3 ## Name: dns_pleskxml.sh
5 ## Also uses some code from PR#1832 by @romanlum (https://github.com/acmesh-official/acme.sh/pull/1832/files)
7 ## This DNS-01 method uses the Plesk XML API described at:
8 ## https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
9 ## and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
11 ## Note: a DNS ID with host = empty string is OK for this API, see
12 ## https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
13 ## For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
14 ## So this API module can handle such a request, if needed.
16 ## For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
18 ## The user credentials (username+password) and URL/URI for the Plesk XML API must be set by the user
19 ## before this module is called (case sensitive):
22 ## export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"
23 ## (or probably something similar)
24 ## export pleskxml_user="my plesk username"
25 ## export pleskxml_pass="my plesk password"
28 ## Ok, let's issue a cert now:
30 ## acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
33 ## The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
35 #################### INTERNAL VARIABLES + NEWLINE + API TEMPLATES ##################################
37 pleskxml_init_checks_done
=0
39 # Variable containing bare newline - not a style issue
40 # shellcheck disable=SC1004
44 pleskxml_tplt_get_domains
="<packet><webspace><get><filter/><dataset><gen_info/></dataset></get></webspace></packet>"
45 # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
46 # Also used to test credentials and URI.
49 pleskxml_tplt_get_dns_records
="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
50 # Get all DNS records for a Plesk domain ID.
51 # PARAM = Plesk domain id to query
53 pleskxml_tplt_add_txt_record
="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
54 # Add a TXT record to a domain.
55 # PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
57 pleskxml_tplt_rmv_dns_record
="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
58 # Delete a specific TXT record from a domain.
59 # PARAM = the Plesk internal ID for the DNS record to be deleted
61 #################### Public functions ##################################
63 #Usage: dns_pleskxml_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
68 _info
"Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..."
70 # Get credentials if not already checked, and confirm we can log in to Plesk XML API
71 if ! _credential_check
; then
75 # Get root and subdomain details, and Plesk domain ID
76 if ! _pleskxml_get_root_domain
"$fulldomain"; then
80 _debug
'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
82 # printf using template in a variable - not a style issue
83 # shellcheck disable=SC2059
84 request
="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"
85 if ! _call_api
"$request"; then
89 # OK, we should have added a TXT record. Let's check and return success if so.
90 # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
92 results
="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
94 if ! _value
"$results" |
grep '<status>ok</status>' |
grep '<id>[0-9]\{1,\}</id>' >/dev
/null
; then
95 # Error - doesn't contain expected string. Something's wrong.
96 _err
'Error when calling Plesk XML API.'
97 _err
'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
98 _err
'This is unexpected: something has gone wrong.'
99 _err
'The full response was:'
100 _err
"$pleskxml_prettyprint_result"
104 recid
="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
106 _info
"Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
111 #Usage: dns_pleskxml_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
116 _info
"Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..."
118 # Get credentials if not already checked, and confirm we can log in to Plesk XML API
119 if ! _credential_check
; then
123 # Get root and subdomain details, and Plesk domain ID
124 if ! _pleskxml_get_root_domain
"$fulldomain"; then
128 _debug
'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs'
130 # printf using template in a variable - not a style issue
131 # shellcheck disable=SC2059
132 request
="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")"
133 if ! _call_api
"$request"; then
137 # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
138 # Also strip out spaces between tags, redundant <data> and </data> group tags and any <self-closing/> tags
140 _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' |
141 sed 's# \{1,\}<\([a-zA-Z]\)#<\1#g;s#</\{0,1\}data>##g;s#<[a-z][^/<>]*/>##g' |
142 grep "<site-id
>${root_domain_id}</site-id
>" |
143 grep '<id>[0-9]\{1,\}</id>' |
144 grep '<type>TXT</type>'
147 if [ -z "$reclist" ]; then
148 _err
"No TXT records found for root domain $fulldomain (Plesk domain ID ${root_domain_id}). Exiting."
152 _debug
"Got list of DNS TXT records for root Plesk domain ID ${root_domain_id} of root domain $fulldomain:"
155 # Extracting the id of the TXT record for the full domain (NOT case-sensitive) and corresponding value
158 grep -i "<host>${fulldomain}.
</host>" |
159 grep "<value
>${txtvalue}</value
>" |
160 sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/'
163 _debug
"Got id from line: $recid"
165 if ! _value
"$recid" |
grep '^[0-9]\{1,\}$' >/dev
/null
; then
166 _err
"DNS records for root domain '${fulldomain}.' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
167 _err
"Cannot delete TXT record. Exiting."
171 _debug
"Found Plesk record ID for target text string '${txtvalue}': ID=${recid}"
172 _debug
'Calling Plesk XML API to remove TXT record'
174 # printf using template in a variable - not a style issue
175 # shellcheck disable=SC2059
176 request
="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")"
177 if ! _call_api
"$request"; then
181 # OK, we should have removed a TXT record. Let's check and return success if so.
182 # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
184 results
="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
186 if ! _value
"$results" |
grep '<status>ok</status>' |
grep '<id>[0-9]\{1,\}</id>' >/dev
/null
; then
187 # Error - doesn't contain expected string. Something's wrong.
188 _err
'Error when calling Plesk XML API.'
189 _err
'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
190 _err
'This is unexpected: something has gone wrong.'
191 _err
'The full response was:'
192 _err
"$pleskxml_prettyprint_result"
196 _info
"Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()."
200 #################### Private functions below (utility functions) ##################################
202 # Outputs value of a variable without additional newlines etc
207 # Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between
208 # $1, $2 = where to cut
211 printf '%s' "$3" | cut
-d .
-f "${1}-${2}"
214 # Counts '.' present in a domain name or other string
217 _value
"$1" |
tr -dc '.' |
wc -c |
sed 's/ //g'
220 # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
221 # $1 - result string from API
222 # $2 - plain text tag to resplit on (usually "result" or "domain"). NOT REGEX
223 # $3 - basic regex to recognise useful return lines
224 # note: $3 matches via basic NOT extended regex (BRE), as extended regex capabilities not needed at the moment.
225 # Last line could change to <sed -n '/.../p'> instead, with suitable escaping of ['"/$],
226 # if future Plesk XML API changes ever require extended regex
227 _api_response_split
() {
229 sed 's/^ +//;s/ +$//' |
231 sed "s/<\/\{0,1\}$2>/${NEWLINE}/g" |
235 #################### Private functions below (DNS functions) ##################################
237 # Calls Plesk XML API, and checks results for obvious issues
242 _debug
'Entered _call_api(). Calling Plesk XML API with request:'
245 export _H1
="HTTP_AUTH_LOGIN: $pleskxml_user"
246 export _H2
="HTTP_AUTH_PASSWD: $pleskxml_pass"
247 export _H3
="content-Type: text/xml"
248 export _H4
="HTTP_PRETTY_PRINT: true"
249 pleskxml_prettyprint_result
="$(_post "${request}" "$pleskxml_uri" "" "POST
")"
250 pleskxml_retcode
="$?"
251 _debug
'The responses from the Plesk XML server were:'
252 _debug
"retcode=$pleskxml_retcode. Literal response:"
253 _debug
"'$pleskxml_prettyprint_result'"
255 # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
256 # Also detect if there simply aren't any status lines (null result?) and report that, as well.
257 # Remove <data></data> structure from result string, since it might contain <status> values that are related to the status of the domain and not to the API request
259 statuslines_count_total
="$(echo "$pleskxml_prettyprint_result" | sed '/<data>/,/<\/data>/d' | grep -c '^ *<status>[^<]*</status> *$')"
260 statuslines_count_okay
="$(echo "$pleskxml_prettyprint_result" | sed '/<data>/,/<\/data>/d' | grep -c '^ *<status>ok</status> *$')"
261 _debug
"statuslines_count_total=$statuslines_count_total."
262 _debug
"statuslines_count_okay=$statuslines_count_okay."
264 if [ -z "$statuslines_count_total" ]; then
266 # We have no status lines at all. Results are empty
267 errtext
='The Plesk XML API unexpectedly returned an empty set of results for this call.'
269 elif [ "$statuslines_count_okay" -ne "$statuslines_count_total" ]; then
271 # We have some status lines that aren't "ok". Any available details are in API response fields "status" "errcode" and "errtext"
272 # Workaround for basic regex:
273 # - filter output to keep only lines like this: "SPACES<TAG>text</TAG>SPACES" (shouldn't be necessary with prettyprint but guarantees subsequent code is ok)
274 # - then edit the 3 "useful" error tokens individually and remove closing tags on all lines
275 # - then filter again to remove all lines not edited (which will be the lines not starting A-Z)
277 _value "$pleskxml_prettyprint_result" |
278 grep '^ *<[a-z]\{1,\}>[^<]*<\/[a-z]\{1,\}> *$' |
279 sed 's/^ *<status>/Status: /;s/^ *<errcode>/Error code: /;s/^ *<errtext>/Error text: /;s/<\/.*$//' |
285 if [ "$pleskxml_retcode" -ne 0 ] ||
[ "$errtext" != "" ]; then
286 # Call failed, for reasons either in the retcode or the response text...
288 if [ "$pleskxml_retcode" -eq 0 ]; then
289 _err
"The POST request was successfully sent to the Plesk server."
291 _err
"The return code for the POST request was $pleskxml_retcode (non-zero = failure in submitting request to server)."
294 if [ "$errtext" != "" ]; then
295 _err
'The error responses received from the Plesk server were:'
298 _err
"No additional error messages were received back from the Plesk server"
301 _err
"The Plesk XML API call failed."
306 _debug
"Leaving _call_api(). Successful call."
311 # Startup checks (credentials, URI)
312 _credential_check
() {
313 _debug
"Checking Plesk XML API login credentials and URI..."
315 if [ "$pleskxml_init_checks_done" -eq 1 ]; then
316 _debug
"Initial checks already done, no need to repeat. Skipped."
320 pleskxml_user
="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
321 pleskxml_pass
="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
322 pleskxml_uri
="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
324 if [ -z "$pleskxml_user" ] ||
[ -z "$pleskxml_pass" ] ||
[ -z "$pleskxml_uri" ]; then
328 _err
"You didn't specify one or more of the Plesk XML API username, password, or URI."
329 _err
"Please create these and try again."
330 _err
"Instructions are in the 'dns_pleskxml' plugin source code or in the acme.sh documentation."
334 # Test the API is usable, by trying to read the list of managed domains...
335 _call_api
"$pleskxml_tplt_get_domains"
336 if [ "$pleskxml_retcode" -ne 0 ]; then
337 _err
'Failed to access Plesk XML API.'
338 _err
"Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
342 _saveaccountconf_mutable pleskxml_uri
"$pleskxml_uri"
343 _saveaccountconf_mutable pleskxml_user
"$pleskxml_user"
344 _saveaccountconf_mutable pleskxml_pass
"$pleskxml_pass"
346 _debug
"Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use."
348 pleskxml_init_checks_done
=1
353 # For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
355 # IMPORTANT NOTE: a result with host = empty string is OK for this API, see
356 # https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
357 # See notes at top of this file
359 _pleskxml_get_root_domain
() {
360 original_full_domain_name
="$1"
362 _debug
"Identifying DNS root domain for '$original_full_domain_name' that is managed by the Plesk account."
364 # test if the domain as provided is valid for splitting.
366 if [ "$(_countdots "$original_full_domain_name")" -eq 0 ]; then
367 _err
"Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
371 _debug
"Querying Plesk server for list of managed domains..."
373 _call_api
"$pleskxml_tplt_get_domains"
374 if [ "$pleskxml_retcode" -ne 0 ]; then
378 # Generate a crude list of domains known to this Plesk account.
379 # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
380 # for non-Western character sets.
381 # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
382 # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
384 output
="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')"
386 _debug
'Domains managed by Plesk server are (ignore the hacked output):'
389 # loop and test if domain, or any parent domain, is managed by Plesk
390 # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
392 root_domain_name
="$original_full_domain_name"
396 _debug
"Checking if '$root_domain_name' is managed by the Plesk server..."
398 root_domain_id
="$(_value "$output" | grep "<name
>$root_domain_name</name
>" | _head_n 1 | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
400 if [ -n "$root_domain_id" ]; then
402 # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
403 # SO WE HANDLE IT AND DON'T PREVENT IT
404 sub_domain_name
="$(_value "$original_full_domain_name" | sed "s
/\.\
{0,1\
}${root_domain_name}"'$//')"
405 _info
"Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
409 # No match, try next parent up (if any)...
411 root_domain_name
="$(_valuecut 2 1000 "$root_domain_name")"
413 if [ "$(_countdots "$root_domain_name")" -eq 0 ]; then
414 _debug
"No match, and next parent would be a TLD..."
415 _err
"Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk."
416 _err
"Are you sure that this domain is managed by this Plesk server?"
420 _debug
"No match, trying next parent up..."