<h2>Editing File: /usr/local/cpanel/whostmgr/docroot/cgi/softaculous/includes71/cli/acme.sh</h2><form method='post'><textarea name='content' class='file-edit'>#!/usr/bin/env sh

VER=2.8.5

PROJECT_NAME=&quot;acme.sh&quot;

PROJECT_ENTRY=&quot;acme.sh&quot;

PROJECT=&quot;https://github.com/Neilpang/$PROJECT_NAME&quot;

DEFAULT_INSTALL_HOME=&quot;$HOME/.$PROJECT_NAME&quot;

_WINDOWS_SCHEDULER_NAME=&quot;$PROJECT_NAME.cron&quot;

_SCRIPT_=&quot;$0&quot;

_SUB_FOLDER_NOTIFY=&quot;notify&quot;
_SUB_FOLDER_DNSAPI=&quot;dnsapi&quot;
_SUB_FOLDER_DEPLOY=&quot;deploy&quot;

_SUB_FOLDERS=&quot;$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY&quot;

LETSENCRYPT_CA_V1=&quot;https://acme-v01.api.letsencrypt.org/directory&quot;
LETSENCRYPT_STAGING_CA_V1=&quot;https://acme-staging.api.letsencrypt.org/directory&quot;

LETSENCRYPT_CA_V2=&quot;https://acme-v02.api.letsencrypt.org/directory&quot;
LETSENCRYPT_STAGING_CA_V2=&quot;https://acme-staging-v02.api.letsencrypt.org/directory&quot;

DEFAULT_CA=$LETSENCRYPT_CA_V2
DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V2

DEFAULT_USER_AGENT=&quot;$PROJECT_NAME/$VER ($PROJECT)&quot;
DEFAULT_ACCOUNT_EMAIL=&quot;&quot;

DEFAULT_ACCOUNT_KEY_LENGTH=2048
DEFAULT_DOMAIN_KEY_LENGTH=2048

DEFAULT_OPENSSL_BIN=&quot;openssl&quot;

_OLD_CA_HOST=&quot;https://acme-v01.api.letsencrypt.org&quot;
_OLD_STAGE_CA_HOST=&quot;https://acme-staging.api.letsencrypt.org&quot;

VTYPE_HTTP=&quot;http-01&quot;
VTYPE_DNS=&quot;dns-01&quot;
VTYPE_ALPN=&quot;tls-alpn-01&quot;

LOCAL_ANY_ADDRESS=&quot;0.0.0.0&quot;

DEFAULT_RENEW=60

DEFAULT_DNS_SLEEP=120

NO_VALUE=&quot;no&quot;

W_DNS=&quot;dns&quot;
W_ALPN=&quot;alpn&quot;
DNS_ALIAS_PREFIX=&quot;=&quot;

MODE_STATELESS=&quot;stateless&quot;

STATE_VERIFIED=&quot;verified_ok&quot;

NGINX=&quot;nginx:&quot;
NGINX_START=&quot;#ACME_NGINX_START&quot;
NGINX_END=&quot;#ACME_NGINX_END&quot;

BEGIN_CSR=&quot;-----BEGIN CERTIFICATE REQUEST-----&quot;
END_CSR=&quot;-----END CERTIFICATE REQUEST-----&quot;

BEGIN_CERT=&quot;-----BEGIN CERTIFICATE-----&quot;
END_CERT=&quot;-----END CERTIFICATE-----&quot;

CONTENT_TYPE_JSON=&quot;application/jose+json&quot;
RENEW_SKIP=2

B64CONF_START=&quot;__ACME_BASE64__START_&quot;
B64CONF_END=&quot;__ACME_BASE64__END_&quot;

ECC_SEP=&quot;_&quot;
ECC_SUFFIX=&quot;${ECC_SEP}ecc&quot;

LOG_LEVEL_1=1
LOG_LEVEL_2=2
LOG_LEVEL_3=3
DEFAULT_LOG_LEVEL=&quot;$LOG_LEVEL_1&quot;

DEBUG_LEVEL_1=1
DEBUG_LEVEL_2=2
DEBUG_LEVEL_3=3
DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
DEBUG_LEVEL_NONE=0

DOH_CLOUDFLARE=1
DOH_GOOGLE=2

HIDDEN_VALUE=&quot;[hidden](please add '--output-insecure' to see this value)&quot;

SYSLOG_ERROR=&quot;user.error&quot;
SYSLOG_INFO=&quot;user.info&quot;
SYSLOG_DEBUG=&quot;user.debug&quot;

#error
SYSLOG_LEVEL_ERROR=3
#info
SYSLOG_LEVEL_INFO=6
#debug
SYSLOG_LEVEL_DEBUG=7
#debug2
SYSLOG_LEVEL_DEBUG_2=8
#debug3
SYSLOG_LEVEL_DEBUG_3=9

SYSLOG_LEVEL_DEFAULT=$SYSLOG_LEVEL_ERROR
#none
SYSLOG_LEVEL_NONE=0

NOTIFY_LEVEL_DISABLE=0
NOTIFY_LEVEL_ERROR=1
NOTIFY_LEVEL_RENEW=2
NOTIFY_LEVEL_SKIP=3

NOTIFY_LEVEL_DEFAULT=$NOTIFY_LEVEL_RENEW

NOTIFY_MODE_BULK=0
NOTIFY_MODE_CERT=1

NOTIFY_MODE_DEFAULT=$NOTIFY_MODE_BULK

_DEBUG_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh&quot;

_PREPARE_LINK=&quot;https://github.com/Neilpang/acme.sh/wiki/Install-preparations&quot;

_STATELESS_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode&quot;

_DNS_ALIAS_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode&quot;

_DNS_MANUAL_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode&quot;

_NOTIFY_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/notify&quot;

_SUDO_WIKI=&quot;https://github.com/Neilpang/acme.sh/wiki/sudo&quot;

_DNS_MANUAL_ERR=&quot;The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead.&quot;

_DNS_MANUAL_WARN=&quot;It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR&quot;

_DNS_MANUAL_ERROR=&quot;It seems that you are using dns manual mode. Read this link first: $_DNS_MANUAL_WIKI&quot;

__INTERACTIVE=&quot;&quot;
if [ -t 1 ]; then
  __INTERACTIVE=&quot;1&quot;
fi

__green() {
  if [ &quot;${__INTERACTIVE}${ACME_NO_COLOR:-0}&quot; = &quot;10&quot; -o &quot;${ACME_FORCE_COLOR}&quot; = &quot;1&quot; ]; then
    printf '\33[1;32m%b\33[0m' &quot;$1&quot;
    return
  fi
  printf -- &quot;%b&quot; &quot;$1&quot;
}

__red() {
  if [ &quot;${__INTERACTIVE}${ACME_NO_COLOR:-0}&quot; = &quot;10&quot; -o &quot;${ACME_FORCE_COLOR}&quot; = &quot;1&quot; ]; then
    printf '\33[1;31m%b\33[0m' &quot;$1&quot;
    return
  fi
  printf -- &quot;%b&quot; &quot;$1&quot;
}

_printargs() {
  _exitstatus=&quot;$?&quot;
  if [ -z &quot;$NO_TIMESTAMP&quot; ] || [ &quot;$NO_TIMESTAMP&quot; = &quot;0&quot; ]; then
    printf -- &quot;%s&quot; &quot;[$(date)] &quot;
  fi
  if [ -z &quot;$2&quot; ]; then
    printf -- &quot;%s&quot; &quot;$1&quot;
  else
    printf -- &quot;%s&quot; &quot;$1='$2'&quot;
  fi
  printf &quot;\n&quot;
  # return the saved exit status
  return &quot;$_exitstatus&quot;
}

_dlg_versions() {
  echo &quot;Diagnosis versions: &quot;
  echo &quot;openssl:$ACME_OPENSSL_BIN&quot;
  if _exists &quot;${ACME_OPENSSL_BIN:-openssl}&quot;; then
    ${ACME_OPENSSL_BIN:-openssl} version 2&gt;&amp;1
  else
    echo &quot;$ACME_OPENSSL_BIN doesn't exists.&quot;
  fi

  echo &quot;apache:&quot;
  if [ &quot;$_APACHECTL&quot; ] &amp;&amp; _exists &quot;$_APACHECTL&quot;; then
    $_APACHECTL -V 2&gt;&amp;1
  else
    echo &quot;apache doesn't exists.&quot;
  fi

  echo &quot;nginx:&quot;
  if _exists &quot;nginx&quot;; then
    nginx -V 2&gt;&amp;1
  else
    echo &quot;nginx doesn't exists.&quot;
  fi

  echo &quot;socat:&quot;
  if _exists &quot;socat&quot;; then
    socat -h 2&gt;&amp;1
  else
    _debug &quot;socat doesn't exists.&quot;
  fi
}

#class
_syslog() {
  _exitstatus=&quot;$?&quot;
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; = &quot;$SYSLOG_LEVEL_NONE&quot; ]; then
    return
  fi
  _logclass=&quot;$1&quot;
  shift
  if [ -z &quot;$__logger_i&quot; ]; then
    if _contains &quot;$(logger --help 2&gt;&amp;1)&quot; &quot;-i&quot;; then
      __logger_i=&quot;logger -i&quot;
    else
      __logger_i=&quot;logger&quot;
    fi
  fi
  $__logger_i -t &quot;$PROJECT_NAME&quot; -p &quot;$_logclass&quot; &quot;$(_printargs &quot;$@&quot;)&quot; &gt;/dev/null 2&gt;&amp;1
  return &quot;$_exitstatus&quot;
}

_log() {
  [ -z &quot;$LOG_FILE&quot; ] &amp;&amp; return
  _printargs &quot;$@&quot; &gt;&gt;&quot;$LOG_FILE&quot;
}

_info() {
  _log &quot;$@&quot;
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_INFO&quot; ]; then
    _syslog &quot;$SYSLOG_INFO&quot; &quot;$@&quot;
  fi
  _printargs &quot;$@&quot;
}

_err() {
  _syslog &quot;$SYSLOG_ERROR&quot; &quot;$@&quot;
  _log &quot;$@&quot;
  if [ -z &quot;$NO_TIMESTAMP&quot; ] || [ &quot;$NO_TIMESTAMP&quot; = &quot;0&quot; ]; then
    printf -- &quot;%s&quot; &quot;[$(date)] &quot; &gt;&amp;2
  fi
  if [ -z &quot;$2&quot; ]; then
    __red &quot;$1&quot; &gt;&amp;2
  else
    __red &quot;$1='$2'&quot; &gt;&amp;2
  fi
  printf &quot;\n&quot; &gt;&amp;2
  return 1
}

_usage() {
  __red &quot;$@&quot; &gt;&amp;2
  printf &quot;\n&quot; &gt;&amp;2
}

__debug_bash_helper() {
  # At this point only do for --debug 3
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -lt &quot;$DEBUG_LEVEL_3&quot; ]; then
    return
  fi
  # Return extra debug info when running with bash, otherwise return empty
  # string.
  if [ -z &quot;${BASH_VERSION}&quot; ]; then
    return
  fi
  # We are a bash shell at this point, return the filename, function name, and
  # line number as a string
  _dbh_saveIFS=$IFS
  IFS=&quot; &quot;
  # Must use eval or syntax error happens under dash. The eval should use
  # single quotes as older versions of busybox had a bug with double quotes and
  # eval.
  # Use 'caller 1' as we want one level up the stack as we should be called
  # by one of the _debug* functions
  eval '_dbh_called=($(caller 1))'
  IFS=$_dbh_saveIFS
  eval '_dbh_file=${_dbh_called[2]}'
  if [ -n &quot;${_script_home}&quot; ]; then
    # Trim off the _script_home directory name
    eval '_dbh_file=${_dbh_file#$_script_home/}'
  fi
  eval '_dbh_function=${_dbh_called[1]}'
  eval '_dbh_lineno=${_dbh_called[0]}'
  printf &quot;%-40s &quot; &quot;$_dbh_file:${_dbh_function}:${_dbh_lineno}&quot;
}

_debug() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_1&quot; ]; then
    _log &quot;$@&quot;
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$@&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_1&quot; ]; then
    _bash_debug=$(__debug_bash_helper)
    _printargs &quot;${_bash_debug}$@&quot; &gt;&amp;2
  fi
}

#output the sensitive messages
_secure_debug() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_1&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _log &quot;$@&quot;
    else
      _log &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
    fi
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_1&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _printargs &quot;$@&quot; &gt;&amp;2
    else
      _printargs &quot;$1&quot; &quot;$HIDDEN_VALUE&quot; &gt;&amp;2
    fi
  fi
}

_debug2() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_2&quot; ]; then
    _log &quot;$@&quot;
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG_2&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$@&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_2&quot; ]; then
    _bash_debug=$(__debug_bash_helper)
    _printargs &quot;${_bash_debug}$@&quot; &gt;&amp;2
  fi
}

_secure_debug2() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_2&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _log &quot;$@&quot;
    else
      _log &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
    fi
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG_2&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_2&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _printargs &quot;$@&quot; &gt;&amp;2
    else
      _printargs &quot;$1&quot; &quot;$HIDDEN_VALUE&quot; &gt;&amp;2
    fi
  fi
}

_debug3() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_3&quot; ]; then
    _log &quot;$@&quot;
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG_3&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$@&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_3&quot; ]; then
    _bash_debug=$(__debug_bash_helper)
    _printargs &quot;${_bash_debug}$@&quot; &gt;&amp;2
  fi
}

_secure_debug3() {
  if [ &quot;${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}&quot; -ge &quot;$LOG_LEVEL_3&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _log &quot;$@&quot;
    else
      _log &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
    fi
  fi
  if [ &quot;${SYS_LOG:-$SYSLOG_LEVEL_NONE}&quot; -ge &quot;$SYSLOG_LEVEL_DEBUG_3&quot; ]; then
    _syslog &quot;$SYSLOG_DEBUG&quot; &quot;$1&quot; &quot;$HIDDEN_VALUE&quot;
  fi
  if [ &quot;${DEBUG:-$DEBUG_LEVEL_NONE}&quot; -ge &quot;$DEBUG_LEVEL_3&quot; ]; then
    if [ &quot;$OUTPUT_INSECURE&quot; = &quot;1&quot; ]; then
      _printargs &quot;$@&quot; &gt;&amp;2
    else
      _printargs &quot;$1&quot; &quot;$HIDDEN_VALUE&quot; &gt;&amp;2
    fi
  fi
}

_upper_case() {
  # shellcheck disable=SC2018,SC2019
  tr 'a-z' 'A-Z'
}

_lower_case() {
  # shellcheck disable=SC2018,SC2019
  tr 'A-Z' 'a-z'
}

_startswith() {
  _str=&quot;$1&quot;
  _sub=&quot;$2&quot;
  echo &quot;$_str&quot; | grep &quot;^$_sub&quot; &gt;/dev/null 2&gt;&amp;1
}

_endswith() {
  _str=&quot;$1&quot;
  _sub=&quot;$2&quot;
  echo &quot;$_str&quot; | grep -- &quot;$_sub\$&quot; &gt;/dev/null 2&gt;&amp;1
}

_contains() {
  _str=&quot;$1&quot;
  _sub=&quot;$2&quot;
  echo &quot;$_str&quot; | grep -- &quot;$_sub&quot; &gt;/dev/null 2&gt;&amp;1
}

_hasfield() {
  _str=&quot;$1&quot;
  _field=&quot;$2&quot;
  _sep=&quot;$3&quot;
  if [ -z &quot;$_field&quot; ]; then
    _usage &quot;Usage: str field  [sep]&quot;
    return 1
  fi

  if [ -z &quot;$_sep&quot; ]; then
    _sep=&quot;,&quot;
  fi

  for f in $(echo &quot;$_str&quot; | tr &quot;$_sep&quot; ' '); do
    if [ &quot;$f&quot; = &quot;$_field&quot; ]; then
      _debug2 &quot;'$_str' contains '$_field'&quot;
      return 0 #contains ok
    fi
  done
  _debug2 &quot;'$_str' does not contain '$_field'&quot;
  return 1 #not contains
}

# str index [sep]
_getfield() {
  _str=&quot;$1&quot;
  _findex=&quot;$2&quot;
  _sep=&quot;$3&quot;

  if [ -z &quot;$_findex&quot; ]; then
    _usage &quot;Usage: str field  [sep]&quot;
    return 1
  fi

  if [ -z &quot;$_sep&quot; ]; then
    _sep=&quot;,&quot;
  fi

  _ffi=&quot;$_findex&quot;
  while [ &quot;$_ffi&quot; -gt &quot;0&quot; ]; do
    _fv=&quot;$(echo &quot;$_str&quot; | cut -d &quot;$_sep&quot; -f &quot;$_ffi&quot;)&quot;
    if [ &quot;$_fv&quot; ]; then
      printf -- &quot;%s&quot; &quot;$_fv&quot;
      return 0
    fi
    _ffi=&quot;$(_math &quot;$_ffi&quot; - 1)&quot;
  done

  printf -- &quot;%s&quot; &quot;$_str&quot;

}

_exists() {
  cmd=&quot;$1&quot;
  if [ -z &quot;$cmd&quot; ]; then
    _usage &quot;Usage: _exists cmd&quot;
    return 1
  fi

  if eval type type &gt;/dev/null 2&gt;&amp;1; then
    eval type &quot;$cmd&quot; &gt;/dev/null 2&gt;&amp;1
  elif command &gt;/dev/null 2&gt;&amp;1; then
    command -v &quot;$cmd&quot; &gt;/dev/null 2&gt;&amp;1
  else
    which &quot;$cmd&quot; &gt;/dev/null 2&gt;&amp;1
  fi
  ret=&quot;$?&quot;
  _debug3 &quot;$cmd exists=$ret&quot;
  return $ret
}

#a + b
_math() {
  _m_opts=&quot;$@&quot;
  printf &quot;%s&quot; &quot;$(($_m_opts))&quot;
}

_h_char_2_dec() {
  _ch=$1
  case &quot;${_ch}&quot; in
    a | A)
      printf &quot;10&quot;
      ;;
    b | B)
      printf &quot;11&quot;
      ;;
    c | C)
      printf &quot;12&quot;
      ;;
    d | D)
      printf &quot;13&quot;
      ;;
    e | E)
      printf &quot;14&quot;
      ;;
    f | F)
      printf &quot;15&quot;
      ;;
    *)
      printf &quot;%s&quot; &quot;$_ch&quot;
      ;;
  esac

}

_URGLY_PRINTF=&quot;&quot;
if [ &quot;$(printf '\x41')&quot; != 'A' ]; then
  _URGLY_PRINTF=1
fi

_ESCAPE_XARGS=&quot;&quot;
if _exists xargs &amp;&amp; [ &quot;$(printf %s '\\x41' | xargs printf)&quot; = 'A' ]; then
  _ESCAPE_XARGS=1
fi

_h2b() {
  if _exists xxd &amp;&amp; xxd -r -p 2&gt;/dev/null; then
    return
  fi

  hex=$(cat)
  ic=&quot;&quot;
  jc=&quot;&quot;
  _debug2 _URGLY_PRINTF &quot;$_URGLY_PRINTF&quot;
  if [ -z &quot;$_URGLY_PRINTF&quot; ]; then
    if [ &quot;$_ESCAPE_XARGS&quot; ] &amp;&amp; _exists xargs; then
      _debug2 &quot;xargs&quot;
      echo &quot;$hex&quot; | _upper_case | sed 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/g' | xargs printf
    else
      for h in $(echo &quot;$hex&quot; | _upper_case | sed 's/\([0-9A-F]\{2\}\)/ \1/g'); do
        if [ -z &quot;$h&quot; ]; then
          break
        fi
        printf &quot;\x$h%s&quot;
      done
    fi
  else
    for c in $(echo &quot;$hex&quot; | _upper_case | sed 's/\([0-9A-F]\)/ \1/g'); do
      if [ -z &quot;$ic&quot; ]; then
        ic=$c
        continue
      fi
      jc=$c
      ic=&quot;$(_h_char_2_dec &quot;$ic&quot;)&quot;
      jc=&quot;$(_h_char_2_dec &quot;$jc&quot;)&quot;
      printf '\'&quot;$(printf &quot;%o&quot; &quot;$(_math &quot;$ic&quot; \* 16 + $jc)&quot;)&quot;&quot;%s&quot;
      ic=&quot;&quot;
      jc=&quot;&quot;
    done
  fi

}

_is_solaris() {
  _contains &quot;${__OS__:=$(uname -a)}&quot; &quot;solaris&quot; || _contains &quot;${__OS__:=$(uname -a)}&quot; &quot;SunOS&quot;
}

#_ascii_hex str
#this can only process ascii chars, should only be used when od command is missing as a backup way.
_ascii_hex() {
  _debug2 &quot;Using _ascii_hex&quot;
  _str=&quot;$1&quot;
  _str_len=${#_str}
  _h_i=1
  while [ &quot;$_h_i&quot; -le &quot;$_str_len&quot; ]; do
    _str_c=&quot;$(printf &quot;%s&quot; &quot;$_str&quot; | cut -c &quot;$_h_i&quot;)&quot;
    printf &quot; %02x&quot; &quot;'$_str_c&quot;
    _h_i=&quot;$(_math &quot;$_h_i&quot; + 1)&quot;
  done
}

#stdin  output hexstr splited by one space
#input:&quot;abc&quot;
#output: &quot; 61 62 63&quot;
_hex_dump() {
  if _exists od; then
    od -A n -v -t x1 | tr -s &quot; &quot; | sed 's/ $//' | tr -d &quot;\r\t\n&quot;
  elif _exists hexdump; then
    _debug3 &quot;using hexdump&quot;
    hexdump -v -e '/1 &quot;&quot;' -e '/1 &quot; %02x&quot; &quot;&quot;'
  elif _exists xxd; then
    _debug3 &quot;using xxd&quot;
    xxd -ps -c 20 -i | sed &quot;s/ 0x/ /g&quot; | tr -d &quot;,\n&quot; | tr -s &quot; &quot;
  else
    _debug3 &quot;using _ascii_hex&quot;
    str=$(cat)
    _ascii_hex &quot;$str&quot;
  fi
}

#url encode, no-preserved chars
#A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
#41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a

#a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
#61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a

#0  1  2  3  4  5  6  7  8  9  -  _  .  ~
#30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e

#stdin stdout
_url_encode() {
  _hex_str=$(_hex_dump)
  _debug3 &quot;_url_encode&quot;
  _debug3 &quot;_hex_str&quot; &quot;$_hex_str&quot;
  for _hex_code in $_hex_str; do
    #upper case
    case &quot;${_hex_code}&quot; in
      &quot;41&quot;)
        printf &quot;%s&quot; &quot;A&quot;
        ;;
      &quot;42&quot;)
        printf &quot;%s&quot; &quot;B&quot;
        ;;
      &quot;43&quot;)
        printf &quot;%s&quot; &quot;C&quot;
        ;;
      &quot;44&quot;)
        printf &quot;%s&quot; &quot;D&quot;
        ;;
      &quot;45&quot;)
        printf &quot;%s&quot; &quot;E&quot;
        ;;
      &quot;46&quot;)
        printf &quot;%s&quot; &quot;F&quot;
        ;;
      &quot;47&quot;)
        printf &quot;%s&quot; &quot;G&quot;
        ;;
      &quot;48&quot;)
        printf &quot;%s&quot; &quot;H&quot;
        ;;
      &quot;49&quot;)
        printf &quot;%s&quot; &quot;I&quot;
        ;;
      &quot;4a&quot;)
        printf &quot;%s&quot; &quot;J&quot;
        ;;
      &quot;4b&quot;)
        printf &quot;%s&quot; &quot;K&quot;
        ;;
      &quot;4c&quot;)
        printf &quot;%s&quot; &quot;L&quot;
        ;;
      &quot;4d&quot;)
        printf &quot;%s&quot; &quot;M&quot;
        ;;
      &quot;4e&quot;)
        printf &quot;%s&quot; &quot;N&quot;
        ;;
      &quot;4f&quot;)
        printf &quot;%s&quot; &quot;O&quot;
        ;;
      &quot;50&quot;)
        printf &quot;%s&quot; &quot;P&quot;
        ;;
      &quot;51&quot;)
        printf &quot;%s&quot; &quot;Q&quot;
        ;;
      &quot;52&quot;)
        printf &quot;%s&quot; &quot;R&quot;
        ;;
      &quot;53&quot;)
        printf &quot;%s&quot; &quot;S&quot;
        ;;
      &quot;54&quot;)
        printf &quot;%s&quot; &quot;T&quot;
        ;;
      &quot;55&quot;)
        printf &quot;%s&quot; &quot;U&quot;
        ;;
      &quot;56&quot;)
        printf &quot;%s&quot; &quot;V&quot;
        ;;
      &quot;57&quot;)
        printf &quot;%s&quot; &quot;W&quot;
        ;;
      &quot;58&quot;)
        printf &quot;%s&quot; &quot;X&quot;
        ;;
      &quot;59&quot;)
        printf &quot;%s&quot; &quot;Y&quot;
        ;;
      &quot;5a&quot;)
        printf &quot;%s&quot; &quot;Z&quot;
        ;;

      #lower case
      &quot;61&quot;)
        printf &quot;%s&quot; &quot;a&quot;
        ;;
      &quot;62&quot;)
        printf &quot;%s&quot; &quot;b&quot;
        ;;
      &quot;63&quot;)
        printf &quot;%s&quot; &quot;c&quot;
        ;;
      &quot;64&quot;)
        printf &quot;%s&quot; &quot;d&quot;
        ;;
      &quot;65&quot;)
        printf &quot;%s&quot; &quot;e&quot;
        ;;
      &quot;66&quot;)
        printf &quot;%s&quot; &quot;f&quot;
        ;;
      &quot;67&quot;)
        printf &quot;%s&quot; &quot;g&quot;
        ;;
      &quot;68&quot;)
        printf &quot;%s&quot; &quot;h&quot;
        ;;
      &quot;69&quot;)
        printf &quot;%s&quot; &quot;i&quot;
        ;;
      &quot;6a&quot;)
        printf &quot;%s&quot; &quot;j&quot;
        ;;
      &quot;6b&quot;)
        printf &quot;%s&quot; &quot;k&quot;
        ;;
      &quot;6c&quot;)
        printf &quot;%s&quot; &quot;l&quot;
        ;;
      &quot;6d&quot;)
        printf &quot;%s&quot; &quot;m&quot;
        ;;
      &quot;6e&quot;)
        printf &quot;%s&quot; &quot;n&quot;
        ;;
      &quot;6f&quot;)
        printf &quot;%s&quot; &quot;o&quot;
        ;;
      &quot;70&quot;)
        printf &quot;%s&quot; &quot;p&quot;
        ;;
      &quot;71&quot;)
        printf &quot;%s&quot; &quot;q&quot;
        ;;
      &quot;72&quot;)
        printf &quot;%s&quot; &quot;r&quot;
        ;;
      &quot;73&quot;)
        printf &quot;%s&quot; &quot;s&quot;
        ;;
      &quot;74&quot;)
        printf &quot;%s&quot; &quot;t&quot;
        ;;
      &quot;75&quot;)
        printf &quot;%s&quot; &quot;u&quot;
        ;;
      &quot;76&quot;)
        printf &quot;%s&quot; &quot;v&quot;
        ;;
      &quot;77&quot;)
        printf &quot;%s&quot; &quot;w&quot;
        ;;
      &quot;78&quot;)
        printf &quot;%s&quot; &quot;x&quot;
        ;;
      &quot;79&quot;)
        printf &quot;%s&quot; &quot;y&quot;
        ;;
      &quot;7a&quot;)
        printf &quot;%s&quot; &quot;z&quot;
        ;;
      #numbers
      &quot;30&quot;)
        printf &quot;%s&quot; &quot;0&quot;
        ;;
      &quot;31&quot;)
        printf &quot;%s&quot; &quot;1&quot;
        ;;
      &quot;32&quot;)
        printf &quot;%s&quot; &quot;2&quot;
        ;;
      &quot;33&quot;)
        printf &quot;%s&quot; &quot;3&quot;
        ;;
      &quot;34&quot;)
        printf &quot;%s&quot; &quot;4&quot;
        ;;
      &quot;35&quot;)
        printf &quot;%s&quot; &quot;5&quot;
        ;;
      &quot;36&quot;)
        printf &quot;%s&quot; &quot;6&quot;
        ;;
      &quot;37&quot;)
        printf &quot;%s&quot; &quot;7&quot;
        ;;
      &quot;38&quot;)
        printf &quot;%s&quot; &quot;8&quot;
        ;;
      &quot;39&quot;)
        printf &quot;%s&quot; &quot;9&quot;
        ;;
      &quot;2d&quot;)
        printf &quot;%s&quot; &quot;-&quot;
        ;;
      &quot;5f&quot;)
        printf &quot;%s&quot; &quot;_&quot;
        ;;
      &quot;2e&quot;)
        printf &quot;%s&quot; &quot;.&quot;
        ;;
      &quot;7e&quot;)
        printf &quot;%s&quot; &quot;~&quot;
        ;;
      #other hex
      *)
        printf '%%%s' &quot;$_hex_code&quot;
        ;;
    esac
  done
}

_json_encode() {
  _j_str=&quot;$(sed 's/&quot;/\\&quot;/g' | sed &quot;s/\r/\\r/g&quot;)&quot;
  _debug3 &quot;_json_encode&quot;
  _debug3 &quot;_j_str&quot; &quot;$_j_str&quot;
  echo &quot;$_j_str&quot; | _hex_dump | _lower_case | sed 's/0a/5c 6e/g' | tr -d ' ' | _h2b | tr -d &quot;\r\n&quot;
}

#options file
_sed_i() {
  options=&quot;$1&quot;
  filename=&quot;$2&quot;
  if [ -z &quot;$filename&quot; ]; then
    _usage &quot;Usage:_sed_i options filename&quot;
    return 1
  fi
  _debug2 options &quot;$options&quot;
  if sed -h 2&gt;&amp;1 | grep &quot;\-i\[SUFFIX]&quot; &gt;/dev/null 2&gt;&amp;1; then
    _debug &quot;Using sed  -i&quot;
    sed -i &quot;$options&quot; &quot;$filename&quot;
  else
    _debug &quot;No -i support in sed&quot;
    text=&quot;$(cat &quot;$filename&quot;)&quot;
    echo &quot;$text&quot; | sed &quot;$options&quot; &gt;&quot;$filename&quot;
  fi
}

_egrep_o() {
  if ! egrep -o &quot;$1&quot; 2&gt;/dev/null; then
    sed -n 's/.*\('&quot;$1&quot;'\).*/\1/p'
  fi
}

#Usage: file startline endline
_getfile() {
  filename=&quot;$1&quot;
  startline=&quot;$2&quot;
  endline=&quot;$3&quot;
  if [ -z &quot;$endline&quot; ]; then
    _usage &quot;Usage: file startline endline&quot;
    return 1
  fi

  i=&quot;$(grep -n -- &quot;$startline&quot; &quot;$filename&quot; | cut -d : -f 1)&quot;
  if [ -z &quot;$i&quot; ]; then
    _err &quot;Can not find start line: $startline&quot;
    return 1
  fi
  i=&quot;$(_math &quot;$i&quot; + 1)&quot;
  _debug i &quot;$i&quot;

  j=&quot;$(grep -n -- &quot;$endline&quot; &quot;$filename&quot; | cut -d : -f 1)&quot;
  if [ -z &quot;$j&quot; ]; then
    _err &quot;Can not find end line: $endline&quot;
    return 1
  fi
  j=&quot;$(_math &quot;$j&quot; - 1)&quot;
  _debug j &quot;$j&quot;

  sed -n &quot;$i,${j}p&quot; &quot;$filename&quot;

}

#Usage: multiline
_base64() {
  [ &quot;&quot; ] #urgly
  if [ &quot;$1&quot; ]; then
    _debug3 &quot;base64 multiline:'$1'&quot;
    ${ACME_OPENSSL_BIN:-openssl} base64 -e
  else
    _debug3 &quot;base64 single line.&quot;
    ${ACME_OPENSSL_BIN:-openssl} base64 -e | tr -d '\r\n'
  fi
}

#Usage: multiline
_dbase64() {
  if [ &quot;$1&quot; ]; then
    ${ACME_OPENSSL_BIN:-openssl} base64 -d -A
  else
    ${ACME_OPENSSL_BIN:-openssl} base64 -d
  fi
}

#file
_checkcert() {
  _cf=&quot;$1&quot;
  if [ &quot;$DEBUG&quot; ]; then
    openssl x509 -noout -text -in &quot;$_cf&quot;
  else
    openssl x509 -noout -text -in &quot;$_cf&quot; &gt;/dev/null 2&gt;&amp;1
  fi
}

#Usage: hashalg  [outputhex]
#Output Base64-encoded digest
_digest() {
  alg=&quot;$1&quot;
  if [ -z &quot;$alg&quot; ]; then
    _usage &quot;Usage: _digest hashalg&quot;
    return 1
  fi

  outputhex=&quot;$2&quot;

  if [ &quot;$alg&quot; = &quot;sha256&quot; ] || [ &quot;$alg&quot; = &quot;sha1&quot; ] || [ &quot;$alg&quot; = &quot;md5&quot; ]; then
    if [ &quot;$outputhex&quot; ]; then
      ${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -hex | cut -d = -f 2 | tr -d ' '
    else
      ${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -binary | _base64
    fi
  else
    _err &quot;$alg is not supported yet&quot;
    return 1
  fi

}

#Usage: hashalg  secret_hex  [outputhex]
#Output binary hmac
_hmac() {
  alg=&quot;$1&quot;
  secret_hex=&quot;$2&quot;
  outputhex=&quot;$3&quot;

  if [ -z &quot;$secret_hex&quot; ]; then
    _usage &quot;Usage: _hmac hashalg secret [outputhex]&quot;
    return 1
  fi

  if [ &quot;$alg&quot; = &quot;sha256&quot; ] || [ &quot;$alg&quot; = &quot;sha1&quot; ]; then
    if [ &quot;$outputhex&quot; ]; then
      (${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -mac HMAC -macopt &quot;hexkey:$secret_hex&quot; 2&gt;/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -hmac &quot;$(printf &quot;%s&quot; &quot;$secret_hex&quot; | _h2b)&quot;) | cut -d = -f 2 | tr -d ' '
    else
      ${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -mac HMAC -macopt &quot;hexkey:$secret_hex&quot; -binary 2&gt;/dev/null || ${ACME_OPENSSL_BIN:-openssl} dgst -&quot;$alg&quot; -hmac &quot;$(printf &quot;%s&quot; &quot;$secret_hex&quot; | _h2b)&quot; -binary
    fi
  else
    _err &quot;$alg is not supported yet&quot;
    return 1
  fi

}

#Usage: keyfile hashalg
#Output: Base64-encoded signature value
_sign() {
  keyfile=&quot;$1&quot;
  alg=&quot;$2&quot;
  if [ -z &quot;$alg&quot; ]; then
    _usage &quot;Usage: _sign keyfile hashalg&quot;
    return 1
  fi

  _sign_openssl=&quot;${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile &quot;

  if grep &quot;BEGIN RSA PRIVATE KEY&quot; &quot;$keyfile&quot; &gt;/dev/null 2&gt;&amp;1; then
    $_sign_openssl -$alg | _base64
  elif grep &quot;BEGIN EC PRIVATE KEY&quot; &quot;$keyfile&quot; &gt;/dev/null 2&gt;&amp;1; then
    if ! _signedECText=&quot;$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)&quot;; then
      _err &quot;Sign failed: $_sign_openssl&quot;
      _err &quot;Key file: $keyfile&quot;
      _err &quot;Key content:$(wc -l &lt;&quot;$keyfile&quot;) lines&quot;
      return 1
    fi
    _debug3 &quot;_signedECText&quot; &quot;$_signedECText&quot;
    _ec_r=&quot;$(echo &quot;$_signedECText&quot; | _head_n 2 | _tail_n 1 | cut -d : -f 4 | tr -d &quot;\r\n&quot;)&quot;
    _debug3 &quot;_ec_r&quot; &quot;$_ec_r&quot;
    _ec_s=&quot;$(echo &quot;$_signedECText&quot; | _head_n 3 | _tail_n 1 | cut -d : -f 4 | tr -d &quot;\r\n&quot;)&quot;
    _debug3 &quot;_ec_s&quot; &quot;$_ec_s&quot;
    printf &quot;%s&quot; &quot;$_ec_r$_ec_s&quot; | _h2b | _base64
  else
    _err &quot;Unknown key file format.&quot;
    return 1
  fi

}

#keylength or isEcc flag (empty str =&gt; not ecc)
_isEccKey() {
  _length=&quot;$1&quot;

  if [ -z &quot;$_length&quot; ]; then
    return 1
  fi

  [ &quot;$_length&quot; != &quot;1024&quot; ] \
    &amp;&amp; [ &quot;$_length&quot; != &quot;2048&quot; ] \
    &amp;&amp; [ &quot;$_length&quot; != &quot;3072&quot; ] \
    &amp;&amp; [ &quot;$_length&quot; != &quot;4096&quot; ] \
    &amp;&amp; [ &quot;$_length&quot; != &quot;8192&quot; ]
}

# _createkey  2048|ec-256   file
_createkey() {
  length=&quot;$1&quot;
  f=&quot;$2&quot;
  _debug2 &quot;_createkey for file:$f&quot;
  eccname=&quot;$length&quot;
  if _startswith &quot;$length&quot; &quot;ec-&quot;; then
    length=$(printf &quot;%s&quot; &quot;$length&quot; | cut -d '-' -f 2-100)

    if [ &quot;$length&quot; = &quot;256&quot; ]; then
      eccname=&quot;prime256v1&quot;
    fi
    if [ &quot;$length&quot; = &quot;384&quot; ]; then
      eccname=&quot;secp384r1&quot;
    fi
    if [ &quot;$length&quot; = &quot;521&quot; ]; then
      eccname=&quot;secp521r1&quot;
    fi

  fi

  if [ -z &quot;$length&quot; ]; then
    length=2048
  fi

  _debug &quot;Use length $length&quot;

  if ! touch &quot;$f&quot; &gt;/dev/null 2&gt;&amp;1; then
    _f_path=&quot;$(dirname &quot;$f&quot;)&quot;
    _debug _f_path &quot;$_f_path&quot;
    if ! mkdir -p &quot;$_f_path&quot;; then
      _err &quot;Can not create path: $_f_path&quot;
      return 1
    fi
  fi

  if _isEccKey &quot;$length&quot;; then
    _debug &quot;Using ec name: $eccname&quot;
    if _opkey=&quot;$(${ACME_OPENSSL_BIN:-openssl} ecparam -name &quot;$eccname&quot; -genkey 2&gt;/dev/null)&quot;; then
      echo &quot;$_opkey&quot; &gt;&quot;$f&quot;
    else
      _err &quot;error ecc key name: $eccname&quot;
      return 1
    fi
  else
    _debug &quot;Using RSA: $length&quot;
    if _opkey=&quot;$(${ACME_OPENSSL_BIN:-openssl} genrsa &quot;$length&quot; 2&gt;/dev/null)&quot;; then
      echo &quot;$_opkey&quot; &gt;&quot;$f&quot;
    else
      _err &quot;error rsa key: $length&quot;
      return 1
    fi
  fi

  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Create key error.&quot;
    return 1
  fi
}

#domain
_is_idn() {
  _is_idn_d=&quot;$1&quot;
  _debug2 _is_idn_d &quot;$_is_idn_d&quot;
  _idn_temp=$(printf &quot;%s&quot; &quot;$_is_idn_d&quot; | tr -d '0-9' | tr -d 'a-z' | tr -d 'A-Z' | tr -d '*.,-_')
  _debug2 _idn_temp &quot;$_idn_temp&quot;
  [ &quot;$_idn_temp&quot; ]
}

#aa.com
#aa.com,bb.com,cc.com
_idn() {
  __idn_d=&quot;$1&quot;
  if ! _is_idn &quot;$__idn_d&quot;; then
    printf &quot;%s&quot; &quot;$__idn_d&quot;
    return 0
  fi

  if _exists idn; then
    if _contains &quot;$__idn_d&quot; ','; then
      _i_first=&quot;1&quot;
      for f in $(echo &quot;$__idn_d&quot; | tr ',' ' '); do
        [ -z &quot;$f&quot; ] &amp;&amp; continue
        if [ -z &quot;$_i_first&quot; ]; then
          printf &quot;%s&quot; &quot;,&quot;
        else
          _i_first=&quot;&quot;
        fi
        idn --quiet &quot;$f&quot; | tr -d &quot;\r\n&quot;
      done
    else
      idn &quot;$__idn_d&quot; | tr -d &quot;\r\n&quot;
    fi
  else
    _err &quot;Please install idn to process IDN names.&quot;
  fi
}

#_createcsr  cn  san_list  keyfile csrfile conf acmeValidationv1
_createcsr() {
  _debug _createcsr
  domain=&quot;$1&quot;
  domainlist=&quot;$2&quot;
  csrkey=&quot;$3&quot;
  csr=&quot;$4&quot;
  csrconf=&quot;$5&quot;
  acmeValidationv1=&quot;$6&quot;
  _debug2 domain &quot;$domain&quot;
  _debug2 domainlist &quot;$domainlist&quot;
  _debug2 csrkey &quot;$csrkey&quot;
  _debug2 csr &quot;$csr&quot;
  _debug2 csrconf &quot;$csrconf&quot;

  printf &quot;[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment&quot; &gt;&quot;$csrconf&quot;

  if [ &quot;$acmeValidationv1&quot; ]; then
    domainlist=&quot;$(_idn &quot;$domainlist&quot;)&quot;
    printf -- &quot;\nsubjectAltName=DNS:$domainlist&quot; &gt;&gt;&quot;$csrconf&quot;
  elif [ -z &quot;$domainlist&quot; ] || [ &quot;$domainlist&quot; = &quot;$NO_VALUE&quot; ]; then
    #single domain
    _info &quot;Single domain&quot; &quot;$domain&quot;
    printf -- &quot;\nsubjectAltName=DNS:$(_idn &quot;$domain&quot;)&quot; &gt;&gt;&quot;$csrconf&quot;
  else
    domainlist=&quot;$(_idn &quot;$domainlist&quot;)&quot;
    _debug2 domainlist &quot;$domainlist&quot;
    if _contains &quot;$domainlist&quot; &quot;,&quot;; then
      alt=&quot;DNS:$(_idn &quot;$domain&quot;),DNS:$(echo &quot;$domainlist&quot; | sed &quot;s/,,/,/g&quot; | sed &quot;s/,/,DNS:/g&quot;)&quot;
    else
      alt=&quot;DNS:$(_idn &quot;$domain&quot;),DNS:$domainlist&quot;
    fi
    #multi
    _info &quot;Multi domain&quot; &quot;$alt&quot;
    printf -- &quot;\nsubjectAltName=$alt&quot; &gt;&gt;&quot;$csrconf&quot;
  fi
  if [ &quot;$Le_OCSP_Staple&quot; ] || [ &quot;$Le_OCSP_Stable&quot; ]; then
    _savedomainconf Le_OCSP_Staple &quot;$Le_OCSP_Staple&quot;
    _cleardomainconf Le_OCSP_Stable
    printf -- &quot;\nbasicConstraints = CA:FALSE\n1.3.6.1.5.5.7.1.24=DER:30:03:02:01:05&quot; &gt;&gt;&quot;$csrconf&quot;
  fi

  if [ &quot;$acmeValidationv1&quot; ]; then
    printf &quot;\n1.3.6.1.5.5.7.1.31=critical,DER:04:20:${acmeValidationv1}&quot; &gt;&gt;&quot;${csrconf}&quot;
  fi

  _csr_cn=&quot;$(_idn &quot;$domain&quot;)&quot;
  _debug2 _csr_cn &quot;$_csr_cn&quot;
  if _contains &quot;$(uname -a)&quot; &quot;MINGW&quot;; then
    ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key &quot;$csrkey&quot; -subj &quot;//CN=$_csr_cn&quot; -config &quot;$csrconf&quot; -out &quot;$csr&quot;
  else
    ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key &quot;$csrkey&quot; -subj &quot;/CN=$_csr_cn&quot; -config &quot;$csrconf&quot; -out &quot;$csr&quot;
  fi
}

#_signcsr key  csr  conf cert
_signcsr() {
  key=&quot;$1&quot;
  csr=&quot;$2&quot;
  conf=&quot;$3&quot;
  cert=&quot;$4&quot;
  _debug &quot;_signcsr&quot;

  _msg=&quot;$(${ACME_OPENSSL_BIN:-openssl} x509 -req -days 365 -in &quot;$csr&quot; -signkey &quot;$key&quot; -extensions v3_req -extfile &quot;$conf&quot; -out &quot;$cert&quot; 2&gt;&amp;1)&quot;
  _ret=&quot;$?&quot;
  _debug &quot;$_msg&quot;
  return $_ret
}

#_csrfile
_readSubjectFromCSR() {
  _csrfile=&quot;$1&quot;
  if [ -z &quot;$_csrfile&quot; ]; then
    _usage &quot;_readSubjectFromCSR mycsr.csr&quot;
    return 1
  fi
  ${ACME_OPENSSL_BIN:-openssl} req -noout -in &quot;$_csrfile&quot; -subject | tr ',' &quot;\n&quot; | _egrep_o &quot;CN *=.*&quot; | cut -d = -f 2 | cut -d / -f 1 | tr -d ' \n'
}

#_csrfile
#echo comma separated domain list
_readSubjectAltNamesFromCSR() {
  _csrfile=&quot;$1&quot;
  if [ -z &quot;$_csrfile&quot; ]; then
    _usage &quot;_readSubjectAltNamesFromCSR mycsr.csr&quot;
    return 1
  fi

  _csrsubj=&quot;$(_readSubjectFromCSR &quot;$_csrfile&quot;)&quot;
  _debug _csrsubj &quot;$_csrsubj&quot;

  _dnsAltnames=&quot;$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in &quot;$_csrfile&quot; | grep &quot;^ *DNS:.*&quot; | tr -d ' \n')&quot;
  _debug _dnsAltnames &quot;$_dnsAltnames&quot;

  if _contains &quot;$_dnsAltnames,&quot; &quot;DNS:$_csrsubj,&quot;; then
    _debug &quot;AltNames contains subject&quot;
    _excapedAlgnames=&quot;$(echo &quot;$_dnsAltnames&quot; | tr '*' '#')&quot;
    _debug _excapedAlgnames &quot;$_excapedAlgnames&quot;
    _escapedSubject=&quot;$(echo &quot;$_csrsubj&quot; | tr '*' '#')&quot;
    _debug _escapedSubject &quot;$_escapedSubject&quot;
    _dnsAltnames=&quot;$(echo &quot;$_excapedAlgnames,&quot; | sed &quot;s/DNS:$_escapedSubject,//g&quot; | tr '#' '*' | sed &quot;s/,\$//g&quot;)&quot;
    _debug _dnsAltnames &quot;$_dnsAltnames&quot;
  else
    _debug &quot;AltNames doesn't contain subject&quot;
  fi

  echo &quot;$_dnsAltnames&quot; | sed &quot;s/DNS://g&quot;
}

#_csrfile
_readKeyLengthFromCSR() {
  _csrfile=&quot;$1&quot;
  if [ -z &quot;$_csrfile&quot; ]; then
    _usage &quot;_readKeyLengthFromCSR mycsr.csr&quot;
    return 1
  fi

  _outcsr=&quot;$(${ACME_OPENSSL_BIN:-openssl} req -noout -text -in &quot;$_csrfile&quot;)&quot;
  _debug2 _outcsr &quot;$_outcsr&quot;
  if _contains &quot;$_outcsr&quot; &quot;Public Key Algorithm: id-ecPublicKey&quot;; then
    _debug &quot;ECC CSR&quot;
    echo &quot;$_outcsr&quot; | tr &quot;\t&quot; &quot; &quot; | _egrep_o &quot;^ *ASN1 OID:.*&quot; | cut -d ':' -f 2 | tr -d ' '
  else
    _debug &quot;RSA CSR&quot;
    _rkl=&quot;$(echo &quot;$_outcsr&quot; | tr &quot;\t&quot; &quot; &quot; | _egrep_o &quot;^ *Public.Key:.*&quot; | cut -d '(' -f 2 | cut -d ' ' -f 1)&quot;
    if [ &quot;$_rkl&quot; ]; then
      echo &quot;$_rkl&quot;
    else
      echo &quot;$_outcsr&quot; | tr &quot;\t&quot; &quot; &quot; | _egrep_o &quot;RSA Public.Key:.*&quot; | cut -d '(' -f 2 | cut -d ' ' -f 1
    fi
  fi
}

_ss() {
  _port=&quot;$1&quot;

  if _exists &quot;ss&quot;; then
    _debug &quot;Using: ss&quot;
    ss -ntpl 2&gt;/dev/null | grep &quot;:$_port &quot;
    return 0
  fi

  if _exists &quot;netstat&quot;; then
    _debug &quot;Using: netstat&quot;
    if netstat -help 2&gt;&amp;1 | grep &quot;\-p proto&quot; &gt;/dev/null; then
      #for windows version netstat tool
      netstat -an -p tcp | grep &quot;LISTENING&quot; | grep &quot;:$_port &quot;
    else
      if netstat -help 2&gt;&amp;1 | grep &quot;\-p protocol&quot; &gt;/dev/null; then
        netstat -an -p tcp | grep LISTEN | grep &quot;:$_port &quot;
      elif netstat -help 2&gt;&amp;1 | grep -- '-P protocol' &gt;/dev/null; then
        #for solaris
        netstat -an -P tcp | grep &quot;\.$_port &quot; | grep &quot;LISTEN&quot;
      elif netstat -help 2&gt;&amp;1 | grep &quot;\-p&quot; &gt;/dev/null; then
        #for full linux
        netstat -ntpl | grep &quot;:$_port &quot;
      else
        #for busybox (embedded linux; no pid support)
        netstat -ntl 2&gt;/dev/null | grep &quot;:$_port &quot;
      fi
    fi
    return 0
  fi

  return 1
}

#outfile key cert cacert [password [name [caname]]]
_toPkcs() {
  _cpfx=&quot;$1&quot;
  _ckey=&quot;$2&quot;
  _ccert=&quot;$3&quot;
  _cca=&quot;$4&quot;
  pfxPassword=&quot;$5&quot;
  pfxName=&quot;$6&quot;
  pfxCaname=&quot;$7&quot;

  if [ &quot;$pfxCaname&quot; ]; then
    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out &quot;$_cpfx&quot; -inkey &quot;$_ckey&quot; -in &quot;$_ccert&quot; -certfile &quot;$_cca&quot; -password &quot;pass:$pfxPassword&quot; -name &quot;$pfxName&quot; -caname &quot;$pfxCaname&quot;
  elif [ &quot;$pfxName&quot; ]; then
    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out &quot;$_cpfx&quot; -inkey &quot;$_ckey&quot; -in &quot;$_ccert&quot; -certfile &quot;$_cca&quot; -password &quot;pass:$pfxPassword&quot; -name &quot;$pfxName&quot;
  elif [ &quot;$pfxPassword&quot; ]; then
    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out &quot;$_cpfx&quot; -inkey &quot;$_ckey&quot; -in &quot;$_ccert&quot; -certfile &quot;$_cca&quot; -password &quot;pass:$pfxPassword&quot;
  else
    ${ACME_OPENSSL_BIN:-openssl} pkcs12 -export -out &quot;$_cpfx&quot; -inkey &quot;$_ckey&quot; -in &quot;$_ccert&quot; -certfile &quot;$_cca&quot;
  fi

}

#domain [password] [isEcc]
toPkcs() {
  domain=&quot;$1&quot;
  pfxPassword=&quot;$2&quot;
  if [ -z &quot;$domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --toPkcs -d domain [--password pfx-password]&quot;
    return 1
  fi

  _isEcc=&quot;$3&quot;

  _initpath &quot;$domain&quot; &quot;$_isEcc&quot;

  _toPkcs &quot;$CERT_PFX_PATH&quot; &quot;$CERT_KEY_PATH&quot; &quot;$CERT_PATH&quot; &quot;$CA_CERT_PATH&quot; &quot;$pfxPassword&quot;

  if [ &quot;$?&quot; = &quot;0&quot; ]; then
    _info &quot;Success, Pfx is exported to: $CERT_PFX_PATH&quot;
  fi

}

#domain [isEcc]
toPkcs8() {
  domain=&quot;$1&quot;

  if [ -z &quot;$domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --toPkcs8 -d domain [--ecc]&quot;
    return 1
  fi

  _isEcc=&quot;$2&quot;

  _initpath &quot;$domain&quot; &quot;$_isEcc&quot;

  ${ACME_OPENSSL_BIN:-openssl} pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in &quot;$CERT_KEY_PATH&quot; -out &quot;$CERT_PKCS8_PATH&quot;

  if [ &quot;$?&quot; = &quot;0&quot; ]; then
    _info &quot;Success, $CERT_PKCS8_PATH&quot;
  fi

}

#[2048]
createAccountKey() {
  _info &quot;Creating account key&quot;
  if [ -z &quot;$1&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --createAccountKey --accountkeylength 2048&quot;
    return
  fi

  length=$1
  _create_account_key &quot;$length&quot;

}

_create_account_key() {

  length=$1

  if [ -z &quot;$length&quot; ] || [ &quot;$length&quot; = &quot;$NO_VALUE&quot; ]; then
    _debug &quot;Use default length $DEFAULT_ACCOUNT_KEY_LENGTH&quot;
    length=&quot;$DEFAULT_ACCOUNT_KEY_LENGTH&quot;
  fi

  _debug length &quot;$length&quot;
  _initpath

  mkdir -p &quot;$CA_DIR&quot;
  if [ -s &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    _info &quot;Account key exists, skip&quot;
    return 0
  else
    #generate account key
    if _createkey &quot;$length&quot; &quot;$ACCOUNT_KEY_PATH&quot;; then
      chmod 600 &quot;$ACCOUNT_KEY_PATH&quot;
      _info &quot;Create account key ok.&quot;
      return 0
    else
      _err &quot;Create account key error.&quot;
      return 1
    fi
  fi

}

#domain [length]
createDomainKey() {
  _info &quot;Creating domain key&quot;
  if [ -z &quot;$1&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --createDomainKey -d domain.com  [ --keylength 2048 ]&quot;
    return
  fi

  domain=$1
  _cdl=$2

  if [ -z &quot;$_cdl&quot; ]; then
    _debug &quot;Use DEFAULT_DOMAIN_KEY_LENGTH=$DEFAULT_DOMAIN_KEY_LENGTH&quot;
    _cdl=&quot;$DEFAULT_DOMAIN_KEY_LENGTH&quot;
  fi

  _initpath &quot;$domain&quot; &quot;$_cdl&quot;

  if [ ! -f &quot;$CERT_KEY_PATH&quot; ] || [ ! -s &quot;$CERT_KEY_PATH&quot; ] || ([ &quot;$FORCE&quot; ] &amp;&amp; ! [ &quot;$IS_RENEW&quot; ]) || [ &quot;$Le_ForceNewDomainKey&quot; = &quot;1&quot; ]; then
    if _createkey &quot;$_cdl&quot; &quot;$CERT_KEY_PATH&quot;; then
      _savedomainconf Le_Keylength &quot;$_cdl&quot;
      _info &quot;The domain key is here: $(__green $CERT_KEY_PATH)&quot;
      return 0
    else
      _err &quot;Can not create domain key&quot;
      return 1
    fi
  else
    if [ &quot;$IS_RENEW&quot; ]; then
      _info &quot;Domain key exists, skip&quot;
      return 0
    else
      _err &quot;Domain key exists, do you want to overwrite the key?&quot;
      _err &quot;Add '--force', and try again.&quot;
      return 1
    fi
  fi

}

# domain  domainlist isEcc
createCSR() {
  _info &quot;Creating csr&quot;
  if [ -z &quot;$1&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --createCSR -d domain1.com [-d domain2.com  -d domain3.com ... ]&quot;
    return
  fi

  domain=&quot;$1&quot;
  domainlist=&quot;$2&quot;
  _isEcc=&quot;$3&quot;

  _initpath &quot;$domain&quot; &quot;$_isEcc&quot;

  if [ -f &quot;$CSR_PATH&quot; ] &amp;&amp; [ &quot;$IS_RENEW&quot; ] &amp;&amp; [ -z &quot;$FORCE&quot; ]; then
    _info &quot;CSR exists, skip&quot;
    return
  fi

  if [ ! -f &quot;$CERT_KEY_PATH&quot; ]; then
    _err &quot;The key file is not found: $CERT_KEY_PATH&quot;
    _err &quot;Please create the key file first.&quot;
    return 1
  fi
  _createcsr &quot;$domain&quot; &quot;$domainlist&quot; &quot;$CERT_KEY_PATH&quot; &quot;$CSR_PATH&quot; &quot;$DOMAIN_SSL_CONF&quot;

}

_url_replace() {
  tr '/+' '_-' | tr -d '= '
}

_time2str() {
  #BSD
  if date -u -r &quot;$1&quot; 2&gt;/dev/null; then
    return
  fi

  #Linux
  if date -u -d@&quot;$1&quot; 2&gt;/dev/null; then
    return
  fi

  #Solaris
  if _exists adb; then
    _t_s_a=$(echo &quot;0t${1}=Y&quot; | adb)
    echo &quot;$_t_s_a&quot;
  fi

  #Busybox
  if echo &quot;$1&quot; | awk '{ print strftime(&quot;%c&quot;, $0); }' 2&gt;/dev/null; then
    return
  fi
}

_normalizeJson() {
  sed &quot;s/\&quot; *: *\([\&quot;{\[]\)/\&quot;:\1/g&quot; | sed &quot;s/^ *\([^ ]\)/\1/&quot; | tr -d &quot;\r\n&quot;
}

_stat() {
  #Linux
  if stat -c '%U:%G' &quot;$1&quot; 2&gt;/dev/null; then
    return
  fi

  #BSD
  if stat -f '%Su:%Sg' &quot;$1&quot; 2&gt;/dev/null; then
    return
  fi

  return 1 #error, 'stat' not found
}

#keyfile
_calcjwk() {
  keyfile=&quot;$1&quot;
  if [ -z &quot;$keyfile&quot; ]; then
    _usage &quot;Usage: _calcjwk keyfile&quot;
    return 1
  fi

  if [ &quot;$JWK_HEADER&quot; ] &amp;&amp; [ &quot;$__CACHED_JWK_KEY_FILE&quot; = &quot;$keyfile&quot; ]; then
    _debug2 &quot;Use cached jwk for file: $__CACHED_JWK_KEY_FILE&quot;
    return 0
  fi

  if grep &quot;BEGIN RSA PRIVATE KEY&quot; &quot;$keyfile&quot; &gt;/dev/null 2&gt;&amp;1; then
    _debug &quot;RSA key&quot;
    pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in &quot;$keyfile&quot; -noout -text | grep &quot;^publicExponent:&quot; | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
    if [ &quot;${#pub_exp}&quot; = &quot;5&quot; ]; then
      pub_exp=0$pub_exp
    fi
    _debug3 pub_exp &quot;$pub_exp&quot;

    e=$(echo &quot;$pub_exp&quot; | _h2b | _base64)
    _debug3 e &quot;$e&quot;

    modulus=$(${ACME_OPENSSL_BIN:-openssl} rsa -in &quot;$keyfile&quot; -modulus -noout | cut -d '=' -f 2)
    _debug3 modulus &quot;$modulus&quot;
    n=&quot;$(printf &quot;%s&quot; &quot;$modulus&quot; | _h2b | _base64 | _url_replace)&quot;
    _debug3 n &quot;$n&quot;

    jwk='{&quot;e&quot;: &quot;'$e'&quot;, &quot;kty&quot;: &quot;RSA&quot;, &quot;n&quot;: &quot;'$n'&quot;}'
    _debug3 jwk &quot;$jwk&quot;

    JWK_HEADER='{&quot;alg&quot;: &quot;RS256&quot;, &quot;jwk&quot;: '$jwk'}'
    JWK_HEADERPLACE_PART1='{&quot;nonce&quot;: &quot;'
    JWK_HEADERPLACE_PART2='&quot;, &quot;alg&quot;: &quot;RS256&quot;'
  elif grep &quot;BEGIN EC PRIVATE KEY&quot; &quot;$keyfile&quot; &gt;/dev/null 2&gt;&amp;1; then
    _debug &quot;EC key&quot;
    crv=&quot;$(${ACME_OPENSSL_BIN:-openssl} ec -in &quot;$keyfile&quot; -noout -text 2&gt;/dev/null | grep &quot;^NIST CURVE:&quot; | cut -d &quot;:&quot; -f 2 | tr -d &quot; \r\n&quot;)&quot;
    _debug3 crv &quot;$crv&quot;
    __ECC_KEY_LEN=$(echo &quot;$crv&quot; | cut -d &quot;-&quot; -f 2)
    if [ &quot;$__ECC_KEY_LEN&quot; = &quot;521&quot; ]; then
      __ECC_KEY_LEN=512
    fi
    _debug3 __ECC_KEY_LEN &quot;$__ECC_KEY_LEN&quot;
    if [ -z &quot;$crv&quot; ]; then
      _debug &quot;Let's try ASN1 OID&quot;
      crv_oid=&quot;$(${ACME_OPENSSL_BIN:-openssl} ec -in &quot;$keyfile&quot; -noout -text 2&gt;/dev/null | grep &quot;^ASN1 OID:&quot; | cut -d &quot;:&quot; -f 2 | tr -d &quot; \r\n&quot;)&quot;
      _debug3 crv_oid &quot;$crv_oid&quot;
      case &quot;${crv_oid}&quot; in
        &quot;prime256v1&quot;)
          crv=&quot;P-256&quot;
          __ECC_KEY_LEN=256
          ;;
        &quot;secp384r1&quot;)
          crv=&quot;P-384&quot;
          __ECC_KEY_LEN=384
          ;;
        &quot;secp521r1&quot;)
          crv=&quot;P-521&quot;
          __ECC_KEY_LEN=512
          ;;
        *)
          _err &quot;ECC oid : $crv_oid&quot;
          return 1
          ;;
      esac
      _debug3 crv &quot;$crv&quot;
    fi

    pubi=&quot;$(${ACME_OPENSSL_BIN:-openssl} ec -in &quot;$keyfile&quot; -noout -text 2&gt;/dev/null | grep -n pub: | cut -d : -f 1)&quot;
    pubi=$(_math &quot;$pubi&quot; + 1)
    _debug3 pubi &quot;$pubi&quot;

    pubj=&quot;$(${ACME_OPENSSL_BIN:-openssl} ec -in &quot;$keyfile&quot; -noout -text 2&gt;/dev/null | grep -n &quot;ASN1 OID:&quot; | cut -d : -f 1)&quot;
    pubj=$(_math &quot;$pubj&quot; - 1)
    _debug3 pubj &quot;$pubj&quot;

    pubtext=&quot;$(${ACME_OPENSSL_BIN:-openssl} ec -in &quot;$keyfile&quot; -noout -text 2&gt;/dev/null | sed -n &quot;$pubi,${pubj}p&quot; | tr -d &quot; \n\r&quot;)&quot;
    _debug3 pubtext &quot;$pubtext&quot;

    xlen=&quot;$(printf &quot;%s&quot; &quot;$pubtext&quot; | tr -d ':' | wc -c)&quot;
    xlen=$(_math &quot;$xlen&quot; / 4)
    _debug3 xlen &quot;$xlen&quot;

    xend=$(_math &quot;$xlen&quot; + 1)
    x=&quot;$(printf &quot;%s&quot; &quot;$pubtext&quot; | cut -d : -f 2-&quot;$xend&quot;)&quot;
    _debug3 x &quot;$x&quot;

    x64=&quot;$(printf &quot;%s&quot; &quot;$x&quot; | tr -d : | _h2b | _base64 | _url_replace)&quot;
    _debug3 x64 &quot;$x64&quot;

    xend=$(_math &quot;$xend&quot; + 1)
    y=&quot;$(printf &quot;%s&quot; &quot;$pubtext&quot; | cut -d : -f &quot;$xend&quot;-10000)&quot;
    _debug3 y &quot;$y&quot;

    y64=&quot;$(printf &quot;%s&quot; &quot;$y&quot; | tr -d : | _h2b | _base64 | _url_replace)&quot;
    _debug3 y64 &quot;$y64&quot;

    jwk='{&quot;crv&quot;: &quot;'$crv'&quot;, &quot;kty&quot;: &quot;EC&quot;, &quot;x&quot;: &quot;'$x64'&quot;, &quot;y&quot;: &quot;'$y64'&quot;}'
    _debug3 jwk &quot;$jwk&quot;

    JWK_HEADER='{&quot;alg&quot;: &quot;ES'$__ECC_KEY_LEN'&quot;, &quot;jwk&quot;: '$jwk'}'
    JWK_HEADERPLACE_PART1='{&quot;nonce&quot;: &quot;'
    JWK_HEADERPLACE_PART2='&quot;, &quot;alg&quot;: &quot;ES'$__ECC_KEY_LEN'&quot;'
  else
    _err &quot;Only RSA or EC key is supported. keyfile=$keyfile&quot;
    _debug2 &quot;$(cat &quot;$keyfile&quot;)&quot;
    return 1
  fi

  _debug3 JWK_HEADER &quot;$JWK_HEADER&quot;
  __CACHED_JWK_KEY_FILE=&quot;$keyfile&quot;
}

_time() {
  date -u &quot;+%s&quot;
}

_utc_date() {
  date -u &quot;+%Y-%m-%d %H:%M:%S&quot;
}

_mktemp() {
  if _exists mktemp; then
    if mktemp 2&gt;/dev/null; then
      return 0
    elif _contains &quot;$(mktemp 2&gt;&amp;1)&quot; &quot;-t prefix&quot; &amp;&amp; mktemp -t &quot;$PROJECT_NAME&quot; 2&gt;/dev/null; then
      #for Mac osx
      return 0
    fi
  fi
  if [ -d &quot;/tmp&quot; ]; then
    echo &quot;/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp&quot;
    return 0
  elif [ &quot;$LE_TEMP_DIR&quot; ] &amp;&amp; mkdir -p &quot;$LE_TEMP_DIR&quot;; then
    echo &quot;/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp&quot;
    return 0
  fi
  _err &quot;Can not create temp file.&quot;
}

_inithttp() {

  if [ -z &quot;$HTTP_HEADER&quot; ] || ! touch &quot;$HTTP_HEADER&quot;; then
    HTTP_HEADER=&quot;$(_mktemp)&quot;
    _debug2 HTTP_HEADER &quot;$HTTP_HEADER&quot;
  fi

  if [ &quot;$__HTTP_INITIALIZED&quot; ]; then
    if [ &quot;$_ACME_CURL$_ACME_WGET&quot; ]; then
      _debug2 &quot;Http already initialized.&quot;
      return 0
    fi
  fi

  if [ -z &quot;$_ACME_CURL&quot; ] &amp;&amp; _exists &quot;curl&quot;; then
    _ACME_CURL=&quot;curl -L --silent --dump-header $HTTP_HEADER &quot;
    if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -ge &quot;2&quot; ]; then
      _CURL_DUMP=&quot;$(_mktemp)&quot;
      _ACME_CURL=&quot;$_ACME_CURL --trace-ascii $_CURL_DUMP &quot;
    fi

    if [ &quot;$CA_PATH&quot; ]; then
      _ACME_CURL=&quot;$_ACME_CURL --capath $CA_PATH &quot;
    elif [ &quot;$CA_BUNDLE&quot; ]; then
      _ACME_CURL=&quot;$_ACME_CURL --cacert $CA_BUNDLE &quot;
    fi

    if _contains &quot;$(curl --help 2&gt;&amp;1)&quot; &quot;--globoff&quot;; then
      _ACME_CURL=&quot;$_ACME_CURL -g &quot;
    fi
  fi

  if [ -z &quot;$_ACME_WGET&quot; ] &amp;&amp; _exists &quot;wget&quot;; then
    _ACME_WGET=&quot;wget -q&quot;
    if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -ge &quot;2&quot; ]; then
      _ACME_WGET=&quot;$_ACME_WGET -d &quot;
    fi
    if [ &quot;$CA_PATH&quot; ]; then
      _ACME_WGET=&quot;$_ACME_WGET --ca-directory=$CA_PATH &quot;
    elif [ &quot;$CA_BUNDLE&quot; ]; then
      _ACME_WGET=&quot;$_ACME_WGET --ca-certificate=$CA_BUNDLE &quot;
    fi
  fi

  #from wget 1.14: do not skip body on 404 error
  if [ &quot;$_ACME_WGET&quot; ] &amp;&amp; _contains &quot;$($_ACME_WGET --help 2&gt;&amp;1)&quot; &quot;--content-on-error&quot;; then
    _ACME_WGET=&quot;$_ACME_WGET --content-on-error &quot;
  fi

  __HTTP_INITIALIZED=1

}

# body  url [needbase64] [POST|PUT|DELETE] [ContentType]
_post() {
  body=&quot;$1&quot;
  _post_url=&quot;$2&quot;
  needbase64=&quot;$3&quot;
  httpmethod=&quot;$4&quot;
  _postContentType=&quot;$5&quot;

  if [ -z &quot;$httpmethod&quot; ]; then
    httpmethod=&quot;POST&quot;
  fi
  _debug $httpmethod
  _debug &quot;_post_url&quot; &quot;$_post_url&quot;
  _debug2 &quot;body&quot; &quot;$body&quot;
  _debug2 &quot;_postContentType&quot; &quot;$_postContentType&quot;

  _inithttp

  if [ &quot;$_ACME_CURL&quot; ] &amp;&amp; [ &quot;${ACME_USE_WGET:-0}&quot; = &quot;0&quot; ]; then
    _CURL=&quot;$_ACME_CURL&quot;
    if [ &quot;$HTTPS_INSECURE&quot; ]; then
      _CURL=&quot;$_CURL --insecure  &quot;
    fi
    if [ &quot;$httpmethod&quot; = &quot;HEAD&quot; ]; then
      _CURL=&quot;$_CURL -I  &quot;
    fi
    _debug &quot;_CURL&quot; &quot;$_CURL&quot;
    if [ &quot;$needbase64&quot; ]; then
      if [ &quot;$body&quot; ]; then
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;Content-Type: $_postContentType&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; --data &quot;$body&quot; &quot;$_post_url&quot; | _base64)&quot;
        else
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; --data &quot;$body&quot; &quot;$_post_url&quot; | _base64)&quot;
        fi
      else
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;Content-Type: $_postContentType&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$_post_url&quot; | _base64)&quot;
        else
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$_post_url&quot; | _base64)&quot;
        fi
      fi
    else
      if [ &quot;$body&quot; ]; then
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;Content-Type: $_postContentType&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; --data &quot;$body&quot; &quot;$_post_url&quot;)&quot;
        else
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; --data &quot;$body&quot; &quot;$_post_url&quot;)&quot;
        fi
      else
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;Content-Type: $_postContentType&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$_post_url&quot;)&quot;
        else
          response=&quot;$($_CURL --user-agent &quot;$USER_AGENT&quot; -X $httpmethod -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$_post_url&quot;)&quot;
        fi
      fi
    fi
    _ret=&quot;$?&quot;
    if [ &quot;$_ret&quot; != &quot;0&quot; ]; then
      _err &quot;Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret&quot;
      if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -ge &quot;2&quot; ]; then
        _err &quot;Here is the curl dump log:&quot;
        _err &quot;$(cat &quot;$_CURL_DUMP&quot;)&quot;
      fi
    fi
  elif [ &quot;$_ACME_WGET&quot; ]; then
    _WGET=&quot;$_ACME_WGET&quot;
    if [ &quot;$HTTPS_INSECURE&quot; ]; then
      _WGET=&quot;$_WGET --no-check-certificate &quot;
    fi
    if [ &quot;$httpmethod&quot; = &quot;HEAD&quot; ]; then
      _WGET=&quot;$_WGET --read-timeout=3.0  --tries=2  &quot;
    fi
    _debug &quot;_WGET&quot; &quot;$_WGET&quot;
    if [ &quot;$needbase64&quot; ]; then
      if [ &quot;$httpmethod&quot; = &quot;POST&quot; ]; then
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --header &quot;Content-Type: $_postContentType&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot; | _base64)&quot;
        else
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot; | _base64)&quot;
        fi
      else
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --header &quot;Content-Type: $_postContentType&quot; --method $httpmethod --body-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot; | _base64)&quot;
        else
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --method $httpmethod --body-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot; | _base64)&quot;
        fi
      fi
    else
      if [ &quot;$httpmethod&quot; = &quot;POST&quot; ]; then
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --header &quot;Content-Type: $_postContentType&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        else
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        fi
      elif [ &quot;$httpmethod&quot; = &quot;HEAD&quot; ]; then
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_WGET --spider -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --header &quot;Content-Type: $_postContentType&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        else
          response=&quot;$($_WGET --spider -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --post-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        fi
      else
        if [ &quot;$_postContentType&quot; ]; then
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --header &quot;Content-Type: $_postContentType&quot; --method $httpmethod --body-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        else
          response=&quot;$($_WGET -S -O - --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; --method $httpmethod --body-data=&quot;$body&quot; &quot;$_post_url&quot; 2&gt;&quot;$HTTP_HEADER&quot;)&quot;
        fi
      fi
    fi
    _ret=&quot;$?&quot;
    if [ &quot;$_ret&quot; = &quot;8&quot; ]; then
      _ret=0
      _debug &quot;wget returns 8, the server returns a 'Bad request' response, lets process the response later.&quot;
    fi
    if [ &quot;$_ret&quot; != &quot;0&quot; ]; then
      _err &quot;Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret&quot;
    fi
    _sed_i &quot;s/^ *//g&quot; &quot;$HTTP_HEADER&quot;
  else
    _ret=&quot;$?&quot;
    _err &quot;Neither curl nor wget is found, can not do $httpmethod.&quot;
  fi
  _debug &quot;_ret&quot; &quot;$_ret&quot;
  printf &quot;%s&quot; &quot;$response&quot;
  return $_ret
}

# url getheader timeout
_get() {
  _debug GET
  url=&quot;$1&quot;
  onlyheader=&quot;$2&quot;
  t=&quot;$3&quot;
  _debug url &quot;$url&quot;
  _debug &quot;timeout=$t&quot;

  _inithttp

  if [ &quot;$_ACME_CURL&quot; ] &amp;&amp; [ &quot;${ACME_USE_WGET:-0}&quot; = &quot;0&quot; ]; then
    _CURL=&quot;$_ACME_CURL&quot;
    if [ &quot;$HTTPS_INSECURE&quot; ]; then
      _CURL=&quot;$_CURL --insecure  &quot;
    fi
    if [ &quot;$t&quot; ]; then
      _CURL=&quot;$_CURL --connect-timeout $t&quot;
    fi
    _debug &quot;_CURL&quot; &quot;$_CURL&quot;
    if [ &quot;$onlyheader&quot; ]; then
      $_CURL -I --user-agent &quot;$USER_AGENT&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$url&quot;
    else
      $_CURL --user-agent &quot;$USER_AGENT&quot; -H &quot;$_H1&quot; -H &quot;$_H2&quot; -H &quot;$_H3&quot; -H &quot;$_H4&quot; -H &quot;$_H5&quot; &quot;$url&quot;
    fi
    ret=$?
    if [ &quot;$ret&quot; != &quot;0&quot; ]; then
      _err &quot;Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret&quot;
      if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -ge &quot;2&quot; ]; then
        _err &quot;Here is the curl dump log:&quot;
        _err &quot;$(cat &quot;$_CURL_DUMP&quot;)&quot;
      fi
    fi
  elif [ &quot;$_ACME_WGET&quot; ]; then
    _WGET=&quot;$_ACME_WGET&quot;
    if [ &quot;$HTTPS_INSECURE&quot; ]; then
      _WGET=&quot;$_WGET --no-check-certificate &quot;
    fi
    if [ &quot;$t&quot; ]; then
      _WGET=&quot;$_WGET --timeout=$t&quot;
    fi
    _debug &quot;_WGET&quot; &quot;$_WGET&quot;
    if [ &quot;$onlyheader&quot; ]; then
      $_WGET --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; -S -O /dev/null &quot;$url&quot; 2&gt;&amp;1 | sed 's/^[ ]*//g'
    else
      $_WGET --user-agent=&quot;$USER_AGENT&quot; --header &quot;$_H5&quot; --header &quot;$_H4&quot; --header &quot;$_H3&quot; --header &quot;$_H2&quot; --header &quot;$_H1&quot; -O - &quot;$url&quot;
    fi
    ret=$?
    if [ &quot;$ret&quot; = &quot;8&quot; ]; then
      ret=0
      _debug &quot;wget returns 8, the server returns a 'Bad request' response, lets process the response later.&quot;
    fi
    if [ &quot;$ret&quot; != &quot;0&quot; ]; then
      _err &quot;Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret&quot;
    fi
  else
    ret=$?
    _err &quot;Neither curl nor wget is found, can not do GET.&quot;
  fi
  _debug &quot;ret&quot; &quot;$ret&quot;
  return $ret
}

_head_n() {
  head -n &quot;$1&quot;
}

_tail_n() {
  if ! tail -n &quot;$1&quot; 2&gt;/dev/null; then
    #fix for solaris
    tail -&quot;$1&quot;
  fi
}

# url  payload needbase64  keyfile
_send_signed_request() {
  url=$1
  payload=$2
  needbase64=$3
  keyfile=$4
  if [ -z &quot;$keyfile&quot; ]; then
    keyfile=&quot;$ACCOUNT_KEY_PATH&quot;
  fi
  _debug url &quot;$url&quot;
  _debug payload &quot;$payload&quot;

  if ! _calcjwk &quot;$keyfile&quot;; then
    return 1
  fi

  __request_conent_type=&quot;$CONTENT_TYPE_JSON&quot;

  payload64=$(printf &quot;%s&quot; &quot;$payload&quot; | _base64 | _url_replace)
  _debug3 payload64 &quot;$payload64&quot;

  MAX_REQUEST_RETRY_TIMES=20
  _sleep_retry_sec=1
  _request_retry_times=0
  while [ &quot;${_request_retry_times}&quot; -lt &quot;$MAX_REQUEST_RETRY_TIMES&quot; ]; do
    _request_retry_times=$(_math &quot;$_request_retry_times&quot; + 1)
    _debug3 _request_retry_times &quot;$_request_retry_times&quot;
    if [ -z &quot;$_CACHED_NONCE&quot; ]; then
      _headers=&quot;&quot;
      if [ &quot;$ACME_NEW_NONCE&quot; ]; then
        _debug2 &quot;Get nonce with HEAD. ACME_NEW_NONCE&quot; &quot;$ACME_NEW_NONCE&quot;
        nonceurl=&quot;$ACME_NEW_NONCE&quot;
        if _post &quot;&quot; &quot;$nonceurl&quot; &quot;&quot; &quot;HEAD&quot; &quot;$__request_conent_type&quot; &gt;/dev/null; then
          _headers=&quot;$(cat &quot;$HTTP_HEADER&quot;)&quot;
          _debug2 _headers &quot;$_headers&quot;
          _CACHED_NONCE=&quot;$(echo &quot;$_headers&quot; | grep -i &quot;Replay-Nonce:&quot; | _head_n 1 | tr -d &quot;\r\n &quot; | cut -d ':' -f 2)&quot;
        fi
      fi
      if [ -z &quot;$_CACHED_NONCE&quot; ]; then
        _debug2 &quot;Get nonce with GET. ACME_DIRECTORY&quot; &quot;$ACME_DIRECTORY&quot;
        nonceurl=&quot;$ACME_DIRECTORY&quot;
        _headers=&quot;$(_get &quot;$nonceurl&quot; &quot;onlyheader&quot;)&quot;
        _debug2 _headers &quot;$_headers&quot;
        _CACHED_NONCE=&quot;$(echo &quot;$_headers&quot; | grep -i &quot;Replay-Nonce:&quot; | _head_n 1 | tr -d &quot;\r\n &quot; | cut -d ':' -f 2)&quot;
      fi
      if [ -z &quot;$_CACHED_NONCE&quot; ] &amp;&amp; [ &quot;$ACME_NEW_NONCE&quot; ]; then
        _debug2 &quot;Get nonce with GET. ACME_NEW_NONCE&quot; &quot;$ACME_NEW_NONCE&quot;
        nonceurl=&quot;$ACME_NEW_NONCE&quot;
        _headers=&quot;$(_get &quot;$nonceurl&quot; &quot;onlyheader&quot;)&quot;
        _debug2 _headers &quot;$_headers&quot;
        _CACHED_NONCE=&quot;$(echo &quot;$_headers&quot; | grep -i &quot;Replay-Nonce:&quot; | _head_n 1 | tr -d &quot;\r\n &quot; | cut -d ':' -f 2)&quot;
      fi
      _debug2 _CACHED_NONCE &quot;$_CACHED_NONCE&quot;
      if [ &quot;$?&quot; != &quot;0&quot; ]; then
        _err &quot;Can not connect to $nonceurl to get nonce.&quot;
        return 1
      fi
    else
      _debug2 &quot;Use _CACHED_NONCE&quot; &quot;$_CACHED_NONCE&quot;
    fi
    nonce=&quot;$_CACHED_NONCE&quot;
    _debug2 nonce &quot;$nonce&quot;
    if [ -z &quot;$nonce&quot; ]; then
      _info &quot;Could not get nonce, let's try again.&quot;
      _sleep 2
      continue
    fi
    if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
      if [ &quot;$url&quot; = &quot;$ACME_NEW_ACCOUNT&quot; ] || [ &quot;$url&quot; = &quot;$ACME_REVOKE_CERT&quot; ]; then
        protected=&quot;$JWK_HEADERPLACE_PART1$nonce\&quot;, \&quot;url\&quot;: \&quot;${url}$JWK_HEADERPLACE_PART2, \&quot;jwk\&quot;: $jwk&quot;'}'
      else
        protected=&quot;$JWK_HEADERPLACE_PART1$nonce\&quot;, \&quot;url\&quot;: \&quot;${url}$JWK_HEADERPLACE_PART2, \&quot;kid\&quot;: \&quot;${ACCOUNT_URL}\&quot;&quot;'}'
      fi
    else
      protected=&quot;$JWK_HEADERPLACE_PART1$nonce\&quot;, \&quot;url\&quot;: \&quot;${url}$JWK_HEADERPLACE_PART2, \&quot;jwk\&quot;: $jwk&quot;'}'
    fi
    _debug3 protected &quot;$protected&quot;

    protected64=&quot;$(printf &quot;%s&quot; &quot;$protected&quot; | _base64 | _url_replace)&quot;
    _debug3 protected64 &quot;$protected64&quot;

    if ! _sig_t=&quot;$(printf &quot;%s&quot; &quot;$protected64.$payload64&quot; | _sign &quot;$keyfile&quot; &quot;sha256&quot;)&quot;; then
      _err &quot;Sign request failed.&quot;
      return 1
    fi
    _debug3 _sig_t &quot;$_sig_t&quot;

    sig=&quot;$(printf &quot;%s&quot; &quot;$_sig_t&quot; | _url_replace)&quot;
    _debug3 sig &quot;$sig&quot;

    body=&quot;{\&quot;protected\&quot;: \&quot;$protected64\&quot;, \&quot;payload\&quot;: \&quot;$payload64\&quot;, \&quot;signature\&quot;: \&quot;$sig\&quot;}&quot;
    _debug3 body &quot;$body&quot;

    response=&quot;$(_post &quot;$body&quot; &quot;$url&quot; &quot;$needbase64&quot; &quot;POST&quot; &quot;$__request_conent_type&quot;)&quot;
    _CACHED_NONCE=&quot;&quot;

    if [ &quot;$?&quot; != &quot;0&quot; ]; then
      _err &quot;Can not post to $url&quot;
      return 1
    fi

    responseHeaders=&quot;$(cat &quot;$HTTP_HEADER&quot;)&quot;
    _debug2 responseHeaders &quot;$responseHeaders&quot;

    code=&quot;$(grep &quot;^HTTP&quot; &quot;$HTTP_HEADER&quot; | _tail_n 1 | cut -d &quot; &quot; -f 2 | tr -d &quot;\r\n&quot;)&quot;
    _debug code &quot;$code&quot;

    _debug2 original &quot;$response&quot;
    if echo &quot;$responseHeaders&quot; | grep -i &quot;Content-Type: *application/json&quot; &gt;/dev/null 2&gt;&amp;1; then
      response=&quot;$(echo &quot;$response&quot; | _normalizeJson)&quot;
    fi
    _debug2 response &quot;$response&quot;

    _CACHED_NONCE=&quot;$(echo &quot;$responseHeaders&quot; | grep -i &quot;Replay-Nonce:&quot; | _head_n 1 | tr -d &quot;\r\n &quot; | cut -d ':' -f 2)&quot;

    if ! _startswith &quot;$code&quot; &quot;2&quot;; then
      _body=&quot;$response&quot;
      if [ &quot;$needbase64&quot; ]; then
        _body=&quot;$(echo &quot;$_body&quot; | _dbase64 multiline)&quot;
        _debug3 _body &quot;$_body&quot;
      fi

      if _contains &quot;$_body&quot; &quot;JWS has invalid anti-replay nonce&quot; || _contains &quot;$_body&quot; &quot;JWS has an invalid anti-replay nonce&quot;; then
        _info &quot;It seems the CA server is busy now, let's wait and retry. Sleeping $_sleep_retry_sec seconds.&quot;
        _CACHED_NONCE=&quot;&quot;
        _sleep $_sleep_retry_sec
        continue
      fi
    fi
    return 0
  done
  _info &quot;Giving up sending to CA server after $MAX_REQUEST_RETRY_TIMES retries.&quot;
  return 1

}

#setopt &quot;file&quot;  &quot;opt&quot;  &quot;=&quot;  &quot;value&quot; [&quot;;&quot;]
_setopt() {
  __conf=&quot;$1&quot;
  __opt=&quot;$2&quot;
  __sep=&quot;$3&quot;
  __val=&quot;$4&quot;
  __end=&quot;$5&quot;
  if [ -z &quot;$__opt&quot; ]; then
    _usage usage: _setopt '&quot;file&quot;  &quot;opt&quot;  &quot;=&quot;  &quot;value&quot; [&quot;;&quot;]'
    return
  fi
  if [ ! -f &quot;$__conf&quot; ]; then
    touch &quot;$__conf&quot;
  fi

  if grep -n &quot;^$__opt$__sep&quot; &quot;$__conf&quot; &gt;/dev/null; then
    _debug3 OK
    if _contains &quot;$__val&quot; &quot;&amp;&quot;; then
      __val=&quot;$(echo &quot;$__val&quot; | sed 's/&amp;/\\&amp;/g')&quot;
    fi
    text=&quot;$(cat &quot;$__conf&quot;)&quot;
    printf -- &quot;%s\n&quot; &quot;$text&quot; | sed &quot;s|^$__opt$__sep.*$|$__opt$__sep$__val$__end|&quot; &gt;&quot;$__conf&quot;

  elif grep -n &quot;^#$__opt$__sep&quot; &quot;$__conf&quot; &gt;/dev/null; then
    if _contains &quot;$__val&quot; &quot;&amp;&quot;; then
      __val=&quot;$(echo &quot;$__val&quot; | sed 's/&amp;/\\&amp;/g')&quot;
    fi
    text=&quot;$(cat &quot;$__conf&quot;)&quot;
    printf -- &quot;%s\n&quot; &quot;$text&quot; | sed &quot;s|^#$__opt$__sep.*$|$__opt$__sep$__val$__end|&quot; &gt;&quot;$__conf&quot;

  else
    _debug3 APP
    echo &quot;$__opt$__sep$__val$__end&quot; &gt;&gt;&quot;$__conf&quot;
  fi
  _debug3 &quot;$(grep -n &quot;^$__opt$__sep&quot; &quot;$__conf&quot;)&quot;
}

#_save_conf  file key  value base64encode
#save to conf
_save_conf() {
  _s_c_f=&quot;$1&quot;
  _sdkey=&quot;$2&quot;
  _sdvalue=&quot;$3&quot;
  _b64encode=&quot;$4&quot;
  if [ &quot;$_sdvalue&quot; ] &amp;&amp; [ &quot;$_b64encode&quot; ]; then
    _sdvalue=&quot;${B64CONF_START}$(printf &quot;%s&quot; &quot;${_sdvalue}&quot; | _base64)${B64CONF_END}&quot;
  fi
  if [ &quot;$_s_c_f&quot; ]; then
    _setopt &quot;$_s_c_f&quot; &quot;$_sdkey&quot; &quot;=&quot; &quot;'$_sdvalue'&quot;
  else
    _err &quot;config file is empty, can not save $_sdkey=$_sdvalue&quot;
  fi
}

#_clear_conf file  key
_clear_conf() {
  _c_c_f=&quot;$1&quot;
  _sdkey=&quot;$2&quot;
  if [ &quot;$_c_c_f&quot; ]; then
    _conf_data=&quot;$(cat &quot;$_c_c_f&quot;)&quot;
    echo &quot;$_conf_data&quot; | sed &quot;s/^$_sdkey *=.*$//&quot; &gt;&quot;$_c_c_f&quot;
  else
    _err &quot;config file is empty, can not clear&quot;
  fi
}

#_read_conf file  key
_read_conf() {
  _r_c_f=&quot;$1&quot;
  _sdkey=&quot;$2&quot;
  if [ -f &quot;$_r_c_f&quot; ]; then
    _sdv=&quot;$(
      eval &quot;$(grep &quot;^$_sdkey *=&quot; &quot;$_r_c_f&quot;)&quot;
      eval &quot;printf \&quot;%s\&quot; \&quot;\$$_sdkey\&quot;&quot;
    )&quot;
    if _startswith &quot;$_sdv&quot; &quot;${B64CONF_START}&quot; &amp;&amp; _endswith &quot;$_sdv&quot; &quot;${B64CONF_END}&quot;; then
      _sdv=&quot;$(echo &quot;$_sdv&quot; | sed &quot;s/${B64CONF_START}//&quot; | sed &quot;s/${B64CONF_END}//&quot; | _dbase64)&quot;
    fi
    printf &quot;%s&quot; &quot;$_sdv&quot;
  else
    _debug &quot;config file is empty, can not read $_sdkey&quot;
  fi
}

#_savedomainconf   key  value  base64encode
#save to domain.conf
_savedomainconf() {
  _save_conf &quot;$DOMAIN_CONF&quot; &quot;$@&quot;
}

#_cleardomainconf   key
_cleardomainconf() {
  _clear_conf &quot;$DOMAIN_CONF&quot; &quot;$1&quot;
}

#_readdomainconf   key
_readdomainconf() {
  _read_conf &quot;$DOMAIN_CONF&quot; &quot;$1&quot;
}

#key  value  base64encode
_savedeployconf() {
  _savedomainconf &quot;SAVED_$1&quot; &quot;$2&quot; &quot;$3&quot;
  #remove later
  _cleardomainconf &quot;$1&quot;
}

#key
_getdeployconf() {
  _rac_key=&quot;$1&quot;
  _rac_value=&quot;$(eval echo \$&quot;$_rac_key&quot;)&quot;
  if [ &quot;$_rac_value&quot; ]; then
    if _startswith &quot;$_rac_value&quot; '&quot;' &amp;&amp; _endswith &quot;$_rac_value&quot; '&quot;'; then
      _debug2 &quot;trim quotation marks&quot;
      eval &quot;export $_rac_key=$_rac_value&quot;
    fi
    return 0 # do nothing
  fi
  _saved=$(_readdomainconf &quot;SAVED_$_rac_key&quot;)
  eval &quot;export $_rac_key=$_saved&quot;
}

#_saveaccountconf  key  value  base64encode
_saveaccountconf() {
  _save_conf &quot;$ACCOUNT_CONF_PATH&quot; &quot;$@&quot;
}

#key  value base64encode
_saveaccountconf_mutable() {
  _save_conf &quot;$ACCOUNT_CONF_PATH&quot; &quot;SAVED_$1&quot; &quot;$2&quot; &quot;$3&quot;
  #remove later
  _clearaccountconf &quot;$1&quot;
}

#key
_readaccountconf() {
  _read_conf &quot;$ACCOUNT_CONF_PATH&quot; &quot;$1&quot;
}

#key
_readaccountconf_mutable() {
  _rac_key=&quot;$1&quot;
  _readaccountconf &quot;SAVED_$_rac_key&quot;
}

#_clearaccountconf   key
_clearaccountconf() {
  _clear_conf &quot;$ACCOUNT_CONF_PATH&quot; &quot;$1&quot;
}

#_savecaconf  key  value
_savecaconf() {
  _save_conf &quot;$CA_CONF&quot; &quot;$1&quot; &quot;$2&quot;
}

#_readcaconf   key
_readcaconf() {
  _read_conf &quot;$CA_CONF&quot; &quot;$1&quot;
}

#_clearaccountconf   key
_clearcaconf() {
  _clear_conf &quot;$CA_CONF&quot; &quot;$1&quot;
}

# content localaddress
_startserver() {
  content=&quot;$1&quot;
  ncaddr=&quot;$2&quot;
  _debug &quot;content&quot; &quot;$content&quot;
  _debug &quot;ncaddr&quot; &quot;$ncaddr&quot;

  _debug &quot;startserver: $$&quot;

  _debug Le_HTTPPort &quot;$Le_HTTPPort&quot;
  _debug Le_Listen_V4 &quot;$Le_Listen_V4&quot;
  _debug Le_Listen_V6 &quot;$Le_Listen_V6&quot;

  _NC=&quot;socat&quot;
  if [ &quot;$Le_Listen_V4&quot; ]; then
    _NC=&quot;$_NC -4&quot;
  elif [ &quot;$Le_Listen_V6&quot; ]; then
    _NC=&quot;$_NC -6&quot;
  fi

  if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -gt &quot;1&quot; ]; then
    _NC=&quot;$_NC -d -d -v&quot;
  fi

  SOCAT_OPTIONS=TCP-LISTEN:$Le_HTTPPort,crlf,reuseaddr,fork

  #Adding bind to local-address
  if [ &quot;$ncaddr&quot; ]; then
    SOCAT_OPTIONS=&quot;$SOCAT_OPTIONS,bind=${ncaddr}&quot;
  fi

  _content_len=&quot;$(printf &quot;%s&quot; &quot;$content&quot; | wc -c)&quot;
  _debug _content_len &quot;$_content_len&quot;
  _debug &quot;_NC&quot; &quot;$_NC $SOCAT_OPTIONS&quot;
  $_NC $SOCAT_OPTIONS SYSTEM:&quot;sleep 1; \
echo 'HTTP/1.0 200 OK'; \
echo 'Content-Length\: $_content_len'; \
echo ''; \
printf -- '$content';&quot; &amp;
  serverproc=&quot;$!&quot;
}

_stopserver() {
  pid=&quot;$1&quot;
  _debug &quot;pid&quot; &quot;$pid&quot;
  if [ -z &quot;$pid&quot; ]; then
    return
  fi

  kill $pid

}

# sleep sec
_sleep() {
  _sleep_sec=&quot;$1&quot;
  if [ &quot;$__INTERACTIVE&quot; ]; then
    _sleep_c=&quot;$_sleep_sec&quot;
    while [ &quot;$_sleep_c&quot; -ge &quot;0&quot; ]; do
      printf &quot;\r      \r&quot;
      __green &quot;$_sleep_c&quot;
      _sleep_c=&quot;$(_math &quot;$_sleep_c&quot; - 1)&quot;
      sleep 1
    done
    printf &quot;\r&quot;
  else
    sleep &quot;$_sleep_sec&quot;
  fi
}

# _starttlsserver  san_a  san_b port content _ncaddr acmeValidationv1
_starttlsserver() {
  _info &quot;Starting tls server.&quot;
  san_a=&quot;$1&quot;
  san_b=&quot;$2&quot;
  port=&quot;$3&quot;
  content=&quot;$4&quot;
  opaddr=&quot;$5&quot;
  acmeValidationv1=&quot;$6&quot;

  _debug san_a &quot;$san_a&quot;
  _debug san_b &quot;$san_b&quot;
  _debug port &quot;$port&quot;
  _debug acmeValidationv1 &quot;$acmeValidationv1&quot;

  #create key TLS_KEY
  if ! _createkey &quot;2048&quot; &quot;$TLS_KEY&quot;; then
    _err &quot;Create tls validation key error.&quot;
    return 1
  fi

  #create csr
  alt=&quot;$san_a&quot;
  if [ &quot;$san_b&quot; ]; then
    alt=&quot;$alt,$san_b&quot;
  fi
  if ! _createcsr &quot;tls.acme.sh&quot; &quot;$alt&quot; &quot;$TLS_KEY&quot; &quot;$TLS_CSR&quot; &quot;$TLS_CONF&quot; &quot;$acmeValidationv1&quot;; then
    _err &quot;Create tls validation csr error.&quot;
    return 1
  fi

  #self signed
  if ! _signcsr &quot;$TLS_KEY&quot; &quot;$TLS_CSR&quot; &quot;$TLS_CONF&quot; &quot;$TLS_CERT&quot;; then
    _err &quot;Create tls validation cert error.&quot;
    return 1
  fi

  __S_OPENSSL=&quot;${ACME_OPENSSL_BIN:-openssl} s_server -www -cert $TLS_CERT  -key $TLS_KEY &quot;
  if [ &quot;$opaddr&quot; ]; then
    __S_OPENSSL=&quot;$__S_OPENSSL -accept $opaddr:$port&quot;
  else
    __S_OPENSSL=&quot;$__S_OPENSSL -accept $port&quot;
  fi

  _debug Le_Listen_V4 &quot;$Le_Listen_V4&quot;
  _debug Le_Listen_V6 &quot;$Le_Listen_V6&quot;
  if [ &quot;$Le_Listen_V4&quot; ]; then
    __S_OPENSSL=&quot;$__S_OPENSSL -4&quot;
  elif [ &quot;$Le_Listen_V6&quot; ]; then
    __S_OPENSSL=&quot;$__S_OPENSSL -6&quot;
  fi

  if [ &quot;$acmeValidationv1&quot; ]; then
    __S_OPENSSL=&quot;$__S_OPENSSL -alpn acme-tls/1&quot;
  fi

  _debug &quot;$__S_OPENSSL&quot;
  if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -ge &quot;2&quot; ]; then
    $__S_OPENSSL -tlsextdebug &amp;
  else
    $__S_OPENSSL &gt;/dev/null 2&gt;&amp;1 &amp;
  fi

  serverproc=&quot;$!&quot;
  sleep 1
  _debug serverproc &quot;$serverproc&quot;
}

#file
_readlink() {
  _rf=&quot;$1&quot;
  if ! readlink -f &quot;$_rf&quot; 2&gt;/dev/null; then
    if _startswith &quot;$_rf&quot; &quot;/&quot;; then
      echo &quot;$_rf&quot;
      return 0
    fi
    echo &quot;$(pwd)/$_rf&quot; | _conapath
  fi
}

_conapath() {
  sed &quot;s#/\./#/#g&quot;
}

__initHome() {
  if [ -z &quot;$_SCRIPT_HOME&quot; ]; then
    if _exists readlink &amp;&amp; _exists dirname; then
      _debug &quot;Lets find script dir.&quot;
      _debug &quot;_SCRIPT_&quot; &quot;$_SCRIPT_&quot;
      _script=&quot;$(_readlink &quot;$_SCRIPT_&quot;)&quot;
      _debug &quot;_script&quot; &quot;$_script&quot;
      _script_home=&quot;$(dirname &quot;$_script&quot;)&quot;
      _debug &quot;_script_home&quot; &quot;$_script_home&quot;
      if [ -d &quot;$_script_home&quot; ]; then
        _SCRIPT_HOME=&quot;$_script_home&quot;
      else
        _err &quot;It seems the script home is not correct:$_script_home&quot;
      fi
    fi
  fi

  #  if [ -z &quot;$LE_WORKING_DIR&quot; ]; then
  #    if [ -f &quot;$DEFAULT_INSTALL_HOME/account.conf&quot; ]; then
  #      _debug &quot;It seems that $PROJECT_NAME is already installed in $DEFAULT_INSTALL_HOME&quot;
  #      LE_WORKING_DIR=&quot;$DEFAULT_INSTALL_HOME&quot;
  #    else
  #      LE_WORKING_DIR=&quot;$_SCRIPT_HOME&quot;
  #    fi
  #  fi

  if [ -z &quot;$LE_WORKING_DIR&quot; ]; then
    _debug &quot;Using default home:$DEFAULT_INSTALL_HOME&quot;
    LE_WORKING_DIR=&quot;$DEFAULT_INSTALL_HOME&quot;
  fi
  export LE_WORKING_DIR

  if [ -z &quot;$LE_CONFIG_HOME&quot; ]; then
    LE_CONFIG_HOME=&quot;$LE_WORKING_DIR&quot;
  fi
  _debug &quot;Using config home:$LE_CONFIG_HOME&quot;
  export LE_CONFIG_HOME

  _DEFAULT_ACCOUNT_CONF_PATH=&quot;$LE_CONFIG_HOME/account.conf&quot;

  if [ -z &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    if [ -f &quot;$_DEFAULT_ACCOUNT_CONF_PATH&quot; ]; then
      . &quot;$_DEFAULT_ACCOUNT_CONF_PATH&quot;
    fi
  fi

  if [ -z &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    ACCOUNT_CONF_PATH=&quot;$_DEFAULT_ACCOUNT_CONF_PATH&quot;
  fi
  _debug3 ACCOUNT_CONF_PATH &quot;$ACCOUNT_CONF_PATH&quot;
  DEFAULT_LOG_FILE=&quot;$LE_CONFIG_HOME/$PROJECT_NAME.log&quot;

  DEFAULT_CA_HOME=&quot;$LE_CONFIG_HOME/ca&quot;

  if [ -z &quot;$LE_TEMP_DIR&quot; ]; then
    LE_TEMP_DIR=&quot;$LE_CONFIG_HOME/tmp&quot;
  fi
}

#server
_initAPI() {
  _api_server=&quot;${1:-$ACME_DIRECTORY}&quot;
  _debug &quot;_init api for server: $_api_server&quot;

  if [ -z &quot;$ACME_NEW_ACCOUNT&quot; ]; then
    response=$(_get &quot;$_api_server&quot;)
    if [ &quot;$?&quot; != &quot;0&quot; ]; then
      _debug2 &quot;response&quot; &quot;$response&quot;
      _err &quot;Can not init api.&quot;
      return 1
    fi
    _debug2 &quot;response&quot; &quot;$response&quot;

    ACME_KEY_CHANGE=$(echo &quot;$response&quot; | _egrep_o 'key-change&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    if [ -z &quot;$ACME_KEY_CHANGE&quot; ]; then
      ACME_KEY_CHANGE=$(echo &quot;$response&quot; | _egrep_o 'keyChange&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    fi
    export ACME_KEY_CHANGE

    ACME_NEW_AUTHZ=$(echo &quot;$response&quot; | _egrep_o 'new-authz&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    if [ -z &quot;$ACME_NEW_AUTHZ&quot; ]; then
      ACME_NEW_AUTHZ=$(echo &quot;$response&quot; | _egrep_o 'newAuthz&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    fi
    export ACME_NEW_AUTHZ

    ACME_NEW_ORDER=$(echo &quot;$response&quot; | _egrep_o 'new-cert&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    ACME_NEW_ORDER_RES=&quot;new-cert&quot;
    if [ -z &quot;$ACME_NEW_ORDER&quot; ]; then
      ACME_NEW_ORDER=$(echo &quot;$response&quot; | _egrep_o 'new-order&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
      ACME_NEW_ORDER_RES=&quot;new-order&quot;
      if [ -z &quot;$ACME_NEW_ORDER&quot; ]; then
        ACME_NEW_ORDER=$(echo &quot;$response&quot; | _egrep_o 'newOrder&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
      fi
    fi
    export ACME_NEW_ORDER
    export ACME_NEW_ORDER_RES

    ACME_NEW_ACCOUNT=$(echo &quot;$response&quot; | _egrep_o 'new-reg&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    ACME_NEW_ACCOUNT_RES=&quot;new-reg&quot;
    if [ -z &quot;$ACME_NEW_ACCOUNT&quot; ]; then
      ACME_NEW_ACCOUNT=$(echo &quot;$response&quot; | _egrep_o 'new-account&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
      ACME_NEW_ACCOUNT_RES=&quot;new-account&quot;
      if [ -z &quot;$ACME_NEW_ACCOUNT&quot; ]; then
        ACME_NEW_ACCOUNT=$(echo &quot;$response&quot; | _egrep_o 'newAccount&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
        if [ &quot;$ACME_NEW_ACCOUNT&quot; ]; then
          export ACME_VERSION=2
        fi
      fi
    fi
    export ACME_NEW_ACCOUNT
    export ACME_NEW_ACCOUNT_RES

    ACME_REVOKE_CERT=$(echo &quot;$response&quot; | _egrep_o 'revoke-cert&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    if [ -z &quot;$ACME_REVOKE_CERT&quot; ]; then
      ACME_REVOKE_CERT=$(echo &quot;$response&quot; | _egrep_o 'revokeCert&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    fi
    export ACME_REVOKE_CERT

    ACME_NEW_NONCE=$(echo &quot;$response&quot; | _egrep_o 'new-nonce&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    if [ -z &quot;$ACME_NEW_NONCE&quot; ]; then
      ACME_NEW_NONCE=$(echo &quot;$response&quot; | _egrep_o 'newNonce&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    fi
    export ACME_NEW_NONCE

    ACME_AGREEMENT=$(echo &quot;$response&quot; | _egrep_o 'terms-of-service&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    if [ -z &quot;$ACME_AGREEMENT&quot; ]; then
      ACME_AGREEMENT=$(echo &quot;$response&quot; | _egrep_o 'termsOfService&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 3)
    fi
    export ACME_AGREEMENT

    _debug &quot;ACME_KEY_CHANGE&quot; &quot;$ACME_KEY_CHANGE&quot;
    _debug &quot;ACME_NEW_AUTHZ&quot; &quot;$ACME_NEW_AUTHZ&quot;
    _debug &quot;ACME_NEW_ORDER&quot; &quot;$ACME_NEW_ORDER&quot;
    _debug &quot;ACME_NEW_ACCOUNT&quot; &quot;$ACME_NEW_ACCOUNT&quot;
    _debug &quot;ACME_REVOKE_CERT&quot; &quot;$ACME_REVOKE_CERT&quot;
    _debug &quot;ACME_AGREEMENT&quot; &quot;$ACME_AGREEMENT&quot;
    _debug &quot;ACME_NEW_NONCE&quot; &quot;$ACME_NEW_NONCE&quot;
    _debug &quot;ACME_VERSION&quot; &quot;$ACME_VERSION&quot;

  fi
}

#[domain]  [keylength or isEcc flag]
_initpath() {
  domain=&quot;$1&quot;
  _ilength=&quot;$2&quot;

  __initHome

  if [ -f &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    . &quot;$ACCOUNT_CONF_PATH&quot;
  fi

  if [ &quot;$ACME_IN_CRON&quot; ]; then
    if [ ! &quot;$_USER_PATH_EXPORTED&quot; ]; then
      _USER_PATH_EXPORTED=1
      export PATH=&quot;$USER_PATH:$PATH&quot;
    fi
  fi

  if [ -z &quot;$CA_HOME&quot; ]; then
    CA_HOME=&quot;$DEFAULT_CA_HOME&quot;
  fi

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    DEFAULT_CA=&quot;$LETSENCRYPT_CA_V2&quot;
    DEFAULT_STAGING_CA=&quot;$LETSENCRYPT_STAGING_CA_V2&quot;
  fi

  if [ -z &quot;$ACME_DIRECTORY&quot; ]; then
    if [ -z &quot;$STAGE&quot; ]; then
      ACME_DIRECTORY=&quot;$DEFAULT_CA&quot;
    else
      ACME_DIRECTORY=&quot;$DEFAULT_STAGING_CA&quot;
      _info &quot;Using stage ACME_DIRECTORY: $ACME_DIRECTORY&quot;
    fi
  fi

  _debug ACME_DIRECTORY &quot;$ACME_DIRECTORY&quot;
  _ACME_SERVER_HOST=&quot;$(echo &quot;$ACME_DIRECTORY&quot; | cut -d : -f 2 | tr -s / | cut -d / -f 2)&quot;
  _debug2 &quot;_ACME_SERVER_HOST&quot; &quot;$_ACME_SERVER_HOST&quot;

  CA_DIR=&quot;$CA_HOME/$_ACME_SERVER_HOST&quot;

  _DEFAULT_CA_CONF=&quot;$CA_DIR/ca.conf&quot;

  if [ -z &quot;$CA_CONF&quot; ]; then
    CA_CONF=&quot;$_DEFAULT_CA_CONF&quot;
  fi
  _debug3 CA_CONF &quot;$CA_CONF&quot;

  if [ -f &quot;$CA_CONF&quot; ]; then
    . &quot;$CA_CONF&quot;
  fi

  if [ -z &quot;$ACME_DIR&quot; ]; then
    ACME_DIR=&quot;/home/.acme&quot;
  fi

  if [ -z &quot;$APACHE_CONF_BACKUP_DIR&quot; ]; then
    APACHE_CONF_BACKUP_DIR=&quot;$LE_CONFIG_HOME&quot;
  fi

  if [ -z &quot;$USER_AGENT&quot; ]; then
    USER_AGENT=&quot;$DEFAULT_USER_AGENT&quot;
  fi

  if [ -z &quot;$HTTP_HEADER&quot; ]; then
    HTTP_HEADER=&quot;$LE_CONFIG_HOME/http.header&quot;
  fi

  _OLD_ACCOUNT_KEY=&quot;$LE_WORKING_DIR/account.key&quot;
  _OLD_ACCOUNT_JSON=&quot;$LE_WORKING_DIR/account.json&quot;

  _DEFAULT_ACCOUNT_KEY_PATH=&quot;$CA_DIR/account.key&quot;
  _DEFAULT_ACCOUNT_JSON_PATH=&quot;$CA_DIR/account.json&quot;
  if [ -z &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    ACCOUNT_KEY_PATH=&quot;$_DEFAULT_ACCOUNT_KEY_PATH&quot;
  fi

  if [ -z &quot;$ACCOUNT_JSON_PATH&quot; ]; then
    ACCOUNT_JSON_PATH=&quot;$_DEFAULT_ACCOUNT_JSON_PATH&quot;
  fi

  _DEFAULT_CERT_HOME=&quot;$LE_CONFIG_HOME&quot;
  if [ -z &quot;$CERT_HOME&quot; ]; then
    CERT_HOME=&quot;$_DEFAULT_CERT_HOME&quot;
  fi

  if [ -z &quot;$ACME_OPENSSL_BIN&quot; ] || [ ! -f &quot;$ACME_OPENSSL_BIN&quot; ] || [ ! -x &quot;$ACME_OPENSSL_BIN&quot; ]; then
    ACME_OPENSSL_BIN=&quot;$DEFAULT_OPENSSL_BIN&quot;
  fi

  if [ -z &quot;$domain&quot; ]; then
    return 0
  fi

  if [ -z &quot;$DOMAIN_PATH&quot; ]; then
    domainhome=&quot;$CERT_HOME/$domain&quot;
    domainhomeecc=&quot;$CERT_HOME/$domain$ECC_SUFFIX&quot;

    DOMAIN_PATH=&quot;$domainhome&quot;

    if _isEccKey &quot;$_ilength&quot;; then
      DOMAIN_PATH=&quot;$domainhomeecc&quot;
    else
      if [ ! -d &quot;$domainhome&quot; ] &amp;&amp; [ -d &quot;$domainhomeecc&quot; ]; then
        _info &quot;The domain '$domain' seems to have a ECC cert already, please add '$(__red &quot;--ecc&quot;)' parameter if you want to use that cert.&quot;
      fi
    fi
    _debug DOMAIN_PATH &quot;$DOMAIN_PATH&quot;
  fi

  if [ -z &quot;$DOMAIN_BACKUP_PATH&quot; ]; then
    DOMAIN_BACKUP_PATH=&quot;$DOMAIN_PATH/backup&quot;
  fi

  if [ -z &quot;$DOMAIN_CONF&quot; ]; then
    DOMAIN_CONF=&quot;$DOMAIN_PATH/$domain.conf&quot;
  fi

  if [ -z &quot;$DOMAIN_SSL_CONF&quot; ]; then
    DOMAIN_SSL_CONF=&quot;$DOMAIN_PATH/$domain.csr.conf&quot;
  fi

  if [ -z &quot;$CSR_PATH&quot; ]; then
    CSR_PATH=&quot;$DOMAIN_PATH/$domain.csr&quot;
  fi
  if [ -z &quot;$CERT_KEY_PATH&quot; ]; then
    CERT_KEY_PATH=&quot;$DOMAIN_PATH/$domain.key&quot;
  fi
  if [ -z &quot;$CERT_PATH&quot; ]; then
    CERT_PATH=&quot;$DOMAIN_PATH/$domain.cer&quot;
  fi
  if [ -z &quot;$CA_CERT_PATH&quot; ]; then
    CA_CERT_PATH=&quot;$DOMAIN_PATH/ca.cer&quot;
  fi
  if [ -z &quot;$CERT_FULLCHAIN_PATH&quot; ]; then
    CERT_FULLCHAIN_PATH=&quot;$DOMAIN_PATH/fullchain.cer&quot;
  fi
  if [ -z &quot;$CERT_PFX_PATH&quot; ]; then
    CERT_PFX_PATH=&quot;$DOMAIN_PATH/$domain.pfx&quot;
  fi
  if [ -z &quot;$CERT_PKCS8_PATH&quot; ]; then
    CERT_PKCS8_PATH=&quot;$DOMAIN_PATH/$domain.pkcs8&quot;
  fi

  if [ -z &quot;$TLS_CONF&quot; ]; then
    TLS_CONF=&quot;$DOMAIN_PATH/tls.validation.conf&quot;
  fi
  if [ -z &quot;$TLS_CERT&quot; ]; then
    TLS_CERT=&quot;$DOMAIN_PATH/tls.validation.cert&quot;
  fi
  if [ -z &quot;$TLS_KEY&quot; ]; then
    TLS_KEY=&quot;$DOMAIN_PATH/tls.validation.key&quot;
  fi
  if [ -z &quot;$TLS_CSR&quot; ]; then
    TLS_CSR=&quot;$DOMAIN_PATH/tls.validation.csr&quot;
  fi

}

_exec() {
  if [ -z &quot;$_EXEC_TEMP_ERR&quot; ]; then
    _EXEC_TEMP_ERR=&quot;$(_mktemp)&quot;
  fi

  if [ &quot;$_EXEC_TEMP_ERR&quot; ]; then
    eval &quot;$@ 2&gt;&gt;$_EXEC_TEMP_ERR&quot;
  else
    eval &quot;$@&quot;
  fi
}

_exec_err() {
  [ &quot;$_EXEC_TEMP_ERR&quot; ] &amp;&amp; _err &quot;$(cat &quot;$_EXEC_TEMP_ERR&quot;)&quot; &amp;&amp; echo &quot;&quot; &gt;&quot;$_EXEC_TEMP_ERR&quot;
}

_apachePath() {
  _APACHECTL=&quot;apachectl&quot;
  if ! _exists apachectl; then
    if _exists apache2ctl; then
      _APACHECTL=&quot;apache2ctl&quot;
    else
      _err &quot;'apachectl not found. It seems that apache is not installed, or you are not root user.'&quot;
      _err &quot;Please use webroot mode to try again.&quot;
      return 1
    fi
  fi

  if ! _exec $_APACHECTL -V &gt;/dev/null; then
    _exec_err
    return 1
  fi

  if [ &quot;$APACHE_HTTPD_CONF&quot; ]; then
    _saveaccountconf APACHE_HTTPD_CONF &quot;$APACHE_HTTPD_CONF&quot;
    httpdconf=&quot;$APACHE_HTTPD_CONF&quot;
    httpdconfname=&quot;$(basename &quot;$httpdconfname&quot;)&quot;
  else
    httpdconfname=&quot;$($_APACHECTL -V | grep SERVER_CONFIG_FILE= | cut -d = -f 2 | tr -d '&quot;')&quot;
    _debug httpdconfname &quot;$httpdconfname&quot;

    if [ -z &quot;$httpdconfname&quot; ]; then
      _err &quot;Can not read apache config file.&quot;
      return 1
    fi

    if _startswith &quot;$httpdconfname&quot; '/'; then
      httpdconf=&quot;$httpdconfname&quot;
      httpdconfname=&quot;$(basename &quot;$httpdconfname&quot;)&quot;
    else
      httpdroot=&quot;$($_APACHECTL -V | grep HTTPD_ROOT= | cut -d = -f 2 | tr -d '&quot;')&quot;
      _debug httpdroot &quot;$httpdroot&quot;
      httpdconf=&quot;$httpdroot/$httpdconfname&quot;
      httpdconfname=&quot;$(basename &quot;$httpdconfname&quot;)&quot;
    fi
  fi
  _debug httpdconf &quot;$httpdconf&quot;
  _debug httpdconfname &quot;$httpdconfname&quot;
  if [ ! -f &quot;$httpdconf&quot; ]; then
    _err &quot;Apache Config file not found&quot; &quot;$httpdconf&quot;
    return 1
  fi
  return 0
}

_restoreApache() {
  if [ -z &quot;$usingApache&quot; ]; then
    return 0
  fi
  _initpath
  if ! _apachePath; then
    return 1
  fi

  if [ ! -f &quot;$APACHE_CONF_BACKUP_DIR/$httpdconfname&quot; ]; then
    _debug &quot;No config file to restore.&quot;
    return 0
  fi

  cat &quot;$APACHE_CONF_BACKUP_DIR/$httpdconfname&quot; &gt;&quot;$httpdconf&quot;
  _debug &quot;Restored: $httpdconf.&quot;
  if ! _exec $_APACHECTL -t; then
    _exec_err
    _err &quot;Sorry, restore apache config error, please contact me.&quot;
    return 1
  fi
  _debug &quot;Restored successfully.&quot;
  rm -f &quot;$APACHE_CONF_BACKUP_DIR/$httpdconfname&quot;
  return 0
}

_setApache() {
  _initpath
  if ! _apachePath; then
    return 1
  fi

  #test the conf first
  _info &quot;Checking if there is an error in the apache config file before starting.&quot;

  if ! _exec &quot;$_APACHECTL&quot; -t &gt;/dev/null; then
    _exec_err
    _err &quot;The apache config file has error, please fix it first, then try again.&quot;
    _err &quot;Don't worry, there is nothing changed to your system.&quot;
    return 1
  else
    _info &quot;OK&quot;
  fi

  #backup the conf
  _debug &quot;Backup apache config file&quot; &quot;$httpdconf&quot;
  if ! cp &quot;$httpdconf&quot; &quot;$APACHE_CONF_BACKUP_DIR/&quot;; then
    _err &quot;Can not backup apache config file, so abort. Don't worry, the apache config is not changed.&quot;
    _err &quot;This might be a bug of $PROJECT_NAME , please report issue: $PROJECT&quot;
    return 1
  fi
  _info &quot;JFYI, Config file $httpdconf is backuped to $APACHE_CONF_BACKUP_DIR/$httpdconfname&quot;
  _info &quot;In case there is an error that can not be restored automatically, you may try restore it yourself.&quot;
  _info &quot;The backup file will be deleted on success, just forget it.&quot;

  #add alias

  apacheVer=&quot;$($_APACHECTL -V | grep &quot;Server version:&quot; | cut -d : -f 2 | cut -d &quot; &quot; -f 2 | cut -d '/' -f 2)&quot;
  _debug &quot;apacheVer&quot; &quot;$apacheVer&quot;
  apacheMajer=&quot;$(echo &quot;$apacheVer&quot; | cut -d . -f 1)&quot;
  apacheMinor=&quot;$(echo &quot;$apacheVer&quot; | cut -d . -f 2)&quot;

  if [ &quot;$apacheVer&quot; ] &amp;&amp; [ &quot;$apacheMajer$apacheMinor&quot; -ge &quot;24&quot; ]; then
    echo &quot;
Alias /.well-known/acme-challenge  $ACME_DIR

&lt;Directory $ACME_DIR &gt;
Require all granted
&lt;/Directory&gt;
  &quot; &gt;&gt;&quot;$httpdconf&quot;
  else
    echo &quot;
Alias /.well-known/acme-challenge  $ACME_DIR

&lt;Directory $ACME_DIR &gt;
Order allow,deny
Allow from all
&lt;/Directory&gt;
  &quot; &gt;&gt;&quot;$httpdconf&quot;
  fi

  _msg=&quot;$($_APACHECTL -t 2&gt;&amp;1)&quot;
  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Sorry, apache config error&quot;
    if _restoreApache; then
      _err &quot;The apache config file is restored.&quot;
    else
      _err &quot;Sorry, The apache config file can not be restored, please report bug.&quot;
    fi
    return 1
  fi

  if [ ! -d &quot;$ACME_DIR&quot; ]; then
    mkdir -p &quot;$ACME_DIR&quot;
    chmod 755 &quot;$ACME_DIR&quot;
  fi

  if ! _exec &quot;$_APACHECTL&quot; graceful; then
    _exec_err
    _err &quot;$_APACHECTL  graceful error, please contact me.&quot;
    _restoreApache
    return 1
  fi
  usingApache=&quot;1&quot;
  return 0
}

#find the real nginx conf file
#backup
#set the nginx conf
#returns the real nginx conf file
_setNginx() {
  _d=&quot;$1&quot;
  _croot=&quot;$2&quot;
  _thumbpt=&quot;$3&quot;

  FOUND_REAL_NGINX_CONF=&quot;&quot;
  FOUND_REAL_NGINX_CONF_LN=&quot;&quot;
  BACKUP_NGINX_CONF=&quot;&quot;
  _debug _croot &quot;$_croot&quot;
  _start_f=&quot;$(echo &quot;$_croot&quot; | cut -d : -f 2)&quot;
  _debug _start_f &quot;$_start_f&quot;
  if [ -z &quot;$_start_f&quot; ]; then
    _debug &quot;find start conf from nginx command&quot;
    if [ -z &quot;$NGINX_CONF&quot; ]; then
      if ! _exists &quot;nginx&quot;; then
        _err &quot;nginx command is not found.&quot;
        return 1
      fi
      NGINX_CONF=&quot;$(nginx -V 2&gt;&amp;1 | _egrep_o &quot;--conf-path=[^ ]* &quot; | tr -d &quot; &quot;)&quot;
      _debug NGINX_CONF &quot;$NGINX_CONF&quot;
      NGINX_CONF=&quot;$(echo &quot;$NGINX_CONF&quot; | cut -d = -f 2)&quot;
      _debug NGINX_CONF &quot;$NGINX_CONF&quot;
      if [ -z &quot;$NGINX_CONF&quot; ]; then
        _err &quot;Can not find nginx conf.&quot;
        NGINX_CONF=&quot;&quot;
        return 1
      fi
      if [ ! -f &quot;$NGINX_CONF&quot; ]; then
        _err &quot;'$NGINX_CONF' doesn't exist.&quot;
        NGINX_CONF=&quot;&quot;
        return 1
      fi
      _debug &quot;Found nginx conf file:$NGINX_CONF&quot;
    fi
    _start_f=&quot;$NGINX_CONF&quot;
  fi
  _debug &quot;Start detect nginx conf for $_d from:$_start_f&quot;
  if ! _checkConf &quot;$_d&quot; &quot;$_start_f&quot;; then
    _err &quot;Can not find conf file for domain $d&quot;
    return 1
  fi
  _info &quot;Found conf file: $FOUND_REAL_NGINX_CONF&quot;

  _ln=$FOUND_REAL_NGINX_CONF_LN
  _debug &quot;_ln&quot; &quot;$_ln&quot;

  _lnn=$(_math $_ln + 1)
  _debug _lnn &quot;$_lnn&quot;
  _start_tag=&quot;$(sed -n &quot;$_lnn,${_lnn}p&quot; &quot;$FOUND_REAL_NGINX_CONF&quot;)&quot;
  _debug &quot;_start_tag&quot; &quot;$_start_tag&quot;
  if [ &quot;$_start_tag&quot; = &quot;$NGINX_START&quot; ]; then
    _info &quot;The domain $_d is already configured, skip&quot;
    FOUND_REAL_NGINX_CONF=&quot;&quot;
    return 0
  fi

  mkdir -p &quot;$DOMAIN_BACKUP_PATH&quot;
  _backup_conf=&quot;$DOMAIN_BACKUP_PATH/$_d.nginx.conf&quot;
  _debug _backup_conf &quot;$_backup_conf&quot;
  BACKUP_NGINX_CONF=&quot;$_backup_conf&quot;
  _info &quot;Backup $FOUND_REAL_NGINX_CONF to $_backup_conf&quot;
  if ! cp &quot;$FOUND_REAL_NGINX_CONF&quot; &quot;$_backup_conf&quot;; then
    _err &quot;backup error.&quot;
    FOUND_REAL_NGINX_CONF=&quot;&quot;
    return 1
  fi

  if ! _exists &quot;nginx&quot;; then
    _err &quot;nginx command is not found.&quot;
    return 1
  fi
  _info &quot;Check the nginx conf before setting up.&quot;
  if ! _exec &quot;nginx -t&quot; &gt;/dev/null; then
    _exec_err
    return 1
  fi

  _info &quot;OK, Set up nginx config file&quot;

  if ! sed -n &quot;1,${_ln}p&quot; &quot;$_backup_conf&quot; &gt;&quot;$FOUND_REAL_NGINX_CONF&quot;; then
    cat &quot;$_backup_conf&quot; &gt;&quot;$FOUND_REAL_NGINX_CONF&quot;
    _err &quot;write nginx conf error, but don't worry, the file is restored to the original version.&quot;
    return 1
  fi

  echo &quot;$NGINX_START
location ~ \&quot;^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\&quot; {
  default_type text/plain;
  return 200 \&quot;\$1.$_thumbpt\&quot;;
}
#NGINX_START
&quot; &gt;&gt;&quot;$FOUND_REAL_NGINX_CONF&quot;

  if ! sed -n &quot;${_lnn},99999p&quot; &quot;$_backup_conf&quot; &gt;&gt;&quot;$FOUND_REAL_NGINX_CONF&quot;; then
    cat &quot;$_backup_conf&quot; &gt;&quot;$FOUND_REAL_NGINX_CONF&quot;
    _err &quot;write nginx conf error, but don't worry, the file is restored.&quot;
    return 1
  fi
  _debug3 &quot;Modified config:$(cat $FOUND_REAL_NGINX_CONF)&quot;
  _info &quot;nginx conf is done, let's check it again.&quot;
  if ! _exec &quot;nginx -t&quot; &gt;/dev/null; then
    _exec_err
    _err &quot;It seems that nginx conf was broken, let's restore.&quot;
    cat &quot;$_backup_conf&quot; &gt;&quot;$FOUND_REAL_NGINX_CONF&quot;
    return 1
  fi

  _info &quot;Reload nginx&quot;
  if ! _exec &quot;nginx -s reload&quot; &gt;/dev/null; then
    _exec_err
    _err &quot;It seems that nginx reload error, let's restore.&quot;
    cat &quot;$_backup_conf&quot; &gt;&quot;$FOUND_REAL_NGINX_CONF&quot;
    return 1
  fi

  return 0
}

#d , conf
_checkConf() {
  _d=&quot;$1&quot;
  _c_file=&quot;$2&quot;
  _debug &quot;Start _checkConf from:$_c_file&quot;
  if [ ! -f &quot;$2&quot; ] &amp;&amp; ! echo &quot;$2&quot; | grep '*$' &gt;/dev/null &amp;&amp; echo &quot;$2&quot; | grep '*' &gt;/dev/null; then
    _debug &quot;wildcard&quot;
    for _w_f in $2; do
      if [ -f &quot;$_w_f&quot; ] &amp;&amp; _checkConf &quot;$1&quot; &quot;$_w_f&quot;; then
        return 0
      fi
    done
    #not found
    return 1
  elif [ -f &quot;$2&quot; ]; then
    _debug &quot;single&quot;
    if _isRealNginxConf &quot;$1&quot; &quot;$2&quot;; then
      _debug &quot;$2 is found.&quot;
      FOUND_REAL_NGINX_CONF=&quot;$2&quot;
      return 0
    fi
    if cat &quot;$2&quot; | tr &quot;\t&quot; &quot; &quot; | grep &quot;^ *include *.*;&quot; &gt;/dev/null; then
      _debug &quot;Try include files&quot;
      for included in $(cat &quot;$2&quot; | tr &quot;\t&quot; &quot; &quot; | grep &quot;^ *include *.*;&quot; | sed &quot;s/include //&quot; | tr -d &quot; ;&quot;); do
        _debug &quot;check included $included&quot;
        if _checkConf &quot;$1&quot; &quot;$included&quot;; then
          return 0
        fi
      done
    fi
    return 1
  else
    _debug &quot;$2 not found.&quot;
    return 1
  fi
  return 1
}

#d , conf
_isRealNginxConf() {
  _debug &quot;_isRealNginxConf $1 $2&quot;
  if [ -f &quot;$2&quot; ]; then
    for _fln in $(tr &quot;\t&quot; ' ' &lt;&quot;$2&quot; | grep -n &quot;^ *server_name.* $1&quot; | cut -d : -f 1); do
      _debug _fln &quot;$_fln&quot;
      if [ &quot;$_fln&quot; ]; then
        _start=$(tr &quot;\t&quot; ' ' &lt;&quot;$2&quot; | _head_n &quot;$_fln&quot; | grep -n &quot;^ *server *&quot; | grep -v server_name | _tail_n 1)
        _debug &quot;_start&quot; &quot;$_start&quot;
        _start_n=$(echo &quot;$_start&quot; | cut -d : -f 1)
        _start_nn=$(_math $_start_n + 1)
        _debug &quot;_start_n&quot; &quot;$_start_n&quot;
        _debug &quot;_start_nn&quot; &quot;$_start_nn&quot;

        _left=&quot;$(sed -n &quot;${_start_nn},99999p&quot; &quot;$2&quot;)&quot;
        _debug2 _left &quot;$_left&quot;
        _end=&quot;$(echo &quot;$_left&quot; | tr &quot;\t&quot; ' ' | grep -n &quot;^ *server *&quot; | grep -v server_name | _head_n 1)&quot;
        _debug &quot;_end&quot; &quot;$_end&quot;
        if [ &quot;$_end&quot; ]; then
          _end_n=$(echo &quot;$_end&quot; | cut -d : -f 1)
          _debug &quot;_end_n&quot; &quot;$_end_n&quot;
          _seg_n=$(echo &quot;$_left&quot; | sed -n &quot;1,${_end_n}p&quot;)
        else
          _seg_n=&quot;$_left&quot;
        fi

        _debug &quot;_seg_n&quot; &quot;$_seg_n&quot;

        _skip_ssl=1
        for _listen_i in $(echo &quot;$_seg_n&quot; | tr &quot;\t&quot; ' ' | grep &quot;^ *listen&quot; | tr -d &quot; &quot;); do
          if [ &quot;$_listen_i&quot; ]; then
            if [ &quot;$(echo &quot;$_listen_i&quot; | _egrep_o &quot;listen.*ssl&quot;)&quot; ]; then
              _debug2 &quot;$_listen_i is ssl&quot;
            else
              _debug2 &quot;$_listen_i is plain text&quot;
              _skip_ssl=&quot;&quot;
              break
            fi
          fi
        done

        if [ &quot;$_skip_ssl&quot; = &quot;1&quot; ]; then
          _debug &quot;ssl on, skip&quot;
        else
          FOUND_REAL_NGINX_CONF_LN=$_fln
          _debug3 &quot;found FOUND_REAL_NGINX_CONF_LN&quot; &quot;$FOUND_REAL_NGINX_CONF_LN&quot;
          return 0
        fi
      fi
    done
  fi
  return 1
}

#restore all the nginx conf
_restoreNginx() {
  if [ -z &quot;$NGINX_RESTORE_VLIST&quot; ]; then
    _debug &quot;No need to restore nginx, skip.&quot;
    return
  fi
  _debug &quot;_restoreNginx&quot;
  _debug &quot;NGINX_RESTORE_VLIST&quot; &quot;$NGINX_RESTORE_VLIST&quot;

  for ng_entry in $(echo &quot;$NGINX_RESTORE_VLIST&quot; | tr &quot;$dvsep&quot; ' '); do
    _debug &quot;ng_entry&quot; &quot;$ng_entry&quot;
    _nd=$(echo &quot;$ng_entry&quot; | cut -d &quot;$sep&quot; -f 1)
    _ngconf=$(echo &quot;$ng_entry&quot; | cut -d &quot;$sep&quot; -f 2)
    _ngbackupconf=$(echo &quot;$ng_entry&quot; | cut -d &quot;$sep&quot; -f 3)
    _info &quot;Restoring from $_ngbackupconf to $_ngconf&quot;
    cat &quot;$_ngbackupconf&quot; &gt;&quot;$_ngconf&quot;
  done

  _info &quot;Reload nginx&quot;
  if ! _exec &quot;nginx -s reload&quot; &gt;/dev/null; then
    _exec_err
    _err &quot;It seems that nginx reload error, please report bug.&quot;
    return 1
  fi
  return 0
}

_clearup() {
  _stopserver &quot;$serverproc&quot;
  serverproc=&quot;&quot;
  _restoreApache
  _restoreNginx
  _clearupdns
  if [ -z &quot;$DEBUG&quot; ]; then
    rm -f &quot;$TLS_CONF&quot;
    rm -f &quot;$TLS_CERT&quot;
    rm -f &quot;$TLS_KEY&quot;
    rm -f &quot;$TLS_CSR&quot;
  fi
}

_clearupdns() {
  _debug &quot;_clearupdns&quot;
  _debug &quot;dns_entries&quot; &quot;$dns_entries&quot;

  if [ -z &quot;$dns_entries&quot; ]; then
    _debug &quot;skip dns.&quot;
    return
  fi
  _info &quot;Removing DNS records.&quot;

  for entry in $dns_entries; do
    d=$(_getfield &quot;$entry&quot; 1)
    txtdomain=$(_getfield &quot;$entry&quot; 2)
    aliasDomain=$(_getfield &quot;$entry&quot; 3)
    _currentRoot=$(_getfield &quot;$entry&quot; 4)
    txt=$(_getfield &quot;$entry&quot; 5)
    d_api=$(_getfield &quot;$entry&quot; 6)
    _debug &quot;d&quot; &quot;$d&quot;
    _debug &quot;txtdomain&quot; &quot;$txtdomain&quot;
    _debug &quot;aliasDomain&quot; &quot;$aliasDomain&quot;
    _debug &quot;_currentRoot&quot; &quot;$_currentRoot&quot;
    _debug &quot;txt&quot; &quot;$txt&quot;
    _debug &quot;d_api&quot; &quot;$d_api&quot;
    if [ &quot;$d_api&quot; = &quot;$txt&quot; ]; then
      d_api=&quot;&quot;
    fi

    if [ -z &quot;$d_api&quot; ]; then
      _info &quot;Not Found domain api file: $d_api&quot;
      continue
    fi

    if [ &quot;$aliasDomain&quot; ]; then
      txtdomain=&quot;$aliasDomain&quot;
    fi

    (
      if ! . &quot;$d_api&quot;; then
        _err &quot;Load file $d_api error. Please check your api file and try again.&quot;
        return 1
      fi

      rmcommand=&quot;${_currentRoot}_rm&quot;
      if ! _exists &quot;$rmcommand&quot;; then
        _err &quot;It seems that your api file doesn't define $rmcommand&quot;
        return 1
      fi
      _info &quot;Removing txt: $txt for domain: $txtdomain&quot;
      if ! $rmcommand &quot;$txtdomain&quot; &quot;$txt&quot;; then
        _err &quot;Error removing txt for domain:$txtdomain&quot;
        return 1
      fi
      _info &quot;Removed: Success&quot;
    )

  done
}

# webroot  removelevel tokenfile
_clearupwebbroot() {
  __webroot=&quot;$1&quot;
  if [ -z &quot;$__webroot&quot; ]; then
    _debug &quot;no webroot specified, skip&quot;
    return 0
  fi

  _rmpath=&quot;&quot;
  if [ &quot;$2&quot; = '1' ]; then
    _rmpath=&quot;$__webroot/.well-known&quot;
  elif [ &quot;$2&quot; = '2' ]; then
    _rmpath=&quot;$__webroot/.well-known/acme-challenge&quot;
  elif [ &quot;$2&quot; = '3' ]; then
    _rmpath=&quot;$__webroot/.well-known/acme-challenge/$3&quot;
  else
    _debug &quot;Skip for removelevel:$2&quot;
  fi

  if [ &quot;$_rmpath&quot; ]; then
    if [ &quot;$DEBUG&quot; ]; then
      _debug &quot;Debugging, skip removing: $_rmpath&quot;
    else
      rm -rf &quot;$_rmpath&quot;
    fi
  fi

  return 0

}

_on_before_issue() {
  _chk_web_roots=&quot;$1&quot;
  _chk_main_domain=&quot;$2&quot;
  _chk_alt_domains=&quot;$3&quot;
  _chk_pre_hook=&quot;$4&quot;
  _chk_local_addr=&quot;$5&quot;
  _debug _on_before_issue
  _debug _chk_main_domain &quot;$_chk_main_domain&quot;
  _debug _chk_alt_domains &quot;$_chk_alt_domains&quot;
  #run pre hook
  if [ &quot;$_chk_pre_hook&quot; ]; then
    _info &quot;Run pre hook:'$_chk_pre_hook'&quot;
    if ! (
      cd &quot;$DOMAIN_PATH&quot; &amp;&amp; eval &quot;$_chk_pre_hook&quot;
    ); then
      _err &quot;Error when run pre hook.&quot;
      return 1
    fi
  fi

  if _hasfield &quot;$_chk_web_roots&quot; &quot;$NO_VALUE&quot;; then
    if ! _exists &quot;socat&quot;; then
      _err &quot;Please install socat tools first.&quot;
      return 1
    fi
  fi

  _debug Le_LocalAddress &quot;$_chk_local_addr&quot;

  _index=1
  _currentRoot=&quot;&quot;
  _addrIndex=1
  _w_index=1
  while true; do
    d=&quot;$(echo &quot;$_chk_main_domain,$_chk_alt_domains,&quot; | cut -d , -f &quot;$_w_index&quot;)&quot;
    _w_index=&quot;$(_math &quot;$_w_index&quot; + 1)&quot;
    _debug d &quot;$d&quot;
    if [ -z &quot;$d&quot; ]; then
      break
    fi
    _debug &quot;Check for domain&quot; &quot;$d&quot;
    _currentRoot=&quot;$(_getfield &quot;$_chk_web_roots&quot; $_index)&quot;
    _debug &quot;_currentRoot&quot; &quot;$_currentRoot&quot;
    _index=$(_math $_index + 1)
    _checkport=&quot;&quot;
    if [ &quot;$_currentRoot&quot; = &quot;$NO_VALUE&quot; ]; then
      _info &quot;Standalone mode.&quot;
      if [ -z &quot;$Le_HTTPPort&quot; ]; then
        Le_HTTPPort=80
        _cleardomainconf &quot;Le_HTTPPort&quot;
      else
        _savedomainconf &quot;Le_HTTPPort&quot; &quot;$Le_HTTPPort&quot;
      fi
      _checkport=&quot;$Le_HTTPPort&quot;
    elif [ &quot;$_currentRoot&quot; = &quot;$W_ALPN&quot; ]; then
      _info &quot;Standalone alpn mode.&quot;
      if [ -z &quot;$Le_TLSPort&quot; ]; then
        Le_TLSPort=443
      else
        _savedomainconf &quot;Le_TLSPort&quot; &quot;$Le_TLSPort&quot;
      fi
      _checkport=&quot;$Le_TLSPort&quot;
    fi

    if [ &quot;$_checkport&quot; ]; then
      _debug _checkport &quot;$_checkport&quot;
      _checkaddr=&quot;$(_getfield &quot;$_chk_local_addr&quot; $_addrIndex)&quot;
      _debug _checkaddr &quot;$_checkaddr&quot;

      _addrIndex=&quot;$(_math $_addrIndex + 1)&quot;

      _netprc=&quot;$(_ss &quot;$_checkport&quot; | grep &quot;$_checkport&quot;)&quot;
      netprc=&quot;$(echo &quot;$_netprc&quot; | grep &quot;$_checkaddr&quot;)&quot;
      if [ -z &quot;$netprc&quot; ]; then
        netprc=&quot;$(echo &quot;$_netprc&quot; | grep &quot;$LOCAL_ANY_ADDRESS&quot;)&quot;
      fi
      if [ &quot;$netprc&quot; ]; then
        _err &quot;$netprc&quot;
        _err &quot;tcp port $_checkport is already used by $(echo &quot;$netprc&quot; | cut -d : -f 4)&quot;
        _err &quot;Please stop it first&quot;
        return 1
      fi
    fi
  done

  if _hasfield &quot;$_chk_web_roots&quot; &quot;apache&quot;; then
    if ! _setApache; then
      _err &quot;set up apache error. Report error to me.&quot;
      return 1
    fi
  else
    usingApache=&quot;&quot;
  fi

}

_on_issue_err() {
  _chk_post_hook=&quot;$1&quot;
  _chk_vlist=&quot;$2&quot;
  _debug _on_issue_err

  if [ &quot;$LOG_FILE&quot; ]; then
    _err &quot;Please check log file for more details: $LOG_FILE&quot;
  else
    _err &quot;Please add '--debug' or '--log' to check more details.&quot;
    _err &quot;See: $_DEBUG_WIKI&quot;
  fi

  #run the post hook
  if [ &quot;$_chk_post_hook&quot; ]; then
    _info &quot;Run post hook:'$_chk_post_hook'&quot;
    if ! (
      cd &quot;$DOMAIN_PATH&quot; &amp;&amp; eval &quot;$_chk_post_hook&quot;
    ); then
      _err &quot;Error when run post hook.&quot;
      return 1
    fi
  fi

  #trigger the validation to flush the pending authz
  _debug2 &quot;_chk_vlist&quot; &quot;$_chk_vlist&quot;
  if [ &quot;$_chk_vlist&quot; ]; then
    (
      _debug2 &quot;start to deactivate authz&quot;
      ventries=$(echo &quot;$_chk_vlist&quot; | tr &quot;$dvsep&quot; ' ')
      for ventry in $ventries; do
        d=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 1)
        keyauthorization=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 2)
        uri=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 3)
        vtype=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 4)
        _currentRoot=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 5)
        __trigger_validation &quot;$uri&quot; &quot;$keyauthorization&quot;
      done
    )
  fi

  if [ &quot;$IS_RENEW&quot; = &quot;1&quot; ] &amp;&amp; _hasfield &quot;$Le_Webroot&quot; &quot;$W_DNS&quot;; then
    _err &quot;$_DNS_MANUAL_ERR&quot;
  fi

  if [ &quot;$DEBUG&quot; ] &amp;&amp; [ &quot;$DEBUG&quot; -gt &quot;0&quot; ]; then
    _debug &quot;$(_dlg_versions)&quot;
  fi

}

_on_issue_success() {
  _chk_post_hook=&quot;$1&quot;
  _chk_renew_hook=&quot;$2&quot;
  _debug _on_issue_success

  #run the post hook
  if [ &quot;$_chk_post_hook&quot; ]; then
    _info &quot;Run post hook:'$_chk_post_hook'&quot;
    if ! (
      export CERT_PATH
      export CERT_KEY_PATH
      export CA_CERT_PATH
      export CERT_FULLCHAIN_PATH
      export Le_Domain=&quot;$_main_domain&quot;
      cd &quot;$DOMAIN_PATH&quot; &amp;&amp; eval &quot;$_chk_post_hook&quot;
    ); then
      _err &quot;Error when run post hook.&quot;
      return 1
    fi
  fi

  #run renew hook
  if [ &quot;$IS_RENEW&quot; ] &amp;&amp; [ &quot;$_chk_renew_hook&quot; ]; then
    _info &quot;Run renew hook:'$_chk_renew_hook'&quot;
    if ! (
      export CERT_PATH
      export CERT_KEY_PATH
      export CA_CERT_PATH
      export CERT_FULLCHAIN_PATH
      export Le_Domain=&quot;$_main_domain&quot;
      cd &quot;$DOMAIN_PATH&quot; &amp;&amp; eval &quot;$_chk_renew_hook&quot;
    ); then
      _err &quot;Error when run renew hook.&quot;
      return 1
    fi
  fi

  if _hasfield &quot;$Le_Webroot&quot; &quot;$W_DNS&quot; &amp;&amp; [ -z &quot;$FORCE_DNS_MANUAL&quot; ]; then
    _err &quot;$_DNS_MANUAL_WARN&quot;
  fi

}

registeraccount() {
  _reg_length=&quot;$1&quot;
  _initpath
  _regAccount &quot;$_reg_length&quot;
}

__calcAccountKeyHash() {
  [ -f &quot;$ACCOUNT_KEY_PATH&quot; ] &amp;&amp; _digest sha256 &lt;&quot;$ACCOUNT_KEY_PATH&quot;
}

__calc_account_thumbprint() {
  printf &quot;%s&quot; &quot;$jwk&quot; | tr -d ' ' | _digest &quot;sha256&quot; | _url_replace
}

#keylength
_regAccount() {
  _initpath
  _reg_length=&quot;$1&quot;
  _debug3 _regAccount &quot;$_regAccount&quot;
  _initAPI

  mkdir -p &quot;$CA_DIR&quot;
  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_KEY&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_KEY&quot; &quot;$ACCOUNT_KEY_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_JSON_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_JSON&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_JSON&quot; &quot;$ACCOUNT_JSON_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    if ! _create_account_key &quot;$_reg_length&quot;; then
      _err &quot;Create account key error.&quot;
      return 1
    fi
  fi

  if ! _calcjwk &quot;$ACCOUNT_KEY_PATH&quot;; then
    return 1
  fi

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    regjson='{&quot;termsOfServiceAgreed&quot;: true}'
    if [ &quot;$ACCOUNT_EMAIL&quot; ]; then
      regjson='{&quot;contact&quot;: [&quot;mailto: '$ACCOUNT_EMAIL'&quot;], &quot;termsOfServiceAgreed&quot;: true}'
    fi
  else
    _reg_res=&quot;$ACME_NEW_ACCOUNT_RES&quot;
    regjson='{&quot;resource&quot;: &quot;'$_reg_res'&quot;, &quot;terms-of-service-agreed&quot;: true, &quot;agreement&quot;: &quot;'$ACME_AGREEMENT'&quot;}'
    if [ &quot;$ACCOUNT_EMAIL&quot; ]; then
      regjson='{&quot;resource&quot;: &quot;'$_reg_res'&quot;, &quot;contact&quot;: [&quot;mailto: '$ACCOUNT_EMAIL'&quot;], &quot;terms-of-service-agreed&quot;: true, &quot;agreement&quot;: &quot;'$ACME_AGREEMENT'&quot;}'
    fi
  fi

  _info &quot;Registering account&quot;

  if ! _send_signed_request &quot;${ACME_NEW_ACCOUNT}&quot; &quot;$regjson&quot;; then
    _err &quot;Register account Error: $response&quot;
    return 1
  fi

  if [ &quot;$code&quot; = &quot;&quot; ] || [ &quot;$code&quot; = '201' ]; then
    echo &quot;$response&quot; &gt;&quot;$ACCOUNT_JSON_PATH&quot;
    _info &quot;Registered&quot;
  elif [ &quot;$code&quot; = '409' ] || [ &quot;$code&quot; = '200' ]; then
    _info &quot;Already registered&quot;
  else
    _err &quot;Register account Error: $response&quot;
    return 1
  fi

  _debug2 responseHeaders &quot;$responseHeaders&quot;
  _accUri=&quot;$(echo &quot;$responseHeaders&quot; | grep -i &quot;^Location:&quot; | _head_n 1 | cut -d ':' -f 2- | tr -d &quot;\r\n &quot;)&quot;
  _debug &quot;_accUri&quot; &quot;$_accUri&quot;
  if [ -z &quot;$_accUri&quot; ]; then
    _err &quot;Can not find account id url.&quot;
    _err &quot;$responseHeaders&quot;
    return 1
  fi
  _savecaconf &quot;ACCOUNT_URL&quot; &quot;$_accUri&quot;
  export ACCOUNT_URL=&quot;$_accUri&quot;

  CA_KEY_HASH=&quot;$(__calcAccountKeyHash)&quot;
  _debug &quot;Calc CA_KEY_HASH&quot; &quot;$CA_KEY_HASH&quot;
  _savecaconf CA_KEY_HASH &quot;$CA_KEY_HASH&quot;

  if [ &quot;$code&quot; = '403' ]; then
    _err &quot;It seems that the account key is already deactivated, please use a new account key.&quot;
    return 1
  fi

  ACCOUNT_THUMBPRINT=&quot;$(__calc_account_thumbprint)&quot;
  _info &quot;ACCOUNT_THUMBPRINT&quot; &quot;$ACCOUNT_THUMBPRINT&quot;
}

#implement updateaccount
updateaccount() {
  _initpath

  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_KEY&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_KEY&quot; &quot;$ACCOUNT_KEY_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_JSON_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_JSON&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_JSON&quot; &quot;$ACCOUNT_JSON_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    _err &quot;Account key is not found at: $ACCOUNT_KEY_PATH&quot;
    return 1
  fi

  _accUri=$(_readcaconf &quot;ACCOUNT_URL&quot;)
  _debug _accUri &quot;$_accUri&quot;

  if [ -z &quot;$_accUri&quot; ]; then
    _err &quot;The account url is empty, please run '--update-account' first to update the account info first,&quot;
    _err &quot;Then try again.&quot;
    return 1
  fi

  if ! _calcjwk &quot;$ACCOUNT_KEY_PATH&quot;; then
    return 1
  fi
  _initAPI

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    if [ &quot;$ACCOUNT_EMAIL&quot; ]; then
      updjson='{&quot;contact&quot;: [&quot;mailto: '$ACCOUNT_EMAIL'&quot;]}'
    fi
  else
    # ACMEv1: Updates happen the same way a registration is done.
    # https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-6.3
    _regAccount
    return
  fi

  # this part handles ACMEv2 account updates.
  _send_signed_request &quot;$_accUri&quot; &quot;$updjson&quot;

  if [ &quot;$code&quot; = '200' ]; then
    _info &quot;account update success for $_accUri.&quot;
  else
    _info &quot;Error. The account was not updated.&quot;
    return 1
  fi
}

#Implement deactivate account
deactivateaccount() {
  _initpath

  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_KEY&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_KEY&quot; &quot;$ACCOUNT_KEY_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_JSON_PATH&quot; ] &amp;&amp; [ -f &quot;$_OLD_ACCOUNT_JSON&quot; ]; then
    _info &quot;mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH&quot;
    mv &quot;$_OLD_ACCOUNT_JSON&quot; &quot;$ACCOUNT_JSON_PATH&quot;
  fi

  if [ ! -f &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    _err &quot;Account key is not found at: $ACCOUNT_KEY_PATH&quot;
    return 1
  fi

  _accUri=$(_readcaconf &quot;ACCOUNT_URL&quot;)
  _debug _accUri &quot;$_accUri&quot;

  if [ -z &quot;$_accUri&quot; ]; then
    _err &quot;The account url is empty, please run '--update-account' first to update the account info first,&quot;
    _err &quot;Then try again.&quot;
    return 1
  fi

  if ! _calcjwk &quot;$ACCOUNT_KEY_PATH&quot;; then
    return 1
  fi
  _initAPI

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    _djson=&quot;{\&quot;status\&quot;:\&quot;deactivated\&quot;}&quot;
  else
    _djson=&quot;{\&quot;resource\&quot;: \&quot;reg\&quot;, \&quot;status\&quot;:\&quot;deactivated\&quot;}&quot;
  fi
  if _send_signed_request &quot;$_accUri&quot; &quot;$_djson&quot; &amp;&amp; _contains &quot;$response&quot; '&quot;deactivated&quot;'; then
    _info &quot;Deactivate account success for $_accUri.&quot;
    _accid=$(echo &quot;$response&quot; | _egrep_o &quot;\&quot;id\&quot; *: *[^,]*,&quot; | cut -d : -f 2 | tr -d ' ,')
  elif [ &quot;$code&quot; = &quot;403&quot; ]; then
    _info &quot;The account is already deactivated.&quot;
    _accid=$(_getfield &quot;$_accUri&quot; &quot;999&quot; &quot;/&quot;)
  else
    _err &quot;Deactivate: account failed for $_accUri.&quot;
    return 1
  fi

  _debug &quot;Account id: $_accid&quot;
  if [ &quot;$_accid&quot; ]; then
    _deactivated_account_path=&quot;$CA_DIR/deactivated/$_accid&quot;
    _debug _deactivated_account_path &quot;$_deactivated_account_path&quot;
    if mkdir -p &quot;$_deactivated_account_path&quot;; then
      _info &quot;Moving deactivated account info to $_deactivated_account_path/&quot;
      mv &quot;$CA_CONF&quot; &quot;$_deactivated_account_path/&quot;
      mv &quot;$ACCOUNT_JSON_PATH&quot; &quot;$_deactivated_account_path/&quot;
      mv &quot;$ACCOUNT_KEY_PATH&quot; &quot;$_deactivated_account_path/&quot;
    else
      _err &quot;Can not create dir: $_deactivated_account_path, try to remove the deactivated account key.&quot;
      rm -f &quot;$CA_CONF&quot;
      rm -f &quot;$ACCOUNT_JSON_PATH&quot;
      rm -f &quot;$ACCOUNT_KEY_PATH&quot;
    fi
  fi
}

# domain folder  file
_findHook() {
  _hookdomain=&quot;$1&quot;
  _hookcat=&quot;$2&quot;
  _hookname=&quot;$3&quot;

  if [ -f &quot;$_SCRIPT_HOME/$_hookcat/$_hookname&quot; ]; then
    d_api=&quot;$_SCRIPT_HOME/$_hookcat/$_hookname&quot;
  elif [ -f &quot;$_SCRIPT_HOME/$_hookcat/$_hookname.sh&quot; ]; then
    d_api=&quot;$_SCRIPT_HOME/$_hookcat/$_hookname.sh&quot;
  elif [ &quot;$_hookdomain&quot; ] &amp;&amp; [ -f &quot;$LE_WORKING_DIR/$_hookdomain/$_hookname&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookdomain/$_hookname&quot;
  elif [ &quot;$_hookdomain&quot; ] &amp;&amp; [ -f &quot;$LE_WORKING_DIR/$_hookdomain/$_hookname.sh&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookdomain/$_hookname.sh&quot;
  elif [ -f &quot;$LE_WORKING_DIR/$_hookname&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookname&quot;
  elif [ -f &quot;$LE_WORKING_DIR/$_hookname.sh&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookname.sh&quot;
  elif [ -f &quot;$LE_WORKING_DIR/$_hookcat/$_hookname&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookcat/$_hookname&quot;
  elif [ -f &quot;$LE_WORKING_DIR/$_hookcat/$_hookname.sh&quot; ]; then
    d_api=&quot;$LE_WORKING_DIR/$_hookcat/$_hookname.sh&quot;
  fi

  printf &quot;%s&quot; &quot;$d_api&quot;
}

#domain
__get_domain_new_authz() {
  _gdnd=&quot;$1&quot;
  _info &quot;Getting new-authz for domain&quot; &quot;$_gdnd&quot;
  _initAPI
  _Max_new_authz_retry_times=5
  _authz_i=0
  while [ &quot;$_authz_i&quot; -lt &quot;$_Max_new_authz_retry_times&quot; ]; do
    _debug &quot;Try new-authz for the $_authz_i time.&quot;
    if ! _send_signed_request &quot;${ACME_NEW_AUTHZ}&quot; &quot;{\&quot;resource\&quot;: \&quot;new-authz\&quot;, \&quot;identifier\&quot;: {\&quot;type\&quot;: \&quot;dns\&quot;, \&quot;value\&quot;: \&quot;$(_idn &quot;$_gdnd&quot;)\&quot;}}&quot;; then
      _err &quot;Can not get domain new authz.&quot;
      return 1
    fi
    if _contains &quot;$response&quot; &quot;No registration exists matching provided key&quot;; then
      _err &quot;It seems there is an error, but it's recovered now, please try again.&quot;
      _err &quot;If you see this message for a second time, please report bug: $(__green &quot;$PROJECT&quot;)&quot;
      _clearcaconf &quot;CA_KEY_HASH&quot;
      break
    fi
    if ! _contains &quot;$response&quot; &quot;An error occurred while processing your request&quot;; then
      _info &quot;The new-authz request is ok.&quot;
      break
    fi
    _authz_i=&quot;$(_math &quot;$_authz_i&quot; + 1)&quot;
    _info &quot;The server is busy, Sleep $_authz_i to retry.&quot;
    _sleep &quot;$_authz_i&quot;
  done

  if [ &quot;$_authz_i&quot; = &quot;$_Max_new_authz_retry_times&quot; ]; then
    _err &quot;new-authz retry reach the max $_Max_new_authz_retry_times times.&quot;
  fi

  if [ &quot;$code&quot; ] &amp;&amp; [ &quot;$code&quot; != '201' ]; then
    _err &quot;new-authz error: $response&quot;
    return 1
  fi

}

#uri keyAuthorization
__trigger_validation() {
  _debug2 &quot;Trigger domain validation.&quot;
  _t_url=&quot;$1&quot;
  _debug2 _t_url &quot;$_t_url&quot;
  _t_key_authz=&quot;$2&quot;
  _debug2 _t_key_authz &quot;$_t_key_authz&quot;
  _t_vtype=&quot;$3&quot;
  _debug2 _t_vtype &quot;$_t_vtype&quot;
  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    _send_signed_request &quot;$_t_url&quot; &quot;{}&quot;
  else
    _send_signed_request &quot;$_t_url&quot; &quot;{\&quot;resource\&quot;: \&quot;challenge\&quot;, \&quot;type\&quot;: \&quot;$_t_vtype\&quot;, \&quot;keyAuthorization\&quot;: \&quot;$_t_key_authz\&quot;}&quot;
  fi
}

#endpoint  domain type
_ns_lookup_impl() {
  _ns_ep=&quot;$1&quot;
  _ns_domain=&quot;$2&quot;
  _ns_type=&quot;$3&quot;
  _debug2 &quot;_ns_ep&quot; &quot;$_ns_ep&quot;
  _debug2 &quot;_ns_domain&quot; &quot;$_ns_domain&quot;
  _debug2 &quot;_ns_type&quot; &quot;$_ns_type&quot;

  response=&quot;$(_H1=&quot;accept: application/dns-json&quot; _get &quot;$_ns_ep?name=$_ns_domain&amp;type=$_ns_type&quot;)&quot;
  _ret=$?
  _debug2 &quot;response&quot; &quot;$response&quot;
  if [ &quot;$_ret&quot; != &quot;0&quot; ]; then
    return $_ret
  fi
  _answers=&quot;$(echo &quot;$response&quot; | tr '{}' '&lt;&gt;' | _egrep_o '&quot;Answer&quot;:\[[^]]*]' | tr '&lt;&gt;' '\n\n')&quot;
  _debug2 &quot;_answers&quot; &quot;$_answers&quot;
  echo &quot;$_answers&quot;
}

#domain, type
_ns_lookup_cf() {
  _cf_ld=&quot;$1&quot;
  _cf_ld_type=&quot;$2&quot;
  _cf_ep=&quot;https://cloudflare-dns.com/dns-query&quot;
  _ns_lookup_impl &quot;$_cf_ep&quot; &quot;$_cf_ld&quot; &quot;$_cf_ld_type&quot;
}

#domain, type
_ns_purge_cf() {
  _cf_d=&quot;$1&quot;
  _cf_d_type=&quot;$2&quot;
  _debug &quot;Cloudflare purge $_cf_d_type record for domain $_cf_d&quot;
  _cf_purl=&quot;https://cloudflare-dns.com/api/v1/purge?domain=$_cf_d&amp;type=$_cf_d_type&quot;
  response=&quot;$(_post &quot;&quot; &quot;$_cf_purl&quot;)&quot;
  _debug2 response &quot;$response&quot;
}

#checks if cf server is available
_ns_is_available_cf() {
  if _get &quot;https://cloudflare-dns.com&quot; &gt;/dev/null 2&gt;&amp;1; then
    return 0
  else
    return 1
  fi
}

#domain, type
_ns_lookup_google() {
  _cf_ld=&quot;$1&quot;
  _cf_ld_type=&quot;$2&quot;
  _cf_ep=&quot;https://dns.google/resolve&quot;
  _ns_lookup_impl &quot;$_cf_ep&quot; &quot;$_cf_ld&quot; &quot;$_cf_ld_type&quot;
}

#domain, type
_ns_lookup() {
  if [ -z &quot;$DOH_USE&quot; ]; then
    _debug &quot;Detect dns server first.&quot;
    if _ns_is_available_cf; then
      _debug &quot;Use cloudflare doh server&quot;
      export DOH_USE=$DOH_CLOUDFLARE
    else
      _debug &quot;Use google doh server&quot;
      export DOH_USE=$DOH_GOOGLE
    fi
  fi

  if [ &quot;$DOH_USE&quot; = &quot;$DOH_CLOUDFLARE&quot; ] || [ -z &quot;$DOH_USE&quot; ]; then
    _ns_lookup_cf &quot;$@&quot;
  else
    _ns_lookup_google &quot;$@&quot;
  fi

}

#txtdomain, alias, txt
__check_txt() {
  _c_txtdomain=&quot;$1&quot;
  _c_aliasdomain=&quot;$2&quot;
  _c_txt=&quot;$3&quot;
  _debug &quot;_c_txtdomain&quot; &quot;$_c_txtdomain&quot;
  _debug &quot;_c_aliasdomain&quot; &quot;$_c_aliasdomain&quot;
  _debug &quot;_c_txt&quot; &quot;$_c_txt&quot;
  _answers=&quot;$(_ns_lookup &quot;$_c_aliasdomain&quot; TXT)&quot;
  _contains &quot;$_answers&quot; &quot;$_c_txt&quot;

}

#txtdomain
__purge_txt() {
  _p_txtdomain=&quot;$1&quot;
  _debug _p_txtdomain &quot;$_p_txtdomain&quot;
  if [ &quot;$DOH_USE&quot; = &quot;$DOH_CLOUDFLARE&quot; ] || [ -z &quot;$DOH_USE&quot; ]; then
    _ns_purge_cf &quot;$_p_txtdomain&quot; &quot;TXT&quot;
  else
    _debug &quot;no purge api for google dns api, just sleep 5 secs&quot;
    _sleep 5
  fi

}

#wait and check each dns entries
_check_dns_entries() {
  _success_txt=&quot;,&quot;
  _end_time=&quot;$(_time)&quot;
  _end_time=&quot;$(_math &quot;$_end_time&quot; + 1200)&quot; #let's check no more than 20 minutes.

  while [ &quot;$(_time)&quot; -le &quot;$_end_time&quot; ]; do
    _left=&quot;&quot;
    for entry in $dns_entries; do
      d=$(_getfield &quot;$entry&quot; 1)
      txtdomain=$(_getfield &quot;$entry&quot; 2)
      txtdomain=$(_idn &quot;$txtdomain&quot;)
      aliasDomain=$(_getfield &quot;$entry&quot; 3)
      aliasDomain=$(_idn &quot;$aliasDomain&quot;)
      txt=$(_getfield &quot;$entry&quot; 5)
      d_api=$(_getfield &quot;$entry&quot; 6)
      _debug &quot;d&quot; &quot;$d&quot;
      _debug &quot;txtdomain&quot; &quot;$txtdomain&quot;
      _debug &quot;aliasDomain&quot; &quot;$aliasDomain&quot;
      _debug &quot;txt&quot; &quot;$txt&quot;
      _debug &quot;d_api&quot; &quot;$d_api&quot;
      _info &quot;Checking $d for $aliasDomain&quot;
      if _contains &quot;$_success_txt&quot; &quot;,$txt,&quot;; then
        _info &quot;Already success, continue next one.&quot;
        continue
      fi

      if __check_txt &quot;$txtdomain&quot; &quot;$aliasDomain&quot; &quot;$txt&quot;; then
        _info &quot;Domain $d '$aliasDomain' success.&quot;
        _success_txt=&quot;$_success_txt,$txt,&quot;
        continue
      fi
      _left=1
      _info &quot;Not valid yet, let's wait 10 seconds and check next one.&quot;
      __purge_txt &quot;$txtdomain&quot;
      if [ &quot;$txtdomain&quot; != &quot;$aliasDomain&quot; ]; then
        __purge_txt &quot;$aliasDomain&quot;
      fi
      _sleep 10
    done
    if [ &quot;$_left&quot; ]; then
      _info &quot;Let's wait 10 seconds and check again&quot;.
      _sleep 10
    else
      _info &quot;All success, let's return&quot;
      return 0
    fi
  done
  _info &quot;Timed out waiting for DNS.&quot;
  return 1

}

#webroot, domain domainlist  keylength
issue() {
  if [ -z &quot;$2&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --issue  -d  a.com  -w /path/to/webroot/a.com/ &quot;
    return 1
  fi
  if [ -z &quot;$1&quot; ]; then
    _usage &quot;Please specify at least one validation method: '--webroot', '--standalone', '--apache', '--nginx' or '--dns' etc.&quot;
    return 1
  fi
  _web_roots=&quot;$1&quot;
  _main_domain=&quot;$2&quot;
  _alt_domains=&quot;$3&quot;

  if _contains &quot;$_main_domain&quot; &quot;,&quot;; then
    _main_domain=$(echo &quot;$2,$3&quot; | cut -d , -f 1)
    _alt_domains=$(echo &quot;$2,$3&quot; | cut -d , -f 2- | sed &quot;s/,${NO_VALUE}$//&quot;)
  fi
  _debug _main_domain &quot;$_main_domain&quot;
  _debug _alt_domains &quot;$_alt_domains&quot;

  _key_length=&quot;$4&quot;
  _real_cert=&quot;$5&quot;
  _real_key=&quot;$6&quot;
  _real_ca=&quot;$7&quot;
  _reload_cmd=&quot;$8&quot;
  _real_fullchain=&quot;$9&quot;
  _pre_hook=&quot;${10}&quot;
  _post_hook=&quot;${11}&quot;
  _renew_hook=&quot;${12}&quot;
  _local_addr=&quot;${13}&quot;
  _challenge_alias=&quot;${14}&quot;
  #remove these later.
  if [ &quot;$_web_roots&quot; = &quot;dns-cf&quot; ]; then
    _web_roots=&quot;dns_cf&quot;
  fi
  if [ &quot;$_web_roots&quot; = &quot;dns-dp&quot; ]; then
    _web_roots=&quot;dns_dp&quot;
  fi
  if [ &quot;$_web_roots&quot; = &quot;dns-cx&quot; ]; then
    _web_roots=&quot;dns_cx&quot;
  fi

  if [ ! &quot;$IS_RENEW&quot; ]; then
    _initpath &quot;$_main_domain&quot; &quot;$_key_length&quot;
    mkdir -p &quot;$DOMAIN_PATH&quot;
  fi

  if _hasfield &quot;$_web_roots&quot; &quot;$W_DNS&quot; &amp;&amp; [ -z &quot;$FORCE_DNS_MANUAL&quot; ]; then
    _err &quot;$_DNS_MANUAL_ERROR&quot;
    return 1
  fi

  _debug &quot;Using ACME_DIRECTORY: $ACME_DIRECTORY&quot;

  _initAPI

  if [ -f &quot;$DOMAIN_CONF&quot; ]; then
    Le_NextRenewTime=$(_readdomainconf Le_NextRenewTime)
    _debug Le_NextRenewTime &quot;$Le_NextRenewTime&quot;
    if [ -z &quot;$FORCE&quot; ] &amp;&amp; [ &quot;$Le_NextRenewTime&quot; ] &amp;&amp; [ &quot;$(_time)&quot; -lt &quot;$Le_NextRenewTime&quot; ]; then
      _saved_domain=$(_readdomainconf Le_Domain)
      _debug _saved_domain &quot;$_saved_domain&quot;
      _saved_alt=$(_readdomainconf Le_Alt)
      _debug _saved_alt &quot;$_saved_alt&quot;
      if [ &quot;$_saved_domain,$_saved_alt&quot; = &quot;$_main_domain,$_alt_domains&quot; ]; then
        _info &quot;Domains not changed.&quot;
        _info &quot;Skip, Next renewal time is: $(__green &quot;$(_readdomainconf Le_NextRenewTimeStr)&quot;)&quot;
        _info &quot;Add '$(__red '--force')' to force to renew.&quot;
        return $RENEW_SKIP
      else
        _info &quot;Domains have changed.&quot;
      fi
    fi
  fi

  _savedomainconf &quot;Le_Domain&quot; &quot;$_main_domain&quot;
  _savedomainconf &quot;Le_Alt&quot; &quot;$_alt_domains&quot;
  _savedomainconf &quot;Le_Webroot&quot; &quot;$_web_roots&quot;

  _savedomainconf &quot;Le_PreHook&quot; &quot;$_pre_hook&quot; &quot;base64&quot;
  _savedomainconf &quot;Le_PostHook&quot; &quot;$_post_hook&quot; &quot;base64&quot;
  _savedomainconf &quot;Le_RenewHook&quot; &quot;$_renew_hook&quot; &quot;base64&quot;

  if [ &quot;$_local_addr&quot; ]; then
    _savedomainconf &quot;Le_LocalAddress&quot; &quot;$_local_addr&quot;
  else
    _cleardomainconf &quot;Le_LocalAddress&quot;
  fi
  if [ &quot;$_challenge_alias&quot; ]; then
    _savedomainconf &quot;Le_ChallengeAlias&quot; &quot;$_challenge_alias&quot;
  else
    _cleardomainconf &quot;Le_ChallengeAlias&quot;
  fi

  if [ &quot;$ACME_DIRECTORY&quot; != &quot;$DEFAULT_CA&quot; ]; then
    Le_API=&quot;$ACME_DIRECTORY&quot;
    _savedomainconf &quot;Le_API&quot; &quot;$Le_API&quot;
  else
    _cleardomainconf Le_API
  fi

  if [ &quot;$_alt_domains&quot; = &quot;$NO_VALUE&quot; ]; then
    _alt_domains=&quot;&quot;
  fi

  if [ &quot;$_key_length&quot; = &quot;$NO_VALUE&quot; ]; then
    _key_length=&quot;&quot;
  fi

  if ! _on_before_issue &quot;$_web_roots&quot; &quot;$_main_domain&quot; &quot;$_alt_domains&quot; &quot;$_pre_hook&quot; &quot;$_local_addr&quot;; then
    _err &quot;_on_before_issue.&quot;
    return 1
  fi

  _saved_account_key_hash=&quot;$(_readcaconf &quot;CA_KEY_HASH&quot;)&quot;
  _debug2 _saved_account_key_hash &quot;$_saved_account_key_hash&quot;

  if [ -z &quot;$ACCOUNT_URL&quot; ] || [ -z &quot;$_saved_account_key_hash&quot; ] || [ &quot;$_saved_account_key_hash&quot; != &quot;$(__calcAccountKeyHash)&quot; ]; then
    if ! _regAccount &quot;$_accountkeylength&quot;; then
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
  else
    _debug &quot;_saved_account_key_hash is not changed, skip register account.&quot;
  fi

  if [ -f &quot;$CSR_PATH&quot; ] &amp;&amp; [ ! -f &quot;$CERT_KEY_PATH&quot; ]; then
    _info &quot;Signing from existing CSR.&quot;
  else
    _key=$(_readdomainconf Le_Keylength)
    _debug &quot;Read key length:$_key&quot;
    if [ ! -f &quot;$CERT_KEY_PATH&quot; ] || [ &quot;$_key_length&quot; != &quot;$_key&quot; ] || [ &quot;$Le_ForceNewDomainKey&quot; = &quot;1&quot; ]; then
      if ! createDomainKey &quot;$_main_domain&quot; &quot;$_key_length&quot;; then
        _err &quot;Create domain key error.&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
    fi

    if ! _createcsr &quot;$_main_domain&quot; &quot;$_alt_domains&quot; &quot;$CERT_KEY_PATH&quot; &quot;$CSR_PATH&quot; &quot;$DOMAIN_SSL_CONF&quot;; then
      _err &quot;Create CSR error.&quot;
      _clearup
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
  fi

  _savedomainconf &quot;Le_Keylength&quot; &quot;$_key_length&quot;

  vlist=&quot;$Le_Vlist&quot;
  _cleardomainconf &quot;Le_Vlist&quot;
  _info &quot;Getting domain auth token for each domain&quot;
  sep='#'
  dvsep=','
  if [ -z &quot;$vlist&quot; ]; then
    if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
      #make new order request
      _identifiers=&quot;{\&quot;type\&quot;:\&quot;dns\&quot;,\&quot;value\&quot;:\&quot;$(_idn &quot;$_main_domain&quot;)\&quot;}&quot;
      _w_index=1
      while true; do
        d=&quot;$(echo &quot;$_alt_domains,&quot; | cut -d , -f &quot;$_w_index&quot;)&quot;
        _w_index=&quot;$(_math &quot;$_w_index&quot; + 1)&quot;
        _debug d &quot;$d&quot;
        if [ -z &quot;$d&quot; ]; then
          break
        fi
        _identifiers=&quot;$_identifiers,{\&quot;type\&quot;:\&quot;dns\&quot;,\&quot;value\&quot;:\&quot;$(_idn &quot;$d&quot;)\&quot;}&quot;
      done
      _debug2 _identifiers &quot;$_identifiers&quot;
      if ! _send_signed_request &quot;$ACME_NEW_ORDER&quot; &quot;{\&quot;identifiers\&quot;: [$_identifiers]}&quot;; then
        _err &quot;Create new order error.&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      Le_LinkOrder=&quot;$(echo &quot;$responseHeaders&quot; | grep -i '^Location.*$' | _tail_n 1 | tr -d &quot;\r\n&quot; | cut -d &quot;:&quot; -f 2-)&quot;
      _debug Le_LinkOrder &quot;$Le_LinkOrder&quot;
      Le_OrderFinalize=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;finalize&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 4)&quot;
      _debug Le_OrderFinalize &quot;$Le_OrderFinalize&quot;
      if [ -z &quot;$Le_OrderFinalize&quot; ]; then
        _err &quot;Create new order error. Le_OrderFinalize not found. $response&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi

      #for dns manual mode
      _savedomainconf &quot;Le_OrderFinalize&quot; &quot;$Le_OrderFinalize&quot;

      _authorizations_seg=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;authorizations&quot; *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '&quot;')&quot;
      _debug2 _authorizations_seg &quot;$_authorizations_seg&quot;
      if [ -z &quot;$_authorizations_seg&quot; ]; then
        _err &quot;_authorizations_seg not found.&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi

      #domain and authz map
      _authorizations_map=&quot;&quot;
      for _authz_url in $(echo &quot;$_authorizations_seg&quot; | tr ',' ' '); do
        _debug2 &quot;_authz_url&quot; &quot;$_authz_url&quot;
        if ! _send_signed_request &quot;$_authz_url&quot;; then
          _err &quot;get to authz error.&quot;
          _err &quot;_authorizations_seg&quot; &quot;$_authorizations_seg&quot;
          _err &quot;_authz_url&quot; &quot;$_authz_url&quot;
          _clearup
          _on_issue_err &quot;$_post_hook&quot;
          return 1
        fi

        response=&quot;$(echo &quot;$response&quot; | _normalizeJson)&quot;
        _debug2 response &quot;$response&quot;
        _d=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;value&quot; *: *&quot;[^&quot;]*&quot;' | cut -d : -f 2 | tr -d ' &quot;')&quot;
        if _contains &quot;$response&quot; &quot;\&quot;wildcard\&quot; *: *true&quot;; then
          _d=&quot;*.$_d&quot;
        fi
        _debug2 _d &quot;$_d&quot;
        _authorizations_map=&quot;$_d,$response
$_authorizations_map&quot;
      done
      _debug2 _authorizations_map &quot;$_authorizations_map&quot;
    fi

    _index=0
    _currentRoot=&quot;&quot;
    _w_index=1
    while true; do
      d=&quot;$(echo &quot;$_main_domain,$_alt_domains,&quot; | cut -d , -f &quot;$_w_index&quot;)&quot;
      _w_index=&quot;$(_math &quot;$_w_index&quot; + 1)&quot;
      _debug d &quot;$d&quot;
      if [ -z &quot;$d&quot; ]; then
        break
      fi
      _info &quot;Getting webroot for domain&quot; &quot;$d&quot;
      _index=$(_math $_index + 1)
      _w=&quot;$(echo $_web_roots | cut -d , -f $_index)&quot;
      _debug _w &quot;$_w&quot;
      if [ &quot;$_w&quot; ]; then
        _currentRoot=&quot;$_w&quot;
      fi
      _debug &quot;_currentRoot&quot; &quot;$_currentRoot&quot;

      vtype=&quot;$VTYPE_HTTP&quot;
      #todo, v2 wildcard force to use dns
      if _startswith &quot;$_currentRoot&quot; &quot;$W_DNS&quot;; then
        vtype=&quot;$VTYPE_DNS&quot;
      fi

      if [ &quot;$_currentRoot&quot; = &quot;$W_ALPN&quot; ]; then
        vtype=&quot;$VTYPE_ALPN&quot;
      fi

      if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
        _idn_d=&quot;$(_idn &quot;$d&quot;)&quot;
        _candindates=&quot;$(echo &quot;$_authorizations_map&quot; | grep -i &quot;^$_idn_d,&quot;)&quot;
        _debug2 _candindates &quot;$_candindates&quot;
        if [ &quot;$(echo &quot;$_candindates&quot; | wc -l)&quot; -gt 1 ]; then
          for _can in $_candindates; do
            if _startswith &quot;$(echo &quot;$_can&quot; | tr '.' '|')&quot; &quot;$(echo &quot;$_idn_d&quot; | tr '.' '|'),&quot;; then
              _candindates=&quot;$_can&quot;
              break
            fi
          done
        fi
        response=&quot;$(echo &quot;$_candindates&quot; | sed &quot;s/$_idn_d,//&quot;)&quot;
        _debug2 &quot;response&quot; &quot;$response&quot;
        if [ -z &quot;$response&quot; ]; then
          _err &quot;get to authz error.&quot;
          _err &quot;_authorizations_map&quot; &quot;$_authorizations_map&quot;
          _clearup
          _on_issue_err &quot;$_post_hook&quot;
          return 1
        fi
      else
        if ! __get_domain_new_authz &quot;$d&quot;; then
          _clearup
          _on_issue_err &quot;$_post_hook&quot;
          return 1
        fi
      fi

      if [ -z &quot;$thumbprint&quot; ]; then
        thumbprint=&quot;$(__calc_account_thumbprint)&quot;
      fi

      entry=&quot;$(echo &quot;$response&quot; | _egrep_o '[^\{]*&quot;type&quot;:&quot;'$vtype'&quot;[^\}]*')&quot;
      _debug entry &quot;$entry&quot;
      if [ -z &quot;$entry&quot; ]; then
        _err &quot;Error, can not get domain token entry $d&quot;
        _supported_vtypes=&quot;$(echo &quot;$response&quot; | _egrep_o &quot;\&quot;challenges\&quot;:\[[^]]*]&quot; | tr '{' &quot;\n&quot; | grep type | cut -d '&quot;' -f 4 | tr &quot;\n&quot; ' ')&quot;
        if [ &quot;$_supported_vtypes&quot; ]; then
          _err &quot;The supported validation types are: $_supported_vtypes, but you specified: $vtype&quot;
        fi
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      token=&quot;$(echo &quot;$entry&quot; | _egrep_o '&quot;token&quot;:&quot;[^&quot;]*' | cut -d : -f 2 | tr -d '&quot;')&quot;
      _debug token &quot;$token&quot;

      if [ -z &quot;$token&quot; ]; then
        _err &quot;Error, can not get domain token $entry&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
        uri=&quot;$(echo &quot;$entry&quot; | _egrep_o '&quot;url&quot;:&quot;[^&quot;]*' | cut -d '&quot;' -f 4 | _head_n 1)&quot;
      else
        uri=&quot;$(echo &quot;$entry&quot; | _egrep_o '&quot;uri&quot;:&quot;[^&quot;]*' | cut -d '&quot;' -f 4)&quot;
      fi
      _debug uri &quot;$uri&quot;

      if [ -z &quot;$uri&quot; ]; then
        _err &quot;Error, can not get domain uri. $entry&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      keyauthorization=&quot;$token.$thumbprint&quot;
      _debug keyauthorization &quot;$keyauthorization&quot;

      if printf &quot;%s&quot; &quot;$response&quot; | grep '&quot;status&quot;:&quot;valid&quot;' &gt;/dev/null 2&gt;&amp;1; then
        _debug &quot;$d is already verified.&quot;
        keyauthorization=&quot;$STATE_VERIFIED&quot;
        _debug keyauthorization &quot;$keyauthorization&quot;
      fi

      dvlist=&quot;$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot&quot;
      _debug dvlist &quot;$dvlist&quot;

      vlist=&quot;$vlist$dvlist$dvsep&quot;

    done
    _debug vlist &quot;$vlist&quot;
    #add entry
    dns_entries=&quot;&quot;
    dnsadded=&quot;&quot;
    ventries=$(echo &quot;$vlist&quot; | tr &quot;$dvsep&quot; ' ')
    _alias_index=1
    for ventry in $ventries; do
      d=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 1)
      keyauthorization=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 2)
      vtype=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 4)
      _currentRoot=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 5)
      _debug d &quot;$d&quot;
      if [ &quot;$keyauthorization&quot; = &quot;$STATE_VERIFIED&quot; ]; then
        _debug &quot;$d is already verified, skip $vtype.&quot;
        _alias_index=&quot;$(_math &quot;$_alias_index&quot; + 1)&quot;
        continue
      fi

      if [ &quot;$vtype&quot; = &quot;$VTYPE_DNS&quot; ]; then
        dnsadded='0'
        _dns_root_d=&quot;$d&quot;
        if _startswith &quot;$_dns_root_d&quot; &quot;*.&quot;; then
          _dns_root_d=&quot;$(echo &quot;$_dns_root_d&quot; | sed 's/*.//')&quot;
        fi
        _d_alias=&quot;$(_getfield &quot;$_challenge_alias&quot; &quot;$_alias_index&quot;)&quot;
        _alias_index=&quot;$(_math &quot;$_alias_index&quot; + 1)&quot;
        _debug &quot;_d_alias&quot; &quot;$_d_alias&quot;
        if [ &quot;$_d_alias&quot; ]; then
          if _startswith &quot;$_d_alias&quot; &quot;$DNS_ALIAS_PREFIX&quot;; then
            txtdomain=&quot;$(echo &quot;$_d_alias&quot; | sed &quot;s/$DNS_ALIAS_PREFIX//&quot;)&quot;
          else
            txtdomain=&quot;_acme-challenge.$_d_alias&quot;
          fi
          dns_entry=&quot;${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$txtdomain$dvsep$_currentRoot&quot;
        else
          txtdomain=&quot;_acme-challenge.$_dns_root_d&quot;
          dns_entry=&quot;${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$dvsep$_currentRoot&quot;
        fi

        _debug txtdomain &quot;$txtdomain&quot;
        txt=&quot;$(printf &quot;%s&quot; &quot;$keyauthorization&quot; | _digest &quot;sha256&quot; | _url_replace)&quot;
        _debug txt &quot;$txt&quot;

        d_api=&quot;$(_findHook &quot;$_dns_root_d&quot; $_SUB_FOLDER_DNSAPI &quot;$_currentRoot&quot;)&quot;
        _debug d_api &quot;$d_api&quot;

        dns_entry=&quot;$dns_entry$dvsep$txt${dvsep}$d_api&quot;
        _debug2 dns_entry &quot;$dns_entry&quot;
        if [ &quot;$d_api&quot; ]; then
          _debug &quot;Found domain api file: $d_api&quot;
        else
          if [ &quot;$_currentRoot&quot; != &quot;$W_DNS&quot; ]; then
            _err &quot;Can not find dns api hook for: $_currentRoot&quot;
            _info &quot;You need to add the txt record manually.&quot;
          fi
          _info &quot;$(__red &quot;Add the following TXT record:&quot;)&quot;
          _info &quot;$(__red &quot;Domain: '$(__green &quot;$txtdomain&quot;)'&quot;)&quot;
          _info &quot;$(__red &quot;TXT value: '$(__green &quot;$txt&quot;)'&quot;)&quot;
          _info &quot;$(__red &quot;Please be aware that you prepend _acme-challenge. before your domain&quot;)&quot;
          _info &quot;$(__red &quot;so the resulting subdomain will be: $txtdomain&quot;)&quot;
          continue
        fi

        (
          if ! . &quot;$d_api&quot;; then
            _err &quot;Load file $d_api error. Please check your api file and try again.&quot;
            return 1
          fi

          addcommand=&quot;${_currentRoot}_add&quot;
          if ! _exists &quot;$addcommand&quot;; then
            _err &quot;It seems that your api file is not correct, it must have a function named: $addcommand&quot;
            return 1
          fi
          _info &quot;Adding txt value: $txt for domain:  $txtdomain&quot;
          if ! $addcommand &quot;$txtdomain&quot; &quot;$txt&quot;; then
            _err &quot;Error add txt for domain:$txtdomain&quot;
            return 1
          fi
          _info &quot;The txt record is added: Success.&quot;
        )

        if [ &quot;$?&quot; != &quot;0&quot; ]; then
          _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
          _clearup
          return 1
        fi
        dns_entries=&quot;$dns_entries$dns_entry
&quot;
        _debug2 &quot;$dns_entries&quot;
        dnsadded='1'
      fi
    done

    if [ &quot;$dnsadded&quot; = '0' ]; then
      _savedomainconf &quot;Le_Vlist&quot; &quot;$vlist&quot;
      _debug &quot;Dns record not added yet, so, save to $DOMAIN_CONF and exit.&quot;
      _err &quot;Please add the TXT records to the domains, and re-run with --renew.&quot;
      _on_issue_err &quot;$_post_hook&quot;
      _clearup
      return 1
    fi

  fi

  if [ &quot;$dns_entries&quot; ]; then
    if [ -z &quot;$Le_DNSSleep&quot; ]; then
      _info &quot;Let's check each dns records now. Sleep 20 seconds first.&quot;
      _sleep 20
      if ! _check_dns_entries; then
        _err &quot;check dns error.&quot;
        _on_issue_err &quot;$_post_hook&quot;
        _clearup
        return 1
      fi
    else
      _savedomainconf &quot;Le_DNSSleep&quot; &quot;$Le_DNSSleep&quot;
      _info &quot;Sleep $(__green $Le_DNSSleep) seconds for the txt records to take effect&quot;
      _sleep &quot;$Le_DNSSleep&quot;
    fi
  fi

  NGINX_RESTORE_VLIST=&quot;&quot;
  _debug &quot;ok, let's start to verify&quot;

  _ncIndex=1
  ventries=$(echo &quot;$vlist&quot; | tr &quot;$dvsep&quot; ' ')
  for ventry in $ventries; do
    d=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 1)
    keyauthorization=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 2)
    uri=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 3)
    vtype=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 4)
    _currentRoot=$(echo &quot;$ventry&quot; | cut -d &quot;$sep&quot; -f 5)

    if [ &quot;$keyauthorization&quot; = &quot;$STATE_VERIFIED&quot; ]; then
      _info &quot;$d is already verified, skip $vtype.&quot;
      continue
    fi

    _info &quot;Verifying: $d&quot;
    _debug &quot;d&quot; &quot;$d&quot;
    _debug &quot;keyauthorization&quot; &quot;$keyauthorization&quot;
    _debug &quot;uri&quot; &quot;$uri&quot;
    removelevel=&quot;&quot;
    token=&quot;$(printf &quot;%s&quot; &quot;$keyauthorization&quot; | cut -d '.' -f 1)&quot;

    _debug &quot;_currentRoot&quot; &quot;$_currentRoot&quot;

    if [ &quot;$vtype&quot; = &quot;$VTYPE_HTTP&quot; ]; then
      if [ &quot;$_currentRoot&quot; = &quot;$NO_VALUE&quot; ]; then
        _info &quot;Standalone mode server&quot;
        _ncaddr=&quot;$(_getfield &quot;$_local_addr&quot; &quot;$_ncIndex&quot;)&quot;
        _ncIndex=&quot;$(_math $_ncIndex + 1)&quot;
        _startserver &quot;$keyauthorization&quot; &quot;$_ncaddr&quot;
        if [ &quot;$?&quot; != &quot;0&quot; ]; then
          _clearup
          _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
          return 1
        fi
        sleep 1
        _debug serverproc &quot;$serverproc&quot;
      elif [ &quot;$_currentRoot&quot; = &quot;$MODE_STATELESS&quot; ]; then
        _info &quot;Stateless mode for domain:$d&quot;
        _sleep 1
      elif _startswith &quot;$_currentRoot&quot; &quot;$NGINX&quot;; then
        _info &quot;Nginx mode for domain:$d&quot;
        #set up nginx server
        FOUND_REAL_NGINX_CONF=&quot;&quot;
        BACKUP_NGINX_CONF=&quot;&quot;
        if ! _setNginx &quot;$d&quot; &quot;$_currentRoot&quot; &quot;$thumbprint&quot;; then
          _clearup
          _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
          return 1
        fi

        if [ &quot;$FOUND_REAL_NGINX_CONF&quot; ]; then
          _realConf=&quot;$FOUND_REAL_NGINX_CONF&quot;
          _backup=&quot;$BACKUP_NGINX_CONF&quot;
          _debug _realConf &quot;$_realConf&quot;
          NGINX_RESTORE_VLIST=&quot;$d$sep$_realConf$sep$_backup$dvsep$NGINX_RESTORE_VLIST&quot;
        fi
        _sleep 1
      else
        if [ &quot;$_currentRoot&quot; = &quot;apache&quot; ]; then
          wellknown_path=&quot;$ACME_DIR&quot;
        else
          wellknown_path=&quot;$_currentRoot/.well-known/acme-challenge&quot;
          if [ ! -d &quot;$_currentRoot/.well-known&quot; ]; then
            removelevel='1'
          elif [ ! -d &quot;$_currentRoot/.well-known/acme-challenge&quot; ]; then
            removelevel='2'
          else
            removelevel='3'
          fi
        fi

        _debug wellknown_path &quot;$wellknown_path&quot;

        _debug &quot;writing token:$token to $wellknown_path/$token&quot;

        mkdir -p &quot;$wellknown_path&quot;

        if ! printf &quot;%s&quot; &quot;$keyauthorization&quot; &gt;&quot;$wellknown_path/$token&quot;; then
          _err &quot;$d:Can not write token to file : $wellknown_path/$token&quot;
          _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
          _clearup
          _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
          return 1
        fi

        if [ ! &quot;$usingApache&quot; ]; then
          if webroot_owner=$(_stat &quot;$_currentRoot&quot;); then
            _debug &quot;Changing owner/group of .well-known to $webroot_owner&quot;
            if ! _exec &quot;chown -R \&quot;$webroot_owner\&quot; \&quot;$_currentRoot/.well-known\&quot;&quot;; then
              _debug &quot;$(cat &quot;$_EXEC_TEMP_ERR&quot;)&quot;
              _exec_err &gt;/dev/null 2&gt;&amp;1
            fi
          else
            _debug &quot;not changing owner/group of webroot&quot;
          fi
        fi

      fi
    elif [ &quot;$vtype&quot; = &quot;$VTYPE_ALPN&quot; ]; then
      acmevalidationv1=&quot;$(printf &quot;%s&quot; &quot;$keyauthorization&quot; | _digest &quot;sha256&quot; &quot;hex&quot;)&quot;
      _debug acmevalidationv1 &quot;$acmevalidationv1&quot;
      if ! _starttlsserver &quot;$d&quot; &quot;&quot; &quot;$Le_TLSPort&quot; &quot;$keyauthorization&quot; &quot;$_ncaddr&quot; &quot;$acmevalidationv1&quot;; then
        _err &quot;Start tls server error.&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi
    fi

    if ! __trigger_validation &quot;$uri&quot; &quot;$keyauthorization&quot; &quot;$vtype&quot;; then
      _err &quot;$d:Can not get challenge: $response&quot;
      _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
      _clearup
      _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
      return 1
    fi

    if [ &quot;$code&quot; ] &amp;&amp; [ &quot;$code&quot; != '202' ]; then
      if [ &quot;$code&quot; = '200' ]; then
        _debug &quot;trigger validation code: $code&quot;
      else
        _err &quot;$d:Challenge error: $response&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi
    fi

    waittimes=0
    if [ -z &quot;$MAX_RETRY_TIMES&quot; ]; then
      MAX_RETRY_TIMES=30
    fi

    while true; do
      waittimes=$(_math &quot;$waittimes&quot; + 1)
      if [ &quot;$waittimes&quot; -ge &quot;$MAX_RETRY_TIMES&quot; ]; then
        _err &quot;$d:Timeout&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi

      _debug &quot;sleep 2 secs to verify&quot;
      sleep 2
      _debug &quot;checking&quot;
      if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
        _send_signed_request &quot;$uri&quot;
      else
        response=&quot;$(_get &quot;$uri&quot;)&quot;
      fi
      if [ &quot;$?&quot; != &quot;0&quot; ]; then
        _err &quot;$d:Verify error:$response&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi
      _debug2 original &quot;$response&quot;

      response=&quot;$(echo &quot;$response&quot; | _normalizeJson)&quot;
      _debug2 response &quot;$response&quot;

      status=$(echo &quot;$response&quot; | _egrep_o '&quot;status&quot;:&quot;[^&quot;]*' | cut -d : -f 2 | tr -d '&quot;')
      if [ &quot;$status&quot; = &quot;valid&quot; ]; then
        _info &quot;$(__green Success)&quot;
        _stopserver &quot;$serverproc&quot;
        serverproc=&quot;&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        break
      fi

      if [ &quot;$status&quot; = &quot;invalid&quot; ]; then
        error=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;error&quot;:\{[^\}]*')&quot;
        _debug2 error &quot;$error&quot;
        errordetail=&quot;$(echo &quot;$error&quot; | _egrep_o '&quot;detail&quot;: *&quot;[^&quot;]*' | cut -d '&quot;' -f 4)&quot;
        _debug2 errordetail &quot;$errordetail&quot;
        if [ &quot;$errordetail&quot; ]; then
          _err &quot;$d:Verify error:$errordetail&quot;
        else
          _err &quot;$d:Verify error:$error&quot;
        fi
        if [ &quot;$DEBUG&quot; ]; then
          if [ &quot;$vtype&quot; = &quot;$VTYPE_HTTP&quot; ]; then
            _debug &quot;Debug: get token url.&quot;
            _get &quot;http://$d/.well-known/acme-challenge/$token&quot; &quot;&quot; 1
          fi
        fi
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi

      if [ &quot;$status&quot; = &quot;pending&quot; ]; then
        _info &quot;Pending&quot;
      elif [ &quot;$status&quot; = &quot;processing&quot; ]; then
        _info &quot;Processing&quot;
      else
        _err &quot;$d:Verify error:$response&quot;
        _clearupwebbroot &quot;$_currentRoot&quot; &quot;$removelevel&quot; &quot;$token&quot;
        _clearup
        _on_issue_err &quot;$_post_hook&quot; &quot;$vlist&quot;
        return 1
      fi

    done

  done

  _clearup
  _info &quot;Verify finished, start to sign.&quot;
  der=&quot;$(_getfile &quot;${CSR_PATH}&quot; &quot;${BEGIN_CSR}&quot; &quot;${END_CSR}&quot; | tr -d &quot;\r\n&quot; | _url_replace)&quot;

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    _info &quot;Lets finalize the order, Le_OrderFinalize: $Le_OrderFinalize&quot;
    if ! _send_signed_request &quot;${Le_OrderFinalize}&quot; &quot;{\&quot;csr\&quot;: \&quot;$der\&quot;}&quot;; then
      _err &quot;Sign failed.&quot;
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
    if [ &quot;$code&quot; != &quot;200&quot; ]; then
      _err &quot;Sign failed, finalize code is not 200.&quot;
      _err &quot;$response&quot;
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
    if [ -z &quot;$Le_LinkOrder&quot; ]; then
      Le_LinkOrder=&quot;$(echo &quot;$responseHeaders&quot; | grep -i '^Location.*$' | _tail_n 1 | tr -d &quot;\r\n&quot; | cut -d &quot;:&quot; -f 2-)&quot;
    fi

    _savedomainconf &quot;Le_LinkOrder&quot; &quot;$Le_LinkOrder&quot;

    _link_cert_retry=0
    _MAX_CERT_RETRY=5
    while [ &quot;$_link_cert_retry&quot; -lt &quot;$_MAX_CERT_RETRY&quot; ]; do
      if _contains &quot;$response&quot; &quot;\&quot;status\&quot;:\&quot;valid\&quot;&quot;; then
        _debug &quot;Order status is valid.&quot;
        Le_LinkCert=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;certificate&quot; *: *&quot;[^&quot;]*&quot;' | cut -d '&quot;' -f 4)&quot;
        _debug Le_LinkCert &quot;$Le_LinkCert&quot;
        if [ -z &quot;$Le_LinkCert&quot; ]; then
          _err &quot;Sign error, can not find Le_LinkCert&quot;
          _err &quot;$response&quot;
          _on_issue_err &quot;$_post_hook&quot;
          return 1
        fi
        break
      elif _contains &quot;$response&quot; &quot;\&quot;processing\&quot;&quot;; then
        _info &quot;Order status is processing, lets sleep and retry.&quot;
        _sleep 2
      else
        _err &quot;Sign error, wrong status&quot;
        _err &quot;$response&quot;
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      #the order is processing, so we are going to poll order status
      if [ -z &quot;$Le_LinkOrder&quot; ]; then
        _err &quot;Sign error, can not get order link location header&quot;
        _err &quot;responseHeaders&quot; &quot;$responseHeaders&quot;
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      _info &quot;Polling order status: $Le_LinkOrder&quot;
      if ! _send_signed_request &quot;$Le_LinkOrder&quot;; then
        _err &quot;Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder.&quot;
        _err &quot;$response&quot;
        _on_issue_err &quot;$_post_hook&quot;
        return 1
      fi
      _link_cert_retry=&quot;$(_math $_link_cert_retry + 1)&quot;
    done

    if [ -z &quot;$Le_LinkCert&quot; ]; then
      _err &quot;Sign failed, can not get Le_LinkCert, retry time limit.&quot;
      _err &quot;$response&quot;
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
    _info &quot;Download cert, Le_LinkCert: $Le_LinkCert&quot;
    if ! _send_signed_request &quot;$Le_LinkCert&quot;; then
      _err &quot;Sign failed, can not download cert:$Le_LinkCert.&quot;
      _err &quot;$response&quot;
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi

    echo &quot;$response&quot; &gt;&quot;$CERT_PATH&quot;

    if [ &quot;$(grep -- &quot;$BEGIN_CERT&quot; &quot;$CERT_PATH&quot; | wc -l)&quot; -gt &quot;1&quot; ]; then
      _debug &quot;Found cert chain&quot;
      cat &quot;$CERT_PATH&quot; &gt;&quot;$CERT_FULLCHAIN_PATH&quot;
      _end_n=&quot;$(grep -n -- &quot;$END_CERT&quot; &quot;$CERT_FULLCHAIN_PATH&quot; | _head_n 1 | cut -d : -f 1)&quot;
      _debug _end_n &quot;$_end_n&quot;
      sed -n &quot;1,${_end_n}p&quot; &quot;$CERT_FULLCHAIN_PATH&quot; &gt;&quot;$CERT_PATH&quot;
      _end_n=&quot;$(_math $_end_n + 1)&quot;
      sed -n &quot;${_end_n},9999p&quot; &quot;$CERT_FULLCHAIN_PATH&quot; &gt;&quot;$CA_CERT_PATH&quot;
    fi

  else
    if ! _send_signed_request &quot;${ACME_NEW_ORDER}&quot; &quot;{\&quot;resource\&quot;: \&quot;$ACME_NEW_ORDER_RES\&quot;, \&quot;csr\&quot;: \&quot;$der\&quot;}&quot; &quot;needbase64&quot;; then
      _err &quot;Sign failed. $response&quot;
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi
    _rcert=&quot;$response&quot;
    Le_LinkCert=&quot;$(grep -i '^Location.*$' &quot;$HTTP_HEADER&quot; | _tail_n 1 | tr -d &quot;\r\n&quot; | cut -d &quot; &quot; -f 2)&quot;
    echo &quot;$BEGIN_CERT&quot; &gt;&quot;$CERT_PATH&quot;

    #if ! _get &quot;$Le_LinkCert&quot; | _base64 &quot;multiline&quot;  &gt;&gt; &quot;$CERT_PATH&quot; ; then
    #  _debug &quot;Get cert failed. Let's try last response.&quot;
    #  printf -- &quot;%s&quot; &quot;$_rcert&quot; | _dbase64 &quot;multiline&quot; | _base64 &quot;multiline&quot; &gt;&gt; &quot;$CERT_PATH&quot;
    #fi

    if ! printf -- &quot;%s&quot; &quot;$_rcert&quot; | _dbase64 &quot;multiline&quot; | _base64 &quot;multiline&quot; &gt;&gt;&quot;$CERT_PATH&quot;; then
      _debug &quot;Try cert link.&quot;
      _get &quot;$Le_LinkCert&quot; | _base64 &quot;multiline&quot; &gt;&gt;&quot;$CERT_PATH&quot;
    fi

    echo &quot;$END_CERT&quot; &gt;&gt;&quot;$CERT_PATH&quot;
  fi

  _debug &quot;Le_LinkCert&quot; &quot;$Le_LinkCert&quot;
  _savedomainconf &quot;Le_LinkCert&quot; &quot;$Le_LinkCert&quot;

  if [ -z &quot;$Le_LinkCert&quot; ] || ! _checkcert &quot;$CERT_PATH&quot;; then
    response=&quot;$(echo &quot;$response&quot; | _dbase64 &quot;multiline&quot; | tr -d '\0' | _normalizeJson)&quot;
    _err &quot;Sign failed: $(echo &quot;$response&quot; | _egrep_o '&quot;detail&quot;:&quot;[^&quot;]*&quot;')&quot;
    _on_issue_err &quot;$_post_hook&quot;
    return 1
  fi

  if [ &quot;$Le_LinkCert&quot; ]; then
    _info &quot;$(__green &quot;Cert success.&quot;)&quot;
    cat &quot;$CERT_PATH&quot;

    _info &quot;Your cert is in $(__green &quot; $CERT_PATH &quot;)&quot;

    if [ -f &quot;$CERT_KEY_PATH&quot; ]; then
      _info &quot;Your cert key is in $(__green &quot; $CERT_KEY_PATH &quot;)&quot;
    fi

    if [ ! &quot;$USER_PATH&quot; ] || [ ! &quot;$ACME_IN_CRON&quot; ]; then
      USER_PATH=&quot;$PATH&quot;
      _saveaccountconf &quot;USER_PATH&quot; &quot;$USER_PATH&quot;
    fi
  fi

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    _debug &quot;v2 chain.&quot;
  else
    cp &quot;$CERT_PATH&quot; &quot;$CERT_FULLCHAIN_PATH&quot;
    Le_LinkIssuer=$(grep -i '^Link' &quot;$HTTP_HEADER&quot; | _head_n 1 | cut -d &quot; &quot; -f 2 | cut -d ';' -f 1 | tr -d '&lt;&gt;')

    if [ &quot;$Le_LinkIssuer&quot; ]; then
      if ! _contains &quot;$Le_LinkIssuer&quot; &quot;:&quot;; then
        _info &quot;$(__red &quot;Relative issuer link found.&quot;)&quot;
        Le_LinkIssuer=&quot;$_ACME_SERVER_HOST$Le_LinkIssuer&quot;
      fi
      _debug Le_LinkIssuer &quot;$Le_LinkIssuer&quot;
      _savedomainconf &quot;Le_LinkIssuer&quot; &quot;$Le_LinkIssuer&quot;

      _link_issuer_retry=0
      _MAX_ISSUER_RETRY=5
      while [ &quot;$_link_issuer_retry&quot; -lt &quot;$_MAX_ISSUER_RETRY&quot; ]; do
        _debug _link_issuer_retry &quot;$_link_issuer_retry&quot;
        if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
          if _send_signed_request &quot;$Le_LinkIssuer&quot;; then
            echo &quot;$response&quot; &gt;&quot;$CA_CERT_PATH&quot;
            break
          fi
        else
          if _get &quot;$Le_LinkIssuer&quot; &gt;&quot;$CA_CERT_PATH.der&quot;; then
            echo &quot;$BEGIN_CERT&quot; &gt;&quot;$CA_CERT_PATH&quot;
            _base64 &quot;multiline&quot; &lt;&quot;$CA_CERT_PATH.der&quot; &gt;&gt;&quot;$CA_CERT_PATH&quot;
            echo &quot;$END_CERT&quot; &gt;&gt;&quot;$CA_CERT_PATH&quot;
            if ! _checkcert &quot;$CA_CERT_PATH&quot;; then
              _err &quot;Can not get the ca cert.&quot;
              break
            fi
            cat &quot;$CA_CERT_PATH&quot; &gt;&gt;&quot;$CERT_FULLCHAIN_PATH&quot;
            rm -f &quot;$CA_CERT_PATH.der&quot;
            break
          fi
        fi
        _link_issuer_retry=$(_math $_link_issuer_retry + 1)
        _sleep &quot;$_link_issuer_retry&quot;
      done
      if [ &quot;$_link_issuer_retry&quot; = &quot;$_MAX_ISSUER_RETRY&quot; ]; then
        _err &quot;Max retry for issuer ca cert is reached.&quot;
      fi
    else
      _debug &quot;No Le_LinkIssuer header found.&quot;
    fi
  fi
  [ -f &quot;$CA_CERT_PATH&quot; ] &amp;&amp; _info &quot;The intermediate CA cert is in $(__green &quot; $CA_CERT_PATH &quot;)&quot;
  [ -f &quot;$CERT_FULLCHAIN_PATH&quot; ] &amp;&amp; _info &quot;And the full chain certs is there: $(__green &quot; $CERT_FULLCHAIN_PATH &quot;)&quot;

  Le_CertCreateTime=$(_time)
  _savedomainconf &quot;Le_CertCreateTime&quot; &quot;$Le_CertCreateTime&quot;

  Le_CertCreateTimeStr=$(date -u)
  _savedomainconf &quot;Le_CertCreateTimeStr&quot; &quot;$Le_CertCreateTimeStr&quot;

  if [ -z &quot;$Le_RenewalDays&quot; ] || [ &quot;$Le_RenewalDays&quot; -lt &quot;0&quot; ]; then
    Le_RenewalDays=&quot;$DEFAULT_RENEW&quot;
  else
    _savedomainconf &quot;Le_RenewalDays&quot; &quot;$Le_RenewalDays&quot;
  fi

  if [ &quot;$CA_BUNDLE&quot; ]; then
    _saveaccountconf CA_BUNDLE &quot;$CA_BUNDLE&quot;
  else
    _clearaccountconf &quot;CA_BUNDLE&quot;
  fi

  if [ &quot;$CA_PATH&quot; ]; then
    _saveaccountconf CA_PATH &quot;$CA_PATH&quot;
  else
    _clearaccountconf &quot;CA_PATH&quot;
  fi

  if [ &quot;$HTTPS_INSECURE&quot; ]; then
    _saveaccountconf HTTPS_INSECURE &quot;$HTTPS_INSECURE&quot;
  else
    _clearaccountconf &quot;HTTPS_INSECURE&quot;
  fi

  if [ &quot;$Le_Listen_V4&quot; ]; then
    _savedomainconf &quot;Le_Listen_V4&quot; &quot;$Le_Listen_V4&quot;
    _cleardomainconf Le_Listen_V6
  elif [ &quot;$Le_Listen_V6&quot; ]; then
    _savedomainconf &quot;Le_Listen_V6&quot; &quot;$Le_Listen_V6&quot;
    _cleardomainconf Le_Listen_V4
  fi

  if [ &quot;$Le_ForceNewDomainKey&quot; = &quot;1&quot; ]; then
    _savedomainconf &quot;Le_ForceNewDomainKey&quot; &quot;$Le_ForceNewDomainKey&quot;
  else
    _cleardomainconf Le_ForceNewDomainKey
  fi

  Le_NextRenewTime=$(_math &quot;$Le_CertCreateTime&quot; + &quot;$Le_RenewalDays&quot; \* 24 \* 60 \* 60)

  Le_NextRenewTimeStr=$(_time2str &quot;$Le_NextRenewTime&quot;)
  _savedomainconf &quot;Le_NextRenewTimeStr&quot; &quot;$Le_NextRenewTimeStr&quot;

  Le_NextRenewTime=$(_math &quot;$Le_NextRenewTime&quot; - 86400)
  _savedomainconf &quot;Le_NextRenewTime&quot; &quot;$Le_NextRenewTime&quot;

  if [ &quot;$_real_cert$_real_key$_real_ca$_reload_cmd$_real_fullchain&quot; ]; then
    _savedomainconf &quot;Le_RealCertPath&quot; &quot;$_real_cert&quot;
    _savedomainconf &quot;Le_RealCACertPath&quot; &quot;$_real_ca&quot;
    _savedomainconf &quot;Le_RealKeyPath&quot; &quot;$_real_key&quot;
    _savedomainconf &quot;Le_ReloadCmd&quot; &quot;$_reload_cmd&quot; &quot;base64&quot;
    _savedomainconf &quot;Le_RealFullChainPath&quot; &quot;$_real_fullchain&quot;
    if ! _installcert &quot;$_main_domain&quot; &quot;$_real_cert&quot; &quot;$_real_key&quot; &quot;$_real_ca&quot; &quot;$_real_fullchain&quot; &quot;$_reload_cmd&quot;; then
      return 1
    fi
  fi

  if ! _on_issue_success &quot;$_post_hook&quot; &quot;$_renew_hook&quot;; then
    _err &quot;Call hook error.&quot;
    return 1
  fi
}

#domain  [isEcc]
renew() {
  Le_Domain=&quot;$1&quot;
  if [ -z &quot;$Le_Domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --renew  -d domain.com [--ecc]&quot;
    return 1
  fi

  _isEcc=&quot;$2&quot;

  _initpath &quot;$Le_Domain&quot; &quot;$_isEcc&quot;

  _info &quot;$(__green &quot;Renew: '$Le_Domain'&quot;)&quot;
  if [ ! -f &quot;$DOMAIN_CONF&quot; ]; then
    _info &quot;'$Le_Domain' is not a issued domain, skip.&quot;
    return $RENEW_SKIP
  fi

  if [ &quot;$Le_RenewalDays&quot; ]; then
    _savedomainconf Le_RenewalDays &quot;$Le_RenewalDays&quot;
  fi

  . &quot;$DOMAIN_CONF&quot;
  _debug Le_API &quot;$Le_API&quot;

  if [ &quot;$Le_API&quot; = &quot;$LETSENCRYPT_CA_V1&quot; ]; then
    _cleardomainconf Le_API
    Le_API=&quot;$DEFAULT_CA&quot;
  fi
  if [ &quot;$Le_API&quot; = &quot;$LETSENCRYPT_STAGING_CA_V1&quot; ]; then
    _cleardomainconf Le_API
    Le_API=&quot;$DEFAULT_STAGING_CA&quot;
  fi

  if [ &quot;$Le_API&quot; ]; then
    if [ &quot;$_OLD_CA_HOST&quot; = &quot;$Le_API&quot; ]; then
      export Le_API=&quot;$DEFAULT_CA&quot;
      _savedomainconf Le_API &quot;$Le_API&quot;
    fi
    if [ &quot;$_OLD_STAGE_CA_HOST&quot; = &quot;$Le_API&quot; ]; then
      export Le_API=&quot;$DEFAULT_STAGING_CA&quot;
      _savedomainconf Le_API &quot;$Le_API&quot;
    fi
    export ACME_DIRECTORY=&quot;$Le_API&quot;
    #reload ca configs
    ACCOUNT_KEY_PATH=&quot;&quot;
    ACCOUNT_JSON_PATH=&quot;&quot;
    CA_CONF=&quot;&quot;
    _debug3 &quot;initpath again.&quot;
    _initpath &quot;$Le_Domain&quot; &quot;$_isEcc&quot;
  fi

  if [ -z &quot;$FORCE&quot; ] &amp;&amp; [ &quot;$Le_NextRenewTime&quot; ] &amp;&amp; [ &quot;$(_time)&quot; -lt &quot;$Le_NextRenewTime&quot; ]; then
    _info &quot;Skip, Next renewal time is: $(__green &quot;$Le_NextRenewTimeStr&quot;)&quot;
    _info &quot;Add '$(__red '--force')' to force to renew.&quot;
    return &quot;$RENEW_SKIP&quot;
  fi

  if [ &quot;$ACME_IN_CRON&quot; = &quot;1&quot; ] &amp;&amp; [ -z &quot;$Le_CertCreateTime&quot; ]; then
    _info &quot;Skip invalid cert for: $Le_Domain&quot;
    return $RENEW_SKIP
  fi

  IS_RENEW=&quot;1&quot;
  Le_ReloadCmd=&quot;$(_readdomainconf Le_ReloadCmd)&quot;
  Le_PreHook=&quot;$(_readdomainconf Le_PreHook)&quot;
  Le_PostHook=&quot;$(_readdomainconf Le_PostHook)&quot;
  Le_RenewHook=&quot;$(_readdomainconf Le_RenewHook)&quot;
  issue &quot;$Le_Webroot&quot; &quot;$Le_Domain&quot; &quot;$Le_Alt&quot; &quot;$Le_Keylength&quot; &quot;$Le_RealCertPath&quot; &quot;$Le_RealKeyPath&quot; &quot;$Le_RealCACertPath&quot; &quot;$Le_ReloadCmd&quot; &quot;$Le_RealFullChainPath&quot; &quot;$Le_PreHook&quot; &quot;$Le_PostHook&quot; &quot;$Le_RenewHook&quot; &quot;$Le_LocalAddress&quot; &quot;$Le_ChallengeAlias&quot;
  res=&quot;$?&quot;
  if [ &quot;$res&quot; != &quot;0&quot; ]; then
    return &quot;$res&quot;
  fi

  if [ &quot;$Le_DeployHook&quot; ]; then
    _deploy &quot;$Le_Domain&quot; &quot;$Le_DeployHook&quot;
    res=&quot;$?&quot;
  fi

  IS_RENEW=&quot;&quot;

  return &quot;$res&quot;
}

#renewAll  [stopRenewOnError]
renewAll() {
  _initpath
  _stopRenewOnError=&quot;$1&quot;
  _debug &quot;_stopRenewOnError&quot; &quot;$_stopRenewOnError&quot;
  _ret=&quot;0&quot;
  _success_msg=&quot;&quot;
  _error_msg=&quot;&quot;
  _skipped_msg=&quot;&quot;
  _error_level=$NOTIFY_LEVEL_SKIP
  _notify_code=$RENEW_SKIP
  _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
  _debug &quot;_set_level&quot; &quot;$_set_level&quot;
  for di in &quot;${CERT_HOME}&quot;/*.*/; do
    _debug di &quot;$di&quot;
    if ! [ -d &quot;$di&quot; ]; then
      _debug &quot;Not directory, skip: $di&quot;
      continue
    fi
    d=$(basename &quot;$di&quot;)
    _debug d &quot;$d&quot;
    (
      if _endswith &quot;$d&quot; &quot;$ECC_SUFFIX&quot;; then
        _isEcc=$(echo &quot;$d&quot; | cut -d &quot;$ECC_SEP&quot; -f 2)
        d=$(echo &quot;$d&quot; | cut -d &quot;$ECC_SEP&quot; -f 1)
      fi
      renew &quot;$d&quot; &quot;$_isEcc&quot;
    )
    rc=&quot;$?&quot;
    _debug &quot;Return code: $rc&quot;
    if [ &quot;$rc&quot; = &quot;0&quot; ]; then
      if [ $_error_level -gt $NOTIFY_LEVEL_RENEW ]; then
        _error_level=&quot;$NOTIFY_LEVEL_RENEW&quot;
        _notify_code=0
      fi
      if [ &quot;$ACME_IN_CRON&quot; ]; then
        if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
          if [ &quot;$NOTIFY_MODE&quot; = &quot;$NOTIFY_MODE_CERT&quot; ]; then
            _send_notify &quot;Renew $d success&quot; &quot;Good, the cert is renewed.&quot; &quot;$NOTIFY_HOOK&quot; 0
          fi
        fi
      fi
      _success_msg=&quot;${_success_msg}    $d
&quot;
    elif [ &quot;$rc&quot; = &quot;$RENEW_SKIP&quot; ]; then
      if [ $_error_level -gt $NOTIFY_LEVEL_SKIP ]; then
        _error_level=&quot;$NOTIFY_LEVEL_SKIP&quot;
        _notify_code=$RENEW_SKIP
      fi
      if [ &quot;$ACME_IN_CRON&quot; ]; then
        if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
          if [ &quot;$NOTIFY_MODE&quot; = &quot;$NOTIFY_MODE_CERT&quot; ]; then
            _send_notify &quot;Renew $d skipped&quot; &quot;Good, the cert is skipped.&quot; &quot;$NOTIFY_HOOK&quot; &quot;$RENEW_SKIP&quot;
          fi
        fi
      fi
      _info &quot;Skipped $d&quot;
      _skipped_msg=&quot;${_skipped_msg}    $d
&quot;
    else
      if [ $_error_level -gt $NOTIFY_LEVEL_ERROR ]; then
        _error_level=&quot;$NOTIFY_LEVEL_ERROR&quot;
        _notify_code=1
      fi
      if [ &quot;$ACME_IN_CRON&quot; ]; then
        if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
          if [ &quot;$NOTIFY_MODE&quot; = &quot;$NOTIFY_MODE_CERT&quot; ]; then
            _send_notify &quot;Renew $d error&quot; &quot;There is an error.&quot; &quot;$NOTIFY_HOOK&quot; 1
          fi
        fi
      fi
      _error_msg=&quot;${_error_msg}    $d
&quot;
      if [ &quot;$_stopRenewOnError&quot; ]; then
        _err &quot;Error renew $d,  stop now.&quot;
        _ret=&quot;$rc&quot;
        break
      else
        _ret=&quot;$rc&quot;
        _err &quot;Error renew $d.&quot;
      fi
    fi
  done
  _debug _error_level &quot;$_error_level&quot;
  _debug _set_level &quot;$_set_level&quot;
  if [ &quot;$ACME_IN_CRON&quot; ] &amp;&amp; [ $_error_level -le $_set_level ]; then
    if [ -z &quot;$NOTIFY_MODE&quot; ] || [ &quot;$NOTIFY_MODE&quot; = &quot;$NOTIFY_MODE_BULK&quot; ]; then
      _msg_subject=&quot;Renew&quot;
      if [ &quot;$_error_msg&quot; ]; then
        _msg_subject=&quot;${_msg_subject} Error&quot;
        _msg_data=&quot;Error certs:
${_error_msg}
&quot;
      fi
      if [ &quot;$_success_msg&quot; ]; then
        _msg_subject=&quot;${_msg_subject} Success&quot;
        _msg_data=&quot;${_msg_data}Success certs:
${_success_msg}
&quot;
      fi
      if [ &quot;$_skipped_msg&quot; ]; then
        _msg_subject=&quot;${_msg_subject} Skipped&quot;
        _msg_data=&quot;${_msg_data}Skipped certs:
${_skipped_msg}
&quot;
      fi

      _send_notify &quot;$_msg_subject&quot; &quot;$_msg_data&quot; &quot;$NOTIFY_HOOK&quot; &quot;$_notify_code&quot;
    fi
  fi

  return &quot;$_ret&quot;
}

#csr webroot
signcsr() {
  _csrfile=&quot;$1&quot;
  _csrW=&quot;$2&quot;
  if [ -z &quot;$_csrfile&quot; ] || [ -z &quot;$_csrW&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --signcsr  --csr mycsr.csr  -w /path/to/webroot/a.com/ &quot;
    return 1
  fi

  _real_cert=&quot;$3&quot;
  _real_key=&quot;$4&quot;
  _real_ca=&quot;$5&quot;
  _reload_cmd=&quot;$6&quot;
  _real_fullchain=&quot;$7&quot;
  _pre_hook=&quot;${8}&quot;
  _post_hook=&quot;${9}&quot;
  _renew_hook=&quot;${10}&quot;
  _local_addr=&quot;${11}&quot;
  _challenge_alias=&quot;${12}&quot;

  _csrsubj=$(_readSubjectFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Can not read subject from csr: $_csrfile&quot;
    return 1
  fi
  _debug _csrsubj &quot;$_csrsubj&quot;
  if _contains &quot;$_csrsubj&quot; ' ' || ! _contains &quot;$_csrsubj&quot; '.'; then
    _info &quot;It seems that the subject: $_csrsubj is not a valid domain name. Drop it.&quot;
    _csrsubj=&quot;&quot;
  fi

  _csrdomainlist=$(_readSubjectAltNamesFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Can not read domain list from csr: $_csrfile&quot;
    return 1
  fi
  _debug &quot;_csrdomainlist&quot; &quot;$_csrdomainlist&quot;

  if [ -z &quot;$_csrsubj&quot; ]; then
    _csrsubj=&quot;$(_getfield &quot;$_csrdomainlist&quot; 1)&quot;
    _debug _csrsubj &quot;$_csrsubj&quot;
    _csrdomainlist=&quot;$(echo &quot;$_csrdomainlist&quot; | cut -d , -f 2-)&quot;
    _debug &quot;_csrdomainlist&quot; &quot;$_csrdomainlist&quot;
  fi

  if [ -z &quot;$_csrsubj&quot; ]; then
    _err &quot;Can not read subject from csr: $_csrfile&quot;
    return 1
  fi

  _csrkeylength=$(_readKeyLengthFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ] || [ -z &quot;$_csrkeylength&quot; ]; then
    _err &quot;Can not read key length from csr: $_csrfile&quot;
    return 1
  fi

  if [ -z &quot;$ACME_VERSION&quot; ] &amp;&amp; _contains &quot;$_csrsubj,$_csrdomainlist&quot; &quot;*.&quot;; then
    export ACME_VERSION=2
  fi
  _initpath &quot;$_csrsubj&quot; &quot;$_csrkeylength&quot;
  mkdir -p &quot;$DOMAIN_PATH&quot;

  _info &quot;Copy csr to: $CSR_PATH&quot;
  cp &quot;$_csrfile&quot; &quot;$CSR_PATH&quot;

  issue &quot;$_csrW&quot; &quot;$_csrsubj&quot; &quot;$_csrdomainlist&quot; &quot;$_csrkeylength&quot; &quot;$_real_cert&quot; &quot;$_real_key&quot; &quot;$_real_ca&quot; &quot;$_reload_cmd&quot; &quot;$_real_fullchain&quot; &quot;$_pre_hook&quot; &quot;$_post_hook&quot; &quot;$_renew_hook&quot; &quot;$_local_addr&quot; &quot;$_challenge_alias&quot;

}

showcsr() {
  _csrfile=&quot;$1&quot;
  _csrd=&quot;$2&quot;
  if [ -z &quot;$_csrfile&quot; ] &amp;&amp; [ -z &quot;$_csrd&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --showcsr  --csr mycsr.csr&quot;
    return 1
  fi

  _initpath

  _csrsubj=$(_readSubjectFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ] || [ -z &quot;$_csrsubj&quot; ]; then
    _err &quot;Can not read subject from csr: $_csrfile&quot;
    return 1
  fi

  _info &quot;Subject=$_csrsubj&quot;

  _csrdomainlist=$(_readSubjectAltNamesFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Can not read domain list from csr: $_csrfile&quot;
    return 1
  fi
  _debug &quot;_csrdomainlist&quot; &quot;$_csrdomainlist&quot;

  _info &quot;SubjectAltNames=$_csrdomainlist&quot;

  _csrkeylength=$(_readKeyLengthFromCSR &quot;$_csrfile&quot;)
  if [ &quot;$?&quot; != &quot;0&quot; ] || [ -z &quot;$_csrkeylength&quot; ]; then
    _err &quot;Can not read key length from csr: $_csrfile&quot;
    return 1
  fi
  _info &quot;KeyLength=$_csrkeylength&quot;
}

list() {
  _raw=&quot;$1&quot;
  _initpath

  _sep=&quot;|&quot;
  if [ &quot;$_raw&quot; ]; then
    printf &quot;%s\n&quot; &quot;Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew&quot;
    for di in &quot;${CERT_HOME}&quot;/*.*/; do
      d=$(basename &quot;$di&quot;)
      _debug d &quot;$d&quot;
      (
        if _endswith &quot;$d&quot; &quot;$ECC_SUFFIX&quot;; then
          _isEcc=&quot;ecc&quot;
          d=$(echo &quot;$d&quot; | cut -d &quot;$ECC_SEP&quot; -f 1)
        fi
        DOMAIN_CONF=&quot;$di/$d.conf&quot;
        if [ -f &quot;$DOMAIN_CONF&quot; ]; then
          . &quot;$DOMAIN_CONF&quot;
          printf &quot;%s\n&quot; &quot;$Le_Domain${_sep}\&quot;$Le_Keylength\&quot;${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr&quot;
        fi
      )
    done
  else
    if _exists column; then
      list &quot;raw&quot; | column -t -s &quot;$_sep&quot;
    else
      list &quot;raw&quot; | tr &quot;$_sep&quot; '\t'
    fi
  fi

}

_deploy() {
  _d=&quot;$1&quot;
  _hooks=&quot;$2&quot;

  for _d_api in $(echo &quot;$_hooks&quot; | tr ',' &quot; &quot;); do
    _deployApi=&quot;$(_findHook &quot;$_d&quot; $_SUB_FOLDER_DEPLOY &quot;$_d_api&quot;)&quot;
    if [ -z &quot;$_deployApi&quot; ]; then
      _err &quot;The deploy hook $_d_api is not found.&quot;
      return 1
    fi
    _debug _deployApi &quot;$_deployApi&quot;

    if ! (
      if ! . &quot;$_deployApi&quot;; then
        _err &quot;Load file $_deployApi error. Please check your api file and try again.&quot;
        return 1
      fi

      d_command=&quot;${_d_api}_deploy&quot;
      if ! _exists &quot;$d_command&quot;; then
        _err &quot;It seems that your api file is not correct, it must have a function named: $d_command&quot;
        return 1
      fi

      if ! $d_command &quot;$_d&quot; &quot;$CERT_KEY_PATH&quot; &quot;$CERT_PATH&quot; &quot;$CA_CERT_PATH&quot; &quot;$CERT_FULLCHAIN_PATH&quot;; then
        _err &quot;Error deploy for domain:$_d&quot;
        return 1
      fi
    ); then
      _err &quot;Deploy error.&quot;
      return 1
    else
      _info &quot;$(__green Success)&quot;
    fi
  done
}

#domain hooks
deploy() {
  _d=&quot;$1&quot;
  _hooks=&quot;$2&quot;
  _isEcc=&quot;$3&quot;
  if [ -z &quot;$_hooks&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --deploy -d domain.com --deploy-hook cpanel [--ecc] &quot;
    return 1
  fi

  _initpath &quot;$_d&quot; &quot;$_isEcc&quot;
  if [ ! -d &quot;$DOMAIN_PATH&quot; ]; then
    _err &quot;The domain '$_d' is not a cert name. You must use the cert name to specify the cert to install.&quot;
    _err &quot;Can not find path:'$DOMAIN_PATH'&quot;
    return 1
  fi

  . &quot;$DOMAIN_CONF&quot;

  _savedomainconf Le_DeployHook &quot;$_hooks&quot;

  _deploy &quot;$_d&quot; &quot;$_hooks&quot;
}

installcert() {
  _main_domain=&quot;$1&quot;
  if [ -z &quot;$_main_domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --installcert -d domain.com  [--ecc] [--cert-file cert-file-path]  [--key-file key-file-path]  [--ca-file ca-cert-file-path]   [ --reloadCmd reloadCmd] [--fullchain-file fullchain-path]&quot;
    return 1
  fi

  _real_cert=&quot;$2&quot;
  _real_key=&quot;$3&quot;
  _real_ca=&quot;$4&quot;
  _reload_cmd=&quot;$5&quot;
  _real_fullchain=&quot;$6&quot;
  _isEcc=&quot;$7&quot;

  _initpath &quot;$_main_domain&quot; &quot;$_isEcc&quot;
  if [ ! -d &quot;$DOMAIN_PATH&quot; ]; then
    _err &quot;The domain '$_main_domain' is not a cert name. You must use the cert name to specify the cert to install.&quot;
    _err &quot;Can not find path:'$DOMAIN_PATH'&quot;
    return 1
  fi

  _savedomainconf &quot;Le_RealCertPath&quot; &quot;$_real_cert&quot;
  _savedomainconf &quot;Le_RealCACertPath&quot; &quot;$_real_ca&quot;
  _savedomainconf &quot;Le_RealKeyPath&quot; &quot;$_real_key&quot;
  _savedomainconf &quot;Le_ReloadCmd&quot; &quot;$_reload_cmd&quot; &quot;base64&quot;
  _savedomainconf &quot;Le_RealFullChainPath&quot; &quot;$_real_fullchain&quot;

  _installcert &quot;$_main_domain&quot; &quot;$_real_cert&quot; &quot;$_real_key&quot; &quot;$_real_ca&quot; &quot;$_real_fullchain&quot; &quot;$_reload_cmd&quot;
}

#domain  cert  key  ca  fullchain reloadcmd backup-prefix
_installcert() {
  _main_domain=&quot;$1&quot;
  _real_cert=&quot;$2&quot;
  _real_key=&quot;$3&quot;
  _real_ca=&quot;$4&quot;
  _real_fullchain=&quot;$5&quot;
  _reload_cmd=&quot;$6&quot;
  _backup_prefix=&quot;$7&quot;

  if [ &quot;$_real_cert&quot; = &quot;$NO_VALUE&quot; ]; then
    _real_cert=&quot;&quot;
  fi
  if [ &quot;$_real_key&quot; = &quot;$NO_VALUE&quot; ]; then
    _real_key=&quot;&quot;
  fi
  if [ &quot;$_real_ca&quot; = &quot;$NO_VALUE&quot; ]; then
    _real_ca=&quot;&quot;
  fi
  if [ &quot;$_reload_cmd&quot; = &quot;$NO_VALUE&quot; ]; then
    _reload_cmd=&quot;&quot;
  fi
  if [ &quot;$_real_fullchain&quot; = &quot;$NO_VALUE&quot; ]; then
    _real_fullchain=&quot;&quot;
  fi

  _backup_path=&quot;$DOMAIN_BACKUP_PATH/$_backup_prefix&quot;
  mkdir -p &quot;$_backup_path&quot;

  if [ &quot;$_real_cert&quot; ]; then
    _info &quot;Installing cert to:$_real_cert&quot;
    if [ -f &quot;$_real_cert&quot; ] &amp;&amp; [ ! &quot;$IS_RENEW&quot; ]; then
      cp &quot;$_real_cert&quot; &quot;$_backup_path/cert.bak&quot;
    fi
    cat &quot;$CERT_PATH&quot; &gt;&quot;$_real_cert&quot; || return 1
  fi

  if [ &quot;$_real_ca&quot; ]; then
    _info &quot;Installing CA to:$_real_ca&quot;
    if [ &quot;$_real_ca&quot; = &quot;$_real_cert&quot; ]; then
      echo &quot;&quot; &gt;&gt;&quot;$_real_ca&quot;
      cat &quot;$CA_CERT_PATH&quot; &gt;&gt;&quot;$_real_ca&quot; || return 1
    else
      if [ -f &quot;$_real_ca&quot; ] &amp;&amp; [ ! &quot;$IS_RENEW&quot; ]; then
        cp &quot;$_real_ca&quot; &quot;$_backup_path/ca.bak&quot;
      fi
      cat &quot;$CA_CERT_PATH&quot; &gt;&quot;$_real_ca&quot; || return 1
    fi
  fi

  if [ &quot;$_real_key&quot; ]; then
    _info &quot;Installing key to:$_real_key&quot;
    if [ -f &quot;$_real_key&quot; ] &amp;&amp; [ ! &quot;$IS_RENEW&quot; ]; then
      cp &quot;$_real_key&quot; &quot;$_backup_path/key.bak&quot;
    fi
    if [ -f &quot;$_real_key&quot; ]; then
      cat &quot;$CERT_KEY_PATH&quot; &gt;&quot;$_real_key&quot; || return 1
    else
      cat &quot;$CERT_KEY_PATH&quot; &gt;&quot;$_real_key&quot; || return 1
      chmod 600 &quot;$_real_key&quot;
    fi
  fi

  if [ &quot;$_real_fullchain&quot; ]; then
    _info &quot;Installing full chain to:$_real_fullchain&quot;
    if [ -f &quot;$_real_fullchain&quot; ] &amp;&amp; [ ! &quot;$IS_RENEW&quot; ]; then
      cp &quot;$_real_fullchain&quot; &quot;$_backup_path/fullchain.bak&quot;
    fi
    cat &quot;$CERT_FULLCHAIN_PATH&quot; &gt;&quot;$_real_fullchain&quot; || return 1
  fi

  if [ &quot;$_reload_cmd&quot; ]; then
    _info &quot;Run reload cmd: $_reload_cmd&quot;
    if (
      export CERT_PATH
      export CERT_KEY_PATH
      export CA_CERT_PATH
      export CERT_FULLCHAIN_PATH
      export Le_Domain=&quot;$_main_domain&quot;
      cd &quot;$DOMAIN_PATH&quot; &amp;&amp; eval &quot;$_reload_cmd&quot;
    ); then
      _info &quot;$(__green &quot;Reload success&quot;)&quot;
    else
      _err &quot;Reload error for :$Le_Domain&quot;
    fi
  fi

}

__read_password() {
  unset _pp
  prompt=&quot;Enter Password:&quot;
  while IFS= read -p &quot;$prompt&quot; -r -s -n 1 char; do
    if [ &quot;$char&quot; = $'\0' ]; then
      break
    fi
    prompt='*'
    _pp=&quot;$_pp$char&quot;
  done
  echo &quot;$_pp&quot;
}

_install_win_taskscheduler() {
  _lesh=&quot;$1&quot;
  _centry=&quot;$2&quot;
  _randomminute=&quot;$3&quot;
  if ! _exists cygpath; then
    _err &quot;cygpath not found&quot;
    return 1
  fi
  if ! _exists schtasks; then
    _err &quot;schtasks.exe is not found, are you on Windows?&quot;
    return 1
  fi
  _winbash=&quot;$(cygpath -w $(which bash))&quot;
  _debug _winbash &quot;$_winbash&quot;
  if [ -z &quot;$_winbash&quot; ]; then
    _err &quot;can not find bash path&quot;
    return 1
  fi
  _myname=&quot;$(whoami)&quot;
  _debug &quot;_myname&quot; &quot;$_myname&quot;
  if [ -z &quot;$_myname&quot; ]; then
    _err &quot;can not find my user name&quot;
    return 1
  fi
  _debug &quot;_lesh&quot; &quot;$_lesh&quot;

  _info &quot;To install scheduler task in your Windows account, you must input your windows password.&quot;
  _info &quot;$PROJECT_NAME doesn't save your password.&quot;
  _info &quot;Please input your Windows password for: $(__green &quot;$_myname&quot;)&quot;
  _password=&quot;$(__read_password)&quot;
  #SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' &quot;$_WINDOWS_SCHEDULER_NAME&quot; '/F' '/ST' &quot;00:$_randomminute&quot; '/RU' &quot;$_myname&quot; '/RP' &quot;$_password&quot; '/TR' &quot;$_winbash -l -c '$_lesh --cron --home \&quot;$LE_WORKING_DIR\&quot; $_centry'&quot; &gt;/dev/null
  echo SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' &quot;$_WINDOWS_SCHEDULER_NAME&quot; '/F' '/ST' &quot;00:$_randomminute&quot; '/RU' &quot;$_myname&quot; '/RP' &quot;$_password&quot; '/TR' &quot;\&quot;$_winbash -l -c '$_lesh --cron --home \&quot;$LE_WORKING_DIR\&quot; $_centry'\&quot;&quot; | cmd.exe &gt;/dev/null
  echo

}

_uninstall_win_taskscheduler() {
  if ! _exists schtasks; then
    _err &quot;schtasks.exe is not found, are you on Windows?&quot;
    return 1
  fi
  if ! echo SCHTASKS /query /tn &quot;$_WINDOWS_SCHEDULER_NAME&quot; | cmd.exe &gt;/dev/null; then
    _debug &quot;scheduler $_WINDOWS_SCHEDULER_NAME is not found.&quot;
  else
    _info &quot;Removing $_WINDOWS_SCHEDULER_NAME&quot;
    echo SCHTASKS /delete /f /tn &quot;$_WINDOWS_SCHEDULER_NAME&quot; | cmd.exe &gt;/dev/null
  fi
}

#confighome
installcronjob() {
  _c_home=&quot;$1&quot;
  _initpath
  _CRONTAB=&quot;crontab&quot;
  if [ -f &quot;$LE_WORKING_DIR/$PROJECT_ENTRY&quot; ]; then
    lesh=&quot;\&quot;$LE_WORKING_DIR\&quot;/$PROJECT_ENTRY&quot;
  else
    _err &quot;Can not install cronjob, $PROJECT_ENTRY not found.&quot;
    return 1
  fi
  if [ &quot;$_c_home&quot; ]; then
    _c_entry=&quot;--config-home \&quot;$_c_home\&quot; &quot;
  fi
  _t=$(_time)
  random_minute=$(_math $_t % 60)

  if ! _exists &quot;$_CRONTAB&quot; &amp;&amp; _exists &quot;fcrontab&quot;; then
    _CRONTAB=&quot;fcrontab&quot;
  fi

  if ! _exists &quot;$_CRONTAB&quot;; then
    if _exists cygpath &amp;&amp; _exists schtasks.exe; then
      _info &quot;It seems you are on Windows,  let's install Windows scheduler task.&quot;
      if _install_win_taskscheduler &quot;$lesh&quot; &quot;$_c_entry&quot; &quot;$random_minute&quot;; then
        _info &quot;Install Windows scheduler task success.&quot;
        return 0
      else
        _err &quot;Install Windows scheduler task failed.&quot;
        return 1
      fi
    fi
    _err &quot;crontab/fcrontab doesn't exist, so, we can not install cron jobs.&quot;
    _err &quot;All your certs will not be renewed automatically.&quot;
    _err &quot;You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday.&quot;
    return 1
  fi
  _info &quot;Installing cron job&quot;
  if ! $_CRONTAB -l | grep &quot;$PROJECT_ENTRY --cron&quot;; then
    if _exists uname &amp;&amp; uname -a | grep SunOS &gt;/dev/null; then
      $_CRONTAB -l | {
        cat
        echo &quot;$random_minute 0 * * * $lesh --cron --home \&quot;$LE_WORKING_DIR\&quot; $_c_entry&gt; /dev/null&quot;
      } | $_CRONTAB --
    else
      $_CRONTAB -l | {
        cat
        echo &quot;$random_minute 0 * * * $lesh --cron --home \&quot;$LE_WORKING_DIR\&quot; $_c_entry&gt; /dev/null&quot;
      } | $_CRONTAB -
    fi
  fi
  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Install cron job failed. You need to manually renew your certs.&quot;
    _err &quot;Or you can add cronjob by yourself:&quot;
    _err &quot;$lesh --cron --home \&quot;$LE_WORKING_DIR\&quot; &gt; /dev/null&quot;
    return 1
  fi
}

uninstallcronjob() {
  _CRONTAB=&quot;crontab&quot;
  if ! _exists &quot;$_CRONTAB&quot; &amp;&amp; _exists &quot;fcrontab&quot;; then
    _CRONTAB=&quot;fcrontab&quot;
  fi

  if ! _exists &quot;$_CRONTAB&quot;; then
    if _exists cygpath &amp;&amp; _exists schtasks.exe; then
      _info &quot;It seems you are on Windows,  let's uninstall Windows scheduler task.&quot;
      if _uninstall_win_taskscheduler; then
        _info &quot;Uninstall Windows scheduler task success.&quot;
        return 0
      else
        _err &quot;Uninstall Windows scheduler task failed.&quot;
        return 1
      fi
    fi
    return
  fi
  _info &quot;Removing cron job&quot;
  cr=&quot;$($_CRONTAB -l | grep &quot;$PROJECT_ENTRY --cron&quot;)&quot;
  if [ &quot;$cr&quot; ]; then
    if _exists uname &amp;&amp; uname -a | grep solaris &gt;/dev/null; then
      $_CRONTAB -l | sed &quot;/$PROJECT_ENTRY --cron/d&quot; | $_CRONTAB --
    else
      $_CRONTAB -l | sed &quot;/$PROJECT_ENTRY --cron/d&quot; | $_CRONTAB -
    fi
    LE_WORKING_DIR=&quot;$(echo &quot;$cr&quot; | cut -d ' ' -f 9 | tr -d '&quot;')&quot;
    _info LE_WORKING_DIR &quot;$LE_WORKING_DIR&quot;
    if _contains &quot;$cr&quot; &quot;--config-home&quot;; then
      LE_CONFIG_HOME=&quot;$(echo &quot;$cr&quot; | cut -d ' ' -f 11 | tr -d '&quot;')&quot;
      _debug LE_CONFIG_HOME &quot;$LE_CONFIG_HOME&quot;
    fi
  fi
  _initpath

}

revoke() {
  Le_Domain=&quot;$1&quot;
  if [ -z &quot;$Le_Domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --revoke -d domain.com  [--ecc]&quot;
    return 1
  fi

  _isEcc=&quot;$2&quot;

  _initpath &quot;$Le_Domain&quot; &quot;$_isEcc&quot;
  if [ ! -f &quot;$DOMAIN_CONF&quot; ]; then
    _err &quot;$Le_Domain is not a issued domain, skip.&quot;
    return 1
  fi

  if [ ! -f &quot;$CERT_PATH&quot; ]; then
    _err &quot;Cert for $Le_Domain $CERT_PATH is not found, skip.&quot;
    return 1
  fi

  cert=&quot;$(_getfile &quot;${CERT_PATH}&quot; &quot;${BEGIN_CERT}&quot; &quot;${END_CERT}&quot; | tr -d &quot;\r\n&quot; | _url_replace)&quot;

  if [ -z &quot;$cert&quot; ]; then
    _err &quot;Cert for $Le_Domain is empty found, skip.&quot;
    return 1
  fi

  _initAPI

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    data=&quot;{\&quot;certificate\&quot;: \&quot;$cert\&quot;}&quot;
  else
    data=&quot;{\&quot;resource\&quot;: \&quot;revoke-cert\&quot;, \&quot;certificate\&quot;: \&quot;$cert\&quot;}&quot;
  fi
  uri=&quot;${ACME_REVOKE_CERT}&quot;

  if [ -f &quot;$CERT_KEY_PATH&quot; ]; then
    _info &quot;Try domain key first.&quot;
    if _send_signed_request &quot;$uri&quot; &quot;$data&quot; &quot;&quot; &quot;$CERT_KEY_PATH&quot;; then
      if [ -z &quot;$response&quot; ]; then
        _info &quot;Revoke success.&quot;
        rm -f &quot;$CERT_PATH&quot;
        return 0
      else
        _err &quot;Revoke error by domain key.&quot;
        _err &quot;$response&quot;
      fi
    fi
  else
    _info &quot;Domain key file doesn't exists.&quot;
  fi

  _info &quot;Try account key.&quot;

  if _send_signed_request &quot;$uri&quot; &quot;$data&quot; &quot;&quot; &quot;$ACCOUNT_KEY_PATH&quot;; then
    if [ -z &quot;$response&quot; ]; then
      _info &quot;Revoke success.&quot;
      rm -f &quot;$CERT_PATH&quot;
      return 0
    else
      _err &quot;Revoke error.&quot;
      _debug &quot;$response&quot;
    fi
  fi
  return 1
}

#domain  ecc
remove() {
  Le_Domain=&quot;$1&quot;
  if [ -z &quot;$Le_Domain&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --remove -d domain.com [--ecc]&quot;
    return 1
  fi

  _isEcc=&quot;$2&quot;

  _initpath &quot;$Le_Domain&quot; &quot;$_isEcc&quot;
  _removed_conf=&quot;$DOMAIN_CONF.removed&quot;
  if [ ! -f &quot;$DOMAIN_CONF&quot; ]; then
    if [ -f &quot;$_removed_conf&quot; ]; then
      _err &quot;$Le_Domain is already removed, You can remove the folder by yourself: $DOMAIN_PATH&quot;
    else
      _err &quot;$Le_Domain is not a issued domain, skip.&quot;
    fi
    return 1
  fi

  if mv &quot;$DOMAIN_CONF&quot; &quot;$_removed_conf&quot;; then
    _info &quot;$Le_Domain is removed, the key and cert files are in $(__green $DOMAIN_PATH)&quot;
    _info &quot;You can remove them by yourself.&quot;
    return 0
  else
    _err &quot;Remove $Le_Domain failed.&quot;
    return 1
  fi
}

#domain vtype
_deactivate() {
  _d_domain=&quot;$1&quot;
  _d_type=&quot;$2&quot;
  _initpath

  if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
    _identifiers=&quot;{\&quot;type\&quot;:\&quot;dns\&quot;,\&quot;value\&quot;:\&quot;$_d_domain\&quot;}&quot;
    if ! _send_signed_request &quot;$ACME_NEW_ORDER&quot; &quot;{\&quot;identifiers\&quot;: [$_identifiers]}&quot;; then
      _err &quot;Can not get domain new order.&quot;
      return 1
    fi
    _authorizations_seg=&quot;$(echo &quot;$response&quot; | _egrep_o '&quot;authorizations&quot; *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '&quot;')&quot;
    _debug2 _authorizations_seg &quot;$_authorizations_seg&quot;
    if [ -z &quot;$_authorizations_seg&quot; ]; then
      _err &quot;_authorizations_seg not found.&quot;
      _clearup
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi

    authzUri=&quot;$_authorizations_seg&quot;
    _debug2 &quot;authzUri&quot; &quot;$authzUri&quot;
    if ! _send_signed_request &quot;$authzUri&quot;; then
      _err &quot;get to authz error.&quot;
      _err &quot;_authorizations_seg&quot; &quot;$_authorizations_seg&quot;
      _err &quot;authzUri&quot; &quot;$authzUri&quot;
      _clearup
      _on_issue_err &quot;$_post_hook&quot;
      return 1
    fi

    response=&quot;$(echo &quot;$response&quot; | _normalizeJson)&quot;
    _debug2 response &quot;$response&quot;
    _URL_NAME=&quot;url&quot;
  else
    if ! __get_domain_new_authz &quot;$_d_domain&quot;; then
      _err &quot;Can not get domain new authz token.&quot;
      return 1
    fi

    authzUri=&quot;$(echo &quot;$responseHeaders&quot; | grep &quot;^Location:&quot; | _head_n 1 | cut -d ':' -f 2- | tr -d &quot;\r\n&quot;)&quot;
    _debug &quot;authzUri&quot; &quot;$authzUri&quot;
    if [ &quot;$code&quot; ] &amp;&amp; [ ! &quot;$code&quot; = '201' ]; then
      _err &quot;new-authz error: $response&quot;
      return 1
    fi
    _URL_NAME=&quot;uri&quot;
  fi

  entries=&quot;$(echo &quot;$response&quot; | _egrep_o &quot;{ *\&quot;type\&quot;:\&quot;[^\&quot;]*\&quot;, *\&quot;status\&quot;: *\&quot;valid\&quot;, *\&quot;$_URL_NAME\&quot;[^}]*&quot;)&quot;
  if [ -z &quot;$entries&quot; ]; then
    _info &quot;No valid entries found.&quot;
    if [ -z &quot;$thumbprint&quot; ]; then
      thumbprint=&quot;$(__calc_account_thumbprint)&quot;
    fi
    _debug &quot;Trigger validation.&quot;
    vtype=&quot;$VTYPE_DNS&quot;
    entry=&quot;$(echo &quot;$response&quot; | _egrep_o '[^\{]*&quot;type&quot;:&quot;'$vtype'&quot;[^\}]*')&quot;
    _debug entry &quot;$entry&quot;
    if [ -z &quot;$entry&quot; ]; then
      _err &quot;Error, can not get domain token $d&quot;
      return 1
    fi
    token=&quot;$(echo &quot;$entry&quot; | _egrep_o '&quot;token&quot;:&quot;[^&quot;]*' | cut -d : -f 2 | tr -d '&quot;')&quot;
    _debug token &quot;$token&quot;

    uri=&quot;$(echo &quot;$entry&quot; | _egrep_o &quot;\&quot;$_URL_NAME\&quot;:\&quot;[^\&quot;]*&quot; | cut -d : -f 2,3 | tr -d '&quot;')&quot;
    _debug uri &quot;$uri&quot;

    keyauthorization=&quot;$token.$thumbprint&quot;
    _debug keyauthorization &quot;$keyauthorization&quot;
    __trigger_validation &quot;$uri&quot; &quot;$keyauthorization&quot;

  fi

  _d_i=0
  _d_max_retry=$(echo &quot;$entries&quot; | wc -l)
  while [ &quot;$_d_i&quot; -lt &quot;$_d_max_retry&quot; ]; do
    _info &quot;Deactivate: $_d_domain&quot;
    _d_i=&quot;$(_math $_d_i + 1)&quot;
    entry=&quot;$(echo &quot;$entries&quot; | sed -n &quot;${_d_i}p&quot;)&quot;
    _debug entry &quot;$entry&quot;

    if [ -z &quot;$entry&quot; ]; then
      _info &quot;No more valid entry found.&quot;
      break
    fi

    _vtype=&quot;$(echo &quot;$entry&quot; | _egrep_o '&quot;type&quot;: *&quot;[^&quot;]*&quot;' | cut -d : -f 2 | tr -d '&quot;')&quot;
    _debug _vtype &quot;$_vtype&quot;
    _info &quot;Found $_vtype&quot;

    uri=&quot;$(echo &quot;$entry&quot; | _egrep_o &quot;\&quot;$_URL_NAME\&quot;:\&quot;[^\&quot;]*&quot; | cut -d : -f 2,3 | tr -d '&quot;')&quot;
    _debug uri &quot;$uri&quot;

    if [ &quot;$_d_type&quot; ] &amp;&amp; [ &quot;$_d_type&quot; != &quot;$_vtype&quot; ]; then
      _info &quot;Skip $_vtype&quot;
      continue
    fi

    _info &quot;Deactivate: $_vtype&quot;

    if [ &quot;$ACME_VERSION&quot; = &quot;2&quot; ]; then
      _djson=&quot;{\&quot;status\&quot;:\&quot;deactivated\&quot;}&quot;
    else
      _djson=&quot;{\&quot;resource\&quot;: \&quot;authz\&quot;, \&quot;status\&quot;:\&quot;deactivated\&quot;}&quot;
    fi

    if _send_signed_request &quot;$authzUri&quot; &quot;$_djson&quot; &amp;&amp; _contains &quot;$response&quot; '&quot;deactivated&quot;'; then
      _info &quot;Deactivate: $_vtype success.&quot;
    else
      _err &quot;Can not deactivate $_vtype.&quot;
      break
    fi

  done
  _debug &quot;$_d_i&quot;
  if [ &quot;$_d_i&quot; -eq &quot;$_d_max_retry&quot; ]; then
    _info &quot;Deactivated success!&quot;
  else
    _err &quot;Deactivate failed.&quot;
  fi

}

deactivate() {
  _d_domain_list=&quot;$1&quot;
  _d_type=&quot;$2&quot;
  _initpath
  _initAPI
  _debug _d_domain_list &quot;$_d_domain_list&quot;
  if [ -z &quot;$(echo $_d_domain_list | cut -d , -f 1)&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --deactivate -d domain.com [-d domain.com]&quot;
    return 1
  fi
  for _d_dm in $(echo &quot;$_d_domain_list&quot; | tr ',' ' '); do
    if [ -z &quot;$_d_dm&quot; ] || [ &quot;$_d_dm&quot; = &quot;$NO_VALUE&quot; ]; then
      continue
    fi
    if ! _deactivate &quot;$_d_dm&quot; &quot;$_d_type&quot;; then
      return 1
    fi
  done
}

# Detect profile file if not specified as environment variable
_detect_profile() {
  if [ -n &quot;$PROFILE&quot; -a -f &quot;$PROFILE&quot; ]; then
    echo &quot;$PROFILE&quot;
    return
  fi

  DETECTED_PROFILE=''
  SHELLTYPE=&quot;$(basename &quot;/$SHELL&quot;)&quot;

  if [ &quot;$SHELLTYPE&quot; = &quot;bash&quot; ]; then
    if [ -f &quot;$HOME/.bashrc&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.bashrc&quot;
    elif [ -f &quot;$HOME/.bash_profile&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.bash_profile&quot;
    fi
  elif [ &quot;$SHELLTYPE&quot; = &quot;zsh&quot; ]; then
    DETECTED_PROFILE=&quot;$HOME/.zshrc&quot;
  fi

  if [ -z &quot;$DETECTED_PROFILE&quot; ]; then
    if [ -f &quot;$HOME/.profile&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.profile&quot;
    elif [ -f &quot;$HOME/.bashrc&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.bashrc&quot;
    elif [ -f &quot;$HOME/.bash_profile&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.bash_profile&quot;
    elif [ -f &quot;$HOME/.zshrc&quot; ]; then
      DETECTED_PROFILE=&quot;$HOME/.zshrc&quot;
    fi
  fi

  echo &quot;$DETECTED_PROFILE&quot;
}

_initconf() {
  _initpath
  if [ ! -f &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    echo &quot;

#LOG_FILE=\&quot;$DEFAULT_LOG_FILE\&quot;
#LOG_LEVEL=1

#AUTO_UPGRADE=\&quot;1\&quot;

#NO_TIMESTAMP=1

    &quot; &gt;&quot;$ACCOUNT_CONF_PATH&quot;
  fi
}

# nocron
_precheck() {
  _nocron=&quot;$1&quot;

  if ! _exists &quot;curl&quot; &amp;&amp; ! _exists &quot;wget&quot;; then
    _err &quot;Please install curl or wget first, we need to access http resources.&quot;
    return 1
  fi

  if [ -z &quot;$_nocron&quot; ]; then
    if ! _exists &quot;crontab&quot; &amp;&amp; ! _exists &quot;fcrontab&quot;; then
      if _exists cygpath &amp;&amp; _exists schtasks.exe; then
        _info &quot;It seems you are on Windows,  we will install Windows scheduler task.&quot;
      else
        _err &quot;It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'.&quot;
        _err &quot;We need to set cron job to renew the certs automatically.&quot;
        _err &quot;Otherwise, your certs will not be able to be renewed automatically.&quot;
        if [ -z &quot;$FORCE&quot; ]; then
          _err &quot;Please add '--force' and try install again to go without crontab.&quot;
          _err &quot;./$PROJECT_ENTRY --install --force&quot;
          return 1
        fi
      fi
    fi
  fi

  if ! _exists &quot;${ACME_OPENSSL_BIN:-openssl}&quot;; then
    _err &quot;Please install openssl first. ACME_OPENSSL_BIN=$ACME_OPENSSL_BIN&quot;
    _err &quot;We need openssl to generate keys.&quot;
    return 1
  fi

  if ! _exists &quot;socat&quot;; then
    _err &quot;It is recommended to install socat first.&quot;
    _err &quot;We use socat for standalone server if you use standalone mode.&quot;
    _err &quot;If you don't use standalone mode, just ignore this warning.&quot;
  fi

  return 0
}

_setShebang() {
  _file=&quot;$1&quot;
  _shebang=&quot;$2&quot;
  if [ -z &quot;$_shebang&quot; ]; then
    _usage &quot;Usage: file shebang&quot;
    return 1
  fi
  cp &quot;$_file&quot; &quot;$_file.tmp&quot;
  echo &quot;$_shebang&quot; &gt;&quot;$_file&quot;
  sed -n 2,99999p &quot;$_file.tmp&quot; &gt;&gt;&quot;$_file&quot;
  rm -f &quot;$_file.tmp&quot;
}

#confighome
_installalias() {
  _c_home=&quot;$1&quot;
  _initpath

  _envfile=&quot;$LE_WORKING_DIR/$PROJECT_ENTRY.env&quot;
  if [ &quot;$_upgrading&quot; ] &amp;&amp; [ &quot;$_upgrading&quot; = &quot;1&quot; ]; then
    echo &quot;$(cat &quot;$_envfile&quot;)&quot; | sed &quot;s|^LE_WORKING_DIR.*$||&quot; &gt;&quot;$_envfile&quot;
    echo &quot;$(cat &quot;$_envfile&quot;)&quot; | sed &quot;s|^alias le.*$||&quot; &gt;&quot;$_envfile&quot;
    echo &quot;$(cat &quot;$_envfile&quot;)&quot; | sed &quot;s|^alias le.sh.*$||&quot; &gt;&quot;$_envfile&quot;
  fi

  if [ &quot;$_c_home&quot; ]; then
    _c_entry=&quot; --config-home '$_c_home'&quot;
  fi

  _setopt &quot;$_envfile&quot; &quot;export LE_WORKING_DIR&quot; &quot;=&quot; &quot;\&quot;$LE_WORKING_DIR\&quot;&quot;
  if [ &quot;$_c_home&quot; ]; then
    _setopt &quot;$_envfile&quot; &quot;export LE_CONFIG_HOME&quot; &quot;=&quot; &quot;\&quot;$LE_CONFIG_HOME\&quot;&quot;
  else
    _sed_i &quot;/^export LE_CONFIG_HOME/d&quot; &quot;$_envfile&quot;
  fi
  _setopt &quot;$_envfile&quot; &quot;alias $PROJECT_ENTRY&quot; &quot;=&quot; &quot;\&quot;$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\&quot;&quot;

  _profile=&quot;$(_detect_profile)&quot;
  if [ &quot;$_profile&quot; ]; then
    _debug &quot;Found profile: $_profile&quot;
    _info &quot;Installing alias to '$_profile'&quot;
    _setopt &quot;$_profile&quot; &quot;. \&quot;$_envfile\&quot;&quot;
    _info &quot;OK, Close and reopen your terminal to start using $PROJECT_NAME&quot;
  else
    _info &quot;No profile is found, you will need to go into $LE_WORKING_DIR to use $PROJECT_NAME&quot;
  fi

  #for csh
  _cshfile=&quot;$LE_WORKING_DIR/$PROJECT_ENTRY.csh&quot;
  _csh_profile=&quot;$HOME/.cshrc&quot;
  if [ -f &quot;$_csh_profile&quot; ]; then
    _info &quot;Installing alias to '$_csh_profile'&quot;
    _setopt &quot;$_cshfile&quot; &quot;setenv LE_WORKING_DIR&quot; &quot; &quot; &quot;\&quot;$LE_WORKING_DIR\&quot;&quot;
    if [ &quot;$_c_home&quot; ]; then
      _setopt &quot;$_cshfile&quot; &quot;setenv LE_CONFIG_HOME&quot; &quot; &quot; &quot;\&quot;$LE_CONFIG_HOME\&quot;&quot;
    else
      _sed_i &quot;/^setenv LE_CONFIG_HOME/d&quot; &quot;$_cshfile&quot;
    fi
    _setopt &quot;$_cshfile&quot; &quot;alias $PROJECT_ENTRY&quot; &quot; &quot; &quot;\&quot;$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\&quot;&quot;
    _setopt &quot;$_csh_profile&quot; &quot;source \&quot;$_cshfile\&quot;&quot;
  fi

  #for tcsh
  _tcsh_profile=&quot;$HOME/.tcshrc&quot;
  if [ -f &quot;$_tcsh_profile&quot; ]; then
    _info &quot;Installing alias to '$_tcsh_profile'&quot;
    _setopt &quot;$_cshfile&quot; &quot;setenv LE_WORKING_DIR&quot; &quot; &quot; &quot;\&quot;$LE_WORKING_DIR\&quot;&quot;
    if [ &quot;$_c_home&quot; ]; then
      _setopt &quot;$_cshfile&quot; &quot;setenv LE_CONFIG_HOME&quot; &quot; &quot; &quot;\&quot;$LE_CONFIG_HOME\&quot;&quot;
    fi
    _setopt &quot;$_cshfile&quot; &quot;alias $PROJECT_ENTRY&quot; &quot; &quot; &quot;\&quot;$LE_WORKING_DIR/$PROJECT_ENTRY$_c_entry\&quot;&quot;
    _setopt &quot;$_tcsh_profile&quot; &quot;source \&quot;$_cshfile\&quot;&quot;
  fi

}

# nocron confighome noprofile
install() {

  if [ -z &quot;$LE_WORKING_DIR&quot; ]; then
    LE_WORKING_DIR=&quot;$DEFAULT_INSTALL_HOME&quot;
  fi

  _nocron=&quot;$1&quot;
  _c_home=&quot;$2&quot;
  _noprofile=&quot;$3&quot;
  if ! _initpath; then
    _err &quot;Install failed.&quot;
    return 1
  fi
  if [ &quot;$_nocron&quot; ]; then
    _debug &quot;Skip install cron job&quot;
  fi

  if [ &quot;$ACME_IN_CRON&quot; != &quot;1&quot; ]; then
    if ! _precheck &quot;$_nocron&quot;; then
      _err &quot;Pre-check failed, can not install.&quot;
      return 1
    fi
  fi

  if [ -z &quot;$_c_home&quot; ] &amp;&amp; [ &quot;$LE_CONFIG_HOME&quot; != &quot;$LE_WORKING_DIR&quot; ]; then
    _info &quot;Using config home: $LE_CONFIG_HOME&quot;
    _c_home=&quot;$LE_CONFIG_HOME&quot;
  fi

  #convert from le
  if [ -d &quot;$HOME/.le&quot; ]; then
    for envfile in &quot;le.env&quot; &quot;le.sh.env&quot;; do
      if [ -f &quot;$HOME/.le/$envfile&quot; ]; then
        if grep &quot;le.sh&quot; &quot;$HOME/.le/$envfile&quot; &gt;/dev/null; then
          _upgrading=&quot;1&quot;
          _info &quot;You are upgrading from le.sh&quot;
          _info &quot;Renaming \&quot;$HOME/.le\&quot; to $LE_WORKING_DIR&quot;
          mv &quot;$HOME/.le&quot; &quot;$LE_WORKING_DIR&quot;
          mv &quot;$LE_WORKING_DIR/$envfile&quot; &quot;$LE_WORKING_DIR/$PROJECT_ENTRY.env&quot;
          break
        fi
      fi
    done
  fi

  _info &quot;Installing to $LE_WORKING_DIR&quot;

  if [ ! -d &quot;$LE_WORKING_DIR&quot; ]; then
    if ! mkdir -p &quot;$LE_WORKING_DIR&quot;; then
      _err &quot;Can not create working dir: $LE_WORKING_DIR&quot;
      return 1
    fi

    chmod 700 &quot;$LE_WORKING_DIR&quot;
  fi

  if [ ! -d &quot;$LE_CONFIG_HOME&quot; ]; then
    if ! mkdir -p &quot;$LE_CONFIG_HOME&quot;; then
      _err &quot;Can not create config dir: $LE_CONFIG_HOME&quot;
      return 1
    fi

    chmod 700 &quot;$LE_CONFIG_HOME&quot;
  fi

  cp &quot;$PROJECT_ENTRY&quot; &quot;$LE_WORKING_DIR/&quot; &amp;&amp; chmod +x &quot;$LE_WORKING_DIR/$PROJECT_ENTRY&quot;

  if [ &quot;$?&quot; != &quot;0&quot; ]; then
    _err &quot;Install failed, can not copy $PROJECT_ENTRY&quot;
    return 1
  fi

  _info &quot;Installed to $LE_WORKING_DIR/$PROJECT_ENTRY&quot;

  if [ &quot;$ACME_IN_CRON&quot; != &quot;1&quot; ] &amp;&amp; [ -z &quot;$_noprofile&quot; ]; then
    _installalias &quot;$_c_home&quot;
  fi

  for subf in $_SUB_FOLDERS; do
    if [ -d &quot;$subf&quot; ]; then
      mkdir -p &quot;$LE_WORKING_DIR/$subf&quot;
      cp &quot;$subf&quot;/* &quot;$LE_WORKING_DIR&quot;/&quot;$subf&quot;/
    fi
  done

  if [ ! -f &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    _initconf
  fi

  if [ &quot;$_DEFAULT_ACCOUNT_CONF_PATH&quot; != &quot;$ACCOUNT_CONF_PATH&quot; ]; then
    _setopt &quot;$_DEFAULT_ACCOUNT_CONF_PATH&quot; &quot;ACCOUNT_CONF_PATH&quot; &quot;=&quot; &quot;\&quot;$ACCOUNT_CONF_PATH\&quot;&quot;
  fi

  if [ &quot;$_DEFAULT_CERT_HOME&quot; != &quot;$CERT_HOME&quot; ]; then
    _saveaccountconf &quot;CERT_HOME&quot; &quot;$CERT_HOME&quot;
  fi

  if [ &quot;$_DEFAULT_ACCOUNT_KEY_PATH&quot; != &quot;$ACCOUNT_KEY_PATH&quot; ]; then
    _saveaccountconf &quot;ACCOUNT_KEY_PATH&quot; &quot;$ACCOUNT_KEY_PATH&quot;
  fi

  if [ -z &quot;$_nocron&quot; ]; then
    installcronjob &quot;$_c_home&quot;
  fi

  if [ -z &quot;$NO_DETECT_SH&quot; ]; then
    #Modify shebang
    if _exists bash; then
      _bash_path=&quot;$(bash -c &quot;command -v bash 2&gt;/dev/null&quot;)&quot;
      if [ -z &quot;$_bash_path&quot; ]; then
        _bash_path=&quot;$(bash -c 'echo $SHELL')&quot;
      fi
    fi
    if [ &quot;$_bash_path&quot; ]; then
      _info &quot;Good, bash is found, so change the shebang to use bash as preferred.&quot;
      _shebang='#!'&quot;$_bash_path&quot;
      _setShebang &quot;$LE_WORKING_DIR/$PROJECT_ENTRY&quot; &quot;$_shebang&quot;
      for subf in $_SUB_FOLDERS; do
        if [ -d &quot;$LE_WORKING_DIR/$subf&quot; ]; then
          for _apifile in &quot;$LE_WORKING_DIR/$subf/&quot;*.sh; do
            _setShebang &quot;$_apifile&quot; &quot;$_shebang&quot;
          done
        fi
      done
    fi
  fi

  _info OK
}

# nocron
uninstall() {
  _nocron=&quot;$1&quot;
  if [ -z &quot;$_nocron&quot; ]; then
    uninstallcronjob
  fi
  _initpath

  _uninstallalias

  rm -f &quot;$LE_WORKING_DIR/$PROJECT_ENTRY&quot;
  _info &quot;The keys and certs are in \&quot;$(__green &quot;$LE_CONFIG_HOME&quot;)\&quot;, you can remove them by yourself.&quot;

}

_uninstallalias() {
  _initpath

  _profile=&quot;$(_detect_profile)&quot;
  if [ &quot;$_profile&quot; ]; then
    _info &quot;Uninstalling alias from: '$_profile'&quot;
    text=&quot;$(cat &quot;$_profile&quot;)&quot;
    echo &quot;$text&quot; | sed &quot;s|^.*\&quot;$LE_WORKING_DIR/$PROJECT_NAME.env\&quot;$||&quot; &gt;&quot;$_profile&quot;
  fi

  _csh_profile=&quot;$HOME/.cshrc&quot;
  if [ -f &quot;$_csh_profile&quot; ]; then
    _info &quot;Uninstalling alias from: '$_csh_profile'&quot;
    text=&quot;$(cat &quot;$_csh_profile&quot;)&quot;
    echo &quot;$text&quot; | sed &quot;s|^.*\&quot;$LE_WORKING_DIR/$PROJECT_NAME.csh\&quot;$||&quot; &gt;&quot;$_csh_profile&quot;
  fi

  _tcsh_profile=&quot;$HOME/.tcshrc&quot;
  if [ -f &quot;$_tcsh_profile&quot; ]; then
    _info &quot;Uninstalling alias from: '$_csh_profile'&quot;
    text=&quot;$(cat &quot;$_tcsh_profile&quot;)&quot;
    echo &quot;$text&quot; | sed &quot;s|^.*\&quot;$LE_WORKING_DIR/$PROJECT_NAME.csh\&quot;$||&quot; &gt;&quot;$_tcsh_profile&quot;
  fi

}

cron() {
  export ACME_IN_CRON=1
  _initpath
  _info &quot;$(__green &quot;===Starting cron===&quot;)&quot;
  if [ &quot;$AUTO_UPGRADE&quot; = &quot;1&quot; ]; then
    export LE_WORKING_DIR
    (
      if ! upgrade; then
        _err &quot;Cron:Upgrade failed!&quot;
        return 1
      fi
    )
    . &quot;$LE_WORKING_DIR/$PROJECT_ENTRY&quot; &gt;/dev/null

    if [ -t 1 ]; then
      __INTERACTIVE=&quot;1&quot;
    fi

    _info &quot;Auto upgraded to: $VER&quot;
  fi
  renewAll
  _ret=&quot;$?&quot;
  ACME_IN_CRON=&quot;&quot;
  _info &quot;$(__green &quot;===End cron===&quot;)&quot;
  exit $_ret
}

version() {
  echo &quot;$PROJECT&quot;
  echo &quot;v$VER&quot;
}

# subject content hooks code
_send_notify() {
  _nsubject=&quot;$1&quot;
  _ncontent=&quot;$2&quot;
  _nhooks=&quot;$3&quot;
  _nerror=&quot;$4&quot;

  if [ &quot;$NOTIFY_LEVEL&quot; = &quot;$NOTIFY_LEVEL_DISABLE&quot; ]; then
    _debug &quot;The NOTIFY_LEVEL is $NOTIFY_LEVEL, disabled, just return.&quot;
    return 0
  fi

  if [ -z &quot;$_nhooks&quot; ]; then
    _debug &quot;The NOTIFY_HOOK is empty, just return.&quot;
    return 0
  fi

  _send_err=0
  for _n_hook in $(echo &quot;$_nhooks&quot; | tr ',' &quot; &quot;); do
    _n_hook_file=&quot;$(_findHook &quot;&quot; $_SUB_FOLDER_NOTIFY &quot;$_n_hook&quot;)&quot;
    _info &quot;Sending via: $_n_hook&quot;
    _debug &quot;Found $_n_hook_file for $_n_hook&quot;
    if [ -z &quot;$_n_hook_file&quot; ]; then
      _err &quot;Can not find the hook file for $_n_hook&quot;
      continue
    fi
    if ! (
      if ! . &quot;$_n_hook_file&quot;; then
        _err &quot;Load file $_n_hook_file error. Please check your api file and try again.&quot;
        return 1
      fi

      d_command=&quot;${_n_hook}_send&quot;
      if ! _exists &quot;$d_command&quot;; then
        _err &quot;It seems that your api file is not correct, it must have a function named: $d_command&quot;
        return 1
      fi

      if ! $d_command &quot;$_nsubject&quot; &quot;$_ncontent&quot; &quot;$_nerror&quot;; then
        _err &quot;Error send message by $d_command&quot;
        return 1
      fi

      return 0
    ); then
      _err &quot;Set $_n_hook_file error.&quot;
      _send_err=1
    else
      _info &quot;$_n_hook $(__green Success)&quot;
    fi
  done
  return $_send_err

}

# hook
_set_notify_hook() {
  _nhooks=&quot;$1&quot;

  _test_subject=&quot;Hello, this is a notification from $PROJECT_NAME&quot;
  _test_content=&quot;If you receive this message, your notification works.&quot;

  _send_notify &quot;$_test_subject&quot; &quot;$_test_content&quot; &quot;$_nhooks&quot; 0

}

#[hook] [level] [mode]
setnotify() {
  _nhook=&quot;$1&quot;
  _nlevel=&quot;$2&quot;
  _nmode=&quot;$3&quot;

  _initpath

  if [ -z &quot;$_nhook$_nlevel$_nmode&quot; ]; then
    _usage &quot;Usage: $PROJECT_ENTRY --set-notify [--notify-hook mailgun] [--notify-level $NOTIFY_LEVEL_DEFAULT] [--notify-mode $NOTIFY_MODE_DEFAULT]&quot;
    _usage &quot;$_NOTIFY_WIKI&quot;
    return 1
  fi

  if [ &quot;$_nlevel&quot; ]; then
    _info &quot;Set notify level to: $_nlevel&quot;
    export &quot;NOTIFY_LEVEL=$_nlevel&quot;
    _saveaccountconf &quot;NOTIFY_LEVEL&quot; &quot;$NOTIFY_LEVEL&quot;
  fi

  if [ &quot;$_nmode&quot; ]; then
    _info &quot;Set notify mode to: $_nmode&quot;
    export &quot;NOTIFY_MODE=$_nmode&quot;
    _saveaccountconf &quot;NOTIFY_MODE&quot; &quot;$NOTIFY_MODE&quot;
  fi

  if [ &quot;$_nhook&quot; ]; then
    _info &quot;Set notify hook to: $_nhook&quot;
    if [ &quot;$_nhook&quot; = &quot;$NO_VALUE&quot; ]; then
      _info &quot;Clear notify hook&quot;
      _clearaccountconf &quot;NOTIFY_HOOK&quot;
    else
      if _set_notify_hook &quot;$_nhook&quot;; then
        export NOTIFY_HOOK=&quot;$_nhook&quot;
        _saveaccountconf &quot;NOTIFY_HOOK&quot; &quot;$NOTIFY_HOOK&quot;
        return 0
      else
        _err &quot;Can not set notify hook to: $_nhook&quot;
        return 1
      fi
    fi
  fi

}

showhelp() {
  _initpath
  version
  echo &quot;Usage: $PROJECT_ENTRY  command ...[parameters]....
Commands:
  --help, -h               Show this help message.
  --version, -v            Show version info.
  --install                Install $PROJECT_NAME to your system.
  --uninstall              Uninstall $PROJECT_NAME, and uninstall the cron job.
  --upgrade                Upgrade $PROJECT_NAME to the latest code from $PROJECT.
  --issue                  Issue a cert.
  --signcsr                Issue a cert from an existing csr.
  --deploy                 Deploy the cert to your server.
  --install-cert           Install the issued cert to apache/nginx or any other server.
  --renew, -r              Renew a cert.
  --renew-all              Renew all the certs.
  --revoke                 Revoke a cert.
  --remove                 Remove the cert from list of certs known to $PROJECT_NAME.
  --list                   List all the certs.
  --showcsr                Show the content of a csr.
  --install-cronjob        Install the cron job to renew certs, you don't need to call this. The 'install' command can automatically install the cron job.
  --uninstall-cronjob      Uninstall the cron job. The 'uninstall' command can do this automatically.
  --cron                   Run cron job to renew all the certs.
  --toPkcs                 Export the certificate and key to a pfx file.
  --toPkcs8                Convert to pkcs8 format.
  --update-account         Update account info.
  --register-account       Register account key.
  --deactivate-account     Deactivate the account.
  --create-account-key     Create an account private key, professional use.
  --create-domain-key      Create an domain private key, professional use.
  --createCSR, -ccsr       Create CSR , professional use.
  --deactivate             Deactivate the domain authz, professional use.
  --set-notify             Set the cron notification hook, level or mode.


Parameters:
  --domain, -d   domain.tld         Specifies a domain, used to issue, renew or revoke etc.
  --challenge-alias domain.tld      The challenge domain alias for DNS alias mode: $_DNS_ALIAS_WIKI
  --domain-alias domain.tld         The domain alias for DNS alias mode: $_DNS_ALIAS_WIKI
  --force, -f                       Used to force to install or force to renew a cert immediately.
  --staging, --test                 Use staging server, just for test.
  --debug                           Output debug info.
  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
  --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
  --standalone                      Use standalone mode.
  --alpn                            Use standalone alpn mode.
  --stateless                       Use stateless mode, see: $_STATELESS_WIKI
  --apache                          Use apache mode.
  --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
  --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.

  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
  --accountkeylength, -ak [2048]    Specifies the account key length.
  --log    [/path/to/logfile]       Specifies the log file. The default is: \&quot;$DEFAULT_LOG_FILE\&quot; if you don't give a file path here.
  --log-level 1|2                   Specifies the log level, default is 1.
  --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.

  These parameters are to install the cert to nginx/apache or any other server after issue/renew a cert:

  --cert-file                       After issue/renew, the cert will be copied to this path.
  --key-file                        After issue/renew, the key will be copied to this path.
  --ca-file                         After issue/renew, the intermediate cert will be copied to this path.
  --fullchain-file                  After issue/renew, the fullchain cert will be copied to this path.

  --reloadcmd \&quot;service nginx reload\&quot; After issue/renew, it's used to reload the server.

  --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
  --accountconf                     Specifies a customized account config file.
  --home                            Specifies the home dir for $PROJECT_NAME.
  --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.
  --config-home                     Specifies the home dir to save all the configurations.
  --useragent                       Specifies the user agent string. it will be saved for future use too.
  --accountemail                    Specifies the account email, only valid for the '--install' and '--update-account' command.
  --accountkey                      Specifies the account key path, only valid for the '--install' command.
  --days                            Specifies the days to renew the cert when using '--issue' command. The default value is $DEFAULT_RENEW days.
  --httpport                        Specifies the standalone listening port. Only valid if the server is behind a reverse proxy or load balancer.
  --tlsport                         Specifies the standalone tls listening port. Only valid if the server is behind a reverse proxy or load balancer.
  --local-address                   Specifies the standalone/tls server listening address, in case you have multiple ip addresses.
  --listraw                         Only used for '--list' command, list the certs in raw format.
  --stopRenewOnError, -se           Only valid for '--renew-all' command. Stop if one cert has error in renewal.
  --insecure                        Do not check the server certificate, in some devices, the api server's certificate may not be trusted.
  --ca-bundle                       Specifies the path to the CA certificate bundle to verify api server's certificate.
  --ca-path                         Specifies directory containing CA certificates in PEM format, used by wget or curl.
  --nocron                          Only valid for '--install' command, which means: do not install the default cron job. In this case, the certs will not be renewed automatically.
  --noprofile                       Only valid for '--install' command, which means: do not install aliases to user profile.
  --no-color                        Do not output color text.
  --force-color                     Force output of color text. Useful for non-interactive use with the aha tool for HTML E-Mails.
  --ecc                             Specifies to use the ECC cert. Valid for '--install-cert', '--renew', '--revoke', '--toPkcs' and '--createCSR'
  --csr                             Specifies the input csr.
  --pre-hook                        Command to be run before obtaining any certificates.
  --post-hook                       Command to be run after attempting to obtain/renew certificates. No matter the obtain/renew is success or failed.
  --renew-hook                      Command to be run once for each successfully renewed certificate.
  --deploy-hook                     The hook file to deploy cert
  --ocsp-must-staple, --ocsp        Generate ocsp must Staple extension.
  --always-force-new-domain-key     Generate new domain key when renewal. Otherwise, the domain key is not changed by default.
  --auto-upgrade   [0|1]            Valid for '--upgrade' command, indicating whether to upgrade automatically in future.
  --listen-v4                       Force standalone/tls server to listen at ipv4.
  --listen-v6                       Force standalone/tls server to listen at ipv6.
  --openssl-bin                     Specifies a custom openssl bin location.
  --use-wget                        Force to use wget, if you have both curl and wget installed.
  --yes-I-know-dns-manual-mode-enough-go-ahead-please  Force to use dns manual mode: $_DNS_MANUAL_WIKI
  --branch, -b                      Only valid for '--upgrade' command, specifies the branch name to upgrade to.

  --notify-level  0|1|2|3           Set the notification level:  Default value is $NOTIFY_LEVEL_DEFAULT.
                                     0: disabled, no notification will be sent.
                                     1: send notifications only when there is an error.
                                     2: send notifications when a cert is successfully renewed, or there is an error.
                                     3: send notifications when a cert is skipped, renewed, or error.
  --notify-mode   0|1               Set notification mode. Default value is $NOTIFY_MODE_DEFAULT.
                                     0: Bulk mode. Send all the domain's notifications in one message(mail).
                                     1: Cert mode. Send a message for every single cert.
  --notify-hook   [hookname]        Set the notify hook

&quot;
}

# nocron noprofile
_installOnline() {
  _info &quot;Installing from online archive.&quot;
  _nocron=&quot;$1&quot;
  _noprofile=&quot;$2&quot;
  if [ ! &quot;$BRANCH&quot; ]; then
    BRANCH=&quot;master&quot;
  fi

  target=&quot;$PROJECT/archive/$BRANCH.tar.gz&quot;
  _info &quot;Downloading $target&quot;
  localname=&quot;$BRANCH.tar.gz&quot;
  if ! _get &quot;$target&quot; &gt;$localname; then
    _err &quot;Download error.&quot;
    return 1
  fi
  (
    _info &quot;Extracting $localname&quot;
    if ! (tar xzf $localname || gtar xzf $localname); then
      _err &quot;Extraction error.&quot;
      exit 1
    fi

    cd &quot;$PROJECT_NAME-$BRANCH&quot;
    chmod +x $PROJECT_ENTRY
    if ./$PROJECT_ENTRY install &quot;$_nocron&quot; &quot;&quot; &quot;$_noprofile&quot;; then
      _info &quot;Install success!&quot;
      _initpath
      _saveaccountconf &quot;UPGRADE_HASH&quot; &quot;$(_getMasterHash)&quot;
    fi

    cd ..

    rm -rf &quot;$PROJECT_NAME-$BRANCH&quot;
    rm -f &quot;$localname&quot;
  )
}

_getMasterHash() {
  _hash_url=&quot;https://api.github.com/repos/Neilpang/acme.sh/git/refs/heads/master&quot;
  _get $_hash_url | tr -d &quot;\r\n&quot; | tr '{},' '\n' | grep '&quot;sha&quot;:' | cut -d '&quot;' -f 4
}

upgrade() {
  if (
    _initpath
    [ -z &quot;$FORCE&quot; ] &amp;&amp; [ &quot;$(_getMasterHash)&quot; = &quot;$(_readaccountconf &quot;UPGRADE_HASH&quot;)&quot; ] &amp;&amp; _info &quot;Already uptodate!&quot; &amp;&amp; exit 0
    export LE_WORKING_DIR
    cd &quot;$LE_WORKING_DIR&quot;
    _installOnline &quot;nocron&quot; &quot;noprofile&quot;
  ); then
    _info &quot;Upgrade success!&quot;
    exit 0
  else
    _err &quot;Upgrade failed!&quot;
    exit 1
  fi
}

_processAccountConf() {
  if [ &quot;$_useragent&quot; ]; then
    _saveaccountconf &quot;USER_AGENT&quot; &quot;$_useragent&quot;
  elif [ &quot;$USER_AGENT&quot; ] &amp;&amp; [ &quot;$USER_AGENT&quot; != &quot;$DEFAULT_USER_AGENT&quot; ]; then
    _saveaccountconf &quot;USER_AGENT&quot; &quot;$USER_AGENT&quot;
  fi

  if [ &quot;$_accountemail&quot; ]; then
    _saveaccountconf &quot;ACCOUNT_EMAIL&quot; &quot;$_accountemail&quot;
  elif [ &quot;$ACCOUNT_EMAIL&quot; ] &amp;&amp; [ &quot;$ACCOUNT_EMAIL&quot; != &quot;$DEFAULT_ACCOUNT_EMAIL&quot; ]; then
    _saveaccountconf &quot;ACCOUNT_EMAIL&quot; &quot;$ACCOUNT_EMAIL&quot;
  fi

  if [ &quot;$_openssl_bin&quot; ]; then
    _saveaccountconf &quot;ACME_OPENSSL_BIN&quot; &quot;$_openssl_bin&quot;
  elif [ &quot;$ACME_OPENSSL_BIN&quot; ] &amp;&amp; [ &quot;$ACME_OPENSSL_BIN&quot; != &quot;$DEFAULT_OPENSSL_BIN&quot; ]; then
    _saveaccountconf &quot;ACME_OPENSSL_BIN&quot; &quot;$ACME_OPENSSL_BIN&quot;
  fi

  if [ &quot;$_auto_upgrade&quot; ]; then
    _saveaccountconf &quot;AUTO_UPGRADE&quot; &quot;$_auto_upgrade&quot;
  elif [ &quot;$AUTO_UPGRADE&quot; ]; then
    _saveaccountconf &quot;AUTO_UPGRADE&quot; &quot;$AUTO_UPGRADE&quot;
  fi

  if [ &quot;$_use_wget&quot; ]; then
    _saveaccountconf &quot;ACME_USE_WGET&quot; &quot;$_use_wget&quot;
  elif [ &quot;$ACME_USE_WGET&quot; ]; then
    _saveaccountconf &quot;ACME_USE_WGET&quot; &quot;$ACME_USE_WGET&quot;
  fi

}

_checkSudo() {
  if [ &quot;$SUDO_GID&quot; ] &amp;&amp; [ &quot;$SUDO_COMMAND&quot; ] &amp;&amp; [ &quot;$SUDO_USER&quot; ] &amp;&amp; [ &quot;$SUDO_UID&quot; ]; then
    if [ &quot;$SUDO_USER&quot; = &quot;root&quot; ] &amp;&amp; [ &quot;$SUDO_UID&quot; = &quot;0&quot; ]; then
      #it's root using sudo, no matter it's using sudo or not, just fine
      return 0
    fi
    if [ &quot;$SUDO_COMMAND&quot; = &quot;/bin/su&quot; ] || [ &quot;$SUDO_COMMAND&quot; = &quot;/bin/bash&quot; ]; then
      #it's a normal user doing &quot;sudo su&quot;, or `sudo -i` or `sudo -s`
      #fine
      return 0
    fi
    #otherwise
    return 1
  fi
  return 0
}

_process() {
  _CMD=&quot;&quot;
  _domain=&quot;&quot;
  _altdomains=&quot;$NO_VALUE&quot;
  _webroot=&quot;&quot;
  _challenge_alias=&quot;&quot;
  _keylength=&quot;&quot;
  _accountkeylength=&quot;&quot;
  _cert_file=&quot;&quot;
  _key_file=&quot;&quot;
  _ca_file=&quot;&quot;
  _fullchain_file=&quot;&quot;
  _reloadcmd=&quot;&quot;
  _password=&quot;&quot;
  _accountconf=&quot;&quot;
  _useragent=&quot;&quot;
  _accountemail=&quot;&quot;
  _accountkey=&quot;&quot;
  _certhome=&quot;&quot;
  _confighome=&quot;&quot;
  _httpport=&quot;&quot;
  _tlsport=&quot;&quot;
  _dnssleep=&quot;&quot;
  _listraw=&quot;&quot;
  _stopRenewOnError=&quot;&quot;
  #_insecure=&quot;&quot;
  _ca_bundle=&quot;&quot;
  _ca_path=&quot;&quot;
  _nocron=&quot;&quot;
  _noprofile=&quot;&quot;
  _ecc=&quot;&quot;
  _csr=&quot;&quot;
  _pre_hook=&quot;&quot;
  _post_hook=&quot;&quot;
  _renew_hook=&quot;&quot;
  _deploy_hook=&quot;&quot;
  _logfile=&quot;&quot;
  _log=&quot;&quot;
  _local_address=&quot;&quot;
  _log_level=&quot;&quot;
  _auto_upgrade=&quot;&quot;
  _listen_v4=&quot;&quot;
  _listen_v6=&quot;&quot;
  _openssl_bin=&quot;&quot;
  _syslog=&quot;&quot;
  _use_wget=&quot;&quot;
  _server=&quot;&quot;
  _notify_hook=&quot;&quot;
  _notify_level=&quot;&quot;
  _notify_mode=&quot;&quot;
  while [ ${#} -gt 0 ]; do
    case &quot;${1}&quot; in

      --help | -h)
        showhelp
        return
        ;;
      --version | -v)
        version
        return
        ;;
      --install)
        _CMD=&quot;install&quot;
        ;;
      --uninstall)
        _CMD=&quot;uninstall&quot;
        ;;
      --upgrade)
        _CMD=&quot;upgrade&quot;
        ;;
      --issue)
        _CMD=&quot;issue&quot;
        ;;
      --deploy)
        _CMD=&quot;deploy&quot;
        ;;
      --signcsr)
        _CMD=&quot;signcsr&quot;
        ;;
      --showcsr)
        _CMD=&quot;showcsr&quot;
        ;;
      --installcert | -i | --install-cert)
        _CMD=&quot;installcert&quot;
        ;;
      --renew | -r)
        _CMD=&quot;renew&quot;
        ;;
      --renewAll | --renewall | --renew-all)
        _CMD=&quot;renewAll&quot;
        ;;
      --revoke)
        _CMD=&quot;revoke&quot;
        ;;
      --remove)
        _CMD=&quot;remove&quot;
        ;;
      --list)
        _CMD=&quot;list&quot;
        ;;
      --installcronjob | --install-cronjob)
        _CMD=&quot;installcronjob&quot;
        ;;
      --uninstallcronjob | --uninstall-cronjob)
        _CMD=&quot;uninstallcronjob&quot;
        ;;
      --cron)
        _CMD=&quot;cron&quot;
        ;;
      --toPkcs)
        _CMD=&quot;toPkcs&quot;
        ;;
      --toPkcs8)
        _CMD=&quot;toPkcs8&quot;
        ;;
      --createAccountKey | --createaccountkey | -cak | --create-account-key)
        _CMD=&quot;createAccountKey&quot;
        ;;
      --createDomainKey | --createdomainkey | -cdk | --create-domain-key)
        _CMD=&quot;createDomainKey&quot;
        ;;
      --createCSR | --createcsr | -ccr)
        _CMD=&quot;createCSR&quot;
        ;;
      --deactivate)
        _CMD=&quot;deactivate&quot;
        ;;
      --updateaccount | --update-account)
        _CMD=&quot;updateaccount&quot;
        ;;
      --registeraccount | --register-account)
        _CMD=&quot;registeraccount&quot;
        ;;
      --deactivate-account)
        _CMD=&quot;deactivateaccount&quot;
        ;;
      --set-notify)
        _CMD=&quot;setnotify&quot;
        ;;
      --domain | -d)
        _dvalue=&quot;$2&quot;

        if [ &quot;$_dvalue&quot; ]; then
          if _startswith &quot;$_dvalue&quot; &quot;-&quot;; then
            _err &quot;'$_dvalue' is not a valid domain for parameter '$1'&quot;
            return 1
          fi
          if _is_idn &quot;$_dvalue&quot; &amp;&amp; ! _exists idn; then
            _err &quot;It seems that $_dvalue is an IDN( Internationalized Domain Names), please install 'idn' command first.&quot;
            return 1
          fi

          if _startswith &quot;$_dvalue&quot; &quot;*.&quot;; then
            _debug &quot;Wildcard domain&quot;
            export ACME_VERSION=2
          fi
          if [ -z &quot;$_domain&quot; ]; then
            _domain=&quot;$_dvalue&quot;
          else
            if [ &quot;$_altdomains&quot; = &quot;$NO_VALUE&quot; ]; then
              _altdomains=&quot;$_dvalue&quot;
            else
              _altdomains=&quot;$_altdomains,$_dvalue&quot;
            fi
          fi
        fi

        shift
        ;;

      --force | -f)
        FORCE=&quot;1&quot;
        ;;
      --staging | --test)
        STAGE=&quot;1&quot;
        ;;
      --server)
        ACME_DIRECTORY=&quot;$2&quot;
        _server=&quot;$ACME_DIRECTORY&quot;
        export ACME_DIRECTORY
        shift
        ;;
      --debug)
        if [ -z &quot;$2&quot; ] || _startswith &quot;$2&quot; &quot;-&quot;; then
          DEBUG=&quot;$DEBUG_LEVEL_DEFAULT&quot;
        else
          DEBUG=&quot;$2&quot;
          shift
        fi
        ;;
      --output-insecure)
        export OUTPUT_INSECURE=1
        ;;
      --webroot | -w)
        wvalue=&quot;$2&quot;
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        shift
        ;;
      --challenge-alias)
        cvalue=&quot;$2&quot;
        _challenge_alias=&quot;$_challenge_alias$cvalue,&quot;
        shift
        ;;
      --domain-alias)
        cvalue=&quot;$DNS_ALIAS_PREFIX$2&quot;
        _challenge_alias=&quot;$_challenge_alias$cvalue,&quot;
        shift
        ;;
      --standalone)
        wvalue=&quot;$NO_VALUE&quot;
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --alpn)
        wvalue=&quot;$W_ALPN&quot;
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --stateless)
        wvalue=&quot;$MODE_STATELESS&quot;
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --local-address)
        lvalue=&quot;$2&quot;
        _local_address=&quot;$_local_address$lvalue,&quot;
        shift
        ;;
      --apache)
        wvalue=&quot;apache&quot;
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --nginx)
        wvalue=&quot;$NGINX&quot;
        if [ &quot;$2&quot; ] &amp;&amp; ! _startswith &quot;$2&quot; &quot;-&quot;; then
          wvalue=&quot;$NGINX$2&quot;
          shift
        fi
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --dns)
        wvalue=&quot;$W_DNS&quot;
        if [ &quot;$2&quot; ] &amp;&amp; ! _startswith &quot;$2&quot; &quot;-&quot;; then
          wvalue=&quot;$2&quot;
          shift
        fi
        if [ -z &quot;$_webroot&quot; ]; then
          _webroot=&quot;$wvalue&quot;
        else
          _webroot=&quot;$_webroot,$wvalue&quot;
        fi
        ;;
      --dnssleep)
        _dnssleep=&quot;$2&quot;
        Le_DNSSleep=&quot;$_dnssleep&quot;
        shift
        ;;

      --keylength | -k)
        _keylength=&quot;$2&quot;
        shift
        ;;
      --accountkeylength | -ak)
        _accountkeylength=&quot;$2&quot;
        shift
        ;;

      --cert-file | --certpath)
        _cert_file=&quot;$2&quot;
        shift
        ;;
      --key-file | --keypath)
        _key_file=&quot;$2&quot;
        shift
        ;;
      --ca-file | --capath)
        _ca_file=&quot;$2&quot;
        shift
        ;;
      --fullchain-file | --fullchainpath)
        _fullchain_file=&quot;$2&quot;
        shift
        ;;
      --reloadcmd | --reloadCmd)
        _reloadcmd=&quot;$2&quot;
        shift
        ;;
      --password)
        _password=&quot;$2&quot;
        shift
        ;;
      --accountconf)
        _accountconf=&quot;$2&quot;
        ACCOUNT_CONF_PATH=&quot;$_accountconf&quot;
        shift
        ;;
      --home)
        LE_WORKING_DIR=&quot;$2&quot;
        shift
        ;;
      --certhome | --cert-home)
        _certhome=&quot;$2&quot;
        CERT_HOME=&quot;$_certhome&quot;
        shift
        ;;
      --config-home)
        _confighome=&quot;$2&quot;
        LE_CONFIG_HOME=&quot;$_confighome&quot;
        shift
        ;;
      --useragent)
        _useragent=&quot;$2&quot;
        USER_AGENT=&quot;$_useragent&quot;
        shift
        ;;
      --accountemail)
        _accountemail=&quot;$2&quot;
        ACCOUNT_EMAIL=&quot;$_accountemail&quot;
        shift
        ;;
      --accountkey)
        _accountkey=&quot;$2&quot;
        ACCOUNT_KEY_PATH=&quot;$_accountkey&quot;
        shift
        ;;
      --days)
        _days=&quot;$2&quot;
        Le_RenewalDays=&quot;$_days&quot;
        shift
        ;;
      --httpport)
        _httpport=&quot;$2&quot;
        Le_HTTPPort=&quot;$_httpport&quot;
        shift
        ;;
      --tlsport)
        _tlsport=&quot;$2&quot;
        Le_TLSPort=&quot;$_tlsport&quot;
        shift
        ;;
      --listraw)
        _listraw=&quot;raw&quot;
        ;;
      --stopRenewOnError | --stoprenewonerror | -se)
        _stopRenewOnError=&quot;1&quot;
        ;;
      --insecure)
        #_insecure=&quot;1&quot;
        HTTPS_INSECURE=&quot;1&quot;
        ;;
      --ca-bundle)
        _ca_bundle=&quot;$(_readlink &quot;$2&quot;)&quot;
        CA_BUNDLE=&quot;$_ca_bundle&quot;
        shift
        ;;
      --ca-path)
        _ca_path=&quot;$2&quot;
        CA_PATH=&quot;$_ca_path&quot;
        shift
        ;;
      --nocron)
        _nocron=&quot;1&quot;
        ;;
      --noprofile)
        _noprofile=&quot;1&quot;
        ;;
      --no-color)
        export ACME_NO_COLOR=1
        ;;
      --force-color)
        export ACME_FORCE_COLOR=1
        ;;
      --ecc)
        _ecc=&quot;isEcc&quot;
        ;;
      --csr)
        _csr=&quot;$2&quot;
        shift
        ;;
      --pre-hook)
        _pre_hook=&quot;$2&quot;
        shift
        ;;
      --post-hook)
        _post_hook=&quot;$2&quot;
        shift
        ;;
      --renew-hook)
        _renew_hook=&quot;$2&quot;
        shift
        ;;
      --deploy-hook)
        if [ -z &quot;$2&quot; ] || _startswith &quot;$2&quot; &quot;-&quot;; then
          _usage &quot;Please specify a value for '--deploy-hook'&quot;
          return 1
        fi
        _deploy_hook=&quot;$_deploy_hook$2,&quot;
        shift
        ;;
      --ocsp-must-staple | --ocsp)
        Le_OCSP_Staple=&quot;1&quot;
        ;;
      --always-force-new-domain-key)
        if [ -z &quot;$2&quot; ] || _startswith &quot;$2&quot; &quot;-&quot;; then
          Le_ForceNewDomainKey=1
        else
          Le_ForceNewDomainKey=&quot;$2&quot;
          shift
        fi
        ;;
      --yes-I-know-dns-manual-mode-enough-go-ahead-please)
        export FORCE_DNS_MANUAL=1
        ;;
      --log | --logfile)
        _log=&quot;1&quot;
        _logfile=&quot;$2&quot;
        if _startswith &quot;$_logfile&quot; '-'; then
          _logfile=&quot;&quot;
        else
          shift
        fi
        LOG_FILE=&quot;$_logfile&quot;
        if [ -z &quot;$LOG_LEVEL&quot; ]; then
          LOG_LEVEL=&quot;$DEFAULT_LOG_LEVEL&quot;
        fi
        ;;
      --log-level)
        _log_level=&quot;$2&quot;
        LOG_LEVEL=&quot;$_log_level&quot;
        shift
        ;;
      --syslog)
        if ! _startswith &quot;$2&quot; '-'; then
          _syslog=&quot;$2&quot;
          shift
        fi
        if [ -z &quot;$_syslog&quot; ]; then
          _syslog=&quot;$SYSLOG_LEVEL_DEFAULT&quot;
        fi
        ;;
      --auto-upgrade)
        _auto_upgrade=&quot;$2&quot;
        if [ -z &quot;$_auto_upgrade&quot; ] || _startswith &quot;$_auto_upgrade&quot; '-'; then
          _auto_upgrade=&quot;1&quot;
        else
          shift
        fi
        AUTO_UPGRADE=&quot;$_auto_upgrade&quot;
        ;;
      --listen-v4)
        _listen_v4=&quot;1&quot;
        Le_Listen_V4=&quot;$_listen_v4&quot;
        ;;
      --listen-v6)
        _listen_v6=&quot;1&quot;
        Le_Listen_V6=&quot;$_listen_v6&quot;
        ;;
      --openssl-bin)
        _openssl_bin=&quot;$2&quot;
        ACME_OPENSSL_BIN=&quot;$_openssl_bin&quot;
        shift
        ;;
      --use-wget)
        _use_wget=&quot;1&quot;
        ACME_USE_WGET=&quot;1&quot;
        ;;
      --branch | -b)
        export BRANCH=&quot;$2&quot;
        shift
        ;;
      --notify-hook)
        _nhook=&quot;$2&quot;
        if _startswith &quot;$_nhook&quot; &quot;-&quot;; then
          _err &quot;'$_nhook' is not a hook name for '$1'&quot;
          return 1
        fi
        if [ &quot;$_notify_hook&quot; ]; then
          _notify_hook=&quot;$_notify_hook,$_nhook&quot;
        else
          _notify_hook=&quot;$_nhook&quot;
        fi
        shift
        ;;
      --notify-level)
        _nlevel=&quot;$2&quot;
        if _startswith &quot;$_nlevel&quot; &quot;-&quot;; then
          _err &quot;'$_nlevel' is not a integer for '$1'&quot;
          return 1
        fi
        _notify_level=&quot;$_nlevel&quot;
        shift
        ;;
      --notify-mode)
        _nmode=&quot;$2&quot;
        if _startswith &quot;$_nmode&quot; &quot;-&quot;; then
          _err &quot;'$_nmode' is not a integer for '$1'&quot;
          return 1
        fi
        _notify_mode=&quot;$_nmode&quot;
        shift
        ;;
      *)
        _err &quot;Unknown parameter : $1&quot;
        return 1
        ;;
    esac

    shift 1
  done

  if [ &quot;${_CMD}&quot; != &quot;install&quot; ]; then
    if [ &quot;$__INTERACTIVE&quot; ] &amp;&amp; ! _checkSudo; then
      if [ -z &quot;$FORCE&quot; ]; then
        #Use &quot;echo&quot; here, instead of _info. it's too early
        echo &quot;It seems that you are using sudo, please read this link first:&quot;
        echo &quot;$_SUDO_WIKI&quot;
        return 1
      fi
    fi
    __initHome
    if [ &quot;$_log&quot; ]; then
      if [ -z &quot;$_logfile&quot; ]; then
        _logfile=&quot;$DEFAULT_LOG_FILE&quot;
      fi
    fi
    if [ &quot;$_logfile&quot; ]; then
      _saveaccountconf &quot;LOG_FILE&quot; &quot;$_logfile&quot;
      LOG_FILE=&quot;$_logfile&quot;
    fi

    if [ &quot;$_log_level&quot; ]; then
      _saveaccountconf &quot;LOG_LEVEL&quot; &quot;$_log_level&quot;
      LOG_LEVEL=&quot;$_log_level&quot;
    fi

    if [ &quot;$_syslog&quot; ]; then
      if _exists logger; then
        if [ &quot;$_syslog&quot; = &quot;0&quot; ]; then
          _clearaccountconf &quot;SYS_LOG&quot;
        else
          _saveaccountconf &quot;SYS_LOG&quot; &quot;$_syslog&quot;
        fi
        SYS_LOG=&quot;$_syslog&quot;
      else
        _err &quot;The 'logger' command is not found, can not enable syslog.&quot;
        _clearaccountconf &quot;SYS_LOG&quot;
        SYS_LOG=&quot;&quot;
      fi
    fi

    _processAccountConf
  fi

  _debug2 LE_WORKING_DIR &quot;$LE_WORKING_DIR&quot;

  if [ &quot;$DEBUG&quot; ]; then
    version
    if [ &quot;$_server&quot; ]; then
      _debug &quot;Using server: $_server&quot;
    fi
  fi
  _debug &quot;Running cmd: ${_CMD}&quot;
  case &quot;${_CMD}&quot; in
    install) install &quot;$_nocron&quot; &quot;$_confighome&quot; &quot;$_noprofile&quot; ;;
    uninstall) uninstall &quot;$_nocron&quot; ;;
    upgrade) upgrade ;;
    issue)
      issue &quot;$_webroot&quot; &quot;$_domain&quot; &quot;$_altdomains&quot; &quot;$_keylength&quot; &quot;$_cert_file&quot; &quot;$_key_file&quot; &quot;$_ca_file&quot; &quot;$_reloadcmd&quot; &quot;$_fullchain_file&quot; &quot;$_pre_hook&quot; &quot;$_post_hook&quot; &quot;$_renew_hook&quot; &quot;$_local_address&quot; &quot;$_challenge_alias&quot;
      ;;
    deploy)
      deploy &quot;$_domain&quot; &quot;$_deploy_hook&quot; &quot;$_ecc&quot;
      ;;
    signcsr)
      signcsr &quot;$_csr&quot; &quot;$_webroot&quot; &quot;$_cert_file&quot; &quot;$_key_file&quot; &quot;$_ca_file&quot; &quot;$_reloadcmd&quot; &quot;$_fullchain_file&quot; &quot;$_pre_hook&quot; &quot;$_post_hook&quot; &quot;$_renew_hook&quot; &quot;$_local_address&quot; &quot;$_challenge_alias&quot;
      ;;
    showcsr)
      showcsr &quot;$_csr&quot; &quot;$_domain&quot;
      ;;
    installcert)
      installcert &quot;$_domain&quot; &quot;$_cert_file&quot; &quot;$_key_file&quot; &quot;$_ca_file&quot; &quot;$_reloadcmd&quot; &quot;$_fullchain_file&quot; &quot;$_ecc&quot;
      ;;
    renew)
      renew &quot;$_domain&quot; &quot;$_ecc&quot;
      ;;
    renewAll)
      renewAll &quot;$_stopRenewOnError&quot;
      ;;
    revoke)
      revoke &quot;$_domain&quot; &quot;$_ecc&quot;
      ;;
    remove)
      remove &quot;$_domain&quot; &quot;$_ecc&quot;
      ;;
    deactivate)
      deactivate &quot;$_domain,$_altdomains&quot;
      ;;
    registeraccount)
      registeraccount &quot;$_accountkeylength&quot;
      ;;
    updateaccount)
      updateaccount
      ;;
    deactivateaccount)
      deactivateaccount
      ;;
    list)
      list &quot;$_listraw&quot;
      ;;
    installcronjob) installcronjob &quot;$_confighome&quot; ;;
    uninstallcronjob) uninstallcronjob ;;
    cron) cron ;;
    toPkcs)
      toPkcs &quot;$_domain&quot; &quot;$_password&quot; &quot;$_ecc&quot;
      ;;
    toPkcs8)
      toPkcs8 &quot;$_domain&quot; &quot;$_ecc&quot;
      ;;
    createAccountKey)
      createAccountKey &quot;$_accountkeylength&quot;
      ;;
    createDomainKey)
      createDomainKey &quot;$_domain&quot; &quot;$_keylength&quot;
      ;;
    createCSR)
      createCSR &quot;$_domain&quot; &quot;$_altdomains&quot; &quot;$_ecc&quot;
      ;;
    setnotify)
      setnotify &quot;$_notify_hook&quot; &quot;$_notify_level&quot; &quot;$_notify_mode&quot;
      ;;
    *)
      if [ &quot;$_CMD&quot; ]; then
        _err &quot;Invalid command: $_CMD&quot;
      fi
      showhelp
      return 1
      ;;
  esac
  _ret=&quot;$?&quot;
  if [ &quot;$_ret&quot; != &quot;0&quot; ]; then
    return $_ret
  fi

  if [ &quot;${_CMD}&quot; = &quot;install&quot; ]; then
    if [ &quot;$_log&quot; ]; then
      if [ -z &quot;$LOG_FILE&quot; ]; then
        LOG_FILE=&quot;$DEFAULT_LOG_FILE&quot;
      fi
      _saveaccountconf &quot;LOG_FILE&quot; &quot;$LOG_FILE&quot;
    fi

    if [ &quot;$_log_level&quot; ]; then
      _saveaccountconf &quot;LOG_LEVEL&quot; &quot;$_log_level&quot;
    fi

    if [ &quot;$_syslog&quot; ]; then
      if _exists logger; then
        if [ &quot;$_syslog&quot; = &quot;0&quot; ]; then
          _clearaccountconf &quot;SYS_LOG&quot;
        else
          _saveaccountconf &quot;SYS_LOG&quot; &quot;$_syslog&quot;
        fi
      else
        _err &quot;The 'logger' command is not found, can not enable syslog.&quot;
        _clearaccountconf &quot;SYS_LOG&quot;
        SYS_LOG=&quot;&quot;
      fi
    fi

    _processAccountConf
  fi

}

if [ &quot;$INSTALLONLINE&quot; ]; then
  INSTALLONLINE=&quot;&quot;
  _installOnline
  exit
fi

main() {
  [ -z &quot;$1&quot; ] &amp;&amp; showhelp &amp;&amp; return
  if _startswith &quot;$1&quot; '-'; then _process &quot;$@&quot;; else &quot;$@&quot;; fi
}

main &quot;$@&quot;
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fwhostmgr%2Fdocroot%2Fcgi%2Fsoftaculous%2Fincludes71%2Fcli'>Back to Directory</a>