #Usage: multiline
 817 _dbase64() {
 818   if [ "$1" ]; then
 819     ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
 820   else
 821     ${ACME_OPENSSL_BIN:-openssl} base64 -d
 822   fi
 823 }
 824
 825 #Usage: hashalg  [outputhex]
 826 #Output Base64-encoded digest
 827 _digest() {
 828   alg="$1"
 829   if [ -z "$alg" ]; then
 830     _usage "Usage: _digest hashalg"
 831     return 1
 832   fi
 833
 834   outputhex="$2"
 835
 836   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ] || [ "$alg" = "md5" ]; then
 837     if [ "$outputhex" ]; then
 838       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hex | cut -d = -f 2 | tr -d ' '
 839     else
 840       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -binary | _base64
 841     fi
 842   else
 843     _err "$alg is not supported yet"
 844     return 1
 845   fi
 846
 847 }
 848
 849 #Usage: hashalg  secret_hex  [outputhex]
 850 #Output binary hmac
 851 _hmac() {
 852   alg="$1"
 853   secret_hex="$2"
 854   outputhex="$3"
 855
 856   if [ -z "$secret_hex" ]; then
 857     _usage "Usage: _hmac hashalg secret [outputhex]"
 858     return 1
 859   fi
 860
 861   if [ "$alg" = "sha256" ] || [ "$alg" = "sha1" ]; then
 862     if [ "$outputhex" ]; then
 863       (${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)") | cut -d = -f 2 | tr -d ' '
 864     else
 865       ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -mac HMAC -macopt "hexkey:$secret_hex" -binary 2>/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -"$alg" -hmac "$(printf "%s" "$secret_hex" | _h2b)" -binary
 866     fi
 867   else
 868     _err "$alg is not supported yet"
 869     return 1
 870   fi
 871
 872 }
 873
 874 #Usage: keyfile hashalg
 875 #Output: Base64-encoded signature value
 876 _sign() {
 877   keyfile="$1"
 878   alg="$2"
 879   if [ -z "$alg" ]; then
 880     _usage "Usage: _sign keyfile hashalg"
 881     return 1
 882   fi
 883
 884   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
 885   if [ "$alg" = "sha256" ]; then
 886     _sign_openssl="$_sign_openssl -$alg"
 887   else
 888     _err "$alg is not supported yet"
 889     return 1
 890   fi
 891
 892   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 893     $_sign_openssl | _base64
 894   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
 895     if ! _signedECText="$($_sign_openssl | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
 896       _err "Sign failed: $_sign_openssl"
 897       _err "Key file: $keyfile"
 898       _err "Key content:$(wc -l <"$keyfile") lines"
 899       return 1
 900     fi
 901     _debug3 "_signedECText" "$_signedECText"
 902     _ec_r="$(echo "$_signedECText" | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 903     _debug3 "_ec_r" "$_ec_r"
 904     _ec_s="$(echo "$_signedECText" | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d "\r\n")"
 905     _debug3 "_ec_s" "$_ec_s"
 906     printf "%s" "$_ec_r$_ec_s" | _h2b | _base64
 907   else
 908     _err "Unknown key file format."
 909     return 1
 910   fi
 911
 912 }
 913
 914 #keylength
 915 _isEccKey() {
 916   _length="$1"
 917
 918   if [ -z "$_length" ]; then
 919     return 1
 920   fi
 921
 922   [ "$_length" != "1024" ] \
 923     && [ "$_length" != "2048" ] \
 924     && [ "$_length" != "3072" ] \
 925     && [ "$_length" != "4096" ] \
 926     && [ "$_length" != "8192" ]
 927 }
 928
 929 # _createkey  2048|ec-256   file
 930 _createkey() {
 931   length="$1"
 932   f="$2"
 933   _debug2 "_createkey for file:$f"
 934   eccname="$length"
 935   if _startswith "$length" "ec-"; then
 936     length=$(printf "%s" "$length" | cut -d '-' -f 2-100)
 937
 938     if [ "$length" = "256" ]; then
 939       eccname="prime256v1"
 940     fi
 941     if [ "$length" = "384" ]; then
 942       eccname="secp384r1"
 943     fi
 944     if [ "$length" = "521" ]; then
 945       eccname="secp521r1"
 946     fi
 947
 948   fi
 949
 950   if [ -z "$length" ]; then
 951     length=2048
 952   fi
 953
 954   _debug "Use length $length"
 955
 956   if ! touch "$f" >/dev/null 2>&1; then
 957     _f_path="$(dirname "$f")"
 958     _debug _f_path "$_f_path"
 959     if ! mkdir -p "$_f_path"; then
 960       _err "Can not create path: $_f_path"
 961       return 1
 962     fi
 963   fi
 964
 965   if _isEccKey "$length"; then
 966     _debug "Using ec name: $eccname"
 967     ${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null >"$f"
 968   else
 969     _debug "Using RSA: $length"
 970     ${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null >"$f"
 971   fi
 972
 973   if [ "$?" != "0" ]; then
 974     _err "Create key error."
 975     return 1
 976   fi
 977 }
 978
 979 #domain
 980 _is_idn() {
 981   _is_idn_d="$1"
 982   _debug2 _is_idn_d "$_is_idn_d"
 983   _idn_temp=$(printf "%s" "$_is_idn_d" | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '.,-')
 984   _debug2 _idn_temp "$_idn_temp"
 985   [ "$_idn_temp" ]
 986 }
 987
 988 #aa.com
 989 #aa.com,bb.com,cc.com
 990 _idn() {
 991   __idn_d="$1"
 992   if ! _is_idn "$__idn_d"; then
 993     printf "%s" "$__idn_d"
 994     return 0
 995   fi
 996
 997   if _exists idn; then
 998     if _contains "$__idn_d" ','; then
 999       _i_first="1"
1000       for f in $(echo "$__idn_d" | tr ',' ' '); do
1001         [ -z "$f" ] && continue
1002         if [ -z "$_i_first" ]; then
1003           printf "%s" ","
1004         else
1005           _i_first=""
1006         fi
1007         idn --quiet "$f" | tr -d "\r\n"
1008       done
1009     else
1010       idn "$__idn_d" | tr -d "\r\n"
1011     fi
1012   else
1013     _err "Please install idn to process IDN names."
1014   fi
1015 }
1016
1017 #_createcsr  cn  san_list  keyfile csrfile conf
1018 _createcsr() {
1019   _debug _createcsr
1020   domain="$1"
1021   domainlist="$2"
1022   csrkey="$3"
1023   csr="$4"
1024   csrconf="$5"
1025   _debug2 domain "$domain"
1026   _debug2 domainlist "$domainlist"
1027   _debug2 csrkey "$csrkey"
1028   _debug2 csr "$csr"
1029   _debug2 csrconf "$csrconf"
1030
1031   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
1032
1033   if [ -z "$domainlist" ] || [ "$domainlist" = "$NO_VALUE" ]; then
1034     #single domain
1035     _info "Single domain" "$domain"
1036   else
1037     domainlist="$(_idn "$domainlist")"
1038     _debug2 domainlist "$domainlist"
1039     if _contains "$domainlist" ","; then
1040       alt="DNS:$(echo "$domainlist" | sed "s/,/,DNS:/g")"
1041     else
1042       alt="DNS:$domainlist"
1043     fi
1044     #multi
1045     _info "Multi domain" "$alt"
1046     printf -- "\nsubjectAltName=$alt" >>"$csrconf"
1047   fi
1048   if [ "$Le_OCSP_Staple" ] || [ "$Le_OCSP_Stable" ]; then
1049     _savedomainconf Le_OCSP_Staple "$Le_OCSP_Staple"
1050     _cleardomainconf Le_OCSP_Stable
1051     printf -- "\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05" >>"$csrconf"
1052   fi
1053
1054   _csr_cn="$(_idn "$domain")"
1055   _debug2 _csr_cn "$_csr_cn"
1056   if _contains "$(uname -a)" "MINGW"; then
1057     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
1058   else
1059     ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
1060   fi
1061 }
1062
1063 #_signcsr key  csr  conf cert
1064 _signcsr() {
1065   key="$1"
1066   csr="$2"
1067   conf="$3"
1068   cert="$4"
1069   _debug "_signcsr"
1070
1071   _msg="$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in "$csr" -signkey "$key" -extensions v3_req -extfile "$conf" -out "$cert" 2>&1)"
1072   _ret="$?"
1073   _debug "$_msg"
1074   return $_ret
1075 }
1076
1077 #_csrfile
1078 _readSubjectFromCSR() {
1079   _csrfile="$1"
1080   if [ -z "$_csrfile" ]; then
1081     _usage "_readSubjectFromCSR mycsr.csr"
1082     return 1
1083   fi
1084   ${ACME_OPENSSL_BIN:-openssl} req -noout -in "$_csrfile" -subject | _egrep_o "CN *=.*" | cut -d = -f 2 | cut -d / -f 1 | tr -d '\n'
1085 }
1086
1087 #_csrfile
1088 #echo comma separated domain list
1089 _readSubjectAltNamesFromCSR() {
1090   _csrfile="$1"
1091   if [ -z "$_csrfile" ]; then
1092     _usage "_readSubjectAltNamesFromCSR mycsr.csr"
1093     return 1
1094   fi
1095
1096   _csrsubj="$(_readSubjectFromCSR "$_csrfile")"
1097   _debug _csrsubj "$_csrsubj"
1098
1099   _dnsAltnames="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile" | grep "^ *DNS:.*" | tr -d ' \n')"
1100   _debug _dnsAltnames "$_dnsAltnames"
1101
1102   if _contains "$_dnsAltnames," "DNS:$_csrsubj,"; then
1103     _debug "AltNames contains subject"
1104     _dnsAltnames="$(printf "%s" "$_dnsAltnames," | sed "s/DNS:$_csrsubj,//g")"
1105   else
1106     _debug "AltNames doesn't contain subject"
1107   fi
1108
1109   printf "%s" "$_dnsAltnames" | sed "s/DNS://g"
1110 }
1111
1112 #_csrfile
1113 _readKeyLengthFromCSR() {
1114   _csrfile="$1"
1115   if [ -z "$_csrfile" ]; then
1116     _usage "_readKeyLengthFromCSR mycsr.csr"
1117     return 1
1118   fi
1119
1120   _outcsr="$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in "$_csrfile")"
1121   _debug2 _outcsr "$_outcsr"
1122   if _contains "$_outcsr" "Public Key Algorithm: id-ecPublicKey"; then
1123     _debug "ECC CSR"
1124     echo "$_outcsr" | tr "\t" " " | _egrep_o "^ *ASN1 OID:.*" | cut -d ':' -f 2 | tr -d ' '
1125   else
1126     _debug "RSA CSR"
1127     echo "$_outcsr" | tr "\t" " " | _egrep_o "(^ *|RSA )Public.Key:.*" | cut -d '(' -f 2 | cut -d ' ' -f 1
1128   fi
1129 }
1130
1131 _ss() {
1132   _port="$1"
1133
1134   if _exists "ss"; then
1135     _debug "Using: ss"
1136     ss -ntpl | grep ":$_port "
1137     return 0
1138   fi
1139
1140   if _exists "netstat"; then
1141     _debug "Using: netstat"
1142     if netstat -h 2>&1 | grep "\-p proto" >/dev/null; then
1143       #for windows version netstat tool
1144       netstat -an -p tcp | grep "LISTENING" | grep ":$_port "
1145     else
1146       if netstat -help 2>&1 | grep "\-p protocol" >/dev/null; then
1147         netstat -an -p tcp | grep LISTEN | grep ":$_port "
1148       elif netstat -help 2>&1 | grep -- '-P protocol' >/dev/null; then
1149         #for solaris
1150         netstat -an -P tcp | grep "\.$_port " | grep "LISTEN"
1151       elif netstat -help 2>&1 | grep "\-p" >/dev/null; then
1152         #for full linux
1153         netstat -ntpl | grep ":$_port "
1154       else
1155         #for busybox (embedded linux; no pid support)
1156         netstat -ntl 2>/dev/null | grep ":$_port "
1157       fi
1158     fi
1159     return 0
1160   fi
1161
1162   return 1
1163 }
1164
1165 #domain [password] [isEcc]
1166 toPkcs() {
1167   domain="$1"
1168   pfxPassword="$2"
1169   if [ -z "$domain" ]; then
1170     _usage "Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]"
1171     return 1
1172   fi
1173
1174   _isEcc="$3"
1175
1176   _initpath "$domain" "$_isEcc"
1177
1178   if [ "$pfxPassword" ]; then
1179     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH" -password "pass:$pfxPassword"
1180   else
1181     ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out "$CERT_PFX_PATH" -inkey "$CERT_KEY_PATH" -in "$CERT_PATH" -certfile "$CA_CERT_PATH"
1182   fi
1183
1184   if [ "$?" = "0" ]; then
1185     _info "Success, Pfx is exported to: $CERT_PFX_PATH"
1186   fi
1187
1188 }
1189
1190 #domain [isEcc]
1191 toPkcs8() {
1192   domain="$1"
1193
1194   if [ -z "$domain" ]; then
1195     _usage "Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]"
1196     return 1
1197   fi
1198
1199   _isEcc="$2"
1200
1201   _initpath "$domain" "$_isEcc"
1202
1203   ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in "$CERT_KEY_PATH" -out "$CERT_PKCS8_PATH"
1204
1205   if [ "$?" = "0" ]; then
1206     _info "Success, $CERT_PKCS8_PATH"
1207   fi
1208
1209 }
1210
1211 #[2048]
1212 createAccountKey() {
1213   _info "Creating account key"
1214   if [ -z "$1" ]; then
1215     _usage "Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048"
1216     return
1217   fi
1218
1219   length=$1
1220   _create_account_key "$length"
1221
1222 }
1223
1224 _create_account_key() {
1225
1226   length=$1
1227
1228   if [ -z "$length" ] || [ "$length" = "$NO_VALUE" ]; then
1229     _debug "Use default length $DEFAULT_ACCOUNT_KEY_LENGTH"
1230     length="$DEFAULT_ACCOUNT_KEY_LENGTH"
1231   fi
1232
1233   _debug length "$length"
1234   _initpath
1235
1236   mkdir -p "$CA_DIR"
1237   if [ -f "$ACCOUNT_KEY_PATH" ]; then
1238     _info "Account key exists, skip"
1239     return
1240   else
1241     #generate account key
1242     _createkey "$length" "$ACCOUNT_KEY_PATH"
1243   fi
1244
1245 }
1246
1247 #domain [length]
1248 createDomainKey() {
1249   _info "Creating domain key"
1250   if [ -z "$1" ]; then
1251     _usage "Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]"
1252     return
1253   fi
1254
1255   domain=$1
1256   _cdl=$2
1257
1258   if [ -z "$_cdl" ]; then
1259     _debug "Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH"
1260     _cdl="$DEFAULT_DOMAIN_KEY_LENGTH"
1261   fi
1262
1263   _initpath "$domain" "$_cdl"
1264
1265   if [ ! -f "$CERT_KEY_PATH" ] || ([ "$FORCE" ] && ! [ "$IS_RENEW" ]); then
1266     if _createkey "$_cdl" "$CERT_KEY_PATH"; then
1267       _savedomainconf Le_Keylength "$_cdl"
1268       _info "The domain key is here: $(__green $CERT_KEY_PATH)"
1269     fi
1270   else
1271     if [ "$IS_RENEW" ]; then
1272       _info "Domain key exists, skip"
1273       return 0
1274     else
1275       _err "Domain key exists, do you want to overwrite the key?"
1276       _err "Add '--force', and try again."
1277       return 1
1278     fi
1279   fi
1280
1281 }
1282
1283 # domain  domainlist isEcc
1284 createCSR() {
1285   _info "Creating csr"
1286   if [ -z "$1" ]; then
1287     _usage "Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]"
1288     return
1289   fi
1290
1291   domain="$1"
1292   domainlist="$2"
1293   _isEcc="$3"
1294
1295   _initpath "$domain" "$_isEcc"
1296
1297   if [ -f "$CSR_PATH" ] && [ "$IS_RENEW" ] && [ -z "$FORCE" ]; then
1298     _info "CSR exists, skip"
1299     return
1300   fi
1301
1302   if [ ! -f "$CERT_KEY_PATH" ]; then
1303     _err "The key file is not found: $CERT_KEY_PATH"
1304     _err "Please create the key file first."
1305     return 1
1306   fi
1307   _createcsr "$domain" "$domainlist" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"
1308
1309 }
1310
1311 _url_replace() {
1312   tr '/+' '_-' | tr -d '= '
1313 }
1314
1315 _time2str() {
1316   #Linux
1317   if date -u -d@"$1" 2>/dev/null; then
1318     return
1319   fi
1320
1321   #BSD
1322   if date -u -r "$1" 2>/dev/null; then
1323     return
1324   fi
1325
1326   #Soaris
1327   if _exists adb; then
1328     _t_s_a=$(echo "0t${1}=Y" | adb)
1329     echo "$_t_s_a"
1330   fi
1331
1332 }
1333
1334 _normalizeJson() {
1335   sed "s/\" *: *\([\"{\[]\)/\":\1/g" | sed "s/^ *\([^ ]\)/\1/" | tr -d "\r\n"
1336 }
1337
1338 _stat() {
1339   #Linux
1340   if stat -c '%U:%G' "$1" 2>/dev/null; then
1341     return
1342   fi
1343
1344   #BSD
1345   if stat -f '%Su:%Sg' "$1" 2>/dev/null; then
1346     return
1347   fi
1348
1349   return 1 #error, 'stat' not found
1350 }
1351
1352 #keyfile
1353 _calcjwk() {
1354   keyfile="$1"
1355   if [ -z "$keyfile" ]; then
1356     _usage "Usage: _calcjwk keyfile"
1357     return 1
1358   fi
1359
1360   if [ "$JWK_HEADER" ] && [ "$__CACHED_JWK_KEY_FILE" = "$keyfile" ]; then
1361     _debug2 "Use cached jwk for file: $__CACHED_JWK_KEY_FILE"
1362     return 0
1363   fi
1364
1365   if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1366     _debug "RSA key"
1367     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
1368     if [ "${#pub_exp}" = "5" ]; then
1369       pub_exp=0$pub_exp
1370     fi
1371     _debug3 pub_exp "$pub_exp"
1372
1373     e=$(echo "$pub_exp" | _h2b | _base64)
1374     _debug3 e "$e"
1375
1376     modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -modulus -noout | cut -d '=' -f 2)
1377     _debug3 modulus "$modulus"
1378     n="$(printf "%s" "$modulus" | _h2b | _base64 | _url_replace)"
1379     _debug3 n "$n"
1380
1381     jwk='{"e": "'$e'", "kty": "RSA", "n": "'$n'"}'
1382     _debug3 jwk "$jwk"
1383
1384     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
1385     JWK_HEADERPLACE_PART1='{"nonce": "'
1386     JWK_HEADERPLACE_PART2='", "alg": "RS256", "jwk": '$jwk'}'
1387   elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
1388     _debug "EC key"
1389     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
1390     _debug3 crv "$crv"
1391
1392     if [ -z "$crv" ]; then
1393       _debug "Let's try ASN1 OID"
1394       crv_oid="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^ASN1 OID:" | cut -d ":" -f 2 | tr -d " \r\n")"
1395       _debug3 crv_oid "$crv_oid"
1396       case "${crv_oid}" in
1397         "prime256v1")
1398           crv="P-256"
1399           ;;
1400         "secp384r1")
1401           crv="P-384"
1402           ;;
1403         "secp521r1")
1404           crv="P-521"
1405           ;;
1406         *)
1407           _err "ECC oid : $crv_oid"
1408           return 1
1409           ;;
1410       esac
1411       _debug3 crv "$crv"
1412     fi
1413
1414     pubi="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n pub: | cut -d : -f 1)"
1415     pubi=$(_math "$pubi" + 1)
1416     _debug3 pubi "$pubi"
1417
1418     pubj="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep -n "ASN1 OID:" | cut -d : -f 1)"
1419     pubj=$(_math "$pubj" - 1)
1420     _debug3 pubj "$pubj"
1421
1422     pubtext="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | sed -n "$pubi,${pubj}p" | tr -d " \n\r")"
1423     _debug3 pubtext "$pubtext"
1424
1425     xlen="$(printf "%s" "$pubtext" | tr -d ':' | wc -c)"
1426     xlen=$(_math "$xlen" / 4)
1427     _debug3 xlen "$xlen"
1428
1429     xend=$(_math "$xlen" + 1)
1430     x="$(printf "%s" "$pubtext" | cut -d : -f 2-"$xend")"
1431     _debug3 x "$x"
1432
1433     x64="$(printf "%s" "$x" | tr -d : | _h2b | _base64 | _url_replace)"
1434     _debug3 x64 "$x64"
1435
1436     xend=$(_math "$xend" + 1)
1437     y="$(printf "%s" "$pubtext" | cut -d : -f "$xend"-10000)"
1438     _debug3 y "$y"
1439
1440     y64="$(printf "%s" "$y" | tr -d : | _h2b | _base64 | _url_replace)"
1441     _debug3 y64 "$y64"
1442
1443     jwk='{"crv": "'$crv'", "kty": "EC", "x": "'$x64'", "y": "'$y64'"}'
1444     _debug3 jwk "$jwk"
1445
1446     JWK_HEADER='{"alg": "ES256", "jwk": '$jwk'}'
1447     JWK_HEADERPLACE_PART1='{"nonce": "'
1448     JWK_HEADERPLACE_PART2='", "alg": "ES256", "jwk": '$jwk'}'
1449   else
1450     _err "Only RSA or EC key is supported."
1451     return 1
1452   fi
1453
1454   _debug3 JWK_HEADER "$JWK_HEADER"
1455   __CACHED_JWK_KEY_FILE="$keyfile"
1456 }
1457
1458 _time() {
1459   date -u "+%s"
1460 }
1461
1462 _utc_date() {
1463   date -u "+%Y-%m-%d %H:%M:%S"
1464 }
1465
1466 _mktemp() {
1467   if _exists mktemp; then
1468     if mktemp 2>/dev/null; then
1469       return 0
1470     elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
1471       #for Mac osx
1472       return 0
1473     fi
1474   fi
1475   if [ -d "/tmp" ]; then
1476     echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
1477     return 0
1478   elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
1479     echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
1480     return 0
1481   fi
1482   _err "Can not create temp file."
1483 }
1484
1485 _inithttp() {
1486
1487   if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
1488     HTTP_HEADER="$(_mktemp)"
1489     _debug2 HTTP_HEADER "$HTTP_HEADER"
1490   fi
1491
1492   if [ "$__HTTP_INITIALIZED" ]; then
1493     if [ "$_ACME_CURL$_ACME_WGET" ]; then
1494       _debug2 "Http already initialized."
1495       return 0
1496     fi
1497   fi
1498
1499   if [ -z "$_ACME_CURL" ] && _exists "curl"; then
1500     _ACME_CURL="curl -L --silent --dump-header $HTTP_HEADER "
1501     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1502       _CURL_DUMP="$(_mktemp)"
1503       _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
1504     fi
1505
1506     if [ "$CA_PATH" ]; then
1507       _ACME_CURL="$_ACME_CURL --capath $CA_PATH "
1508     elif [ "$CA_BUNDLE" ]; then
1509       _ACME_CURL="$_ACME_CURL --cacert $CA_BUNDLE "
1510     fi
1511
1512   fi
1513
1514   if [ -z "$_ACME_WGET" ] && _exists "wget"; then
1515     _ACME_WGET="wget -q"
1516     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1517       _ACME_WGET="$_ACME_WGET -d "
1518     fi
1519     if [ "$CA_PATH" ]; then
1520       _ACME_WGET="$_ACME_WGET --ca-directory=$CA_PATH "
1521     elif [ "$CA_BUNDLE" ]; then
1522       _ACME_WGET="$_ACME_WGET --ca-certificate=$CA_BUNDLE "
1523     fi
1524   fi
1525
1526   #from wget 1.14: do not skip body on 404 error
1527   if [ "$_ACME_WGET" ] && _contains "$($_ACME_WGET --help 2>&1)" "--content-on-error"; then
1528     _ACME_WGET="$_ACME_WGET --content-on-error "
1529   fi
1530
1531   __HTTP_INITIALIZED=1
1532
1533 }
1534
1535 # body  url [needbase64] [POST|PUT]
1536 _post() {
1537   body="$1"
1538   url="$2"
1539   needbase64="$3"
1540   httpmethod="$4"
1541
1542   if [ -z "$httpmethod" ]; then
1543     httpmethod="POST"
1544   fi
1545   _debug $httpmethod
1546   _debug "url" "$url"
1547   _debug2 "body" "$body"
1548
1549   _inithttp
1550
1551   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1552     _CURL="$_ACME_CURL"
1553     if [ "$HTTPS_INSECURE" ]; then
1554       _CURL="$_CURL --insecure  "
1555     fi
1556     _debug "_CURL" "$_CURL"
1557     if [ "$needbase64" ]; then
1558       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url" | _base64)"
1559     else
1560       response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$url")"
1561     fi
1562     _ret="$?"
1563     if [ "$_ret" != "0" ]; then
1564       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
1565       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1566         _err "Here is the curl dump log:"
1567         _err "$(cat "$_CURL_DUMP")"
1568       fi
1569     fi
1570   elif [ "$_ACME_WGET" ]; then
1571     _WGET="$_ACME_WGET"
1572     if [ "$HTTPS_INSECURE" ]; then
1573       _WGET="$_WGET --no-check-certificate "
1574     fi
1575     _debug "_WGET" "$_WGET"
1576     if [ "$needbase64" ]; then
1577       if [ "$httpmethod" = "POST" ]; then
1578         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1579       else
1580         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER" | _base64)"
1581       fi
1582     else
1583       if [ "$httpmethod" = "POST" ]; then
1584         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$url" 2>"$HTTP_HEADER")"
1585       else
1586         response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$url" 2>"$HTTP_HEADER")"
1587       fi
1588     fi
1589     _ret="$?"
1590     if [ "$_ret" = "8" ]; then
1591       _ret=0
1592       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1593     fi
1594     if [ "$_ret" != "0" ]; then
1595       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
1596     fi
1597     _sed_i "s/^ *//g" "$HTTP_HEADER"
1598   else
1599     _ret="$?"
1600     _err "Neither curl nor wget is found, can not do $httpmethod."
1601   fi
1602   _debug "_ret" "$_ret"
1603   printf "%s" "$response"
1604   return $_ret
1605 }
1606
1607 # url getheader timeout
1608 _get() {
1609   _debug GET
1610   url="$1"
1611   onlyheader="$2"
1612   t="$3"
1613   _debug url "$url"
1614   _debug "timeout" "$t"
1615
1616   _inithttp
1617
1618   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
1619     _CURL="$_ACME_CURL"
1620     if [ "$HTTPS_INSECURE" ]; then
1621       _CURL="$_CURL --insecure  "
1622     fi
1623     if [ "$t" ]; then
1624       _CURL="$_CURL --connect-timeout $t"
1625     fi
1626     _debug "_CURL" "$_CURL"
1627     if [ "$onlyheader" ]; then
1628       $_CURL -I --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1629     else
1630       $_CURL --user-agent "$USER_AGENT" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$url"
1631     fi
1632     ret=$?
1633     if [ "$ret" != "0" ]; then
1634       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
1635       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
1636         _err "Here is the curl dump log:"
1637         _err "$(cat "$_CURL_DUMP")"
1638       fi
1639     fi
1640   elif [ "$_ACME_WGET" ]; then
1641     _WGET="$_ACME_WGET"
1642     if [ "$HTTPS_INSECURE" ]; then
1643       _WGET="$_WGET --no-check-certificate "
1644     fi
1645     if [ "$t" ]; then
1646       _WGET="$_WGET --timeout=$t"
1647     fi
1648     _debug "_WGET" "$_WGET"
1649     if [ "$onlyheader" ]; then
1650       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -S -O /dev/null "$url" 2>&1 | sed 's/^[ ]*//g'
1651     else
1652       $_WGET --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" -O - "$url"
1653     fi
1654     ret=$?
1655     if [ "$ret" = "8" ]; then
1656       ret=0
1657       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
1658     fi
1659     if [ "$ret" != "0" ]; then
1660       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
1661     fi
1662   else
1663     ret=$?
1664     _err "Neither curl nor wget is found, can not do GET."
1665   fi
1666   _debug "ret" "$ret"
1667   return $ret
1668 }
1669
1670 _head_n() {
1671   head -n "$1"
1672 }
1673
1674 _tail_n() {
1675   if ! tail -n "$1" 2>/dev/null; then
1676     #fix for solaris
1677     tail -"$1"
1678   fi
1679 }
1680
1681 # url  payload needbase64  keyfile
1682 _send_signed_request() {
1683   url=$1
1684   payload=$2
1685   needbase64=$3
1686   keyfile=$4
1687   if [ -z "$keyfile" ]; then
1688     keyfile="$ACCOUNT_KEY_PATH"
1689   fi
1690   _debug url "$url"
1691   _debug payload "$payload"
1692
1693   if ! _calcjwk "$keyfile"; then
1694     return 1
1695   fi
1696
1697   payload64=$(printf "%s" "$payload" | _base64 | _url_replace)
1698   _debug3 payload64 "$payload64"
1699
1700   MAX_REQUEST_RETRY_TIMES=5
1701   _request_retry_times=0
1702   while [ "${_request_retry_times}" -lt "$MAX_REQUEST_RETRY_TIMES" ]; do
1703     _debug3 _request_retry_times "$_request_retry_times"
1704     if [ -z "$_CACHED_NONCE" ]; then
1705       _debug2 "Get nonce."
1706       nonceurl="$API/directory"
1707       _headers="$(_get "$nonceurl" "onlyheader")"
1708
1709       if [ "$?" != "0" ]; then
1710         _err "Can not connect to $nonceurl to get nonce."
1711         return 1
1712       fi
1713
1714       _debug2 _headers "$_headers"
1715
1716       _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1717       _debug2 _CACHED_NONCE "$_CACHED_NONCE"
1718     else
1719       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
1720     fi
1721     nonce="$_CACHED_NONCE"
1722     _debug2 nonce "$nonce"
1723
1724     protected="$JWK_HEADERPLACE_PART1$nonce$JWK_HEADERPLACE_PART2"
1725     _debug3 protected "$protected"
1726
1727     protected64="$(printf "%s" "$protected" | _base64 | _url_replace)"
1728     _debug3 protected64 "$protected64"
1729
1730     if ! _sig_t="$(printf "%s" "$protected64.$payload64" | _sign "$keyfile" "sha256")"; then
1731       _err "Sign request failed."
1732       return 1
1733     fi
1734     _debug3 _sig_t "$_sig_t"
1735
1736     sig="$(printf "%s" "$_sig_t" | _url_replace)"
1737     _debug3 sig "$sig"
1738
1739     body="{\"header\": $JWK_HEADER, \"protected\": \"$protected64\", \"payload\": \"$payload64\", \"signature\": \"$sig\"}"
1740     _debug3 body "$body"
1741
1742     response="$(_post "$body" "$url" "$needbase64")"
1743     _CACHED_NONCE=""
1744
1745     if [ "$?" != "0" ]; then
1746       _err "Can not post to $url"
1747       return 1
1748     fi
1749     _debug2 original "$response"
1750     response="$(echo "$response" | _normalizeJson)"
1751
1752     responseHeaders="$(cat "$HTTP_HEADER")"
1753
1754     _debug2 responseHeaders "$responseHeaders"
1755     _debug2 response "$response"
1756     code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\r\n")"
1757     _debug code "$code"
1758
1759     _CACHED_NONCE="$(echo "$responseHeaders" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
1760
1761     if _contains "$response" "JWS has invalid anti-replay nonce"; then
1762       _info "It seems the CA server is busy now, let's wait and retry."
1763       _request_retry_times=$(_math "$_request_retry_times" + 1)
1764       _sleep 5
1765       continue
1766     fi
1767     break
1768   done
1769
1770 }
1771
1772 #setopt "file"  "opt"  "="  "value" [";"]
1773 _setopt() {
1774   __conf="$1"
1775   __opt="$2"
1776   __sep="$3"
1777   __val="$4"
1778   __end="$5"
1779   if [ -z "$__opt" ]; then
1780     _usage usage: _setopt '"file"  "opt"  "="  "value" [";"]'
1781     return
1782   fi
1783   if [ ! -f "$__conf" ]; then
1784     touch "$__conf"
1785   fi
1786
1787   if grep -n "^$__opt$__sep" "$__conf" >/dev/null; then
1788     _debug3 OK
1789     if _contains "$__val" "&"; then
1790       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1791     fi
1792     text="$(cat "$__conf")"
1793     printf -- "%s\n" "$text" | sed "s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1794
1795   elif grep -n "^#$__opt$__sep" "$__conf" >/dev/null; then
1796     if _contains "$__val" "&"; then
1797       __val="$(echo "$__val" | sed 's/&/\\&/g')"
1798     fi
1799     text="$(cat "$__conf")"
1800     printf -- "%s\n" "$text" | sed "s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|" >"$__conf"
1801
1802   else
1803     _debug3 APP
1804     echo "$__opt$__sep$__val$__end" >>"$__conf"
1805   fi
1806   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
1807 }
1808
1809 #_save_conf  file key  value
1810 #save to conf
1811 _save_conf() {
1812   _s_c_f="$1"
1813   _sdkey="$2"
1814   _sdvalue="$3"
1815   if [ "$_s_c_f" ]; then
1816     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
1817   else
1818     _err "config file is empty, can not save $_sdkey=$_sdvalue"
1819   fi
1820 }
1821
1822 #_clear_conf file  key
1823 _clear_conf() {
1824   _c_c_f="$1"
1825   _sdkey="$2"
1826   if [ "$_c_c_f" ]; then
1827     _conf_data="$(cat "$_c_c_f")"
1828     echo "$_conf_data" | sed "s/^$_sdkey *=.*$//" >"$_c_c_f"
1829   else
1830     _err "config file is empty, can not clear"
1831   fi
1832 }
1833
1834 #_read_conf file  key
1835 _read_conf() {
1836   _r_c_f="$1"
1837   _sdkey="$2"
1838   if [ -f "$_r_c_f" ]; then
1839     (
1840       eval "$(grep "^$_sdkey *=" "$_r_c_f")"
1841       eval "printf \"%s\" \"\$$_sdkey\""
1842     )
1843   else
1844     _debug "config file is empty, can not read $_sdkey"
1845   fi
1846 }
1847
1848 #_savedomainconf   key  value
1849 #save to domain.conf
1850 _savedomainconf() {
1851   _save_conf "$DOMAIN_CONF" "$1" "$2"
1852 }
1853
1854 #_cleardomainconf   key
1855 _cleardomainconf() {
1856   _clear_conf "$DOMAIN_CONF" "$1"
1857 }
1858
1859 #_readdomainconf   key
1860 _readdomainconf() {
1861   _read_conf "$DOMAIN_CONF" "$1"
1862 }
1863
1864 #_saveaccountconf  key  value
1865 _saveaccountconf() {
1866   _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
1867 }
1868
1869 #key  value
1870 _saveaccountconf_mutable() {
1871   _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2"
1872   #remove later
1873   _clearaccountconf "$1"
1874 }
1875
1876 #key
1877 _readaccountconf() {
1878   _read_conf "$ACCOUNT_CONF_PATH" "$1"
1879 }
1880
1881 #key
1882 _readaccountconf_mutable() {
1883   _rac_key="$1"
1884   _readaccountconf "SAVED_$_rac_key"
1885 }
1886
1887 #_clearaccountconf   key
1888 _clearaccountconf() {
1889   _clear_conf "$ACCOUNT_CONF_PATH" "$1"
1890 }
1891
1892 #_savecaconf  key  value
1893 _savecaconf() {
1894   _save_conf "$CA_CONF" "$1" "$2"
1895 }
1896
1897 #_readcaconf   key
1898 _readcaconf() {
1899   _read_conf "$CA_CONF" "$1"
1900 }
1901
1902 #_clearaccountconf   key
1903 _clearcaconf() {
1904   _clear_conf "$CA_CONF" "$1"
1905 }
1906
1907 # content localaddress
1908 _startserver() {
1909   content="$1"
1910   ncaddr="$2"
1911   _debug "ncaddr" "$ncaddr"
1912
1913   _debug "startserver: $$"
1914   nchelp="$(nc -h 2>&1)"
1915
1916   _debug Le_HTTPPort "$Le_HTTPPort"
1917   _debug Le_Listen_V4 "$Le_Listen_V4"
1918   _debug Le_Listen_V6 "$Le_Listen_V6"
1919   _NC="nc"
1920
1921   if [ "$Le_Listen_V4" ]; then
1922     _NC="$_NC -4"
1923   elif [ "$Le_Listen_V6" ]; then
1924     _NC="$_NC -6"
1925   fi
1926
1927   if [ "$Le_Listen_V4$Le_Listen_V6$ncaddr" ]; then
1928     if ! _contains "$nchelp" "-4"; then
1929       _err "The nc doesn't support '-4', '-6' or local-address, please install 'netcat-openbsd' and try again."
1930       _err "See $(__green $_PREPARE_LINK)"
1931       return 1
1932     fi
1933   fi
1934
1935   if echo "$nchelp" | grep "\-q[ ,]" >/dev/null; then
1936     _NC="$_NC -q 1 -l $ncaddr"
1937   else
1938     if echo "$nchelp" | grep "GNU netcat" >/dev/null && echo "$nchelp" | grep "\-c, \-\-close" >/dev/null; then
1939       _NC="$_NC -c -l $ncaddr"
1940     elif echo "$nchelp" | grep "\-N" | grep "Shutdown the network socket after EOF on stdin" >/dev/null; then
1941       _NC="$_NC -N -l $ncaddr"
1942     else
1943       _NC="$_NC -l $ncaddr"
1944     fi
1945   fi
1946
1947   _debug "_NC" "$_NC"
1948
1949   #for centos ncat
1950   if _contains "$nchelp" "nmap.org"; then
1951     _debug "Using ncat: nmap.org"
1952     if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"; then
1953       _exec_err
1954       return 1
1955     fi
1956     if [ "$DEBUG" ]; then
1957       _exec_err
1958     fi
1959     return
1960   fi
1961
1962   #  while true ; do
1963   if ! _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC -p \"$Le_HTTPPort\" >&2"; then
1964     _exec "printf \"%s\r\n\r\n%s\" \"HTTP/1.1 200 OK\" \"$content\" | $_NC \"$Le_HTTPPort\" >&2"
1965   fi
1966
1967   if [ "$?" != "0" ]; then
1968     _err "nc listen error."
1969     _exec_err
1970     exit 1
1971   fi
1972   if [ "$DEBUG" ]; then
1973     _exec_err
1974   fi
1975   #  done
1976 }
1977
1978 _stopserver() {
1979   pid="$1"
1980   _debug "pid" "$pid"
1981   if [ -z "$pid" ]; then
1982     return
1983   fi
1984
1985   _debug2 "Le_HTTPPort" "$Le_HTTPPort"
1986   if [ "$Le_HTTPPort" ]; then
1987     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
1988       _get "http://localhost:$Le_HTTPPort" "" 1
1989     else
1990       _get "http://localhost:$Le_HTTPPort" "" 1 >/dev/null 2>&1
1991     fi
1992   fi
1993
1994   _debug2 "Le_TLSPort" "$Le_TLSPort"
1995   if [ "$Le_TLSPort" ]; then
1996     if [ "$DEBUG" ] && [ "$DEBUG" -gt "3" ]; then
1997       _get "https://localhost:$Le_TLSPort" "" 1
1998       _get "https://localhost:$Le_TLSPort" "" 1
1999     else
2000       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
2001       _get "https://localhost:$Le_TLSPort" "" 1 >/dev/null 2>&1
2002     fi
2003   fi
2004 }
2005
2006 # sleep sec
2007 _sleep() {
2008   _sleep_sec="$1"
2009   if [ "$__INTERACTIVE" ]; then
2010     _sleep_c="$_sleep_sec"
2011     while [ "$_sleep_c" -ge "0" ]; do
2012       printf "\r      \r"
2013       __green "$_sleep_c"
2014       _sleep_c="$(_math "$_sleep_c" - 1)"
2015       sleep 1
2016     done
2017     printf "\r"
2018   else
2019     sleep "$_sleep_sec"
2020   fi
2021 }
2022
2023 # _starttlsserver  san_a  san_b port content _ncaddr
2024 _starttlsserver() {
2025   _info "Starting tls server."
2026   san_a="$1"
2027   san_b="$2"
2028   port="$3"
2029   content="$4"
2030   opaddr="$5"
2031
2032   _debug san_a "$san_a"
2033   _debug san_b "$san_b"
2034   _debug port "$port"
2035
2036   #create key TLS_KEY
2037   if ! _createkey "2048" "$TLS_KEY"; then
2038     _err "Create tls validation key error."
2039     return 1
2040   fi
2041
2042   #create csr
2043   alt="$san_a"
2044   if [ "$san_b" ]; then
2045     alt="$alt,$san_b"
2046   fi
2047   if ! _createcsr "tls.acme.sh" "$alt" "$TLS_KEY" "$TLS_CSR" "$TLS_CONF"; then
2048     _err "Create tls validation csr error."
2049     return 1
2050   fi
2051
2052   #self signed
2053   if ! _signcsr "$TLS_KEY" "$TLS_CSR" "$TLS_CONF" "$TLS_CERT"; then
2054     _err "Create tls validation cert error."
2055     return 1
2056   fi
2057
2058   __S_OPENSSL="${ACME_OPENSSL_BIN:-openssl} s_server -cert $TLS_CERT  -key $TLS_KEY "
2059   if [ "$opaddr" ]; then
2060     __S_OPENSSL="$__S_OPENSSL -accept $opaddr:$port"
2061   else
2062     __S_OPENSSL="$__S_OPENSSL -accept $port"
2063   fi
2064
2065   _debug Le_Listen_V4 "$Le_Listen_V4"
2066   _debug Le_Listen_V6 "$Le_Listen_V6"
2067   if [ "$Le_Listen_V4" ]; then
2068     __S_OPENSSL="$__S_OPENSSL -4"
2069   elif [ "$Le_Listen_V6" ]; then
2070     __S_OPENSSL="$__S_OPENSSL -6"
2071   fi
2072
2073   _debug "$__S_OPENSSL"
2074   if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
2075     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL -tlsextdebug) &
2076   else
2077     (printf "%s\r\n\r\n%s" "HTTP/1.1 200 OK" "$content" | $__S_OPENSSL >/dev/null 2>&1) &
2078   fi
2079
2080   serverproc="$!"
2081   sleep 1
2082   _debug serverproc "$serverproc"
2083 }
2084
2085 #file
2086 _readlink() {
2087   _rf="$1"
2088   if ! readlink -f "$_rf" 2>/dev/null; then
2089     if _startswith "$_rf" "/"; then
2090       echo "$_rf"
2091       return 0
2092     fi
2093     echo "$(pwd)/$_rf" | _conapath
2094   fi
2095 }
2096
2097 _conapath() {
2098   sed "s#/\./#/#g"
2099 }
2100
2101 __initHome() {
2102   if [ -z "$_SCRIPT_HOME" ]; then
2103     if _exists readlink && _exists dirname; then
2104       _debug "Lets find script dir."
2105       _debug "_SCRIPT_" "$_SCRIPT_"
2106       _script="$(_readlink "$_SCRIPT_")"
2107       _debug "_script" "$_script"
2108       _script_home="$(dirname "$_script")"
2109       _debug "_script_home" "$_script_home"
2110       if [ -d "$_script_home" ]; then
2111         _SCRIPT_HOME="$_script_home"
2112       else
2113         _err "It seems the script home is not correct:$_script_home"
2114       fi
2115     fi
2116   fi
2117
2118   #  if [ -z "$LE_WORKING_DIR" ]; then
2119   #    if [ -f "$DEFAULT_INSTALL_HOME/account.conf" ]; then
2120   #      _debug "It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME"
2121   #      LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2122   #    else
2123   #      LE_WORKING_DIR="$_SCRIPT_HOME"
2124   #    fi
2125   #  fi
2126
2127   if [ -z "$LE_WORKING_DIR" ]; then
2128     _debug "Using default home:$DEFAULT_INSTALL_HOME"
2129     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
2130   fi
2131   export LE_WORKING_DIR
2132
2133   if [ -z "$LE_CONFIG_HOME" ]; then
2134     LE_CONFIG_HOME="$LE_WORKING_DIR"
2135   fi
2136   _debug "Using config home:$LE_CONFIG_HOME"
2137   export LE_CONFIG_HOME
2138
2139   _DEFAULT_ACCOUNT_CONF_PATH="$LE_CONFIG_HOME/account.conf"
2140
2141   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2142     if [ -f "$_DEFAULT_ACCOUNT_CONF_PATH" ]; then
2143       . "$_DEFAULT_ACCOUNT_CONF_PATH"
2144     fi
2145   fi
2146
2147   if [ -z "$ACCOUNT_CONF_PATH" ]; then
2148     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
2149   fi
2150
2151   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
2152
2153   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"
2154
2155   if [ -z "$LE_TEMP_DIR" ]; then
2156     LE_TEMP_DIR="$LE_CONFIG_HOME/tmp"
2157   fi
2158 }
2159
2160 #[domain]  [keylength]
2161 _initpath() {
2162
2163   __initHome
2164
2165   if [ -f "$ACCOUNT_CONF_PATH" ]; then
2166     . "$ACCOUNT_CONF_PATH"
2167   fi
2168
2169   if [ "$IN_CRON" ]; then
2170     if [ ! "$_USER_PATH_EXPORTED" ]; then
2171       _USER_PATH_EXPORTED=1
2172       export PATH="$USER_PATH:$PATH"
2173     fi
2174   fi
2175
2176   if [ -z "$CA_HOME" ]; then
2177     CA_HOME="$DEFAULT_CA_HOME"
2178   fi
2179
2180   if [ -z "$API" ]; then
2181     if [ -z "$STAGE" ]; then
2182       API="$DEFAULT_CA"
2183     else
2184       API="$STAGE_CA"
2185       _info "Using stage api:$API"
2186     fi
2187   fi
2188
2189   _API_HOST="$(echo "$API" | cut -d : -f 2 | tr -d '/')"
2190   CA_DIR="$CA_HOME/$_API_HOST"
2191
2192   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
2193
2194   if [ -z "$CA_CONF" ]; then
2195     CA_CONF="$_DEFAULT_CA_CONF"
2196   fi
2197   _debug3 CA_CONF "$CA_CONF"
2198
2199   if [ -f "$CA_CONF" ]; then
2200     . "$CA_CONF"
2201   fi
2202
2203   if [ -z "$ACME_DIR" ]; then
2204     ACME_DIR="/home/.acme"
2205   fi
2206
2207   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
2208     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
2209   fi
2210
2211   if [ -z "$USER_AGENT" ]; then
2212     USER_AGENT="$DEFAULT_USER_AGENT"
2213   fi
2214
2215   if [ -z "$HTTP_HEADER" ]; then
2216     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
2217   fi
2218
2219   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
2220   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
2221
2222   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
2223   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
2224   if [ -z "$ACCOUNT_KEY_PATH" ]; then
2225     ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
2226   fi
2227
2228   if [ -z "$ACCOUNT_JSON_PATH" ]; then
2229     ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
2230   fi
2231
2232   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
2233   if [ -z "$CERT_HOME" ]; then
2234     CERT_HOME="$_DEFAULT_CERT_HOME"
2235   fi
2236
2237   if [ -z "$ACME_OPENSSL_BIN" ] || [ ! -f "$ACME_OPENSSL_BIN" ] || [ ! -x "$ACME_OPENSSL_BIN" ]; then
2238     ACME_OPENSSL_BIN="$DEFAULT_OPENSSL_BIN"
2239   fi
2240
2241   if [ -z "$1" ]; then
2242     return 0
2243   fi
2244
2245   domain="$1"
2246   _ilength="$2"
2247
2248   if [ -z "$DOMAIN_PATH" ]; then
2249     domainhome="$CERT_HOME/$domain"
2250     domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
2251
2252     DOMAIN_PATH="$domainhome"
2253
2254     if _isEccKey "$_ilength"; then
2255       DOMAIN_PATH="$domainhomeecc"
2256     else
2257       if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
2258         _info "The domain '$domain' seems to have a ECC cert already, please add '$(__red "--ecc")' parameter if you want to use that cert."
2259       fi
2260     fi
2261     _debug DOMAIN_PATH "$DOMAIN_PATH"
2262   fi
2263
2264   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
2265     DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
2266   fi
2267
2268   if [ -z "$DOMAIN_CONF" ]; then
2269     DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
2270   fi
2271
2272   if [ -z "$DOMAIN_SSL_CONF" ]; then
2273     DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
2274   fi
2275
2276   if [ -z "$CSR_PATH" ]; then
2277     CSR_PATH="$DOMAIN_PATH/$domain.csr"
2278   fi
2279   if [ -z "$CERT_KEY_PATH" ]; then
2280     CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
2281   fi
2282   if [ -z "$CERT_PATH" ]; then
2283     CERT_PATH="$DOMAIN_PATH/$domain.cer"
2284   fi
2285   if [ -z "$CA_CERT_PATH" ]; then
2286     CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
2287   fi
2288   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
2289     CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
2290   fi
2291   if [ -z "$CERT_PFX_PATH" ]; then
2292     CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
2293   fi
2294   if [ -z "$CERT_PKCS8_PATH" ]; then
2295     CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
2296   fi
2297
2298   if [ -z "$TLS_CONF" ]; then
2299     TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
2300   fi
2301   if [ -z "$TLS_CERT" ]; then
2302     TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
2303   fi
2304   if [ -z "$TLS_KEY" ]; then
2305     TLS_KEY="$DOMAIN_PATH/tls.validation.key"
2306   fi
2307   if [ -z "$TLS_CSR" ]; then
2308     TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
2309   fi
2310
2311 }
2312
2313 _exec() {
2314   if [ -z "$_EXEC_TEMP_ERR" ]; then
2315     _EXEC_TEMP_ERR="$(_mktemp)"
2316   fi
2317
2318   if [ "$_EXEC_TEMP_ERR" ]; then
2319     eval "$@ 2>>$_EXEC_TEMP_ERR"
2320   else
2321     eval "$@"
2322   fi
2323 }
2324
2325 _exec_err() {
2326   [ "$_EXEC_TEMP_ERR" ] && _err "$(cat "$_EXEC_TEMP_ERR")" && echo "" >"$_EXEC_TEMP_ERR"
2327 }
2328
2329 _apachePath() {
2330   _APACHECTL="apachectl"
2331   if ! _exists apachectl; then
2332     if _exists apache2ctl; then
2333       _APACHECTL="apache2ctl"
2334     else
2335       _err "'apachectl not found. It seems that apache is not installed, or you are not root user.'"
2336       _err "Please use webroot mode to try again."
2337       return 1
2338     fi
2339   fi
2340
2341   if ! _exec $_APACHECTL -V >/dev/null; then
2342     _exec_err
2343     return 1
2344   fi
2345
2346   if [ "$APACHE_HTTPD_CONF" ]; then
2347     _saveaccountconf APACHE_HTTPD_CONF "$APACHE_HTTPD_CONF"
2348     httpdconf="$APACHE_HTTPD_CONF"
2349     httpdconfname="$(basename "$httpdconfname")"
2350   else
2351     httpdconfname="$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '"')"
2352     _debug httpdconfname "$httpdconfname"
2353
2354     if [ -z "$httpdconfname" ]; then
2355       _err "Can not read apache config file."
2356       return 1
2357     fi
2358
2359     if _startswith "$httpdconfname" '/'; then
2360       httpdconf="$httpdconfname"
2361       httpdconfname="$(basename "$httpdconfname")"
2362     else
2363       httpdroot="$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '"')"
2364       _debug httpdroot "$httpdroot"
2365       httpdconf="$httpdroot/$httpdconfname"
2366       httpdconfname="$(basename "$httpdconfname")"
2367     fi
2368   fi
2369   _debug httpdconf "$httpdconf"
2370   _debug httpdconfname "$httpdconfname"
2371   if [ ! -f "$httpdconf" ]; then
2372     _err "Apache Config file not found" "$httpdconf"
2373     return 1
2374   fi
2375   return 0
2376 }
2377
2378 _restoreApache() {
2379   if [ -z "$usingApache" ]; then
2380     return 0
2381   fi
2382   _initpath
2383   if ! _apachePath; then
2384     return 1
2385   fi
2386
2387   if [ ! -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname" ]; then
2388     _debug "No config file to restore."
2389     return 0
2390   fi
2391
2392   cat "$APACHE_CONF_BACKUP_DIR/$httpdconfname" >"$httpdconf"
2393   _debug "Restored: $httpdconf."
2394   if ! _exec $_APACHECTL -t; then
2395     _exec_err
2396     _err "Sorry, restore apache config error, please contact me."
2397     return 1
2398   fi
2399   _debug "Restored successfully."
2400   rm -f "$APACHE_CONF_BACKUP_DIR/$httpdconfname"
2401   return 0
2402 }
2403
2404 _setApache() {
2405   _initpath
2406   if ! _apachePath; then
2407     return 1
2408   fi
2409
2410   #test the conf first
2411   _info "Checking if there is an error in the apache config file before starting."
2412
2413   if ! _exec "$_APACHECTL" -t >/dev/null; then
2414     _exec_err
2415     _err "The apache config file has error, please fix it first, then try again."
2416     _err "Don't worry, there is nothing changed to your system."
2417     return 1
2418   else
2419     _info "OK"
2420   fi
2421
2422   #backup the conf
2423   _debug "Backup apache config file" "$httpdconf"
2424   if ! cp "$httpdconf" "$APACHE_CONF_BACKUP_DIR/"; then
2425     _err "Can not backup apache config file, so abort. Don't worry, the apache config is not changed."
2426     _err "This might be a bug of $PROJECT_NAME , please report issue: $PROJECT"
2427     return 1
2428   fi
2429   _info "JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname"
2430   _info "In case there is an error that can not be restored automatically, you may try restore it yourself."
2431   _info "The backup file will be deleted on success, just forget it."
2432
2433   #add alias
2434
2435   apacheVer="$($_APACHECTL -V | grep "Server version:" | cut -d : -f 2 | cut -d " " -f 2 | cut -d '/' -f 2)"
2436   _debug "apacheVer" "$apacheVer"
2437   apacheMajer="$(echo "$apacheVer" | cut -d . -f 1)"
2438   apacheMinor="$(echo "$apacheVer" | cut -d . -f 2)"
2439
2440   if [ "$apacheVer" ] && [ "$apacheMajer$apacheMinor" -ge "24" ]; then
2441     echo "
2442 Alias /.well-known/acme-challenge  $ACME_DIR
2443
2444 <Directory $ACME_DIR >
2445 Require all granted
2446 </Directory>
2447   " >>"$httpdconf"
2448   else
2449     echo "
2450 Alias /.well-known/acme-challenge  $ACME_DIR
2451
2452 <Directory $ACME_DIR >
2453 Order allow,deny
2454 Allow from all
2455 </Directory>
2456   " >>"$httpdconf"
2457   fi
2458
2459   _msg="$($_APACHECTL -t 2>&1)"
2460   if [ "$?" != "0" ]; then
2461     _err "Sorry, apache config error"
2462     if _restoreApache; then
2463       _err "The apache config file is restored."
2464     else
2465       _err "Sorry, The apache config file can not be restored, please report bug."
2466     fi
2467     return 1
2468   fi
2469
2470   if [ ! -d "$ACME_DIR" ]; then
2471     mkdir -p "$ACME_DIR"
2472     chmod 755 "$ACME_DIR"
2473   fi
2474
2475   if ! _exec "$_APACHECTL" graceful; then
2476     _exec_err
2477     _err "$_APACHECTL  graceful error, please contact me."
2478     _restoreApache
2479     return 1
2480   fi
2481   usingApache="1"
2482   return 0
2483 }
2484
2485 #find the real nginx conf file
2486 #backup
2487 #set the nginx conf
2488 #returns the real nginx conf file
2489 _setNginx() {
2490   _d="$1"
2491   _croot="$2"
2492   _thumbpt="$3"
2493   if ! _exists "nginx"; then
2494     _err "nginx command is not found."
2495     return 1
2496   fi
2497   FOUND_REAL_NGINX_CONF=""
2498   FOUND_REAL_NGINX_CONF_LN=""
2499   BACKUP_NGINX_CONF=""
2500   _debug _croot "$_croot"
2501   _start_f="$(echo "$_croot" | cut -d : -f 2)"
2502   _debug _start_f "$_start_f"
2503   if [ -z "$_start_f" ]; then
2504     _debug "find start conf from nginx command"
2505     if [ -z "$NGINX_CONF" ]; then
2506       NGINX_CONF="$(nginx -V 2>&1 | _egrep_o "--conf-path=[^ ]* " | tr -d " ")"
2507       _debug NGINX_CONF "$NGINX_CONF"
2508       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
2509       _debug NGINX_CONF "$NGINX_CONF"
2510       if [ ! -f "$NGINX_CONF" ]; then
2511         _err "'$NGINX_CONF' doesn't exist."
2512         NGINX_CONF=""
2513         return 1
2514       fi
2515       _debug "Found nginx conf file:$NGINX_CONF"
2516     fi
2517     _start_f="$NGINX_CONF"
2518   fi
2519   _debug "Start detect nginx conf for $_d from:$_start_f"
2520   if ! _checkConf "$_d" "$_start_f"; then
2521     _err "Can not find conf file for domain $d"
2522     return 1
2523   fi
2524   _info "Found conf file: $FOUND_REAL_NGINX_CONF"
2525
2526   _ln=$FOUND_REAL_NGINX_CONF_LN
2527   _debug "_ln" "$_ln"
2528
2529   _lnn=$(_math $_ln + 1)
2530   _debug _lnn "$_lnn"
2531   _start_tag="$(sed -n "$_lnn,${_lnn}p" "$FOUND_REAL_NGINX_CONF")"
2532   _debug "_start_tag" "$_start_tag"
2533   if [ "$_start_tag" = "$NGINX_START" ]; then
2534     _info "The domain $_d is already configured, skip"
2535     FOUND_REAL_NGINX_CONF=""
2536     return 0
2537   fi
2538
2539   mkdir -p "$DOMAIN_BACKUP_PATH"
2540   _backup_conf="$DOMAIN_BACKUP_PATH/$_d.nginx.conf"
2541   _debug _backup_conf "$_backup_conf"
2542   BACKUP_NGINX_CONF="$_backup_conf"
2543   _info "Backup $FOUND_REAL_NGINX_CONF to $_backup_conf"
2544   if ! cp "$FOUND_REAL_NGINX_CONF" "$_backup_conf"; then
2545     _err "backup error."
2546     FOUND_REAL_NGINX_CONF=""
2547     return 1
2548   fi
2549
2550   _info "Check the nginx conf before setting up."
2551   if ! _exec "nginx -t" >/dev/null; then
2552     _exec_err
2553     return 1
2554   fi
2555
2556   _info "OK, Set up nginx config file"
2557
2558   if ! sed -n "1,${_ln}p" "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"; then
2559     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2560     _err "write nginx conf error, but don't worry, the file is restored to the original version."
2561     return 1
2562   fi
2563
2564   echo "$NGINX_START
2565 location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
2566   default_type text/plain;
2567   return 200 \"\$1.$_thumbpt\";
2568 }
2569 #NGINX_START
2570 " >>"$FOUND_REAL_NGINX_CONF"
2571
2572   if ! sed -n "${_lnn},99999p" "$_backup_conf" >>"$FOUND_REAL_NGINX_CONF"; then
2573     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2574     _err "write nginx conf error, but don't worry, the file is restored."
2575     return 1
2576   fi
2577
2578   _info "nginx conf is done, let's check it again."
2579   if ! _exec "nginx -t" >/dev/null; then
2580     _exec_err
2581     _err "It seems that nginx conf was broken, let's restore."
2582     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2583     return 1
2584   fi
2585
2586   _info "Reload nginx"
2587   if ! _exec "nginx -s reload" >/dev/null; then
2588     _exec_err
2589     _err "It seems that nginx reload error, let's restore."
2590     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
2591     return 1
2592   fi
2593
2594   return 0
2595 }
2596
2597 #d , conf
2598 _checkConf() {
2599   _d="$1"
2600   _c_file="$2"
2601   _debug "Start _checkConf from:$_c_file"
2602   if [ ! -f "$2" ] && ! echo "$2" | grep '*$' >/dev/null && echo "$2" | grep '*' >/dev/null; then
2603     _debug "wildcard"
2604     for _w_f in $2; do
2605       if [ -f "$_w_f" ] && _checkConf "$1" "$_w_f"; then
2606         return 0
2607       fi
2608     done
2609     #not found
2610     return 1
2611   elif [ -f "$2" ]; then
2612     _debug "single"
2613     if _isRealNginxConf "$1" "$2"; then
2614       _debug "$2 is found."
2615       FOUND_REAL_NGINX_CONF="$2"
2616       return 0
2617     fi
2618     if cat "$2" | tr "\t" " " | grep "^ *include *.*;" >/dev/null; then
2619       _debug "Try include files"
2620       for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
2621         _debug "check included $included"
2622         if _checkConf "$1" "$included"; then
2623           return 0
2624         fi
2625       done
2626     fi
2627     return 1
2628   else
2629     _debug "$2 not found."
2630     return 1
2631   fi
2632   return 1
2633 }
2634
2635 #d , conf
2636 _isRealNginxConf() {
2637   _debug "_isRealNginxConf $1 $2"
2638   if [ -f "$2" ]; then
2639     for _fln in $(tr "\t" ' ' <"$2" | grep -n "^ *server_name.* $1" | cut -d : -f 1); do
2640       _debug _fln "$_fln"
2641       if [ "$_fln" ]; then
2642         _start=$(tr "\t" ' ' <"$2" | _head_n "$_fln" | grep -n "^ *server *{" | _tail_n 1)
2643         _debug "_start" "$_start"
2644         _start_n=$(echo "$_start" | cut -d : -f 1)
2645         _start_nn=$(_math $_start_n + 1)
2646         _debug "_start_n" "$_start_n"
2647         _debug "_start_nn" "$_start_nn"
2648
2649         _left="$(sed -n "${_start_nn},99999p" "$2")"
2650         _debug2 _left "$_left"
2651         if echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" >/dev/null; then
2652           _end=$(echo "$_left" | tr "\t" ' ' | grep -n "^ *server *{" | _head_n 1)
2653           _debug "_end" "$_end"
2654           _end_n=$(echo "$_end" | cut -d : -f 1)
2655           _debug "_end_n" "$_end_n"
2656           _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
2657         else
2658           _seg_n="$_left"
2659         fi
2660
2661         _debug "_seg_n" "$_seg_n"
2662
2663         if [ "$(echo "$_seg_n" | _egrep_o "^ *ssl  *on *;")" ]; then
2664           _debug "ssl on, skip"
2665           return 1
2666         fi
2667         FOUND_REAL_NGINX_CONF_LN=$_fln
2668         return 0
2669       fi
2670     done
2671   fi
2672   return 1
2673 }
2674
2675 #restore all the nginx conf
2676 _restoreNginx() {
2677   if [ -z "$NGINX_RESTORE_VLIST" ]; then
2678     _debug "No need to restore nginx, skip."
2679     return
2680   fi
2681   _debug "_restoreNginx"
2682   _debug "NGINX_RESTORE_VLIST" "$NGINX_RESTORE_VLIST"
2683
2684   for ng_entry in $(echo "$NGINX_RESTORE_VLIST" | tr "$dvsep" ' '); do
2685     _debug "ng_entry" "$ng_entry"
2686     _nd=$(echo "$ng_entry" | cut -d "$sep" -f 1)
2687     _ngconf=$(echo "$ng_entry" | cut -d "$sep" -f 2)
2688     _ngbackupconf=$(echo "$ng_entry" | cut -d "$sep" -f 3)
2689     _info "Restoring from $_ngbackupconf to $_ngconf"
2690     cat "$_ngbackupconf" >"$_ngconf"
2691   done
2692
2693   _info "Reload nginx"
2694   if ! _exec "nginx -s reload" >/dev/null; then
2695     _exec_err
2696     _err "It seems that nginx reload error, please report bug."
2697     return 1
2698   fi
2699   return 0
2700 }
2701
2702 _clearup() {
2703   _stopserver "$serverproc"
2704   serverproc=""
2705   _restoreApache
2706   _restoreNginx
2707   _clearupdns
2708   if [ -z "$DEBUG" ]; then
2709     rm -f "$TLS_CONF"
2710     rm -f "$TLS_CERT"
2711     rm -f "$TLS_KEY"
2712     rm -f "$TLS_CSR"
2713   fi
2714 }
2715
2716 _clearupdns() {
2717   _debug "_clearupdns"
2718   if [ "$dnsadded" != 1 ] || [ -z "$vlist" ]; then
2719     _debug "Dns not added, skip."
2720     return
2721   fi
2722
2723   ventries=$(echo "$vlist" | tr ',' ' ')
2724   for ventry in $ventries; do
2725     d=$(echo "$ventry" | cut -d "$sep" -f 1)
2726     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2727     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2728     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2729     txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
2730     _debug txt "$txt"
2731     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
2732       _debug "$d is already verified, skip $vtype."
2733       continue
2734     fi
2735
2736     if [ "$vtype" != "$VTYPE_DNS" ]; then
2737       _info "Skip $d for $vtype"
2738       continue
2739     fi
2740
2741     d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
2742     _debug d_api "$d_api"
2743
2744     if [ -z "$d_api" ]; then
2745       _info "Not Found domain api file: $d_api"
2746       continue
2747     fi
2748
2749     (
2750       if ! . "$d_api"; then
2751         _err "Load file $d_api error. Please check your api file and try again."
2752         return 1
2753       fi
2754
2755       rmcommand="${_currentRoot}_rm"
2756       if ! _exists "$rmcommand"; then
2757         _err "It seems that your api file doesn't define $rmcommand"
2758         return 1
2759       fi
2760
2761       txtdomain="_acme-challenge.$d"
2762
2763       if ! $rmcommand "$txtdomain" "$txt"; then
2764         _err "Error removing txt for domain:$txtdomain"
2765         return 1
2766       fi
2767     )
2768
2769   done
2770 }
2771
2772 # webroot  removelevel tokenfile
2773 _clearupwebbroot() {
2774   __webroot="$1"
2775   if [ -z "$__webroot" ]; then
2776     _debug "no webroot specified, skip"
2777     return 0
2778   fi
2779
2780   _rmpath=""
2781   if [ "$2" = '1' ]; then
2782     _rmpath="$__webroot/.well-known"
2783   elif [ "$2" = '2' ]; then
2784     _rmpath="$__webroot/.well-known/acme-challenge"
2785   elif [ "$2" = '3' ]; then
2786     _rmpath="$__webroot/.well-known/acme-challenge/$3"
2787   else
2788     _debug "Skip for removelevel:$2"
2789   fi
2790
2791   if [ "$_rmpath" ]; then
2792     if [ "$DEBUG" ]; then
2793       _debug "Debugging, skip removing: $_rmpath"
2794     else
2795       rm -rf "$_rmpath"
2796     fi
2797   fi
2798
2799   return 0
2800
2801 }
2802
2803 _on_before_issue() {
2804   _chk_web_roots="$1"
2805   _chk_main_domain="$2"
2806   _chk_alt_domains="$3"
2807   _chk_pre_hook="$4"
2808   _chk_local_addr="$5"
2809   _debug _on_before_issue
2810   #run pre hook
2811   if [ "$_chk_pre_hook" ]; then
2812     _info "Run pre hook:'$_chk_pre_hook'"
2813     if ! (
2814       cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
2815     ); then
2816       _err "Error when run pre hook."
2817       return 1
2818     fi
2819   fi
2820
2821   if _hasfield "$_chk_web_roots" "$NO_VALUE"; then
2822     if ! _exists "nc"; then
2823       _err "Please install netcat(nc) tools first."
2824       return 1
2825     fi
2826   fi
2827
2828   _debug Le_LocalAddress "$_chk_local_addr"
2829
2830   alldomains=$(echo "$_chk_main_domain,$_chk_alt_domains" | tr ',' ' ')
2831   _index=1
2832   _currentRoot=""
2833   _addrIndex=1
2834   for d in $alldomains; do
2835     _debug "Check for domain" "$d"
2836     _currentRoot="$(_getfield "$_chk_web_roots" $_index)"
2837     _debug "_currentRoot" "$_currentRoot"
2838     _index=$(_math $_index + 1)
2839     _checkport=""
2840     if [ "$_currentRoot" = "$NO_VALUE" ]; then
2841       _info "Standalone mode."
2842       if [ -z "$Le_HTTPPort" ]; then
2843         Le_HTTPPort=80
2844       else
2845         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
2846       fi
2847       _checkport="$Le_HTTPPort"
2848     elif [ "$_currentRoot" = "$W_TLS" ]; then
2849       _info "Standalone tls mode."
2850       if [ -z "$Le_TLSPort" ]; then
2851         Le_TLSPort=443
2852       else
2853         _savedomainconf "Le_TLSPort" "$Le_TLSPort"
2854       fi
2855       _checkport="$Le_TLSPort"
2856     fi
2857
2858     if [ "$_checkport" ]; then
2859       _debug _checkport "$_checkport"
2860       _checkaddr="$(_getfield "$_chk_local_addr" $_addrIndex)"
2861       _debug _checkaddr "$_checkaddr"
2862
2863       _addrIndex="$(_math $_addrIndex + 1)"
2864
2865       _netprc="$(_ss "$_checkport" | grep "$_checkport")"
2866       netprc="$(echo "$_netprc" | grep "$_checkaddr")"
2867       if [ -z "$netprc" ]; then
2868         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
2869       fi
2870       if [ "$netprc" ]; then
2871         _err "$netprc"
2872         _err "tcp port $_checkport is already used by $(echo "$netprc" | cut -d : -f 4)"
2873         _err "Please stop it first"
2874         return 1
2875       fi
2876     fi
2877   done
2878
2879   if _hasfield "$_chk_web_roots" "apache"; then
2880     if ! _setApache; then
2881       _err "set up apache error. Report error to me."
2882       return 1
2883     fi
2884   else
2885     usingApache=""
2886   fi
2887
2888 }
2889
2890 _on_issue_err() {
2891   _chk_post_hook="$1"
2892   _chk_vlist="$2"
2893   _debug _on_issue_err
2894   if [ "$LOG_FILE" ]; then
2895     _err "Please check log file for more details: $LOG_FILE"
2896   else
2897     _err "Please add '--debug' or '--log' to check more details."
2898     _err "See: $_DEBUG_WIKI"
2899   fi
2900
2901   #run the post hook
2902   if [ "$_chk_post_hook" ]; then
2903     _info "Run post hook:'$_chk_post_hook'"
2904     if ! (
2905       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
2906     ); then
2907       _err "Error when run post hook."
2908       return 1
2909     fi
2910   fi
2911
2912   #trigger the validation to flush the pending authz
2913   if [ "$_chk_vlist" ]; then
2914     (
2915       _debug2 "_chk_vlist" "$_chk_vlist"
2916       _debug2 "start to deactivate authz"
2917       ventries=$(echo "$_chk_vlist" | tr "$dvsep" ' ')
2918       for ventry in $ventries; do
2919         d=$(echo "$ventry" | cut -d "$sep" -f 1)
2920         keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
2921         uri=$(echo "$ventry" | cut -d "$sep" -f 3)
2922         vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
2923         _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
2924         __trigger_validation "$uri" "$keyauthorization"
2925       done
2926     )
2927   fi
2928
2929   if [ "$DEBUG" ] && [ "$DEBUG" -gt "0" ]; then
2930     _debug "$(_dlg_versions)"
2931   fi
2932
2933 }
2934
2935 _on_issue_success() {
2936   _chk_post_hook="$1"
2937   _chk_renew_hook="$2"
2938   _debug _on_issue_success
2939   #run the post hook
2940   if [ "$_chk_post_hook" ]; then
2941     _info "Run post hook:'$_chk_post_hook'"
2942     if ! (
2943       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
2944     ); then
2945       _err "Error when run post hook."
2946       return 1
2947     fi
2948   fi
2949
2950   #run renew hook
2951   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
2952     _info "Run renew hook:'$_chk_renew_hook'"
2953     if ! (
2954       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
2955     ); then
2956       _err "Error when run renew hook."
2957       return 1
2958     fi
2959   fi
2960
2961 }
2962
2963 updateaccount() {
2964   _initpath
2965   _regAccount
2966 }
2967
2968 registeraccount() {
2969   _reg_length="$1"
2970   _initpath
2971   _regAccount "$_reg_length"
2972 }
2973
2974 __calcAccountKeyHash() {
2975   [ -f "$ACCOUNT_KEY_PATH" ] && _digest sha256 <"$ACCOUNT_KEY_PATH"
2976 }
2977
2978 __calc_account_thumbprint() {
2979   printf "%s" "$jwk" | tr -d ' ' | _digest "sha256" | _url_replace
2980 }
2981
2982 #keylength
2983 _regAccount() {
2984   _initpath
2985   _reg_length="$1"
2986
2987   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
2988     mkdir -p "$CA_DIR"
2989     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
2990     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
2991   fi
2992
2993   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
2994     mkdir -p "$CA_DIR"
2995     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
2996     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
2997   fi
2998
2999   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
3000     if ! _create_account_key "$_reg_length"; then
3001       _err "Create account key error."
3002       return 1
3003     fi
3004   fi
3005
3006   if ! _calcjwk "$ACCOUNT_KEY_PATH"; then
3007     return 1
3008   fi
3009
3010   _updateTos=""
3011   _reg_res="new-reg"
3012   while true; do
3013     _debug AGREEMENT "$AGREEMENT"
3014
3015     regjson='{"resource": "'$_reg_res'", "agreement": "'$AGREEMENT'"}'
3016
3017     if [ "$ACCOUNT_EMAIL" ]; then
3018       regjson='{"resource": "'$_reg_res'", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
3019     fi
3020
3021     if [ -z "$_updateTos" ]; then
3022       _info "Registering account"
3023
3024       if ! _send_signed_request "$API/acme/new-reg" "$regjson"; then
3025         _err "Register account Error: $response"
3026         return 1
3027       fi
3028
3029       if [ "$code" = "" ] || [ "$code" = '201' ]; then
3030         echo "$response" >"$ACCOUNT_JSON_PATH"
3031         _info "Registered"
3032       elif [ "$code" = '409' ]; then
3033         _info "Already registered"
3034       else
3035         _err "Register account Error: $response"
3036         return 1
3037       fi
3038
3039       _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
3040       _debug "_accUri" "$_accUri"
3041
3042       _tos="$(echo "$responseHeaders" | grep "^Link:.*rel=\"terms-of-service\"" | _head_n 1 | _egrep_o "<.*>" | tr -d '<>')"
3043       _debug "_tos" "$_tos"
3044       if [ -z "$_tos" ]; then
3045         _debug "Use default tos: $DEFAULT_AGREEMENT"
3046         _tos="$DEFAULT_AGREEMENT"
3047       fi
3048       if [ "$_tos" != "$AGREEMENT" ]; then
3049         _updateTos=1
3050         AGREEMENT="$_tos"
3051         _reg_res="reg"
3052         continue
3053       fi
3054
3055     else
3056       _debug "Update tos: $_tos"
3057       if ! _send_signed_request "$_accUri" "$regjson"; then
3058         _err "Update tos error."
3059         return 1
3060       fi
3061       if [ "$code" = '202' ]; then
3062         _info "Update success."
3063
3064         CA_KEY_HASH="$(__calcAccountKeyHash)"
3065         _debug "Calc CA_KEY_HASH" "$CA_KEY_HASH"
3066         _savecaconf CA_KEY_HASH "$CA_KEY_HASH"
3067       else
3068         _err "Update account error."
3069         return 1
3070       fi
3071     fi
3072     ACCOUNT_THUMBPRINT="$(__calc_account_thumbprint)"
3073     _info "ACCOUNT_THUMBPRINT" "$ACCOUNT_THUMBPRINT"
3074     return 0
3075   done
3076
3077 }
3078
3079 # domain folder  file
3080 _findHook() {
3081   _hookdomain="$1"
3082   _hookcat="$2"
3083   _hookname="$3"
3084
3085   if [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname" ]; then
3086     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname"
3087   elif [ -f "$_SCRIPT_HOME/$_hookcat/$_hookname.sh" ]; then
3088     d_api="$_SCRIPT_HOME/$_hookcat/$_hookname.sh"
3089   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname" ]; then
3090     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname"
3091   elif [ -f "$LE_WORKING_DIR/$_hookdomain/$_hookname.sh" ]; then
3092     d_api="$LE_WORKING_DIR/$_hookdomain/$_hookname.sh"
3093   elif [ -f "$LE_WORKING_DIR/$_hookname" ]; then
3094     d_api="$LE_WORKING_DIR/$_hookname"
3095   elif [ -f "$LE_WORKING_DIR/$_hookname.sh" ]; then
3096     d_api="$LE_WORKING_DIR/$_hookname.sh"
3097   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname" ]; then
3098     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname"
3099   elif [ -f "$LE_WORKING_DIR/$_hookcat/$_hookname.sh" ]; then
3100     d_api="$LE_WORKING_DIR/$_hookcat/$_hookname.sh"
3101   fi
3102
3103   printf "%s" "$d_api"
3104 }
3105
3106 #domain
3107 __get_domain_new_authz() {
3108   _gdnd="$1"
3109   _info "Getting new-authz for domain" "$_gdnd"
3110
3111   _Max_new_authz_retry_times=5
3112   _authz_i=0
3113   while [ "$_authz_i" -lt "$_Max_new_authz_retry_times" ]; do
3114     _debug "Try new-authz for the $_authz_i time."
3115     if ! _send_signed_request "$API/acme/new-authz" "{\"resource\": \"new-authz\", \"identifier\": {\"type\": \"dns\", \"value\": \"$(_idn "$_gdnd")\"}}"; then
3116       _err "Can not get domain new authz."
3117       return 1
3118     fi
3119     if _contains "$response" "No registration exists matching provided key"; then
3120       _err "It seems there is an error, but it's recovered now, please try again."
3121       _err "If you see this message for a second time, please report bug: $(__green "$PROJECT")"
3122       _clearcaconf "CA_KEY_HASH"
3123       break
3124     fi
3125     if ! _contains "$response" "An error occurred while processing your request"; then
3126       _info "The new-authz request is ok."
3127       break
3128     fi
3129     _authz_i="$(_math "$_authz_i" + 1)"
3130     _info "The server is busy, Sleep $_authz_i to retry."
3131     _sleep "$_authz_i"
3132   done
3133
3134   if [ "$_authz_i" = "$_Max_new_authz_retry_times" ]; then
3135     _err "new-authz retry reach the max $_Max_new_authz_retry_times times."
3136   fi
3137
3138   if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
3139     _err "new-authz error: $response"
3140     return 1
3141   fi
3142
3143 }
3144
3145 #uri keyAuthorization
3146 __trigger_validation() {
3147   _debug2 "tigger domain validation."
3148   _t_url="$1"
3149   _debug2 _t_url "$_t_url"
3150   _t_key_authz="$2"
3151   _debug2 _t_key_authz "$_t_key_authz"
3152   _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$_t_key_authz\"}"
3153 }
3154
3155 #webroot, domain domainlist  keylength
3156 issue() {
3157   if [ -z "$2" ]; then
3158     _usage "Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ "
3159     return 1
3160   fi
3161   if [ -z "$1" ]; then
3162     _usage "Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc."
3163     return 1
3164   fi
3165   _web_roots="$1"
3166   _main_domain="$2"
3167   _alt_domains="$3"
3168   if _contains "$_main_domain" ","; then
3169     _main_domain=$(echo "$2,$3" | cut -d , -f 1)
3170     _alt_domains=$(echo "$2,$3" | cut -d , -f 2- | sed "s/,${NO_VALUE}$//")
3171   fi
3172   _key_length="$4"
3173   _real_cert="$5"
3174   _real_key="$6"
3175   _real_ca="$7"
3176   _reload_cmd="$8"
3177   _real_fullchain="$9"
3178   _pre_hook="${10}"
3179   _post_hook="${11}"
3180   _renew_hook="${12}"
3181   _local_addr="${13}"
3182
3183   #remove these later.
3184   if [ "$_web_roots" = "dns-cf" ]; then
3185     _web_roots="dns_cf"
3186   fi
3187   if [ "$_web_roots" = "dns-dp" ]; then
3188     _web_roots="dns_dp"
3189   fi
3190   if [ "$_web_roots" = "dns-cx" ]; then
3191     _web_roots="dns_cx"
3192   fi
3193   _debug "Using api: $API"
3194
3195   if [ ! "$IS_RENEW" ]; then
3196     _initpath "$_main_domain" "$_key_length"
3197     mkdir -p "$DOMAIN_PATH"
3198   fi
3199
3200   if [ -f "$DOMAIN_CONF" ]; then
3201     Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
3202     _debug Le_NextRenewTime "$Le_NextRenewTime"
3203     if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3204       _saved_domain=$(_readdomainconf Le_Domain)
3205       _debug _saved_domain "$_saved_domain"
3206       _saved_alt=$(_readdomainconf Le_Alt)
3207       _debug _saved_alt "$_saved_alt"
3208       if [ "$_saved_domain,$_saved_alt" = "$_main_domain,$_alt_domains" ]; then
3209         _info "Domains not changed."
3210         _info "Skip, Next renewal time is: $(__green "$(_readdomainconf Le_NextRenewTimeStr)")"
3211         _info "Add '$(__red '--force')' to force to renew."
3212         return $RENEW_SKIP
3213       else
3214         _info "Domains have changed."
3215       fi
3216     fi
3217   fi
3218
3219   _savedomainconf "Le_Domain" "$_main_domain"
3220   _savedomainconf "Le_Alt" "$_alt_domains"
3221   _savedomainconf "Le_Webroot" "$_web_roots"
3222
3223   _savedomainconf "Le_PreHook" "$_pre_hook"
3224   _savedomainconf "Le_PostHook" "$_post_hook"
3225   _savedomainconf "Le_RenewHook" "$_renew_hook"
3226
3227   if [ "$_local_addr" ]; then
3228     _savedomainconf "Le_LocalAddress" "$_local_addr"
3229   else
3230     _cleardomainconf "Le_LocalAddress"
3231   fi
3232
3233   Le_API="$API"
3234   _savedomainconf "Le_API" "$Le_API"
3235
3236   if [ "$_alt_domains" = "$NO_VALUE" ]; then
3237     _alt_domains=""
3238   fi
3239
3240   if [ "$_key_length" = "$NO_VALUE" ]; then
3241     _key_length=""
3242   fi
3243
3244   if ! _on_before_issue "$_web_roots" "$_main_domain" "$_alt_domains" "$_pre_hook" "$_local_addr"; then
3245     _err "_on_before_issue."
3246     return 1
3247   fi
3248
3249   _saved_account_key_hash="$(_readcaconf "CA_KEY_HASH")"
3250   _debug2 _saved_account_key_hash "$_saved_account_key_hash"
3251
3252   if [ -z "$_saved_account_key_hash" ] || [ "$_saved_account_key_hash" != "$(__calcAccountKeyHash)" ]; then
3253     if ! _regAccount "$_accountkeylength"; then
3254       _on_issue_err "$_post_hook"
3255       return 1
3256     fi
3257   else
3258     _debug "_saved_account_key_hash is not changed, skip register account."
3259   fi
3260
3261   if [ -f "$CSR_PATH" ] && [ ! -f "$CERT_KEY_PATH" ]; then
3262     _info "Signing from existing CSR."
3263   else
3264     _key=$(_readdomainconf Le_Keylength)
3265     _debug "Read key length:$_key"
3266     if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ]; then
3267       if ! createDomainKey "$_main_domain" "$_key_length"; then
3268         _err "Create domain key error."
3269         _clearup
3270         _on_issue_err "$_post_hook"
3271         return 1
3272       fi
3273     fi
3274
3275     if ! _createcsr "$_main_domain" "$_alt_domains" "$CERT_KEY_PATH" "$CSR_PATH" "$DOMAIN_SSL_CONF"; then
3276       _err "Create CSR error."
3277       _clearup
3278       _on_issue_err "$_post_hook"
3279       return 1
3280     fi
3281   fi
3282
3283   _savedomainconf "Le_Keylength" "$_key_length"
3284
3285   vlist="$Le_Vlist"
3286
3287   _info "Getting domain auth token for each domain"
3288   sep='#'
3289   dvsep=','
3290   if [ -z "$vlist" ]; then
3291     alldomains=$(echo "$_main_domain,$_alt_domains" | tr ',' ' ')
3292     _index=1
3293     _currentRoot=""
3294     for d in $alldomains; do
3295       _info "Getting webroot for domain" "$d"
3296       _w="$(echo $_web_roots | cut -d , -f $_index)"
3297       _debug _w "$_w"
3298       if [ "$_w" ]; then
3299         _currentRoot="$_w"
3300       fi
3301       _debug "_currentRoot" "$_currentRoot"
3302       _index=$(_math $_index + 1)
3303
3304       vtype="$VTYPE_HTTP"
3305       if _startswith "$_currentRoot" "dns"; then
3306         vtype="$VTYPE_DNS"
3307       fi
3308
3309       if [ "$_currentRoot" = "$W_TLS" ]; then
3310         vtype="$VTYPE_TLS"
3311       fi
3312
3313       if ! __get_domain_new_authz "$d"; then
3314         _clearup
3315         _on_issue_err "$_post_hook"
3316         return 1
3317       fi
3318
3319       if [ -z "$thumbprint" ]; then
3320         thumbprint="$(__calc_account_thumbprint)"
3321       fi
3322
3323       entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
3324       _debug entry "$entry"
3325       if [ -z "$entry" ]; then
3326         _err "Error, can not get domain token $d"
3327         _clearup
3328         _on_issue_err "$_post_hook"
3329         return 1
3330       fi
3331       token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
3332       _debug token "$token"
3333
3334       uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
3335       _debug uri "$uri"
3336
3337       keyauthorization="$token.$thumbprint"
3338       _debug keyauthorization "$keyauthorization"
3339
3340       if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
3341         _debug "$d is already verified, skip."
3342         keyauthorization="$STATE_VERIFIED"
3343         _debug keyauthorization "$keyauthorization"
3344       fi
3345
3346       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"
3347       _debug dvlist "$dvlist"
3348
3349       vlist="$vlist$dvlist$dvsep"
3350
3351     done
3352     _debug vlist "$vlist"
3353     #add entry
3354     dnsadded=""
3355     ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3356     for ventry in $ventries; do
3357       d=$(echo "$ventry" | cut -d "$sep" -f 1)
3358       keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3359       vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3360       _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3361
3362       if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3363         _debug "$d is already verified, skip $vtype."
3364         continue
3365       fi
3366
3367       if [ "$vtype" = "$VTYPE_DNS" ]; then
3368         dnsadded='0'
3369         txtdomain="_acme-challenge.$d"
3370         _debug txtdomain "$txtdomain"
3371         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
3372         _debug txt "$txt"
3373
3374         d_api="$(_findHook "$d" dnsapi "$_currentRoot")"
3375
3376         _debug d_api "$d_api"
3377
3378         if [ "$d_api" ]; then
3379           _info "Found domain api file: $d_api"
3380         else
3381           _err "Add the following TXT record:"
3382           _err "Domain: '$(__green "$txtdomain")'"
3383           _err "TXT value: '$(__green "$txt")'"
3384           _err "Please be aware that you prepend _acme-challenge. before your domain"
3385           _err "so the resulting subdomain will be: $txtdomain"
3386           continue
3387         fi
3388
3389         (
3390           if ! . "$d_api"; then
3391             _err "Load file $d_api error. Please check your api file and try again."
3392             return 1
3393           fi
3394
3395           addcommand="${_currentRoot}_add"
3396           if ! _exists "$addcommand"; then
3397             _err "It seems that your api file is not correct, it must have a function named: $addcommand"
3398             return 1
3399           fi
3400
3401           if ! $addcommand "$txtdomain" "$txt"; then
3402             _err "Error add txt for domain:$txtdomain"
3403             return 1
3404           fi
3405         )
3406
3407         if [ "$?" != "0" ]; then
3408           _clearup
3409           _on_issue_err "$_post_hook"
3410           return 1
3411         fi
3412         dnsadded='1'
3413       fi
3414     done
3415
3416     if [ "$dnsadded" = '0' ]; then
3417       _savedomainconf "Le_Vlist" "$vlist"
3418       _debug "Dns record not added yet, so, save to $DOMAIN_CONF and exit."
3419       _err "Please add the TXT records to the domains, and retry again."
3420       _clearup
3421       _on_issue_err "$_post_hook"
3422       return 1
3423     fi
3424
3425   fi
3426
3427   if [ "$dnsadded" = '1' ]; then
3428     if [ -z "$Le_DNSSleep" ]; then
3429       Le_DNSSleep="$DEFAULT_DNS_SLEEP"
3430     else
3431       _savedomainconf "Le_DNSSleep" "$Le_DNSSleep"
3432     fi
3433
3434     _info "Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect"
3435     _sleep "$Le_DNSSleep"
3436   fi
3437
3438   NGINX_RESTORE_VLIST=""
3439   _debug "ok, let's start to verify"
3440
3441   _ncIndex=1
3442   ventries=$(echo "$vlist" | tr "$dvsep" ' ')
3443   for ventry in $ventries; do
3444     d=$(echo "$ventry" | cut -d "$sep" -f 1)
3445     keyauthorization=$(echo "$ventry" | cut -d "$sep" -f 2)
3446     uri=$(echo "$ventry" | cut -d "$sep" -f 3)
3447     vtype=$(echo "$ventry" | cut -d "$sep" -f 4)
3448     _currentRoot=$(echo "$ventry" | cut -d "$sep" -f 5)
3449
3450     if [ "$keyauthorization" = "$STATE_VERIFIED" ]; then
3451       _info "$d is already verified, skip $vtype."
3452       continue
3453     fi
3454
3455     _info "Verifying:$d"
3456     _debug "d" "$d"
3457     _debug "keyauthorization" "$keyauthorization"
3458     _debug "uri" "$uri"
3459     removelevel=""
3460     token="$(printf "%s" "$keyauthorization" | cut -d '.' -f 1)"
3461
3462     _debug "_currentRoot" "$_currentRoot"
3463
3464     if [ "$vtype" = "$VTYPE_HTTP" ]; then
3465       if [ "$_currentRoot" = "$NO_VALUE" ]; then
3466         _info "Standalone mode server"
3467         _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3468         _ncIndex="$(_math $_ncIndex + 1)"
3469         _startserver "$keyauthorization" "$_ncaddr" &
3470         if [ "$?" != "0" ]; then
3471           _clearup
3472           _on_issue_err "$_post_hook" "$vlist"
3473           return 1
3474         fi
3475         serverproc="$!"
3476         sleep 1
3477         _debug serverproc "$serverproc"
3478       elif [ "$_currentRoot" = "$MODE_STATELESS" ]; then
3479         _info "Stateless mode for domain:$d"
3480         _sleep 1
3481       elif _startswith "$_currentRoot" "$NGINX"; then
3482         _info "Nginx mode for domain:$d"
3483         #set up nginx server
3484         FOUND_REAL_NGINX_CONF=""
3485         BACKUP_NGINX_CONF=""
3486         if ! _setNginx "$d" "$_currentRoot" "$thumbprint"; then
3487           _clearup
3488           _on_issue_err "$_post_hook" "$vlist"
3489           return 1
3490         fi
3491
3492         if [ "$FOUND_REAL_NGINX_CONF" ]; then
3493           _realConf="$FOUND_REAL_NGINX_CONF"
3494           _backup="$BACKUP_NGINX_CONF"
3495           _debug _realConf "$_realConf"
3496           NGINX_RESTORE_VLIST="$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST"
3497         fi
3498         _sleep 1
3499       else
3500         if [ "$_currentRoot" = "apache" ]; then
3501           wellknown_path="$ACME_DIR"
3502         else
3503           wellknown_path="$_currentRoot/.well-known/acme-challenge"
3504           if [ ! -d "$_currentRoot/.well-known" ]; then
3505             removelevel='1'
3506           elif [ ! -d "$_currentRoot/.well-known/acme-challenge" ]; then
3507             removelevel='2'
3508           else
3509             removelevel='3'
3510           fi
3511         fi
3512
3513         _debug wellknown_path "$wellknown_path"
3514
3515         _debug "writing token:$token to $wellknown_path/$token"
3516
3517         mkdir -p "$wellknown_path"
3518
3519         if ! printf "%s" "$keyauthorization" >"$wellknown_path/$token"; then
3520           _err "$d:Can not write token to file : $wellknown_path/$token"
3521           _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3522           _clearup
3523           _on_issue_err "$_post_hook" "$vlist"
3524           return 1
3525         fi
3526
3527         if [ ! "$usingApache" ]; then
3528           if webroot_owner=$(_stat "$_currentRoot"); then
3529             _debug "Changing owner/group of .well-known to $webroot_owner"
3530             if ! _exec "chown -R \"$webroot_owner\" \"$_currentRoot/.well-known\""; then
3531               _debug "$(cat "$_EXEC_TEMP_ERR")"
3532               _exec_err >/dev/null 2>&1
3533             fi
3534           else
3535             _debug "not changing owner/group of webroot"
3536           fi
3537         fi
3538
3539       fi
3540
3541     elif [ "$vtype" = "$VTYPE_TLS" ]; then
3542       #create A
3543       #_hash_A="$(printf "%s" $token | _digest "sha256" "hex" )"
3544       #_debug2 _hash_A "$_hash_A"
3545       #_x="$(echo $_hash_A | cut -c 1-32)"
3546       #_debug2 _x "$_x"
3547       #_y="$(echo $_hash_A | cut -c 33-64)"
3548       #_debug2 _y "$_y"
3549       #_SAN_A="$_x.$_y.token.acme.invalid"
3550       #_debug2 _SAN_A "$_SAN_A"
3551
3552       #create B
3553       _hash_B="$(printf "%s" "$keyauthorization" | _digest "sha256" "hex")"
3554       _debug2 _hash_B "$_hash_B"
3555       _x="$(echo "$_hash_B" | cut -c 1-32)"
3556       _debug2 _x "$_x"
3557       _y="$(echo "$_hash_B" | cut -c 33-64)"
3558       _debug2 _y "$_y"
3559
3560       #_SAN_B="$_x.$_y.ka.acme.invalid"
3561
3562       _SAN_B="$_x.$_y.acme.invalid"
3563       _debug2 _SAN_B "$_SAN_B"
3564
3565       _ncaddr="$(_getfield "$_local_addr" "$_ncIndex")"
3566       _ncIndex="$(_math "$_ncIndex" + 1)"
3567       if ! _starttlsserver "$_SAN_B" "$_SAN_A" "$Le_TLSPort" "$keyauthorization" "$_ncaddr"; then
3568         _err "Start tls server error."
3569         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3570         _clearup
3571         _on_issue_err "$_post_hook" "$vlist"
3572         return 1
3573       fi
3574     fi
3575
3576     if ! __trigger_validation "$uri" "$keyauthorization"; then
3577       _err "$d:Can not get challenge: $response"
3578       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3579       _clearup
3580       _on_issue_err "$_post_hook" "$vlist"
3581       return 1
3582     fi
3583
3584     if [ ! -z "$code" ] && [ ! "$code" = '202' ]; then
3585       _err "$d:Challenge error: $response"
3586       _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3587       _clearup
3588       _on_issue_err "$_post_hook" "$vlist"
3589       return 1
3590     fi
3591
3592     waittimes=0
3593     if [ -z "$MAX_RETRY_TIMES" ]; then
3594       MAX_RETRY_TIMES=30
3595     fi
3596
3597     while true; do
3598       waittimes=$(_math "$waittimes" + 1)
3599       if [ "$waittimes" -ge "$MAX_RETRY_TIMES" ]; then
3600         _err "$d:Timeout"
3601         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3602         _clearup
3603         _on_issue_err "$_post_hook" "$vlist"
3604         return 1
3605       fi
3606
3607       _debug "sleep 2 secs to verify"
3608       sleep 2
3609       _debug "checking"
3610       response="$(_get "$uri")"
3611       if [ "$?" != "0" ]; then
3612         _err "$d:Verify error:$response"
3613         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3614         _clearup
3615         _on_issue_err "$_post_hook" "$vlist"
3616         return 1
3617       fi
3618       _debug2 original "$response"
3619
3620       response="$(echo "$response" | _normalizeJson)"
3621       _debug2 response "$response"
3622
3623       status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
3624       if [ "$status" = "valid" ]; then
3625         _info "$(__green Success)"
3626         _stopserver "$serverproc"
3627         serverproc=""
3628         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3629         break
3630       fi
3631
3632       if [ "$status" = "invalid" ]; then
3633         error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
3634         _debug2 error "$error"
3635         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
3636         _debug2 errordetail "$errordetail"
3637         if [ "$errordetail" ]; then
3638           _err "$d:Verify error:$errordetail"
3639         else
3640           _err "$d:Verify error:$error"
3641         fi
3642         if [ "$DEBUG" ]; then
3643           if [ "$vtype" = "$VTYPE_HTTP" ]; then
3644             _debug "Debug: get token url."
3645             _get "http://$d/.well-known/acme-challenge/$token" "" 1
3646           fi
3647         fi
3648         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3649         _clearup
3650         _on_issue_err "$_post_hook" "$vlist"
3651         return 1
3652       fi
3653
3654       if [ "$status" = "pending" ]; then
3655         _info "Pending"
3656       else
3657         _err "$d:Verify error:$response"
3658         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
3659         _clearup
3660         _on_issue_err "$_post_hook" "$vlist"
3661         return 1
3662       fi
3663
3664     done
3665
3666   done
3667
3668   _clearup
3669   _info "Verify finished, start to sign."
3670   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
3671
3672   if ! _send_signed_request "$API/acme/new-cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"; then
3673     _err "Sign failed."
3674     _on_issue_err "$_post_hook"
3675     return 1
3676   fi
3677
3678   _rcert="$response"
3679   Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
3680   _debug "Le_LinkCert" "$Le_LinkCert"
3681   _savedomainconf "Le_LinkCert" "$Le_LinkCert"
3682
3683   if [ "$Le_LinkCert" ]; then
3684     echo "$BEGIN_CERT" >"$CERT_PATH"
3685
3686     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
3687     #  _debug "Get cert failed. Let's try last response."
3688     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
3689     #fi
3690
3691     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
3692       _debug "Try cert link."
3693       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
3694     fi
3695
3696     echo "$END_CERT" >>"$CERT_PATH"
3697     _info "$(__green "Cert success.")"
3698     cat "$CERT_PATH"
3699
3700     _info "Your cert is in $(__green " $CERT_PATH ")"
3701
3702     if [ -f "$CERT_KEY_PATH" ]; then
3703       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
3704     fi
3705
3706     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
3707
3708     if [ ! "$USER_PATH" ] || [ ! "$IN_CRON" ]; then
3709       USER_PATH="$PATH"
3710       _saveaccountconf "USER_PATH" "$USER_PATH"
3711     fi
3712   fi
3713
3714   if [ -z "$Le_LinkCert" ]; then
3715     response="$(echo "$response" | _dbase64 "multiline" | _normalizeJson)"
3716     _err "Sign failed: $(echo "$response" | _egrep_o '"detail":"[^"]*"')"
3717     _on_issue_err "$_post_hook"
3718     return 1
3719   fi
3720
3721   _cleardomainconf "Le_Vlist"
3722
3723   Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
3724   if ! _contains "$Le_LinkIssuer" ":"; then
3725     Le_LinkIssuer="$API$Le_LinkIssuer"
3726   fi
3727   _debug Le_LinkIssuer "$Le_LinkIssuer"
3728   _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
3729
3730   if [ "$Le_LinkIssuer" ]; then
3731     _link_issuer_retry=0
3732     _MAX_ISSUER_RETRY=5
3733     while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
3734       _debug _link_issuer_retry "$_link_issuer_retry"
3735       if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
3736         echo "$BEGIN_CERT" >"$CA_CERT_PATH"
3737         _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
3738         echo "$END_CERT" >>"$CA_CERT_PATH"
3739
3740         _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
3741         cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
3742         _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
3743
3744         rm -f "$CA_CERT_PATH.der"
3745         break
3746       fi
3747       _link_issuer_retry=$(_math $_link_issuer_retry + 1)
3748       _sleep "$_link_issuer_retry"
3749     done
3750     if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
3751       _err "Max retry for issuer ca cert is reached."
3752     fi
3753   else
3754     _debug "No Le_LinkIssuer header found."
3755   fi
3756
3757   Le_CertCreateTime=$(_time)
3758   _savedomainconf "Le_CertCreateTime" "$Le_CertCreateTime"
3759
3760   Le_CertCreateTimeStr=$(date -u)
3761   _savedomainconf "Le_CertCreateTimeStr" "$Le_CertCreateTimeStr"
3762
3763   if [ -z "$Le_RenewalDays" ] || [ "$Le_RenewalDays" -lt "0" ] || [ "$Le_RenewalDays" -gt "$MAX_RENEW" ]; then
3764     Le_RenewalDays="$MAX_RENEW"
3765   else
3766     _savedomainconf "Le_RenewalDays" "$Le_RenewalDays"
3767   fi
3768
3769   if [ "$CA_BUNDLE" ]; then
3770     _saveaccountconf CA_BUNDLE "$CA_BUNDLE"
3771   else
3772     _clearaccountconf "CA_BUNDLE"
3773   fi
3774
3775   if [ "$CA_PATH" ]; then
3776     _saveaccountconf CA_PATH "$CA_PATH"
3777   else
3778     _clearaccountconf "CA_PATH"
3779   fi
3780
3781   if [ "$HTTPS_INSECURE" ]; then
3782     _saveaccountconf HTTPS_INSECURE "$HTTPS_INSECURE"
3783   else
3784     _clearaccountconf "HTTPS_INSECURE"
3785   fi
3786
3787   if [ "$Le_Listen_V4" ]; then
3788     _savedomainconf "Le_Listen_V4" "$Le_Listen_V4"
3789     _cleardomainconf Le_Listen_V6
3790   elif [ "$Le_Listen_V6" ]; then
3791     _savedomainconf "Le_Listen_V6" "$Le_Listen_V6"
3792     _cleardomainconf Le_Listen_V4
3793   fi
3794
3795   Le_NextRenewTime=$(_math "$Le_CertCreateTime" + "$Le_RenewalDays" \* 24 \* 60 \* 60)
3796
3797   Le_NextRenewTimeStr=$(_time2str "$Le_NextRenewTime")
3798   _savedomainconf "Le_NextRenewTimeStr" "$Le_NextRenewTimeStr"
3799
3800   Le_NextRenewTime=$(_math "$Le_NextRenewTime" - 86400)
3801   _savedomainconf "Le_NextRenewTime" "$Le_NextRenewTime"
3802
3803   _on_issue_success "$_post_hook" "$_renew_hook"
3804
3805   if [ "$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain" ]; then
3806     _savedomainconf "Le_RealCertPath" "$_real_cert"
3807     _savedomainconf "Le_RealCACertPath" "$_real_ca"
3808     _savedomainconf "Le_RealKeyPath" "$_real_key"
3809     _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
3810     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
3811     _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
3812   fi
3813
3814 }
3815
3816 #domain  [isEcc]
3817 renew() {
3818   Le_Domain="$1"
3819   if [ -z "$Le_Domain" ]; then
3820     _usage "Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]"
3821     return 1
3822   fi
3823
3824   _isEcc="$2"
3825
3826   _initpath "$Le_Domain" "$_isEcc"
3827
3828   _info "$(__green "Renew: '$Le_Domain'")"
3829   if [ ! -f "$DOMAIN_CONF" ]; then
3830     _info "'$Le_Domain' is not a issued domain, skip."
3831     return 0
3832   fi
3833
3834   if [ "$Le_RenewalDays" ]; then
3835     _savedomainconf Le_RenewalDays "$Le_RenewalDays"
3836   fi
3837
3838   . "$DOMAIN_CONF"
3839
3840   if [ "$Le_API" ]; then
3841     API="$Le_API"
3842     #reload ca configs
3843     ACCOUNT_KEY_PATH=""
3844     ACCOUNT_JSON_PATH=""
3845     CA_CONF=""
3846     _debug3 "initpath again."
3847     _initpath "$Le_Domain" "$_isEcc"
3848   fi
3849
3850   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
3851     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
3852     _info "Add '$(__red '--force')' to force to renew."
3853     return "$RENEW_SKIP"
3854   fi
3855
3856   IS_RENEW="1"
3857   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress"
3858   res="$?"
3859   if [ "$res" != "0" ]; then
3860     return "$res"
3861   fi
3862
3863   if [ "$Le_DeployHook" ]; then
3864     _deploy "$Le_Domain" "$Le_DeployHook"
3865     res="$?"
3866   fi
3867
3868   IS_RENEW=""
3869
3870   return "$res"
3871 }
3872
3873 #renewAll  [stopRenewOnError]
3874 renewAll() {
3875   _initpath
3876   _stopRenewOnError="$1"
3877   _debug "_stopRenewOnError" "$_stopRenewOnError"
3878   _ret="0"
3879
3880   for di in "${CERT_HOME}"/*.*/; do
3881     _debug di "$di"
3882     if ! [ -d "$di" ]; then
3883       _debug "Not directory, skip: $di"
3884       continue
3885     fi
3886     d=$(basename "$di")
3887     _debug d "$d"
3888     (
3889       if _endswith "$d" "$ECC_SUFFIX"; then
3890         _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
3891         d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
3892       fi
3893       renew "$d" "$_isEcc"
3894     )
3895     rc="$?"
3896     _debug "Return code: $rc"
3897     if [ "$rc" != "0" ]; then
3898       if [ "$rc" = "$RENEW_SKIP" ]; then
3899         _info "Skipped $d"
3900       elif [ "$_stopRenewOnError" ]; then
3901         _err "Error renew $d,  stop now."
3902         return "$rc"
3903       else
3904         _ret="$rc"
3905         _err "Error renew $d."
3906       fi
3907     fi
3908   done
3909   return "$_ret"
3910 }
3911
3912 #csr webroot
3913 signcsr() {
3914   _csrfile="$1"
3915   _csrW="$2"
3916   if [ -z "$_csrfile" ] || [ -z "$_csrW" ]; then
3917     _usage "Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ "
3918     return 1
3919   fi
3920
3921   _initpath
3922
3923   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
3924   if [ "$?" != "0" ]; then
3925     _err "Can not read subject from csr: $_csrfile"
3926     return 1
3927   fi
3928   _debug _csrsubj "$_csrsubj"
3929
3930   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
3931   if [ "$?" != "0" ]; then
3932     _err "Can not read domain list from csr: $_csrfile"
3933     return 1
3934   fi
3935   _debug "_csrdomainlist" "$_csrdomainlist"
3936
3937   if [ -z "$_csrsubj" ]; then
3938     _csrsubj="$(_getfield "$_csrdomainlist" 1)"
3939     _debug _csrsubj "$_csrsubj"
3940     _csrdomainlist="$(echo "$_csrdomainlist" | cut -d , -f 2-)"
3941     _debug "_csrdomainlist" "$_csrdomainlist"
3942   fi
3943
3944   if [ -z "$_csrsubj" ]; then
3945     _err "Can not read subject from csr: $_csrfile"
3946     return 1
3947   fi
3948
3949   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
3950   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
3951     _err "Can not read key length from csr: $_csrfile"
3952     return 1
3953   fi
3954
3955   _initpath "$_csrsubj" "$_csrkeylength"
3956   mkdir -p "$DOMAIN_PATH"
3957
3958   _info "Copy csr to: $CSR_PATH"
3959   cp "$_csrfile" "$CSR_PATH"
3960
3961   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength"
3962
3963 }
3964
3965 showcsr() {
3966   _csrfile="$1"
3967   _csrd="$2"
3968   if [ -z "$_csrfile" ] && [ -z "$_csrd" ]; then
3969     _usage "Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr"
3970     return 1
3971   fi
3972
3973   _initpath
3974
3975   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
3976   if [ "$?" != "0" ] || [ -z "$_csrsubj" ]; then
3977     _err "Can not read subject from csr: $_csrfile"
3978     return 1
3979   fi
3980
3981   _info "Subject=$_csrsubj"
3982
3983   _csrdomainlist=$(_readSubjectAltNamesFromCSR "$_csrfile")
3984   if [ "$?" != "0" ]; then
3985     _err "Can not read domain list from csr: $_csrfile"
3986     return 1
3987   fi
3988   _debug "_csrdomainlist" "$_csrdomainlist"
3989
3990   _info "SubjectAltNames=$_csrdomainlist"
3991
3992   _csrkeylength=$(_readKeyLengthFromCSR "$_csrfile")
3993   if [ "$?" != "0" ] || [ -z "$_csrkeylength" ]; then
3994     _err "Can not read key length from csr: $_csrfile"
3995     return 1
3996   fi
3997   _info "KeyLength=$_csrkeylength"
3998 }
3999
4000 list() {
4001   _raw="$1"
4002   _initpath
4003
4004   _sep="|"
4005   if [ "$_raw" ]; then
4006     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
4007     for di in "${CERT_HOME}"/*.*/; do
4008       if ! [ -d "$di" ]; then
4009         _debug "Not directory, skip: $di"
4010         continue
4011       fi
4012       d=$(basename "$di")
4013       _debug d "$d"
4014       (
4015         if _endswith "$d" "$ECC_SUFFIX"; then
4016           _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
4017           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
4018         fi
4019         _initpath "$d" "$_isEcc"
4020         if [ -f "$DOMAIN_CONF" ]; then
4021           . "$DOMAIN_CONF"
4022           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"
4023         fi
4024       )
4025     done
4026   else
4027     if _exists column; then
4028       list "raw" | column -t -s "$_sep"
4029     else
4030       list "raw" | tr "$_sep" '\t'
4031     fi
4032   fi
4033
4034 }
4035
4036 _deploy() {
4037   _d="$1"
4038   _hooks="$2"
4039
4040   for _d_api in $(echo "$_hooks" | tr ',' " "); do
4041     _deployApi="$(_findHook "$_d" deploy "$_d_api")"
4042     if [ -z "$_deployApi" ]; then
4043       _err "The deploy hook $_d_api is not found."
4044       return 1
4045     fi
4046     _debug _deployApi "$_deployApi"
4047
4048     if ! (
4049       if ! . "$_deployApi"; then
4050         _err "Load file $_deployApi error. Please check your api file and try again."
4051         return 1
4052       fi
4053
4054       d_command="${_d_api}_deploy"
4055       if ! _exists "$d_command"; then
4056         _err "It seems that your api file is not correct, it must have a function named: $d_command"
4057         return 1
4058       fi
4059
4060       if ! $d_command "$_d" "$CERT_KEY_PATH" "$CERT_PATH" "$CA_CERT_PATH" "$CERT_FULLCHAIN_PATH"; then
4061         _err "Error deploy for domain:$_d"
4062         return 1
4063       fi
4064     ); then
4065       _err "Deploy error."
4066       return 1
4067     else
4068       _info "$(__green Success)"
4069     fi
4070   done
4071 }
4072
4073 #domain hooks
4074 deploy() {
4075   _d="$1"
4076   _hooks="$2"
4077   _isEcc="$3"
4078   if [ -z "$_hooks" ]; then
4079     _usage "Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] "
4080     return 1
4081   fi
4082
4083   _initpath "$_d" "$_isEcc"
4084   if [ ! -d "$DOMAIN_PATH" ]; then
4085     _err "Domain is not valid:'$_d'"
4086     return 1
4087   fi
4088
4089   . "$DOMAIN_CONF"
4090
4091   _savedomainconf Le_DeployHook "$_hooks"
4092
4093   _deploy "$_d" "$_hooks"
4094 }
4095
4096 installcert() {
4097   _main_domain="$1"
4098   if [ -z "$_main_domain" ]; then
4099     _usage "Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]"
4100     return 1
4101   fi
4102
4103   _real_cert="$2"
4104   _real_key="$3"
4105   _real_ca="$4"
4106   _reload_cmd="$5"
4107   _real_fullchain="$6"
4108   _isEcc="$7"
4109
4110   _initpath "$_main_domain" "$_isEcc"
4111   if [ ! -d "$DOMAIN_PATH" ]; then
4112     _err "Domain is not valid:'$_main_domain'"
4113     return 1
4114   fi
4115
4116   _savedomainconf "Le_RealCertPath" "$_real_cert"
4117   _savedomainconf "Le_RealCACertPath" "$_real_ca"
4118   _savedomainconf "Le_RealKeyPath" "$_real_key"
4119   _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
4120   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
4121
4122   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"
4123 }
4124
4125 #domain  cert  key  ca  fullchain reloadcmd backup-prefix
4126 _installcert() {
4127   _main_domain="$1"
4128   _real_cert="$2"
4129   _real_key="$3"
4130   _real_ca="$4"
4131   _real_fullchain="$5"
4132   _reload_cmd="$6"
4133   _backup_prefix="$7"
4134
4135   if [ "$_real_cert" = "$NO_VALUE" ]; then
4136     _real_cert=""
4137   fi
4138   if [ "$_real_key" = "$NO_VALUE" ]; then
4139     _real_key=""
4140   fi
4141   if [ "$_real_ca" = "$NO_VALUE" ]; then
4142     _real_ca=""
4143   fi
4144   if [ "$_reload_cmd" = "$NO_VALUE" ]; then
4145     _reload_cmd=""
4146   fi
4147   if [ "$_real_fullchain" = "$NO_VALUE" ]; then
4148     _real_fullchain=""
4149   fi
4150
4151   _backup_path="$DOMAIN_BACKUP_PATH/$_backup_prefix"
4152   mkdir -p "$_backup_path"
4153
4154   if [ "$_real_cert" ]; then
4155     _info "Installing cert to:$_real_cert"
4156     if [ -f "$_real_cert" ] && [ ! "$IS_RENEW" ]; then
4157       cp "$_real_cert" "$_backup_path/cert.bak"
4158     fi
4159     cat "$CERT_PATH" >"$_real_cert"
4160   fi
4161
4162   if [ "$_real_ca" ]; then
4163     _info "Installing CA to:$_real_ca"
4164     if [ "$_real_ca" = "$_real_cert" ]; then
4165       echo "" >>"$_real_ca"
4166       cat "$CA_CERT_PATH" >>"$_real_ca"
4167     else
4168       if [ -f "$_real_ca" ] && [ ! "$IS_RENEW" ]; then
4169         cp "$_real_ca" "$_backup_path/ca.bak"
4170       fi
4171       cat "$CA_CERT_PATH" >"$_real_ca"
4172     fi
4173   fi
4174
4175   if [ "$_real_key" ]; then
4176     _info "Installing key to:$_real_key"
4177     if [ -f "$_real_key" ] && [ ! "$IS_RENEW" ]; then
4178       cp "$_real_key" "$_backup_path/key.bak"
4179     fi
4180     cat "$CERT_KEY_PATH" >"$_real_key"
4181   fi
4182
4183   if [ "$_real_fullchain" ]; then
4184     _info "Installing full chain to:$_real_fullchain"
4185     if [ -f "$_real_fullchain" ] && [ ! "$IS_RENEW" ]; then
4186       cp "$_real_fullchain" "$_backup_path/fullchain.bak"
4187     fi
4188     cat "$CERT_FULLCHAIN_PATH" >"$_real_fullchain"
4189   fi
4190
4191   if [ "$_reload_cmd" ]; then
4192     _info "Run reload cmd: $_reload_cmd"
4193     if (
4194       export CERT_PATH
4195       export CERT_KEY_PATH
4196       export CA_CERT_PATH
4197       export CERT_FULLCHAIN_PATH
4198       export Le_Domain
4199       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
4200     ); then
4201       _info "$(__green "Reload success")"
4202     else
4203       _err "Reload error for :$Le_Domain"
4204     fi
4205   fi
4206
4207 }
4208
4209 #confighome
4210 installcronjob() {
4211   _c_home="$1"
4212   _initpath
4213   if ! _exists "crontab"; then
4214     _err "crontab doesn't exist, so, we can not install cron jobs."
4215     _err "All your certs will not be renewed automatically."
4216     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
4217     return 1
4218   fi
4219
4220   _info "Installing cron job"
4221   if ! crontab -l | grep "$PROJECT_ENTRY --cron"; then
4222     if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
4223       lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
4224     else
4225       _err "Can not install cronjob, $PROJECT_ENTRY not found."
4226       return 1
4227     fi
4228
4229     if [ "$_c_home" ]; then
4230       _c_entry="--config-home \"$_c_home\" "
4231     fi
4232     _t=$(_time)
4233     random_minute=$(_math $_t % 60)
4234     if _exists uname && uname -a | grep SunOS >/dev/null; then
4235       crontab -l | {
4236         cat
4237         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4238       } | crontab --
4239     else
4240       crontab -l | {
4241         cat
4242         echo "$random_minute 0 * * * $lesh --cron --home \"$LE_WORKING_DIR\" $_c_entry> /dev/null"
4243       } | crontab -
4244     fi
4245   fi
4246   if [ "$?" != "0" ]; then
4247     _err "Install cron job failed. You need to manually renew your certs."
4248     _err "Or you can add cronjob by yourself:"
4249     _err "$lesh --cron --home \"$LE_WORKING_DIR\" > /dev/null"
4250     return 1
4251   fi
4252 }
4253
4254 uninstallcronjob() {
4255   if ! _exists "crontab"; then
4256     return
4257   fi
4258   _info "Removing cron job"
4259   cr="$(crontab -l | grep "$PROJECT_ENTRY --cron")"
4260   if [ "$cr" ]; then
4261     if _exists uname && uname -a | grep solaris >/dev/null; then
4262       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab --
4263     else
4264       crontab -l | sed "/$PROJECT_ENTRY --cron/d" | crontab -
4265     fi
4266     LE_WORKING_DIR="$(echo "$cr" | cut -d ' ' -f 9 | tr -d '"')"
4267     _info LE_WORKING_DIR "$LE_WORKING_DIR"
4268     if _contains "$cr" "--config-home"; then
4269       LE_CONFIG_HOME="$(echo "$cr" | cut -d ' ' -f 11 | tr -d '"')"
4270       _debug LE_CONFIG_HOME "$LE_CONFIG_HOME"
4271     fi
4272   fi
4273   _initpath
4274
4275 }
4276
4277 revoke() {
4278   Le_Domain="$1"
4279   if [ -z "$Le_Domain" ]; then
4280     _usage "Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]"
4281     return 1
4282   fi
4283
4284   _isEcc="$2"
4285
4286   _initpath "$Le_Domain" "$_isEcc"
4287   if [ ! -f "$DOMAIN_CONF" ]; then
4288     _err "$Le_Domain is not a issued domain, skip."
4289     return 1
4290   fi
4291
4292   if [ ! -f "$CERT_PATH" ]; then
4293     _err "Cert for $Le_Domain $CERT_PATH is not found, skip."
4294     return 1
4295   fi
4296
4297   cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
4298
4299   if [ -z "$cert" ]; then
4300     _err "Cert for $Le_Domain is empty found, skip."
4301     return 1
4302   fi
4303
4304   data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
4305   uri="$API/acme/revoke-cert"
4306
4307   if [ -f "$CERT_KEY_PATH" ]; then
4308     _info "Try domain key first."
4309     if _send_signed_request "$uri" "$data" "" "$CERT_KEY_PATH"; then
4310       if [ -z "$response" ]; then
4311         _info "Revoke success."
4312         rm -f "$CERT_PATH"
4313         return 0
4314       else
4315         _err "Revoke error by domain key."
4316         _err "$response"
4317       fi
4318     fi
4319   else
4320     _info "Domain key file doesn't exists."
4321   fi
4322
4323   _info "Try account key."
4324
4325   if _send_signed_request "$uri" "$data" "" "$ACCOUNT_KEY_PATH"; then
4326     if [ -z "$response" ]; then
4327       _info "Revoke success."
4328       rm -f "$CERT_PATH"
4329       return 0
4330     else
4331       _err "Revoke error."
4332       _debug "$response"
4333     fi
4334   fi
4335   return 1
4336 }
4337
4338 #domain  ecc
4339 remove() {
4340   Le_Domain="$1"
4341   if [ -z "$Le_Domain" ]; then
4342     _usage "Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]"
4343     return 1
4344   fi
4345
4346   _isEcc="$2"
4347
4348   _initpath "$Le_Domain" "$_isEcc"
4349   _removed_conf="$DOMAIN_CONF.removed"
4350   if [ ! -f "$DOMAIN_CONF" ]; then
4351     if [ -f "$_removed_conf" ]; then
4352       _err "$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH"
4353     else
4354       _err "$Le_Domain is not a issued domain, skip."
4355     fi
4356     return 1
4357   fi
4358
4359   if mv "$DOMAIN_CONF" "$_removed_conf"; then
4360     _info "$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)"
4361     _info "You can remove them by yourself."
4362     return 0
4363   else
4364     _err "Remove $Le_Domain failed."
4365     return 1
4366   fi
4367 }
4368
4369 #domain vtype
4370 _deactivate() {
4371   _d_domain="$1"
4372   _d_type="$2"
4373   _initpath
4374
4375   _d_i=0
4376   _d_max_retry=9
4377   while [ "$_d_i" -lt "$_d_max_retry" ]; do
4378     _info "Deactivate: $_d_domain"
4379     _d_i="$(_math $_d_i + 1)"
4380
4381     if ! __get_domain_new_authz "$_d_domain"; then
4382       _err "Can not get domain new authz token."
4383       return 1
4384     fi
4385
4386     authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
4387     _debug "authzUri" "$authzUri"
4388
4389     if [ ! -z "$code" ] && [ ! "$code" = '201' ]; then
4390       _err "new-authz error: $response"
4391       return 1
4392     fi
4393
4394     entry="$(printf "%s\n" "$response" | _egrep_o '{"type":"[^"]*","status":"valid","uri"[^}]*')"
4395     _debug entry "$entry"
4396
4397     if [ -z "$entry" ]; then
4398       _info "No more valid entry found."
4399       break
4400     fi
4401
4402     _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
4403     _debug _vtype "$_vtype"
4404     _info "Found $_vtype"
4405
4406     uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d : -f 2,3 | tr -d '"')"
4407     _debug uri "$uri"
4408
4409     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then
4410       _info "Skip $_vtype"
4411       continue
4412     fi
4413
4414     _info "Deactivate: $_vtype"
4415
4416     if ! _send_signed_request "$authzUri" "{\"resource\": \"authz\", \"status\":\"deactivated\"}"; then
4417       _err "Can not deactivate $_vtype."
4418       return 1
4419     fi
4420
4421     _info "Deactivate: $_vtype success."
4422
4423   done
4424   _debug "$_d_i"
4425   if [ "$_d_i" -lt "$_d_max_retry" ]; then
4426     _info "Deactivated success!"
4427   else
4428     _err "Deactivate failed."
4429   fi
4430
4431 }
4432
4433 deactivate() {
4434   _d_domain_list="$1"
4435   _d_type="$2"
4436   _initpath
4437   _debug _d_domain_list "$_d_domain_list"
4438   if [ -z "$(echo $_d_domain_list | cut -d , -f 1)" ]; then
4439     _usage "Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]"
4440     return 1
4441   fi
4442   for _d_dm in $(echo "$_d_domain_list" | tr ',' ' '); do
4443     if [ -z "$_d_dm" ] || [ "$_d_dm" = "$NO_VALUE" ]; then
4444       continue
4445     fi
4446     if ! _deactivate "$_d_dm" "$_d_type"; then
4447       return 1
4448     fi
4449   done
4450 }
4451
4452 # Detect profile file if not specified as environment variable
4453 _detect_profile() {
4454   if [ -n "$PROFILE" -a -f "$PROFILE" ]; then
4455     echo "$PROFILE"
4456     return
4457   fi
4458
4459   DETECTED_PROFILE=''
4460   SHELLTYPE="$(basename "/$SHELL")"
4461
4462   if [ "$SHELLTYPE" = "bash" ]; then
4463     if [ -f "$HOME/.bashrc" ]; then
4464       DETECTED_PROFILE="$HOME/.bashrc"
4465     elif [ -f "$HOME/.bash_profile" ]; then
4466       DETECTED_PROFILE="$HOME/.bash_profile"
4467     fi
4468   elif [ "$SHELLTYPE" = "zsh" ]; then
4469     DETECTED_PROFILE="$HOME/.zshrc"
4470   fi
4471
4472   if [ -z "$DETECTED_PROFILE" ]; then
4473     if [ -f "$HOME/.profile" ]; then
4474       DETECTED_PROFILE="$HOME/.profile"
4475     elif [ -f "$HOME/.bashrc" ]; then
4476       DETECTED_PROFILE="$HOME/.bashrc"
4477     elif [ -f "$HOME/.bash_profile" ]; then
4478       DETECTED_PROFILE="$HOME/.bash_profile"
4479     elif [ -f "$HOME/.zshrc" ]; then
4480       DETECTED_PROFILE="$HOME/.zshrc"
4481     fi
4482   fi
4483
4484   if [ ! -z "$DETECTED_PROFILE" ]; then
4485     echo "$DETECTED_PROFILE"
4486   fi
4487 }
4488
4489 _initconf() {
4490   _initpath
4491   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4492     echo "
4493
4494 #LOG_FILE=\"$DEFAULT_LOG_FILE\"
4495 #LOG_LEVEL=1
4496
4497 #AUTO_UPGRADE=\"1\"
4498
4499 #NO_TIMESTAMP=1
4500
4501     " >"$ACCOUNT_CONF_PATH"
4502   fi
4503 }
4504
4505 # nocron
4506 _precheck() {
4507   _nocron="$1"
4508
4509   if ! _exists "curl" && ! _exists "wget"; then
4510     _err "Please install curl or wget first, we need to access http resources."
4511     return 1
4512   fi
4513
4514   if [ -z "$_nocron" ]; then
4515     if ! _exists "crontab"; then
4516       _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
4517       _err "We need to set cron job to renew the certs automatically."
4518       _err "Otherwise, your certs will not be able to be renewed automatically."
4519       if [ -z "$FORCE" ]; then
4520         _err "Please add '--force' and try install again to go without crontab."
4521         _err "./$PROJECT_ENTRY --install --force"
4522         return 1
4523       fi
4524     fi
4525   fi
4526
4527   if ! _exists "${ACME_OPENSSL_BIN:-openssl}"; then
4528     _err "Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN"
4529     _err "We need openssl to generate keys."
4530     return 1
4531   fi
4532
4533   if ! _exists "nc"; then
4534     _err "It is recommended to install nc first, try to install 'nc' or 'netcat'."
4535     _err "We use nc for standalone server if you use standalone mode."
4536     _err "If you don't use standalone mode, just ignore this warning."
4537   fi
4538
4539   return 0
4540 }
4541
4542 _setShebang() {
4543   _file="$1"
4544   _shebang="$2"
4545   if [ -z "$_shebang" ]; then
4546     _usage "Usage: file shebang"
4547     return 1
4548   fi
4549   cp "$_file" "$_file.tmp"
4550   echo "$_shebang" >"$_file"
4551   sed -n 2,99999p "$_file.tmp" >>"$_file"
4552   rm -f "$_file.tmp"
4553 }
4554
4555 #confighome
4556 _installalias() {
4557   _c_home="$1"
4558   _initpath
4559
4560   _envfile="$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4561   if [ "$_upgrading" ] && [ "$_upgrading" = "1" ]; then
4562     echo "$(cat "$_envfile")" | sed "s|^LE_WORKING_DIR.*$||" >"$_envfile"
4563     echo "$(cat "$_envfile")" | sed "s|^alias le.*$||" >"$_envfile"
4564     echo "$(cat "$_envfile")" | sed "s|^alias le.sh.*$||" >"$_envfile"
4565   fi
4566
4567   if [ "$_c_home" ]; then
4568     _c_entry=" --config-home '$_c_home'"
4569   fi
4570
4571   _setopt "$_envfile" "export LE_WORKING_DIR" "=" "\"$LE_WORKING_DIR\""
4572   if [ "$_c_home" ]; then
4573     _setopt "$_envfile" "export LE_CONFIG_HOME" "=" "\"$LE_CONFIG_HOME\""
4574   fi
4575   _setopt "$_envfile" "alias $PROJECT_ENTRY" "=" "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4576
4577   _profile="$(_detect_profile)"
4578   if [ "$_profile" ]; then
4579     _debug "Found profile: $_profile"
4580     _info "Installing alias to '$_profile'"
4581     _setopt "$_profile" ". \"$_envfile\""
4582     _info "OK, Close and reopen your terminal to start using $PROJECT_NAME"
4583   else
4584     _info "No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME"
4585   fi
4586
4587   #for csh
4588   _cshfile="$LE_WORKING_DIR/$PROJECT_ENTRY.csh"
4589   _csh_profile="$HOME/.cshrc"
4590   if [ -f "$_csh_profile" ]; then
4591     _info "Installing alias to '$_csh_profile'"
4592     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4593     if [ "$_c_home" ]; then
4594       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4595     fi
4596     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4597     _setopt "$_csh_profile" "source \"$_cshfile\""
4598   fi
4599
4600   #for tcsh
4601   _tcsh_profile="$HOME/.tcshrc"
4602   if [ -f "$_tcsh_profile" ]; then
4603     _info "Installing alias to '$_tcsh_profile'"
4604     _setopt "$_cshfile" "setenv LE_WORKING_DIR" " " "\"$LE_WORKING_DIR\""
4605     if [ "$_c_home" ]; then
4606       _setopt "$_cshfile" "setenv LE_CONFIG_HOME" " " "\"$LE_CONFIG_HOME\""
4607     fi
4608     _setopt "$_cshfile" "alias $PROJECT_ENTRY" " " "\"$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\""
4609     _setopt "$_tcsh_profile" "source \"$_cshfile\""
4610   fi
4611
4612 }
4613
4614 # nocron confighome
4615 install() {
4616
4617   if [ -z "$LE_WORKING_DIR" ]; then
4618     LE_WORKING_DIR="$DEFAULT_INSTALL_HOME"
4619   fi
4620
4621   _nocron="$1"
4622   _c_home="$2"
4623   if ! _initpath; then
4624     _err "Install failed."
4625     return 1
4626   fi
4627   if [ "$_nocron" ]; then
4628     _debug "Skip install cron job"
4629   fi
4630
4631   if ! _precheck "$_nocron"; then
4632     _err "Pre-check failed, can not install."
4633     return 1
4634   fi
4635
4636   #convert from le
4637   if [ -d "$HOME/.le" ]; then
4638     for envfile in "le.env" "le.sh.env"; do
4639       if [ -f "$HOME/.le/$envfile" ]; then
4640         if grep "le.sh" "$HOME/.le/$envfile" >/dev/null; then
4641           _upgrading="1"
4642           _info "You are upgrading from le.sh"
4643           _info "Renaming \"$HOME/.le\" to $LE_WORKING_DIR"
4644           mv "$HOME/.le" "$LE_WORKING_DIR"
4645           mv "$LE_WORKING_DIR/$envfile" "$LE_WORKING_DIR/$PROJECT_ENTRY.env"
4646           break
4647         fi
4648       fi
4649     done
4650   fi
4651
4652   _info "Installing to $LE_WORKING_DIR"
4653
4654   if ! mkdir -p "$LE_WORKING_DIR"; then
4655     _err "Can not create working dir: $LE_WORKING_DIR"
4656     return 1
4657   fi
4658
4659   chmod 700 "$LE_WORKING_DIR"
4660
4661   if ! mkdir -p "$LE_CONFIG_HOME"; then
4662     _err "Can not create config dir: $LE_CONFIG_HOME"
4663     return 1
4664   fi
4665
4666   chmod 700 "$LE_CONFIG_HOME"
4667
4668   cp "$PROJECT_ENTRY" "$LE_WORKING_DIR/" && chmod +x "$LE_WORKING_DIR/$PROJECT_ENTRY"
4669
4670   if [ "$?" != "0" ]; then
4671     _err "Install failed, can not copy $PROJECT_ENTRY"
4672     return 1
4673   fi
4674
4675   _info "Installed to $LE_WORKING_DIR/$PROJECT_ENTRY"
4676
4677   _installalias "$_c_home"
4678
4679   for subf in $_SUB_FOLDERS; do
4680     if [ -d "$subf" ]; then
4681       mkdir -p "$LE_WORKING_DIR/$subf"
4682       cp "$subf"/* "$LE_WORKING_DIR"/"$subf"/
4683     fi
4684   done
4685
4686   if [ ! -f "$ACCOUNT_CONF_PATH" ]; then
4687     _initconf
4688   fi
4689
4690   if [ "$_DEFAULT_ACCOUNT_CONF_PATH" != "$ACCOUNT_CONF_PATH" ]; then
4691     _setopt "$_DEFAULT_ACCOUNT_CONF_PATH" "ACCOUNT_CONF_PATH" "=" "\"$ACCOUNT_CONF_PATH\""
4692   fi
4693
4694   if [ "$_DEFAULT_CERT_HOME" != "$CERT_HOME" ]; then
4695     _saveaccountconf "CERT_HOME" "$CERT_HOME"
4696   fi
4697
4698   if [ "$_DEFAULT_ACCOUNT_KEY_PATH" != "$ACCOUNT_KEY_PATH" ]; then
4699     _saveaccountconf "ACCOUNT_KEY_PATH" "$ACCOUNT_KEY_PATH"
4700   fi
4701
4702   if [ -z "$_nocron" ]; then
4703     installcronjob "$_c_home"
4704   fi
4705
4706   if [ -z "$NO_DETECT_SH" ]; then
4707     #Modify shebang
4708     if _exists bash; then
4709       _info "Good, bash is found, so change the shebang to use bash as preferred."
4710       _shebang='#!'"$(env bash -c "command -v bash")"
4711       _setShebang "$LE_WORKING_DIR/$PROJECT_ENTRY" "$_shebang"
4712       for subf in $_SUB_FOLDERS; do
4713         if [ -d "$LE_WORKING_DIR/$subf" ]; then
4714           for _apifile in "$LE_WORKING_DIR/$subf/"*.sh; do
4715             _setShebang "$_apifile" "$_shebang"
4716           done
4717         fi
4718       done
4719     fi
4720   fi
4721
4722   _info OK
4723 }
4724
4725 # nocron
4726 uninstall() {
4727   _nocron="$1"
4728   if [ -z "$_nocron" ]; then
4729     uninstallcronjob
4730   fi
4731   _initpath
4732
4733   _uninstallalias
4734
4735   rm -f "$LE_WORKING_DIR/$PROJECT_ENTRY"
4736   _info "The keys and certs are in \"$(__green "$LE_CONFIG_HOME")\", you can remove them by yourself."
4737
4738 }
4739
4740 _uninstallalias() {
4741   _initpath
4742
4743   _profile="$(_detect_profile)"
4744   if [ "$_profile" ]; then
4745     _info "Uninstalling alias from: '$_profile'"
4746     text="$(cat "$_profile")"
4747     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.env\"$||" >"$_profile"
4748   fi
4749
4750   _csh_profile="$HOME/.cshrc"
4751   if [ -f "$_csh_profile" ]; then
4752     _info "Uninstalling alias from: '$_csh_profile'"
4753     text="$(cat "$_csh_profile")"
4754     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_csh_profile"
4755   fi
4756
4757   _tcsh_profile="$HOME/.tcshrc"
4758   if [ -f "$_tcsh_profile" ]; then
4759     _info "Uninstalling alias from: '$_csh_profile'"
4760     text="$(cat "$_tcsh_profile")"
4761     echo "$text" | sed "s|^.*\"$LE_WORKING_DIR/$PROJECT_NAME.csh\"$||" >"$_tcsh_profile"
4762   fi
4763
4764 }
4765
4766 cron() {
4767   IN_CRON=1
4768   _initpath
4769   _info "$(__green "===Starting cron===")"
4770   if [ "$AUTO_UPGRADE" = "1" ]; then
4771     export LE_WORKING_DIR
4772     (
4773       if ! upgrade; then
4774         _err "Cron:Upgrade failed!"
4775         return 1
4776       fi
4777     )
4778     . "$LE_WORKING_DIR/$PROJECT_ENTRY" >/dev/null
4779
4780     if [ -t 1 ]; then
4781       __INTERACTIVE="1"
4782     fi
4783
4784     _info "Auto upgraded to: $VER"
4785   fi
4786   renewAll
4787   _ret="$?"
4788   IN_CRON=""
4789   _info "$(__green "===End cron===")"
4790   exit $_ret
4791 }
4792
4793 version() {
4794   echo "$PROJECT"
4795   echo "v$VER"
4796 }
4797
4798 showhelp() {
4799   _initpath
4800   version
4801   echo "Usage: $PROJECT_ENTRY  command ...[parameters]....
4802 Commands:
4803   --help, -h               Show this help message.
4804   --version, -v            Show version info.
4805   --install                Install $PROJECT_NAME to your system.
4806   --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
4807   --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
4808   --issue                  Issue a cert.
4809   --signcsr                Issue a cert from an existing csr.
4810   --deploy                 Deploy the cert to your server.
4811   --install-cert           Install the issued cert to apache/nginx or any other server.
4812   --renew, -r              Renew a cert.
4813   --renew-all              Renew all the certs.
4814   --revoke                 Revoke a cert.
4815   --remove                 Remove the cert from $PROJECT
4816   --list                   List all the certs.
4817   --showcsr                Show the content of a csr.
4818   --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
4819   --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
4820   --cron                   Run cron job to renew all the certs.
4821   --toPkcs                 Export the certificate and key to a pfx file.
4822   --toPkcs8                Convert to pkcs8 format.
4823   --update-account         Update account info.
4824   --register-account       Register account key.
4825   --create-account-key     Create an account private key, professional use.
4826   --create-domain-key      Create an domain private key, professional use.
4827   --createCSR, -ccsr       Create CSR , professional use.
4828   --deactivate             Deactivate the domain authz, professional use.
4829
4830 Parameters:
4831   --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
4832   --force, -f                       Used to force to install or force to renew a cert immediately.
4833   --staging, --test                 Use staging server, just for test.
4834   --debug                           Output debug info.
4835   --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
4836   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
4837   --standalone                      Use standalone mode.
4838   --stateless                       Use stateless mode, see: $_STATELESS_WIKI
4839   --tls                             Use standalone tls mode.
4840   --apache                          Use apache mode.
4841   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
4842   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
4843
4844   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
4845   --accountkeylength, -ak [2048]    Specifies the account key length.
4846   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
4847   --log-level 1|2                   Specifies the log level, default is 1.
4848   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.
4849
4850   These parameters are to install the cert to nginx/apache or anyother server after issue/renew a cert:
4851
4852   --cert-file                       After issue/renew, the cert will be copied to this path.
4853   --key-file                        After issue/renew, the key will be copied to this path.
4854   --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
4855   --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.
4856
4857   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
4858
4859   --accountconf                     Specifies a customized account config file.
4860   --home                            Specifies the home dir for $PROJECT_NAME .
4861   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
4862   --config-home                     Specifies the home dir to save all the configurations.
4863   --useragent                       Specifies the user agent string. it will be saved for future use too.
4864   --accountemail                    Specifies the account email for registering, Only valid for the '--install' command.
4865   --accountkey                      Specifies the account key path, Only valid for the '--install' command.
4866   --days                            Specifies the days to renew the cert when using '--issue' command. The max value is $MAX_RENEW days.
4867   --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
4868   --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
4869   --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
4870   --listraw                         Only used for '--list' command, list the certs in raw format.
4871   --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
4872   --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
4873   --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
4874   --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
4875   --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
4876   --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
4877   --csr                             Specifies the input csr.
4878   --pre-hook                        Command to be run before obtaining any certificates.
4879   --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
4880   --renew-hook                      Command to be run once for each successfully renewed certificate.
4881   --deploy-hook                     The hook file to deploy cert
4882   --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
4883   --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
4884   --listen-v4                       Force standalone/tls server to listen at ipv4.
4885   --listen-v6                       Force standalone/tls server to listen at ipv6.
4886   --openssl-bin                     Specifies a custom openssl bin location.
4887   --use-wget                        Force to use wget, if you have both curl and wget installed.
4888   "
4889 }
4890
4891 # nocron
4892 _installOnline() {
4893   _info "Installing from online archive."
4894   _nocron="$1"
4895   if [ ! "$BRANCH" ]; then
4896     BRANCH="master"
4897   fi
4898
4899   target="$PROJECT/archive/$BRANCH.tar.gz"
4900   _info "Downloading $target"
4901   localname="$BRANCH.tar.gz"
4902   if ! _get "$target" >$localname; then
4903     _err "Download error."
4904     return 1
4905   fi
4906   (
4907     _info "Extracting $localname"
4908     if ! (tar xzf $localname || gtar xzf $localname); then
4909       _err "Extraction error."
4910       exit 1
4911     fi
4912
4913     cd "$PROJECT_NAME-$BRANCH"
4914     chmod +x $PROJECT_ENTRY
4915     if ./$PROJECT_ENTRY install "$_nocron"; then
4916       _info "Install success!"
4917     fi
4918
4919     cd ..
4920
4921     rm -rf "$PROJECT_NAME-$BRANCH"
4922     rm -f "$localname"
4923   )
4924 }
4925
4926 upgrade() {
4927   if (
4928     _initpath
4929     export LE_WORKING_DIR
4930     cd "$LE_WORKING_DIR"
4931     _installOnline "nocron"
4932   ); then
4933     _info "Upgrade success!"
4934     exit 0
4935   else
4936     _err "Upgrade failed!"
4937     exit 1
4938   fi
4939 }
4940
4941 _processAccountConf() {
4942   if [ "$_useragent" ]; then
4943     _saveaccountconf "USER_AGENT" "$_useragent"
4944   elif [ "$USER_AGENT" ] && [ "$USER_AGENT" != "$DEFAULT_USER_AGENT" ]; then
4945     _saveaccountconf "USER_AGENT" "$USER_AGENT"
4946   fi
4947
4948   if [ "$_accountemail" ]; then
4949     _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
4950   elif [ "$ACCOUNT_EMAIL" ] && [ "$ACCOUNT_EMAIL" != "$DEFAULT_ACCOUNT_EMAIL" ]; then
4951     _saveaccountconf "ACCOUNT_EMAIL" "$ACCOUNT_EMAIL"
4952   fi
4953
4954   if [ "$_openssl_bin" ]; then
4955     _saveaccountconf "ACME_OPENSSL_BIN" "$_openssl_bin"
4956   elif [ "$ACME_OPENSSL_BIN" ] && [ "$ACME_OPENSSL_BIN" != "$DEFAULT_OPENSSL_BIN" ]; then
4957     _saveaccountconf "ACME_OPENSSL_BIN" "$ACME_OPENSSL_BIN"
4958   fi
4959
4960   if [ "$_auto_upgrade" ]; then
4961     _saveaccountconf "AUTO_UPGRADE" "$_auto_upgrade"
4962   elif [ "$AUTO_UPGRADE" ]; then
4963     _saveaccountconf "AUTO_UPGRADE" "$AUTO_UPGRADE"
4964   fi
4965
4966   if [ "$_use_wget" ]; then
4967     _saveaccountconf "ACME_USE_WGET" "$_use_wget"
4968   elif [ "$ACME_USE_WGET" ]; then
4969     _saveaccountconf "ACME_USE_WGET" "$ACME_USE_WGET"
4970   fi
4971
4972 }
4973
4974 _process() {
4975   _CMD=""
4976   _domain=""
4977   _altdomains="$NO_VALUE"
4978   _webroot=""
4979   _keylength=""
4980   _accountkeylength=""
4981   _cert_file=""
4982   _key_file=""
4983   _ca_file=""
4984   _fullchain_file=""
4985   _reloadcmd=""
4986   _password=""
4987   _accountconf=""
4988   _useragent=""
4989   _accountemail=""
4990   _accountkey=""
4991   _certhome=""
4992   _confighome=""
4993   _httpport=""
4994   _tlsport=""
4995   _dnssleep=""
4996   _listraw=""
4997   _stopRenewOnError=""
4998   #_insecure=""
4999   _ca_bundle=""
5000   _ca_path=""
5001   _nocron=""
5002   _ecc=""
5003   _csr=""
5004   _pre_hook=""
5005   _post_hook=""
5006   _renew_hook=""
5007   _deploy_hook=""
5008   _logfile=""
5009   _log=""
5010   _local_address=""
5011   _log_level=""
5012   _auto_upgrade=""
5013   _listen_v4=""
5014   _listen_v6=""
5015   _openssl_bin=""
5016   _syslog=""
5017   _use_wget=""
5018   while [ ${#} -gt 0 ]; do
5019     case "${1}" in
5020
5021       --help | -h)
5022         showhelp
5023         return
5024         ;;
5025       --version | -v)
5026         version
5027         return
5028         ;;
5029       --install)
5030         _CMD="install"
5031         ;;
5032       --uninstall)
5033         _CMD="uninstall"
5034         ;;
5035       --upgrade)
5036         _CMD="upgrade"
5037         ;;
5038       --issue)
5039         _CMD="issue"
5040         ;;
5041       --deploy)
5042         _CMD="deploy"
5043         ;;
5044       --signcsr)
5045         _CMD="signcsr"
5046         ;;
5047       --showcsr)
5048         _CMD="showcsr"
5049         ;;
5050       --installcert | -i | --install-cert)
5051         _CMD="installcert"
5052         ;;
5053       --renew | -r)
5054         _CMD="renew"
5055         ;;
5056       --renewAll | --renewall | --renew-all)
5057         _CMD="renewAll"
5058         ;;
5059       --revoke)
5060         _CMD="revoke"
5061         ;;
5062       --remove)
5063         _CMD="remove"
5064         ;;
5065       --list)
5066         _CMD="list"
5067         ;;
5068       --installcronjob | --install-cronjob)
5069         _CMD="installcronjob"
5070         ;;
5071       --uninstallcronjob | --uninstall-cronjob)
5072         _CMD="uninstallcronjob"
5073         ;;
5074       --cron)
5075         _CMD="cron"
5076         ;;
5077       --toPkcs)
5078         _CMD="toPkcs"
5079         ;;
5080       --toPkcs8)
5081         _CMD="toPkcs8"
5082         ;;
5083       --createAccountKey | --createaccountkey | -cak | --create-account-key)
5084         _CMD="createAccountKey"
5085         ;;
5086       --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
5087         _CMD="createDomainKey"
5088         ;;
5089       --createCSR | --createcsr | -ccr)
5090         _CMD="createCSR"
5091         ;;
5092       --deactivate)
5093         _CMD="deactivate"
5094         ;;
5095       --updateaccount | --update-account)
5096         _CMD="updateaccount"
5097         ;;
5098       --registeraccount | --register-account)
5099         _CMD="registeraccount"
5100         ;;
5101       --domain | -d)
5102         _dvalue="$2"
5103
5104         if [ "$_dvalue" ]; then
5105           if _startswith "$_dvalue" "-"; then
5106             _err "'$_dvalue' is not a valid domain for parameter '$1'"
5107             return 1
5108           fi
5109           if _is_idn "$_dvalue" && ! _exists idn; then
5110             _err "It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first."
5111             return 1
5112           fi
5113
5114           if [ -z "$_domain" ]; then
5115             _domain="$_dvalue"
5116           else
5117             if [ "$_altdomains" = "$NO_VALUE" ]; then
5118               _altdomains="$_dvalue"
5119             else
5120               _altdomains="$_altdomains,$_dvalue"
5121             fi
5122           fi
5123         fi
5124
5125         shift
5126         ;;
5127
5128       --force | -f)
5129         FORCE="1"
5130         ;;
5131       --staging | --test)
5132         STAGE="1"
5133         ;;
5134       --debug)
5135         if [ -z "$2" ] || _startswith "$2" "-"; then
5136           DEBUG="$DEBUG_LEVEL_DEFAULT"
5137         else
5138           DEBUG="$2"
5139           shift
5140         fi
5141         ;;
5142       --output-insecure)
5143         export OUTPUT_INSECURE=1
5144         ;;
5145       --webroot | -w)
5146         wvalue="$2"
5147         if [ -z "$_webroot" ]; then
5148           _webroot="$wvalue"
5149         else
5150           _webroot="$_webroot,$wvalue"
5151         fi
5152         shift
5153         ;;
5154       --standalone)
5155         wvalue="$NO_VALUE"
5156         if [ -z "$_webroot" ]; then
5157           _webroot="$wvalue"
5158         else
5159           _webroot="$_webroot,$wvalue"
5160         fi
5161         ;;
5162       --stateless)
5163         wvalue="$MODE_STATELESS"
5164         if [ -z "$_webroot" ]; then
5165           _webroot="$wvalue"
5166         else
5167           _webroot="$_webroot,$wvalue"
5168         fi
5169         ;;
5170       --local-address)
5171         lvalue="$2"
5172         _local_address="$_local_address$lvalue,"
5173         shift
5174         ;;
5175       --apache)
5176         wvalue="apache"
5177         if [ -z "$_webroot" ]; then
5178           _webroot="$wvalue"
5179         else
5180           _webroot="$_webroot,$wvalue"
5181         fi
5182         ;;
5183       --nginx)
5184         wvalue="$NGINX"
5185         if [ -z "$_webroot" ]; then
5186           _webroot="$wvalue"
5187         else
5188           _webroot="$_webroot,$wvalue"
5189         fi
5190         ;;
5191       --tls)
5192         wvalue="$W_TLS"
5193         if [ -z "$_webroot" ]; then
5194           _webroot="$wvalue"
5195         else
5196           _webroot="$_webroot,$wvalue"
5197         fi
5198         ;;
5199       --dns)
5200         wvalue="dns"
5201         if ! _startswith "$2" "-"; then
5202           wvalue="$2"
5203           shift
5204         fi
5205         if [ -z "$_webroot" ]; then
5206           _webroot="$wvalue"
5207         else
5208           _webroot="$_webroot,$wvalue"
5209         fi
5210         ;;
5211       --dnssleep)
5212         _dnssleep="$2"
5213         Le_DNSSleep="$_dnssleep"
5214         shift
5215         ;;
5216
5217       --keylength | -k)
5218         _keylength="$2"
5219         shift
5220         ;;
5221       --accountkeylength | -ak)
5222         _accountkeylength="$2"
5223         shift
5224         ;;
5225
5226       --cert-file | --certpath)
5227         _cert_file="$2"
5228         shift
5229         ;;
5230       --key-file | --keypath)
5231         _key_file="$2"
5232         shift
5233         ;;
5234       --ca-file | --capath)
5235         _ca_file="$2"
5236         shift
5237         ;;
5238       --fullchain-file | --fullchainpath)
5239         _fullchain_file="$2"
5240         shift
5241         ;;
5242       --reloadcmd | --reloadCmd)
5243         _reloadcmd="$2"
5244         shift
5245         ;;
5246       --password)
5247         _password="$2"
5248         shift
5249         ;;
5250       --accountconf)
5251         _accountconf="$2"
5252         ACCOUNT_CONF_PATH="$_accountconf"
5253         shift
5254         ;;
5255       --home)
5256         LE_WORKING_DIR="$2"
5257         shift
5258         ;;
5259       --certhome | --cert-home)
5260         _certhome="$2"
5261         CERT_HOME="$_certhome"
5262         shift
5263         ;;
5264       --config-home)
5265         _confighome="$2"
5266         LE_CONFIG_HOME="$_confighome"
5267         shift
5268         ;;
5269       --useragent)
5270         _useragent="$2"
5271         USER_AGENT="$_useragent"
5272         shift
5273         ;;
5274       --accountemail)
5275         _accountemail="$2"
5276         ACCOUNT_EMAIL="$_accountemail"
5277         shift
5278         ;;
5279       --accountkey)
5280         _accountkey="$2"
5281         ACCOUNT_KEY_PATH="$_accountkey"
5282         shift
5283         ;;
5284       --days)
5285         _days="$2"
5286         Le_RenewalDays="$_days"
5287         shift
5288         ;;
5289       --httpport)
5290         _httpport="$2"
5291         Le_HTTPPort="$_httpport"
5292         shift
5293         ;;
5294       --tlsport)
5295         _tlsport="$2"
5296         Le_TLSPort="$_tlsport"
5297         shift
5298         ;;
5299
5300       --listraw)
5301         _listraw="raw"
5302         ;;
5303       --stopRenewOnError | --stoprenewonerror | -se)
5304         _stopRenewOnError="1"
5305         ;;
5306       --insecure)
5307         #_insecure="1"
5308         HTTPS_INSECURE="1"
5309         ;;
5310       --ca-bundle)
5311         _ca_bundle="$(_readlink -f "$2")"
5312         CA_BUNDLE="$_ca_bundle"
5313         shift
5314         ;;
5315       --ca-path)
5316         _ca_path="$2"
5317         CA_PATH="$_ca_path"
5318         shift
5319         ;;
5320       --nocron)
5321         _nocron="1"
5322         ;;
5323       --ecc)
5324         _ecc="isEcc"
5325         ;;
5326       --csr)
5327         _csr="$2"
5328         shift
5329         ;;
5330       --pre-hook)
5331         _pre_hook="$2"
5332         shift
5333         ;;
5334       --post-hook)
5335         _post_hook="$2"
5336         shift
5337         ;;
5338       --renew-hook)
5339         _renew_hook="$2"
5340         shift
5341         ;;
5342       --deploy-hook)
5343         if [ -z "$2" ] || _startswith "$2" "-"; then
5344           _usage "Please specify a value for '--deploy-hook'"
5345           return 1
5346         fi
5347         _deploy_hook="$_deploy_hook$2,"
5348         shift
5349         ;;
5350       --ocsp-must-staple | --ocsp)
5351         Le_OCSP_Staple="1"
5352         ;;
5353       --log | --logfile)
5354         _log="1"
5355         _logfile="$2"
5356         if _startswith "$_logfile" '-'; then
5357           _logfile=""
5358         else
5359           shift
5360         fi
5361         LOG_FILE="$_logfile"
5362         if [ -z "$LOG_LEVEL" ]; then
5363           LOG_LEVEL="$DEFAULT_LOG_LEVEL"
5364         fi
5365         ;;
5366       --log-level)
5367         _log_level="$2"
5368         LOG_LEVEL="$_log_level"
5369         shift
5370         ;;
5371       --syslog)
5372         if ! _startswith "$2" '-'; then
5373           _syslog="$2"
5374           shift
5375         fi
5376         if [ -z "$_syslog" ]; then
5377           _syslog="$SYSLOG_LEVEL_DEFAULT"
5378         fi
5379         ;;
5380       --auto-upgrade)
5381         _auto_upgrade="$2"
5382         if [ -z "$_auto_upgrade" ] || _startswith "$_auto_upgrade" '-'; then
5383           _auto_upgrade="1"
5384         else
5385           shift
5386         fi
5387         AUTO_UPGRADE="$_auto_upgrade"
5388         ;;
5389       --listen-v4)
5390         _listen_v4="1"
5391         Le_Listen_V4="$_listen_v4"
5392         ;;
5393       --listen-v6)
5394         _listen_v6="1"
5395         Le_Listen_V6="$_listen_v6"
5396         ;;
5397       --openssl-bin)
5398         _openssl_bin="$2"
5399         ACME_OPENSSL_BIN="$_openssl_bin"
5400         shift
5401         ;;
5402       --use-wget)
5403         _use_wget="1"
5404         ACME_USE_WGET="1"
5405         ;;
5406       *)
5407         _err "Unknown parameter : $1"
5408         return 1
5409         ;;
5410     esac
5411
5412     shift 1
5413   done
5414
5415   if [ "${_CMD}" != "install" ]; then
5416     __initHome
5417     if [ "$_log" ]; then
5418       if [ -z "$_logfile" ]; then
5419         _logfile="$DEFAULT_LOG_FILE"
5420       fi
5421     fi
5422     if [ "$_logfile" ]; then
5423       _saveaccountconf "LOG_FILE" "$_logfile"
5424       LOG_FILE="$_logfile"
5425     fi
5426
5427     if [ "$_log_level" ]; then
5428       _saveaccountconf "LOG_LEVEL" "$_log_level"
5429       LOG_LEVEL="$_log_level"
5430     fi
5431
5432     if [ "$_syslog" ]; then
5433       if _exists logger; then
5434         if [ "$_syslog" = "0" ]; then
5435           _clearaccountconf "SYS_LOG"
5436         else
5437           _saveaccountconf "SYS_LOG" "$_syslog"
5438         fi
5439         SYS_LOG="$_syslog"
5440       else
5441         _err "The 'logger' command is not found, can not enable syslog."
5442         _clearaccountconf "SYS_LOG"
5443         SYS_LOG=""
5444       fi
5445     fi
5446
5447     _processAccountConf
5448   fi
5449
5450   _debug2 LE_WORKING_DIR "$LE_WORKING_DIR"
5451
5452   if [ "$DEBUG" ]; then
5453     version
5454   fi
5455
5456   case "${_CMD}" in
5457     install) install "$_nocron" "$_confighome" ;;
5458     uninstall) uninstall "$_nocron" ;;
5459     upgrade) upgrade ;;
5460     issue)
5461       issue "$_webroot" "$_domain" "$_altdomains" "$_keylength" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address"
5462       ;;
5463     deploy)
5464       deploy "$_domain" "$_deploy_hook" "$_ecc"
5465       ;;
5466     signcsr)
5467       signcsr "$_csr" "$_webroot"
5468       ;;
5469     showcsr)
5470       showcsr "$_csr" "$_domain"
5471       ;;
5472     installcert)
5473       installcert "$_domain" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_ecc"
5474       ;;
5475     renew)
5476       renew "$_domain" "$_ecc"
5477       ;;
5478     renewAll)
5479       renewAll "$_stopRenewOnError"
5480       ;;
5481     revoke)
5482       revoke "$_domain" "$_ecc"
5483       ;;
5484     remove)
5485       remove "$_domain" "$_ecc"
5486       ;;
5487     deactivate)
5488       deactivate "$_domain,$_altdomains"
5489       ;;
5490     registeraccount)
5491       registeraccount "$_accountkeylength"
5492       ;;
5493     updateaccount)
5494       updateaccount
5495       ;;
5496     list)
5497       list "$_listraw"
5498       ;;
5499     installcronjob) installcronjob "$_confighome" ;;
5500     uninstallcronjob) uninstallcronjob ;;
5501     cron) cron ;;
5502     toPkcs)
5503       toPkcs "$_domain" "$_password" "$_ecc"
5504       ;;
5505     toPkcs8)
5506       toPkcs8 "$_domain" "$_ecc"
5507       ;;
5508     createAccountKey)
5509       createAccountKey "$_accountkeylength"
5510       ;;
5511     createDomainKey)
5512       createDomainKey "$_domain" "$_keylength"
5513       ;;
5514     createCSR)
5515       createCSR "$_domain" "$_altdomains" "$_ecc"
5516       ;;
5517
5518     *)
5519       if [ "$_CMD" ]; then
5520         _err "Invalid command: $_CMD"
5521       fi
5522       showhelp
5523       return 1
5524       ;;
5525   esac
5526   _ret="$?"
5527   if [ "$_ret" != "0" ]; then
5528     return $_ret
5529   fi
5530
5531   if [ "${_CMD}" = "install" ]; then
5532     if [ "$_log" ]; then
5533       if [ -z "$LOG_FILE" ]; then
5534         LOG_FILE="$DEFAULT_LOG_FILE"
5535       fi
5536       _saveaccountconf "LOG_FILE" "$LOG_FILE"
5537     fi
5538
5539     if [ "$_log_level" ]; then
5540       _saveaccountconf "LOG_LEVEL" "$_log_level"
5541     fi
5542
5543     if [ "$_syslog" ]; then
5544       if _exists logger; then
5545         if [ "$_syslog" = "0" ]; then
5546           _clearaccountconf "SYS_LOG"
5547         else
5548           _saveaccountconf "SYS_LOG" "$_syslog"
5549         fi
5550       else
5551         _err "The 'logger' command is not found, can not enable syslog."
5552         _clearaccountconf "SYS_LOG"
5553         SYS_LOG=""
5554       fi
5555     fi
5556
5557     _processAccountConf
5558   fi
5559
5560 }
5561
5562 if [ "$INSTALLONLINE" ]; then
5563   INSTALLONLINE=""
5564   _installOnline
5565   exit
5566 fi
5567
5568 main() {
5569   [ -z "$1" ] && showhelp && return
5570   if _startswith "$1" '-'; then _process "$@"; else "$@"; fi
5571 }
5572
5573 main "$@"