Changeset 105afb5


Ignore:
Timestamp:
11/29/21 12:16:54 (3 years ago)
Author:
Edwin Eefting <edwin@datux.nl>
Branches:
master
Children:
439f083
Parents:
7c410f9
Message:

update curl, acme (certbot/letsencrypt) and root ca's

Location:
npl
Files:
7 added
7 deleted
30 edited
1 moved

Legend:

Unmodified
Added
Removed

  • npl/overig/curl/curl.SlackBuild

    r7c410f9 r105afb5  
    22#
    33# Automaticly created by importpackage v1.0
    4 # Imported from: http://mirrors.slackware.com/slackware/slackware-current/source/n/curl/
    5 # Created at Thu Oct 13 15:04:31 CEST 2016
     4# Imported from: https://mirrors.slackware.com/slackware/slackware-current/source/n/curl/
     5# Created at ma 29 nov 2021 11:59:09 CET
    66#DEP:openssl
    77

  • npl/overig/curl/curl.SlackBuild.orig

    r7c410f9 r105afb5  
    1 #!/bin/sh
     1#!/bin/bash
    22
    3 # Copyright 2008, 2009, 2010, 2011, 2013, 2014, 2016  Patrick J. Volkerding, Sebeka, MN, USA
     3# Copyright 2008, 2009, 2010, 2011, 2013, 2014, 2016, 2017, 2018, 2020, 2021  Patrick J. Volkerding, Sebeka, MN, USA
    44# All rights reserved.
    55#
    … …  
    2121#  ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    2222
     23cd $(dirname $0) ; CWD=$(pwd)
    2324
    2425PKGNAM=curl
    25 VERSION=${VERSION:-$(echo curl-*.tar.bz2 | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
     26VERSION=${VERSION:-$(echo curl-*.tar.xz | rev | cut -f 3- -d . | cut -f 1 -d - | rev)}
    2627BUILD=${BUILD:-1}
    2728
    … …  
    3637fi
    3738
    38 NUMJOBS=${NUMJOBS:-" -j7 "}
     39# If the variable PRINT_PACKAGE_NAME is set, then this script will report what
     40# the name of the created package would be, and then exit. This information
     41# could be useful to other scripts.
     42if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then
     43  echo "$PKGNAM-$VERSION-$ARCH-$BUILD.txz"
     44  exit 0
     45fi
    3946
    40 CWD=$(pwd)
     47NUMJOBS=${NUMJOBS:-" -j$(expr $(nproc) + 1) "}
     48
    4149TMP=${TMP:-/tmp}
    4250PKG=$TMP/package-curl
    4351
    44 # Uncomment to build a no-SSL version:
    45 #SSLOPT=--without-ssl
     52# Set this variable to "--without-ssl" to build a no-SSL version:
     53SSLOPT=${SSLOPT:-"--with-openssl"}
    4654
    4755if [ "$ARCH" = "i586" ]; then
    … …  
    6371cd $TMP
    6472rm -rf curl-$VERSION
    65 tar xvf $CWD/curl-$VERSION.tar.bz2 || exit 1
    66 cd curl-$VERSION
     73tar xvf $CWD/curl-$VERSION.tar.xz || exit 1
     74cd curl-$VERSION || exit 1
    6775
    6876chown -R root:root .
    6977find . \
    7078  \( -perm 777 -o -perm 775 -o -perm 711 -o -perm 555 -o -perm 511 \) \
    71   -exec chmod 755 {} \; -o \
     79  -exec chmod 755 {} \+ -o \
    7280  \( -perm 666 -o -perm 664 -o -perm 600 -o -perm 444 -o -perm 440 -o -perm 400 \) \
    73   -exec chmod 644 {} \;
     81  -exec chmod 644 {} \+
    7482
    7583CFLAGS="$SLKCFLAGS" \
    … …  
    7886  --libdir=/usr/lib${LIBDIRSUFFIX} \
    7987  --mandir=/usr/man \
    80   --with-ca-bundle=/usr/share/curl/ca-bundle.crt \
     88  --with-gssapi \
    8189  --enable-static=no \
    82   $SSLOPT
     90  --without-ca-bundle \
     91  --with-ca-path=/etc/ssl/certs \
     92  $SSLOPT || exit 1
    8393
    8494make $NUMJOBS || make || exit 1
    8595make install DESTDIR=$PKG || exit 1
    8696
    87 mkdir -p $PKG/usr/share/curl
    88 cp -a $CWD/cacert.pem.bz2 $PKG/usr/share/curl
    89 ( cd $PKG/usr/share/curl
    90   bzip2 -d cacert.pem.bz2
    91   mv cacert.pem ca-bundle.crt
    92   chown root:root ca-bundle.crt
    93   chmod 644 ca-bundle.crt
     97# Don't ship .la files:
     98rm -f $PKG/{,usr/}lib${LIBDIRSUFFIX}/*.la
     99
     100# We have always installed the man3 documentation, so we'll keep doing it
     101# even though these are no longer installed by default. No || exit 1, if
     102# it works, it works, and if it doesn't, we tried.
     103( cd docs/libcurl
     104  make install-man3 DESTDIR=$PKG
     105  cd opts
     106  make install-man3 DESTDIR=$PKG
    94107)
    95108
    … …  
    104117mkdir -p $PKG/usr/doc/curl-$VERSION
    105118cp -a \
    106   COPYING* README* \
     119  COPYING* README*  \
    107120  $PKG/usr/doc/curl-$VERSION
    108 ( cd docs
    109   rm -rf Makefile* curl-config.1 curl-config.html curl.1 curl.html libcurl
    110   cp -a \
    111     BUGS  FAQ FEATURES INSTALL  MANUAL README* RESOURCES THANKS TODO examples \
    112     $PKG/usr/doc/curl-$VERSION )
    113121# Get rid of .deps cruft:
    114 rm -rf $PKG/usr/doc/curl-$VERSION/examples/.deps
     122rm -rf $PKG/usr/doc/curl-$VERSION/examples/.deps || true
    115123
    116124# If there's a CHANGES file, installing at least part of the recent history

  • npl/overig/curl/curl.build

    r7c410f9 r105afb5  
    1 6526
     16527
     2

  • npl/overig/curl/curl.md5

    r7c410f9 r105afb5  
    1 6a26088131084de88249d18c712efe22  ./cacert-fetch.sh
    2 de25f1a2e0fe6347cbc1b8cf15fb5235  ./cacert.pem.bz2
    3 bd177fd6deecce00cfa7b5916d831c5e  ./curl-7.50.3.tar.bz2
    4 8280845acce7ce9a0d86d2d56f6cb7ed  ./curl-7.50.3.tar.bz2.asc
    5 39c7a420f62ededda8fb99dfda559ae7  ./curl_dev.pkg
    6 3874608d5935cc4fc98ddf66af5b68d8  ./curl.pkg
    7 a2b9ad44cbfffc395e9659aaa54f15fa  ./curl.SlackBuild
    8 c6b669414601bbf65ae4e70f3963f38d  ./curl.SlackBuild.log.gz
    9 c5aaf1f564f36d3e644b1cfa78d65d25  ./curl.SlackBuild.orig
    10 57ca4674cb7b3f61a5368f03c762b298  ./slack-desc
     1cf9f8553762150ef0ebcd5ee412737f5  ./curl-7.80.0.tar.xz
     2acdfa1afa53bc2b3860890fe56164400  ./curl-7.80.0.tar.xz.asc
     37a91c1763505d6ab1838b080cda02479  ./curl_dev.pkg
     4d1c96ad6fda1e0a5c72af6704f1c518e  ./curl.pkg
     5d7cfd54cbf5d2e6530bd4d0d11d41f6b  ./curl.SlackBuild
     60deec8e8a5ad982c5ca4ba26559da236  ./curl.SlackBuild.log.gz
     7f4e145d65c8e5699c6aee62d6202b911  ./curl.SlackBuild.orig
     8e5ca7d0aa9057708c065f7dee5c43ed6  ./curl.url
     9c722a231538a9f14d2335d36231f0c9b  ./slack-desc

  • npl/overig/curl/curl.version

    r7c410f9 r105afb5  
    1 7.50.3
     17.80.0

  • npl/overig/curl/curl_dev.build

    r7c410f9 r105afb5  
    1 6526
     16527

  • npl/overig/curl/curl_dev.version

    r7c410f9 r105afb5  
    1 7.50.3
     17.80.0

  • npl/overig/curl/slack-desc

    r7c410f9 r105afb5  
    11# HOW TO EDIT THIS FILE:
    2 # The "handy ruler" below makes it easier to edit a package description.  Line
     2# The "handy ruler" below makes it easier to edit a package description. Line
    33# up the first '|' above the ':' following the base package name, and the '|'
    4 # on the right side marks the last column you can put a character in.  You must
    5 # make exactly 11 lines for the formatting to be correct.  It's also
     4# on the right side marks the last column you can put a character in. You must
     5# make exactly 11 lines for the formatting to be correct. It's also
    66# customary to leave one space after the ':'.
    77
    … …  
    1010curl:
    1111curl: Curl is a command line tool for transferring data specified with URL
    12 curl: syntax.  The command is designed to work without user interaction or
    13 curl: any kind of interactivity.   Curl offers a busload of useful tricks
     12curl: syntax. The command is designed to work without user interaction or
     13curl: any kind of interactivity. Curl offers a busload of useful tricks
    1414curl: like proxy support, user authentication, ftp upload, HTTP post,  SSL
    1515curl: (https:) connections, cookies, file transfer resume and more.

  • npl/syn3/acme/root/usr/bin/acme.sh

    r7c410f9 r105afb5  
    11#!/usr/bin/env sh
    22
    3 VER=2.8.8
     3VER=3.0.1
    44
    55PROJECT_NAME="acme.sh"
    … …  
    2121_SUB_FOLDERS="$_SUB_FOLDER_DNSAPI $_SUB_FOLDER_DEPLOY $_SUB_FOLDER_NOTIFY"
    2222
    23 LETSENCRYPT_CA_V1="https://acme-v01.api.letsencrypt.org/directory"
    24 LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
     23CA_LETSENCRYPT_V1="https://acme-v01.api.letsencrypt.org/directory"
    2524
    2625CA_LETSENCRYPT_V2="https://acme-v02.api.letsencrypt.org/directory"
    … …  
    3332_ZERO_EAB_ENDPOINT="http://api.zerossl.com/acme/eab-credentials-email"
    3433
    35 DEFAULT_CA=$CA_LETSENCRYPT_V2
     34CA_SSLCOM_RSA="https://acme.ssl.com/sslcom-dv-rsa"
     35CA_SSLCOM_ECC="https://acme.ssl.com/sslcom-dv-ecc"
     36
     37DEFAULT_CA=$CA_ZEROSSL
    3638DEFAULT_STAGING_CA=$CA_LETSENCRYPT_V2_TEST
    3739
    3840CA_NAMES="
     41ZeroSSL.com,zerossl
    3942LetsEncrypt.org,letsencrypt
    4043LetsEncrypt.org_test,letsencrypt_test,letsencrypttest
    4144BuyPass.com,buypass
    4245BuyPass.com_test,buypass_test,buypasstest
    43 ZeroSSL.com,zerossl
     46SSL.com,sslcom
    4447"
    4548
    46 CA_SERVERS="$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_ZEROSSL"
     49CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_SSLCOM_RSA"
    4750
    4851DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
    … …  
    103106DOH_CLOUDFLARE=1
    104107DOH_GOOGLE=2
     108DOH_ALI=3
     109DOH_DP=4
    105110
    106111HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
    … …  
    157162_ZEROSSL_WIKI="https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA"
    158163
     164_SSLCOM_WIKI="https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA"
     165
    159166_SERVER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Server"
    160167
    161168_PREFERRED_CHAIN_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
     169
     170_DNSCHECK_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dnscheck"
    162171
    163172_DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
    … …  
    561570
    562571_h2b() {
    563   if _exists xxd && xxd -r -p 2>/dev/null; then
    564     return
     572  if _exists xxd; then
     573    if _contains "$(xxd --help 2>&1)" "assumes -c30"; then
     574      if xxd -r -p -c 9999 2>/dev/null; then
     575        return
     576      fi
     577    else
     578      if xxd -r -p 2>/dev/null; then
     579        return
     580      fi
     581    fi
    565582  fi
    566583
    … …  
    11231140  if _isEccKey "$length"; then
    11241141    _debug "Using ec name: $eccname"
    1125     if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null)"; then
     1142    if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -noout -genkey 2>/dev/null)"; then
    11261143      echo "$_opkey" >"$f"
    11271144    else
    … …  
    11311148  else
    11321149    _debug "Using RSA: $length"
    1133     if _opkey="$(${ACME_OPENSSL_BIN:-openssl} genrsa "$length" 2>/dev/null)"; then
     1150    __traditional=""
     1151    if _contains "$(${ACME_OPENSSL_BIN:-openssl} help genrsa 2>&1)" "-traditional"; then
     1152      __traditional="-traditional"
     1153    fi
     1154    if _opkey="$(${ACME_OPENSSL_BIN:-openssl} genrsa $__traditional "$length" 2>/dev/null)"; then
    11341155      echo "$_opkey" >"$f"
    11351156    else
    … …  
    11981219  _debug2 csrconf "$csrconf"
    11991220
    1200   printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
     1221  printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\n" >"$csrconf"
    12011222
    12021223  if [ "$acmeValidationv1" ]; then
    … …  
    17501771      _ACME_CURL="$_ACME_CURL -L "
    17511772    fi
    1752     if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
     1773    if [ "$DEBUG" ] && [ "$DEBUG" -ge 2 ]; then
    17531774      _CURL_DUMP="$(_mktemp)"
    17541775      _ACME_CURL="$_ACME_CURL --trace-ascii $_CURL_DUMP "
    … …  
    17891810
    17901811}
     1812
     1813_HTTP_MAX_RETRY=8
    17911814
    17921815# body  url [needbase64] [POST|PUT|DELETE] [ContentType]
    … …  
    17971820  httpmethod="$4"
    17981821  _postContentType="$5"
     1822  _sleep_retry_sec=1
     1823  _http_retry_times=0
     1824  _hcode=0
     1825  while [ "${_http_retry_times}" -le "$_HTTP_MAX_RETRY" ]; do
     1826    [ "$_http_retry_times" = "$_HTTP_MAX_RETRY" ]
     1827    _lastHCode="$?"
     1828    _debug "Retrying post"
     1829    _post_impl "$body" "$_post_url" "$needbase64" "$httpmethod" "$_postContentType" "$_lastHCode"
     1830    _hcode="$?"
     1831    _debug _hcode "$_hcode"
     1832    if [ "$_hcode" = "0" ]; then
     1833      break
     1834    fi
     1835    _http_retry_times=$(_math $_http_retry_times + 1)
     1836    _sleep $_sleep_retry_sec
     1837  done
     1838  return $_hcode
     1839}
     1840
     1841# body  url [needbase64] [POST|PUT|DELETE] [ContentType] [displayError]
     1842_post_impl() {
     1843  body="$1"
     1844  _post_url="$2"
     1845  needbase64="$3"
     1846  httpmethod="$4"
     1847  _postContentType="$5"
     1848  displayError="$6"
    17991849
    18001850  if [ -z "$httpmethod" ]; then
    … …  
    18481898    _ret="$?"
    18491899    if [ "$_ret" != "0" ]; then
    1850       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
     1900      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
     1901        _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
     1902      fi
    18511903      if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
    18521904        _err "Here is the curl dump log:"
    … …  
    19041956    fi
    19051957    if [ "$_ret" != "0" ]; then
    1906       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
     1958      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
     1959        _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
     1960      fi
    19071961    fi
    19081962    _sed_i "s/^ *//g" "$HTTP_HEADER"
    … …  
    19181972# url getheader timeout
    19191973_get() {
     1974  url="$1"
     1975  onlyheader="$2"
     1976  t="$3"
     1977  _sleep_retry_sec=1
     1978  _http_retry_times=0
     1979  _hcode=0
     1980  while [ "${_http_retry_times}" -le "$_HTTP_MAX_RETRY" ]; do
     1981    [ "$_http_retry_times" = "$_HTTP_MAX_RETRY" ]
     1982    _lastHCode="$?"
     1983    _debug "Retrying GET"
     1984    _get_impl "$url" "$onlyheader" "$t" "$_lastHCode"
     1985    _hcode="$?"
     1986    _debug _hcode "$_hcode"
     1987    if [ "$_hcode" = "0" ]; then
     1988      break
     1989    fi
     1990    _http_retry_times=$(_math $_http_retry_times + 1)
     1991    _sleep $_sleep_retry_sec
     1992  done
     1993  return $_hcode
     1994}
     1995
     1996# url getheader timeout displayError
     1997_get_impl() {
    19201998  _debug GET
    19211999  url="$1"
    19222000  onlyheader="$2"
    19232001  t="$3"
     2002  displayError="$4"
    19242003  _debug url "$url"
    19252004  _debug "timeout=$t"
    1926 
     2005  _debug "displayError" "$displayError"
    19272006  _inithttp
    19282007
    … …  
    19432022    ret=$?
    19442023    if [ "$ret" != "0" ]; then
    1945       _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
     2024      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
     2025        _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
     2026      fi
    19462027      if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
    19472028        _err "Here is the curl dump log:"
    … …  
    19692050    fi
    19702051    if [ "$ret" != "0" ]; then
    1971       _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
     2052      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
     2053        _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
     2054      fi
    19722055    fi
    19732056  else
    … …  
    20252108          _headers="$(cat "$HTTP_HEADER")"
    20262109          _debug2 _headers "$_headers"
    2027           _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
     2110          _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2 | cut -d , -f 1)"
    20282111        fi
    20292112      fi
    … …  
    20572140      continue
    20582141    fi
    2059     if [ "$ACME_VERSION" = "2" ]; then
    2060       if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
    2061         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
    2062       elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
    2063         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
    2064       else
    2065         protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
    2066       fi
     2142
     2143    if [ "$url" = "$ACME_NEW_ACCOUNT" ]; then
     2144      protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
     2145    elif [ "$url" = "$ACME_REVOKE_CERT" ] && [ "$keyfile" != "$ACCOUNT_KEY_PATH" ]; then
     2146      protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
    20672147    else
    2068       protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"jwk\": $jwk"'}'
    2069     fi
     2148      protected="$JWK_HEADERPLACE_PART1$nonce\", \"url\": \"${url}$JWK_HEADERPLACE_PART2, \"kid\": \"${ACCOUNT_URL}\""'}'
     2149    fi
     2150
    20702151    _debug3 protected "$protected"
    20712152
    … …  
    21052186    _debug2 response "$response"
    21062187
    2107     _CACHED_NONCE="$(echo "$responseHeaders" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
     2188    _CACHED_NONCE="$(echo "$responseHeaders" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2 | cut -d , -f 1)"
    21082189
    21092190    if ! _startswith "$code" "2"; then
    … …  
    21162197      if _contains "$_body" "JWS has invalid anti-replay nonce" || _contains "$_body" "JWS has an invalid anti-replay nonce"; then
    21172198        _info "It seems the CA server is busy now, let's wait and retry. Sleeping $_sleep_retry_sec seconds."
     2199        _CACHED_NONCE=""
     2200        _sleep $_sleep_retry_sec
     2201        continue
     2202      fi
     2203      if _contains "$_body" "The Replay Nonce is not recognized"; then
     2204        _info "The replay Nonce is not valid, let's get a new one, Sleeping $_sleep_retry_sec seconds."
    21182205        _CACHED_NONCE=""
    21192206        _sleep $_sleep_retry_sec
    … …  
    22472334  fi
    22482335  _saved=$(_readdomainconf "SAVED_$_rac_key")
    2249   eval "export $_rac_key=\"$_saved\""
     2336  eval "export $_rac_key=\"\$_saved\""
    22502337}
    22512338
    … …  
    22762363_clearaccountconf() {
    22772364  _clear_conf "$ACCOUNT_CONF_PATH" "$1"
     2365}
     2366
     2367#key
     2368_clearaccountconf_mutable() {
     2369  _clearaccountconf "SAVED_$1"
     2370  #remove later
     2371  _clearaccountconf "$1"
    22782372}
    22792373
    … …  
    23312425echo 'Content-Length\: $_content_len'; \
    23322426echo ''; \
    2333 printf -- '$content';" &
     2427printf '%s' '$content';" &
    23342428  serverproc="$!"
    23352429}
    … …  
    25062600}
    25072601
     2602_clearAPI() {
     2603  ACME_NEW_ACCOUNT=""
     2604  ACME_KEY_CHANGE=""
     2605  ACME_NEW_AUTHZ=""
     2606  ACME_NEW_ORDER=""
     2607  ACME_REVOKE_CERT=""
     2608  ACME_NEW_NONCE=""
     2609  ACME_AGREEMENT=""
     2610}
     2611
    25082612#server
    25092613_initAPI() {
    … …  
    25112615  _debug "_init api for server: $_api_server"
    25122616
    2513   if [ -z "$ACME_NEW_ACCOUNT" ]; then
     2617  MAX_API_RETRY_TIMES=10
     2618  _sleep_retry_sec=10
     2619  _request_retry_times=0
     2620  while [ -z "$ACME_NEW_ACCOUNT" ] && [ "${_request_retry_times}" -lt "$MAX_API_RETRY_TIMES" ]; do
     2621    _request_retry_times=$(_math "$_request_retry_times" + 1)
    25142622    response=$(_get "$_api_server")
    25152623    if [ "$?" != "0" ]; then
    25162624      _debug2 "response" "$response"
    2517       _err "Can not init api."
    2518       return 1
     2625      _info "Can not init api for: $_api_server."
     2626      _info "Sleep $_sleep_retry_sec and retry."
     2627      _sleep "$_sleep_retry_sec"
     2628      continue
    25192629    fi
    25202630    response=$(echo "$response" | _json_decode)
    25212631    _debug2 "response" "$response"
    25222632
    2523     ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'key-change" *: *"[^"]*"' | cut -d '"' -f 3)
    2524     if [ -z "$ACME_KEY_CHANGE" ]; then
    2525       ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
    2526     fi
     2633    ACME_KEY_CHANGE=$(echo "$response" | _egrep_o 'keyChange" *: *"[^"]*"' | cut -d '"' -f 3)
    25272634    export ACME_KEY_CHANGE
    25282635
    2529     ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'new-authz" *: *"[^"]*"' | cut -d '"' -f 3)
    2530     if [ -z "$ACME_NEW_AUTHZ" ]; then
    2531       ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
    2532     fi
     2636    ACME_NEW_AUTHZ=$(echo "$response" | _egrep_o 'newAuthz" *: *"[^"]*"' | cut -d '"' -f 3)
    25332637    export ACME_NEW_AUTHZ
    25342638
    2535     ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-cert" *: *"[^"]*"' | cut -d '"' -f 3)
    2536     ACME_NEW_ORDER_RES="new-cert"
    2537     if [ -z "$ACME_NEW_ORDER" ]; then
    2538       ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'new-order" *: *"[^"]*"' | cut -d '"' -f 3)
    2539       ACME_NEW_ORDER_RES="new-order"
    2540       if [ -z "$ACME_NEW_ORDER" ]; then
    2541         ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
    2542       fi
    2543     fi
     2639    ACME_NEW_ORDER=$(echo "$response" | _egrep_o 'newOrder" *: *"[^"]*"' | cut -d '"' -f 3)
    25442640    export ACME_NEW_ORDER
    2545     export ACME_NEW_ORDER_RES
    2546 
    2547     ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-reg" *: *"[^"]*"' | cut -d '"' -f 3)
    2548     ACME_NEW_ACCOUNT_RES="new-reg"
    2549     if [ -z "$ACME_NEW_ACCOUNT" ]; then
    2550       ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'new-account" *: *"[^"]*"' | cut -d '"' -f 3)
    2551       ACME_NEW_ACCOUNT_RES="new-account"
    2552       if [ -z "$ACME_NEW_ACCOUNT" ]; then
    2553         ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
    2554         if [ "$ACME_NEW_ACCOUNT" ]; then
    2555           export ACME_VERSION=2
    2556         fi
    2557       fi
    2558     fi
     2641
     2642    ACME_NEW_ACCOUNT=$(echo "$response" | _egrep_o 'newAccount" *: *"[^"]*"' | cut -d '"' -f 3)
    25592643    export ACME_NEW_ACCOUNT
    2560     export ACME_NEW_ACCOUNT_RES
    2561 
    2562     ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revoke-cert" *: *"[^"]*"' | cut -d '"' -f 3)
    2563     if [ -z "$ACME_REVOKE_CERT" ]; then
    2564       ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
    2565     fi
     2644
     2645    ACME_REVOKE_CERT=$(echo "$response" | _egrep_o 'revokeCert" *: *"[^"]*"' | cut -d '"' -f 3)
    25662646    export ACME_REVOKE_CERT
    25672647
    2568     ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'new-nonce" *: *"[^"]*"' | cut -d '"' -f 3)
    2569     if [ -z "$ACME_NEW_NONCE" ]; then
    2570       ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
    2571     fi
     2648    ACME_NEW_NONCE=$(echo "$response" | _egrep_o 'newNonce" *: *"[^"]*"' | cut -d '"' -f 3)
    25722649    export ACME_NEW_NONCE
    25732650
    2574     ACME_AGREEMENT=$(echo "$response" | _egrep_o 'terms-of-service" *: *"[^"]*"' | cut -d '"' -f 3)
    2575     if [ -z "$ACME_AGREEMENT" ]; then
    2576       ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
    2577     fi
     2651    ACME_AGREEMENT=$(echo "$response" | _egrep_o 'termsOfService" *: *"[^"]*"' | cut -d '"' -f 3)
    25782652    export ACME_AGREEMENT
    25792653
    … …  
    25852659    _debug "ACME_AGREEMENT" "$ACME_AGREEMENT"
    25862660    _debug "ACME_NEW_NONCE" "$ACME_NEW_NONCE"
    2587     _debug "ACME_VERSION" "$ACME_VERSION"
    2588 
    2589   fi
     2661    if [ "$ACME_NEW_ACCOUNT" ] && [ "$ACME_NEW_ORDER" ]; then
     2662      return 0
     2663    fi
     2664    _info "Sleep $_sleep_retry_sec and retry."
     2665    _sleep "$_sleep_retry_sec"
     2666  done
     2667  if [ "$ACME_NEW_ACCOUNT" ] && [ "$ACME_NEW_ORDER" ]; then
     2668    return 0
     2669  fi
     2670  _err "Can not init api, for $_api_server"
     2671  return 1
    25902672}
    25912673
    … …  
    26312713  _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
    26322714
    2633   CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
    2634 
     2715  _ACME_SERVER_PATH="$(echo "$ACME_DIRECTORY" | cut -d : -f 2- | tr -s / | cut -d / -f 3-)"
     2716  _debug2 "_ACME_SERVER_PATH" "$_ACME_SERVER_PATH"
     2717
     2718  CA_DIR="$CA_HOME/$_ACME_SERVER_HOST/$_ACME_SERVER_PATH"
    26352719  _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
    2636 
    26372720  if [ -z "$CA_CONF" ]; then
    26382721    CA_CONF="$_DEFAULT_CA_CONF"
    … …  
    26402723  _debug3 CA_CONF "$CA_CONF"
    26412724
    2642   if [ -f "$CA_CONF" ]; then
    2643     . "$CA_CONF"
    2644   fi
    2645 
    2646   if [ -z "$ACME_DIR" ]; then
    2647     ACME_DIR="/home/.acme"
    2648   fi
    2649 
    2650   if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
    2651     APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
    2652   fi
    2653 
    2654   if [ -z "$USER_AGENT" ]; then
    2655     USER_AGENT="$DEFAULT_USER_AGENT"
    2656   fi
    2657 
    2658   if [ -z "$HTTP_HEADER" ]; then
    2659     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
    2660   fi
    2661 
    2662   _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
    2663   _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
     2725  _OLD_CADIR="$CA_HOME/$_ACME_SERVER_HOST"
     2726  _OLD_ACCOUNT_KEY="$_OLD_CADIR/account.key"
     2727  _OLD_ACCOUNT_JSON="$_OLD_CADIR/account.json"
     2728  _OLD_CA_CONF="$_OLD_CADIR/ca.conf"
    26642729
    26652730  _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
    … …  
    26672732  if [ -z "$ACCOUNT_KEY_PATH" ]; then
    26682733    ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
     2734    if [ -f "$_OLD_ACCOUNT_KEY" ] && ! [ -f "$ACCOUNT_KEY_PATH" ]; then
     2735      mkdir -p "$CA_DIR"
     2736      mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
     2737    fi
    26692738  fi
    26702739
    26712740  if [ -z "$ACCOUNT_JSON_PATH" ]; then
    26722741    ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
     2742    if [ -f "$_OLD_ACCOUNT_JSON" ] && ! [ -f "$ACCOUNT_JSON_PATH" ]; then
     2743      mkdir -p "$CA_DIR"
     2744      mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
     2745    fi
     2746  fi
     2747
     2748  if [ -f "$_OLD_CA_CONF" ] && ! [ -f "$CA_CONF" ]; then
     2749    mkdir -p "$CA_DIR"
     2750    mv "$_OLD_CA_CONF" "$CA_CONF"
     2751  fi
     2752
     2753  if [ -f "$CA_CONF" ]; then
     2754    . "$CA_CONF"
     2755  fi
     2756
     2757  if [ -z "$ACME_DIR" ]; then
     2758    ACME_DIR="/home/.acme"
     2759  fi
     2760
     2761  if [ -z "$APACHE_CONF_BACKUP_DIR" ]; then
     2762    APACHE_CONF_BACKUP_DIR="$LE_CONFIG_HOME"
     2763  fi
     2764
     2765  if [ -z "$USER_AGENT" ]; then
     2766    USER_AGENT="$DEFAULT_USER_AGENT"
     2767  fi
     2768
     2769  if [ -z "$HTTP_HEADER" ]; then
     2770    HTTP_HEADER="$LE_CONFIG_HOME/http.header"
    26732771  fi
    26742772
    … …  
    30703168      for included in $(cat "$2" | tr "\t" " " | grep "^ *include *.*;" | sed "s/include //" | tr -d " ;"); do
    30713169        _debug "check included $included"
     3170        if ! _startswith "$included" "/" && _exists dirname; then
     3171          _relpath="$(dirname "$_c_file")"
     3172          _debug "_relpath" "$_relpath"
     3173          included="$_relpath/$included"
     3174        fi
    30723175        if _checkConf "$1" "$included"; then
    30733176          return 0
    … …  
    32803383    _info "Run pre hook:'$_chk_pre_hook'"
    32813384    if ! (
     3385      export Le_Domain="$_chk_main_domain"
     3386      export Le_Alt="$_chk_alt_domains"
    32823387      cd "$DOMAIN_PATH" && eval "$_chk_pre_hook"
    32833388    ); then
    … …  
    33413446      netprc="$(echo "$_netprc" | grep "$_checkaddr")"
    33423447      if [ -z "$netprc" ]; then
    3343         netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS")"
     3448        netprc="$(echo "$_netprc" | grep "$LOCAL_ANY_ADDRESS:$_checkport")"
    33443449      fi
    33453450      if [ "$netprc" ]; then
    … …  
    34983603
    34993604  mkdir -p "$CA_DIR"
    3500   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
    3501     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
    3502     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
    3503   fi
    3504 
    3505   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
    3506     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
    3507     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
    3508   fi
    35093605
    35103606  if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
    … …  
    35303626    _savecaconf "CA_EMAIL" "$_email"
    35313627  fi
    3532   if [ "$ACME_VERSION" = "2" ]; then
    3533     if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
    3534       if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
    3535         _info "No EAB credentials found for ZeroSSL, let's get one"
    3536         if [ -z "$_email" ]; then
    3537           _err "Please provide a email address for ZeroSSL account."
    3538           _err "See ZeroSSL usage: $_ZEROSSL_WIKI"
    3539           return 1
    3540         fi
    3541         _eabresp=$(_post "email=$_email" $_ZERO_EAB_ENDPOINT)
    3542         if [ "$?" != "0" ]; then
    3543           _debug2 "$_eabresp"
    3544           _err "Can not get EAB credentials from ZeroSSL."
    3545           return 1
    3546         fi
    3547         _eab_id="$(echo "$_eabresp" | tr ',}' '\n' | grep '"eab_kid"' | cut -d : -f 2 | tr -d '"')"
    3548         if [ -z "$_eab_id" ]; then
    3549           _err "Can not resolve _eab_id"
    3550           return 1
    3551         fi
    3552         _eab_hmac_key="$(echo "$_eabresp" | tr ',}' '\n' | grep '"eab_hmac_key"' | cut -d : -f 2 | tr -d '"')"
    3553         if [ -z "$_eab_hmac_key" ]; then
    3554           _err "Can not resolve _eab_hmac_key"
    3555           return 1
    3556         fi
    3557         _savecaconf CA_EAB_KEY_ID "$_eab_id"
    3558         _savecaconf CA_EAB_HMAC_KEY "$_eab_hmac_key"
    3559       fi
    3560     fi
    3561     if [ "$_eab_id" ] && [ "$_eab_hmac_key" ]; then
    3562       eab_protected="{\"alg\":\"HS256\",\"kid\":\"$_eab_id\",\"url\":\"${ACME_NEW_ACCOUNT}\"}"
    3563       _debug3 eab_protected "$eab_protected"
    3564 
    3565       eab_protected64=$(printf "%s" "$eab_protected" | _base64 | _url_replace)
    3566       _debug3 eab_protected64 "$eab_protected64"
    3567 
    3568       eab_payload64=$(printf "%s" "$jwk" | _base64 | _url_replace)
    3569       _debug3 eab_payload64 "$eab_payload64"
    3570 
    3571       eab_sign_t="$eab_protected64.$eab_payload64"
    3572       _debug3 eab_sign_t "$eab_sign_t"
    3573 
    3574       key_hex="$(_durl_replace_base64 "$_eab_hmac_key" | _dbase64 | _hex_dump | tr -d ' ')"
    3575       _debug3 key_hex "$key_hex"
    3576 
    3577       eab_signature=$(printf "%s" "$eab_sign_t" | _hmac sha256 $key_hex | _base64 | _url_replace)
    3578       _debug3 eab_signature "$eab_signature"
    3579 
    3580       externalBinding=",\"externalAccountBinding\":{\"protected\":\"$eab_protected64\", \"payload\":\"$eab_payload64\", \"signature\":\"$eab_signature\"}"
    3581       _debug3 externalBinding "$externalBinding"
    3582     fi
    3583     if [ "$_email" ]; then
    3584       email_sg="\"contact\": [\"mailto:$_email\"], "
    3585     fi
    3586     regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
    3587   else
    3588     _reg_res="$ACME_NEW_ACCOUNT_RES"
    3589     regjson='{"resource": "'$_reg_res'", "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
    3590     if [ "$_email" ]; then
    3591       regjson='{"resource": "'$_reg_res'", "contact": ["mailto:'$_email'"], "terms-of-service-agreed": true, "agreement": "'$ACME_AGREEMENT'"}'
    3592     fi
    3593   fi
     3628
     3629  if [ "$ACME_DIRECTORY" = "$CA_ZEROSSL" ]; then
     3630    if [ -z "$_eab_id" ] || [ -z "$_eab_hmac_key" ]; then
     3631      _info "No EAB credentials found for ZeroSSL, let's get one"
     3632      if [ -z "$_email" ]; then
     3633        _info "$(__green "$PROJECT_NAME is using ZeroSSL as default CA now.")"
     3634        _info "$(__green "Please update your account with an email address first.")"
     3635        _info "$(__green "$PROJECT_ENTRY --register-account -m my@example.com")"
     3636        _info "See: $(__green "$_ZEROSSL_WIKI")"
     3637        return 1
     3638      fi
     3639      _eabresp=$(_post "email=$_email" $_ZERO_EAB_ENDPOINT)
     3640      if [ "$?" != "0" ]; then
     3641        _debug2 "$_eabresp"
     3642        _err "Can not get EAB credentials from ZeroSSL."
     3643        return 1
     3644      fi
     3645      _secure_debug2 _eabresp "$_eabresp"
     3646      _eab_id="$(echo "$_eabresp" | tr ',}' '\n\n' | grep '"eab_kid"' | cut -d : -f 2 | tr -d '"')"
     3647      _secure_debug2 _eab_id "$_eab_id"
     3648      if [ -z "$_eab_id" ]; then
     3649        _err "Can not resolve _eab_id"
     3650        return 1
     3651      fi
     3652      _eab_hmac_key="$(echo "$_eabresp" | tr ',}' '\n\n' | grep '"eab_hmac_key"' | cut -d : -f 2 | tr -d '"')"
     3653      _secure_debug2 _eab_hmac_key "$_eab_hmac_key"
     3654      if [ -z "$_eab_hmac_key" ]; then
     3655        _err "Can not resolve _eab_hmac_key"
     3656        return 1
     3657      fi
     3658      _savecaconf CA_EAB_KEY_ID "$_eab_id"
     3659      _savecaconf CA_EAB_HMAC_KEY "$_eab_hmac_key"
     3660    fi
     3661  fi
     3662  if [ "$_eab_id" ] && [ "$_eab_hmac_key" ]; then
     3663    eab_protected="{\"alg\":\"HS256\",\"kid\":\"$_eab_id\",\"url\":\"${ACME_NEW_ACCOUNT}\"}"
     3664    _debug3 eab_protected "$eab_protected"
     3665
     3666    eab_protected64=$(printf "%s" "$eab_protected" | _base64 | _url_replace)
     3667    _debug3 eab_protected64 "$eab_protected64"
     3668
     3669    eab_payload64=$(printf "%s" "$jwk" | _base64 | _url_replace)
     3670    _debug3 eab_payload64 "$eab_payload64"
     3671
     3672    eab_sign_t="$eab_protected64.$eab_payload64"
     3673    _debug3 eab_sign_t "$eab_sign_t"
     3674
     3675    key_hex="$(_durl_replace_base64 "$_eab_hmac_key" | _dbase64 multi | _hex_dump | tr -d ' ')"
     3676    _debug3 key_hex "$key_hex"
     3677
     3678    eab_signature=$(printf "%s" "$eab_sign_t" | _hmac sha256 $key_hex | _base64 | _url_replace)
     3679    _debug3 eab_signature "$eab_signature"
     3680
     3681    externalBinding=",\"externalAccountBinding\":{\"protected\":\"$eab_protected64\", \"payload\":\"$eab_payload64\", \"signature\":\"$eab_signature\"}"
     3682    _debug3 externalBinding "$externalBinding"
     3683  fi
     3684  if [ "$_email" ]; then
     3685    email_sg="\"contact\": [\"mailto:$_email\"], "
     3686  fi
     3687  regjson="{$email_sg\"termsOfServiceAgreed\": true$externalBinding}"
    35943688
    35953689  _info "Registering account: $ACME_DIRECTORY"
    … …  
    36463740  _initpath
    36473741
    3648   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
    3649     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
    3650     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
    3651   fi
    3652 
    3653   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
    3654     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
    3655     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
    3656   fi
    3657 
    36583742  if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
    36593743    _err "Account key is not found at: $ACCOUNT_KEY_PATH"
    … …  
    36763760
    36773761  _email="$(_getAccountEmail)"
    3678   if [ "$ACME_VERSION" = "2" ]; then
    3679     if [ "$ACCOUNT_EMAIL" ]; then
    3680       updjson='{"contact": ["mailto:'$_email'"]}'
    3681     else
    3682       updjson='{"contact": []}'
    3683     fi
     3762
     3763  if [ "$ACCOUNT_EMAIL" ]; then
     3764    updjson='{"contact": ["mailto:'$_email'"]}'
    36843765  else
    3685     # ACMEv1: Updates happen the same way a registration is done.
    3686     # https://tools.ietf.org/html/draft-ietf-acme-acme-01#section-6.3
    3687     _regAccount
    3688     return
    3689   fi
    3690 
    3691   # this part handles ACMEv2 account updates.
     3766    updjson='{"contact": []}'
     3767  fi
     3768
    36923769  _send_signed_request "$_accUri" "$updjson"
    36933770
    … …  
    37053782  _initpath
    37063783
    3707   if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
    3708     _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
    3709     mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
    3710   fi
    3711 
    3712   if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
    3713     _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
    3714     mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
    3715   fi
    3716 
    37173784  if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
    37183785    _err "Account key is not found at: $ACCOUNT_KEY_PATH"
    … …  
    37343801  _initAPI
    37353802
    3736   if [ "$ACME_VERSION" = "2" ]; then
    3737     _djson="{\"status\":\"deactivated\"}"
    3738   else
    3739     _djson="{\"resource\": \"reg\", \"status\":\"deactivated\"}"
    3740   fi
     3803  _djson="{\"status\":\"deactivated\"}"
     3804
    37413805  if _send_signed_request "$_accUri" "$_djson" && _contains "$response" '"deactivated"'; then
    37423806    _info "Deactivate account success for $_accUri."
    … …  
    38433907  _t_vtype="$3"
    38443908  _debug2 _t_vtype "$_t_vtype"
    3845   if [ "$ACME_VERSION" = "2" ]; then
    3846     _send_signed_request "$_t_url" "{}"
    3847   else
    3848     _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"type\": \"$_t_vtype\", \"keyAuthorization\": \"$_t_key_authz\"}"
    3849   fi
     3909
     3910  _send_signed_request "$_t_url" "{}"
     3911
    38503912}
    38513913
    … …  
    38903952#checks if cf server is available
    38913953_ns_is_available_cf() {
    3892   if _get "https://cloudflare-dns.com" >/dev/null 2>&1; then
     3954  if _get "https://cloudflare-dns.com" "" 1 >/dev/null 2>&1; then
     3955    return 0
     3956  else
     3957    return 1
     3958  fi
     3959}
     3960
     3961_ns_is_available_google() {
     3962  if _get "https://dns.google" "" 1 >/dev/null 2>&1; then
    38933963    return 0
    38943964  else
    … …  
    39023972  _cf_ld_type="$2"
    39033973  _cf_ep="https://dns.google/resolve"
     3974  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
     3975}
     3976
     3977_ns_is_available_ali() {
     3978  if _get "https://dns.alidns.com" "" 1 >/dev/null 2>&1; then
     3979    return 0
     3980  else
     3981    return 1
     3982  fi
     3983}
     3984
     3985#domain, type
     3986_ns_lookup_ali() {
     3987  _cf_ld="$1"
     3988  _cf_ld_type="$2"
     3989  _cf_ep="https://dns.alidns.com/resolve"
     3990  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
     3991}
     3992
     3993_ns_is_available_dp() {
     3994  if _get "https://doh.pub" "" 1 >/dev/null 2>&1; then
     3995    return 0
     3996  else
     3997    return 1
     3998  fi
     3999}
     4000
     4001#dnspod
     4002_ns_lookup_dp() {
     4003  _cf_ld="$1"
     4004  _cf_ld_type="$2"
     4005  _cf_ep="https://doh.pub/dns-query"
    39044006  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
    39054007}
    … …  
    39124014      _debug "Use cloudflare doh server"
    39134015      export DOH_USE=$DOH_CLOUDFLARE
    3914     else
     4016    elif _ns_is_available_google; then
    39154017      _debug "Use google doh server"
    39164018      export DOH_USE=$DOH_GOOGLE
     4019    elif _ns_is_available_ali; then
     4020      _debug "Use aliyun doh server"
     4021      export DOH_USE=$DOH_ALI
     4022    elif _ns_is_available_dp; then
     4023      _debug "Use dns pod doh server"
     4024      export DOH_USE=$DOH_DP
     4025    else
     4026      _err "No doh"
    39174027    fi
    39184028  fi
    … …  
    39204030  if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
    39214031    _ns_lookup_cf "$@"
     4032  elif [ "$DOH_USE" = "$DOH_GOOGLE" ]; then
     4033    _ns_lookup_google "$@"
     4034  elif [ "$DOH_USE" = "$DOH_ALI" ]; then
     4035    _ns_lookup_ali "$@"
     4036  elif [ "$DOH_USE" = "$DOH_DP" ]; then
     4037    _ns_lookup_dp "$@"
    39224038  else
    3923     _ns_lookup_google "$@"
     4039    _err "Unknown doh provider: DOH_USE=$DOH_USE"
    39244040  fi
    39254041
    … …  
    39464062    _ns_purge_cf "$_p_txtdomain" "TXT"
    39474063  else
    3948     _debug "no purge api for google dns api, just sleep 5 secs"
     4064    _debug "no purge api for this doh api, just sleep 5 secs"
    39494065    _sleep 5
    39504066  fi
    … …  
    39594075
    39604076  while [ "$(_time)" -le "$_end_time" ]; do
     4077    _info "You can use '--dnssleep' to disable public dns checks."
     4078    _info "See: $_DNSCHECK_WIKI"
    39614079    _left=""
    39624080    for entry in $dns_entries; do
    … …  
    40064124
    40074125#file
    4008 _get_cert_issuers() {
     4126_get_chain_issuers() {
    40094127  _cfile="$1"
    4010   if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
    4011     ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
     4128  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -help 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
     4129    ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep -i 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
    40124130  else
    4013     ${ACME_OPENSSL_BIN:-openssl} x509 -in $_cfile -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
     4131    _cindex=1
     4132    for _startn in $(grep -n -- "$BEGIN_CERT" "$_cfile" | cut -d : -f 1); do
     4133      _endn="$(grep -n -- "$END_CERT" "$_cfile" | cut -d : -f 1 | _head_n $_cindex | _tail_n 1)"
     4134      _debug2 "_startn" "$_startn"
     4135      _debug2 "_endn" "$_endn"
     4136      if [ "$DEBUG" ]; then
     4137        _debug2 "cert$_cindex" "$(sed -n "$_startn,${_endn}p" "$_cfile")"
     4138      fi
     4139      sed -n "$_startn,${_endn}p" "$_cfile" | ${ACME_OPENSSL_BIN:-openssl} x509 -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2 | sed "s/ *\(.*\)/\1/"
     4140      _cindex=$(_math $_cindex + 1)
     4141    done
     4142  fi
     4143}
     4144
     4145#
     4146_get_chain_subjects() {
     4147  _cfile="$1"
     4148  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -help 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
     4149    ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep -i 'Subject:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
     4150  else
     4151    _cindex=1
     4152    for _startn in $(grep -n -- "$BEGIN_CERT" "$_cfile" | cut -d : -f 1); do
     4153      _endn="$(grep -n -- "$END_CERT" "$_cfile" | cut -d : -f 1 | _head_n $_cindex | _tail_n 1)"
     4154      _debug2 "_startn" "$_startn"
     4155      _debug2 "_endn" "$_endn"
     4156      if [ "$DEBUG" ]; then
     4157        _debug2 "cert$_cindex" "$(sed -n "$_startn,${_endn}p" "$_cfile")"
     4158      fi
     4159      sed -n "$_startn,${_endn}p" "$_cfile" | ${ACME_OPENSSL_BIN:-openssl} x509 -text -noout | grep -i 'Subject:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2 | sed "s/ *\(.*\)/\1/"
     4160      _cindex=$(_math $_cindex + 1)
     4161    done
    40144162  fi
    40154163}
    … …  
    40194167  _cfile="$1"
    40204168  _missuer="$2"
    4021   _fissuers="$(_get_cert_issuers $_cfile)"
     4169  _fissuers="$(_get_chain_issuers $_cfile)"
    40224170  _debug2 _fissuers "$_fissuers"
    4023   if _contains "$_fissuers" "$_missuer"; then
    4024     return 0
    4025   fi
    4026   _fissuers="$(echo "$_fissuers" | _lower_case)"
     4171  _rootissuer="$(echo "$_fissuers" | _lower_case | _tail_n 1)"
     4172  _debug2 _rootissuer "$_rootissuer"
    40274173  _missuer="$(echo "$_missuer" | _lower_case)"
    4028   _contains "$_fissuers" "$_missuer"
     4174  _contains "$_rootissuer" "$_missuer"
    40294175}
    40304176
    … …  
    40664212    _initpath "$_main_domain" "$_key_length"
    40674213    mkdir -p "$DOMAIN_PATH"
     4214  elif ! _hasfield "$_web_roots" "$W_DNS"; then
     4215    Le_OrderFinalize=""
     4216    Le_LinkOrder=""
     4217    Le_LinkCert=""
    40684218  fi
    40694219
    … …  
    40754225  _debug "Using ACME_DIRECTORY: $ACME_DIRECTORY"
    40764226
    4077   _initAPI
     4227  if ! _initAPI; then
     4228    return 1
     4229  fi
    40784230
    40794231  if [ -f "$DOMAIN_CONF" ]; then
    … …  
    41794331  dvsep=','
    41804332  if [ -z "$vlist" ]; then
    4181     if [ "$ACME_VERSION" = "2" ]; then
    4182       #make new order request
    4183       _identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
    4184       _w_index=1
    4185       while true; do
    4186         d="$(echo "$_alt_domains," | cut -d , -f "$_w_index")"
    4187         _w_index="$(_math "$_w_index" + 1)"
    4188         _debug d "$d"
    4189         if [ -z "$d" ]; then
    4190           break
    4191         fi
    4192         _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$(_idn "$d")\"}"
    4193       done
    4194       _debug2 _identifiers "$_identifiers"
    4195       if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
    4196         _err "Create new order error."
     4333    #make new order request
     4334    _identifiers="{\"type\":\"dns\",\"value\":\"$(_idn "$_main_domain")\"}"
     4335    _w_index=1
     4336    while true; do
     4337      d="$(echo "$_alt_domains," | cut -d , -f "$_w_index")"
     4338      _w_index="$(_math "$_w_index" + 1)"
     4339      _debug d "$d"
     4340      if [ -z "$d" ]; then
     4341        break
     4342      fi
     4343      _identifiers="$_identifiers,{\"type\":\"dns\",\"value\":\"$(_idn "$d")\"}"
     4344    done
     4345    _debug2 _identifiers "$_identifiers"
     4346    if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
     4347      _err "Create new order error."
     4348      _clearup
     4349      _on_issue_err "$_post_hook"
     4350      return 1
     4351    fi
     4352    Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n " | cut -d ":" -f 2-)"
     4353    _debug Le_LinkOrder "$Le_LinkOrder"
     4354    Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
     4355    _debug Le_OrderFinalize "$Le_OrderFinalize"
     4356    if [ -z "$Le_OrderFinalize" ]; then
     4357      _err "Create new order error. Le_OrderFinalize not found. $response"
     4358      _clearup
     4359      _on_issue_err "$_post_hook"
     4360      return 1
     4361    fi
     4362
     4363    #for dns manual mode
     4364    _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
     4365
     4366    _authorizations_seg="$(echo "$response" | _json_decode | _egrep_o '"authorizations" *: *\[[^\[]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
     4367    _debug2 _authorizations_seg "$_authorizations_seg"
     4368    if [ -z "$_authorizations_seg" ]; then
     4369      _err "_authorizations_seg not found."
     4370      _clearup
     4371      _on_issue_err "$_post_hook"
     4372      return 1
     4373    fi
     4374
     4375    #domain and authz map
     4376    _authorizations_map=""
     4377    for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
     4378      _debug2 "_authz_url" "$_authz_url"
     4379      if ! _send_signed_request "$_authz_url"; then
     4380        _err "get to authz error."
     4381        _err "_authorizations_seg" "$_authorizations_seg"
     4382        _err "_authz_url" "$_authz_url"
    41974383        _clearup
    41984384        _on_issue_err "$_post_hook"
    41994385        return 1
    42004386      fi
    4201       Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n " | cut -d ":" -f 2-)"
    4202       _debug Le_LinkOrder "$Le_LinkOrder"
    4203       Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
    4204       _debug Le_OrderFinalize "$Le_OrderFinalize"
    4205       if [ -z "$Le_OrderFinalize" ]; then
    4206         _err "Create new order error. Le_OrderFinalize not found. $response"
    4207         _clearup
    4208         _on_issue_err "$_post_hook"
    4209         return 1
    4210       fi
    4211 
    4212       #for dns manual mode
    4213       _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
    4214 
    4215       _authorizations_seg="$(echo "$response" | _json_decode | _egrep_o '"authorizations" *: *\[[^\[]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
    4216       _debug2 _authorizations_seg "$_authorizations_seg"
    4217       if [ -z "$_authorizations_seg" ]; then
    4218         _err "_authorizations_seg not found."
    4219         _clearup
    4220         _on_issue_err "$_post_hook"
    4221         return 1
    4222       fi
    4223 
    4224       #domain and authz map
    4225       _authorizations_map=""
    4226       for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
    4227         _debug2 "_authz_url" "$_authz_url"
    4228         if ! _send_signed_request "$_authz_url"; then
    4229           _err "get to authz error."
    4230           _err "_authorizations_seg" "$_authorizations_seg"
    4231           _err "_authz_url" "$_authz_url"
    4232           _clearup
    4233           _on_issue_err "$_post_hook"
    4234           return 1
    4235         fi
    4236 
    4237         response="$(echo "$response" | _normalizeJson)"
    4238         _debug2 response "$response"
    4239         _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
    4240         if _contains "$response" "\"wildcard\" *: *true"; then
    4241           _d="*.$_d"
    4242         fi
    4243         _debug2 _d "$_d"
    4244         _authorizations_map="$_d,$response
     4387
     4388      response="$(echo "$response" | _normalizeJson)"
     4389      _debug2 response "$response"
     4390      _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2 | tr -d ' "')"
     4391      if _contains "$response" "\"wildcard\" *: *true"; then
     4392        _d="*.$_d"
     4393      fi
     4394      _debug2 _d "$_d"
     4395      _authorizations_map="$_d,$response
    42454396$_authorizations_map"
    4246       done
    4247       _debug2 _authorizations_map "$_authorizations_map"
    4248     fi
     4397    done
     4398    _debug2 _authorizations_map "$_authorizations_map"
    42494399
    42504400    _index=0
    … …  
    42774427      fi
    42784428
    4279       if [ "$ACME_VERSION" = "2" ]; then
    4280         _idn_d="$(_idn "$d")"
    4281         _candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
    4282         _debug2 _candidates "$_candidates"
    4283         if [ "$(echo "$_candidates" | wc -l)" -gt 1 ]; then
    4284           for _can in $_candidates; do
    4285             if _startswith "$(echo "$_can" | tr '.' '|')" "$(echo "$_idn_d" | tr '.' '|'),"; then
    4286               _candidates="$_can"
    4287               break
    4288             fi
    4289           done
    4290         fi
    4291         response="$(echo "$_candidates" | sed "s/$_idn_d,//")"
    4292         _debug2 "response" "$response"
    4293         if [ -z "$response" ]; then
    4294           _err "get to authz error."
    4295           _err "_authorizations_map" "$_authorizations_map"
    4296           _clearup
    4297           _on_issue_err "$_post_hook"
    4298           return 1
    4299         fi
    4300       else
    4301         if ! __get_domain_new_authz "$d"; then
    4302           _clearup
    4303           _on_issue_err "$_post_hook"
    4304           return 1
    4305         fi
     4429      _idn_d="$(_idn "$d")"
     4430      _candidates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
     4431      _debug2 _candidates "$_candidates"
     4432      if [ "$(echo "$_candidates" | wc -l)" -gt 1 ]; then
     4433        for _can in $_candidates; do
     4434          if _startswith "$(echo "$_can" | tr '.' '|')" "$(echo "$_idn_d" | tr '.' '|'),"; then
     4435            _candidates="$_can"
     4436            break
     4437          fi
     4438        done
     4439      fi
     4440      response="$(echo "$_candidates" | sed "s/$_idn_d,//")"
     4441      _debug2 "response" "$response"
     4442      if [ -z "$response" ]; then
     4443        _err "get to authz error."
     4444        _err "_authorizations_map" "$_authorizations_map"
     4445        _clearup
     4446        _on_issue_err "$_post_hook"
     4447        return 1
    43064448      fi
    43074449
    … …  
    43444486          return 1
    43454487        fi
    4346         if [ "$ACME_VERSION" = "2" ]; then
    4347           uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
    4348         else
    4349           uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
    4350         fi
     4488
     4489        uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
     4490
    43514491        _debug uri "$uri"
    43524492
    … …  
    46434783      fi
    46444784
    4645       _debug "sleep 2 secs to verify"
    4646       sleep 2
    4647       _debug "checking"
    4648       if [ "$ACME_VERSION" = "2" ]; then
    4649         _send_signed_request "$uri"
    4650       else
    4651         response="$(_get "$uri")"
    4652       fi
    4653       if [ "$?" != "0" ]; then
    4654         _err "$d:Verify error:$response"
    4655         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
    4656         _clearup
    4657         _on_issue_err "$_post_hook" "$vlist"
    4658         return 1
    4659       fi
    46604785      _debug2 original "$response"
    46614786
    … …  
    46644789
    46654790      status=$(echo "$response" | _egrep_o '"status":"[^"]*' | cut -d : -f 2 | tr -d '"')
    4666       if [ "$status" = "valid" ]; then
    4667         _info "$(__green Success)"
    4668         _stopserver "$serverproc"
    4669         serverproc=""
    4670         _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
    4671         break
    4672       fi
    4673 
    4674       if [ "$status" = "invalid" ]; then
     4791      _debug2 status "$status"
     4792      if _contains "$status" "invalid"; then
    46754793        error="$(echo "$response" | _egrep_o '"error":\{[^\}]*')"
    46764794        _debug2 error "$error"
    … …  
    46944812      fi
    46954813
     4814      if _contains "$status" "valid"; then
     4815        _info "$(__green Success)"
     4816        _stopserver "$serverproc"
     4817        serverproc=""
     4818        _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
     4819        break
     4820      fi
     4821
    46964822      if [ "$status" = "pending" ]; then
    4697         _info "Pending"
     4823        _info "Pending, The CA is processing your order, please just wait. ($waittimes/$MAX_RETRY_TIMES)"
    46984824      elif [ "$status" = "processing" ]; then
    4699         _info "Processing"
     4825        _info "Processing, The CA is processing your order, please just wait. ($waittimes/$MAX_RETRY_TIMES)"
    47004826      else
    47014827        _err "$d:Verify error:$response"
    … …  
    47054831        return 1
    47064832      fi
    4707 
     4833      _debug "sleep 2 secs to verify again"
     4834      sleep 2
     4835      _debug "checking"
     4836
     4837      _send_signed_request "$uri"
     4838
     4839      if [ "$?" != "0" ]; then
     4840        _err "$d:Verify error:$response"
     4841        _clearupwebbroot "$_currentRoot" "$removelevel" "$token"
     4842        _clearup
     4843        _on_issue_err "$_post_hook" "$vlist"
     4844        return 1
     4845      fi
    47084846    done
    47094847
    … …  
    47144852  der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
    47154853
    4716   if [ "$ACME_VERSION" = "2" ]; then
    4717     _info "Lets finalize the order."
    4718     _info "Le_OrderFinalize" "$Le_OrderFinalize"
    4719     if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
    4720       _err "Sign failed."
    4721       _on_issue_err "$_post_hook"
    4722       return 1
    4723     fi
    4724     if [ "$code" != "200" ]; then
    4725       _err "Sign failed, finalize code is not 200."
     4854  _info "Lets finalize the order."
     4855  _info "Le_OrderFinalize" "$Le_OrderFinalize"
     4856  if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
     4857    _err "Sign failed."
     4858    _on_issue_err "$_post_hook"
     4859    return 1
     4860  fi
     4861  if [ "$code" != "200" ]; then
     4862    _err "Sign failed, finalize code is not 200."
     4863    _err "$response"
     4864    _on_issue_err "$_post_hook"
     4865    return 1
     4866  fi
     4867  if [ -z "$Le_LinkOrder" ]; then
     4868    Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n \t" | cut -d ":" -f 2-)"
     4869  fi
     4870
     4871  _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
     4872
     4873  _link_cert_retry=0
     4874  _MAX_CERT_RETRY=30
     4875  while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
     4876    if _contains "$response" "\"status\":\"valid\""; then
     4877      _debug "Order status is valid."
     4878      Le_LinkCert="$(echo "$response" | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
     4879      _debug Le_LinkCert "$Le_LinkCert"
     4880      if [ -z "$Le_LinkCert" ]; then
     4881        _err "Sign error, can not find Le_LinkCert"
     4882        _err "$response"
     4883        _on_issue_err "$_post_hook"
     4884        return 1
     4885      fi
     4886      break
     4887    elif _contains "$response" "\"processing\""; then
     4888      _info "Order status is processing, lets sleep and retry."
     4889      _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
     4890      _debug "_retryafter" "$_retryafter"
     4891      if [ "$_retryafter" ]; then
     4892        _info "Retry after: $_retryafter"
     4893        _sleep $_retryafter
     4894      else
     4895        _sleep 2
     4896      fi
     4897    else
     4898      _err "Sign error, wrong status"
    47264899      _err "$response"
    47274900      _on_issue_err "$_post_hook"
    47284901      return 1
    47294902    fi
     4903    #the order is processing, so we are going to poll order status
    47304904    if [ -z "$Le_LinkOrder" ]; then
    4731       Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n \t" | cut -d ":" -f 2-)"
    4732     fi
    4733 
    4734     _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
    4735 
    4736     _link_cert_retry=0
    4737     _MAX_CERT_RETRY=30
    4738     while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
    4739       if _contains "$response" "\"status\":\"valid\""; then
    4740         _debug "Order status is valid."
    4741         Le_LinkCert="$(echo "$response" | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
    4742         _debug Le_LinkCert "$Le_LinkCert"
    4743         if [ -z "$Le_LinkCert" ]; then
    4744           _err "Sign error, can not find Le_LinkCert"
    4745           _err "$response"
    4746           _on_issue_err "$_post_hook"
    4747           return 1
    4748         fi
    4749         break
    4750       elif _contains "$response" "\"processing\""; then
    4751         _info "Order status is processing, lets sleep and retry."
    4752         _retryafter=$(echo "$responseHeaders" | grep -i "^Retry-After *:" | cut -d : -f 2 | tr -d ' ' | tr -d '\r')
    4753         _debug "_retryafter" "$_retryafter"
    4754         if [ "$_retryafter" ]; then
    4755           _info "Retry after: $_retryafter"
    4756           _sleep $_retryafter
    4757         else
    4758           _sleep 2
    4759         fi
    4760       else
    4761         _err "Sign error, wrong status"
    4762         _err "$response"
    4763         _on_issue_err "$_post_hook"
    4764         return 1
    4765       fi
    4766       #the order is processing, so we are going to poll order status
    4767       if [ -z "$Le_LinkOrder" ]; then
    4768         _err "Sign error, can not get order link location header"
    4769         _err "responseHeaders" "$responseHeaders"
    4770         _on_issue_err "$_post_hook"
    4771         return 1
    4772       fi
    4773       _info "Polling order status: $Le_LinkOrder"
    4774       if ! _send_signed_request "$Le_LinkOrder"; then
    4775         _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
    4776         _err "$response"
    4777         _on_issue_err "$_post_hook"
    4778         return 1
    4779       fi
    4780       _link_cert_retry="$(_math $_link_cert_retry + 1)"
    4781     done
    4782 
    4783     if [ -z "$Le_LinkCert" ]; then
    4784       _err "Sign failed, can not get Le_LinkCert, retry time limit."
     4905      _err "Sign error, can not get order link location header"
     4906      _err "responseHeaders" "$responseHeaders"
     4907      _on_issue_err "$_post_hook"
     4908      return 1
     4909    fi
     4910    _info "Polling order status: $Le_LinkOrder"
     4911    if ! _send_signed_request "$Le_LinkOrder"; then
     4912      _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
    47854913      _err "$response"
    47864914      _on_issue_err "$_post_hook"
    47874915      return 1
    47884916    fi
    4789     _info "Downloading cert."
    4790     _info "Le_LinkCert" "$Le_LinkCert"
    4791     if ! _send_signed_request "$Le_LinkCert"; then
    4792       _err "Sign failed, can not download cert:$Le_LinkCert."
    4793       _err "$response"
    4794       _on_issue_err "$_post_hook"
    4795       return 1
    4796     fi
    4797 
    4798     echo "$response" >"$CERT_PATH"
    4799     _split_cert_chain "$CERT_PATH" "$CERT_FULLCHAIN_PATH" "$CA_CERT_PATH"
    4800 
    4801     if [ "$_preferred_chain" ] && [ -f "$CERT_FULLCHAIN_PATH" ]; then
    4802       if ! _match_issuer "$CERT_FULLCHAIN_PATH" "$_preferred_chain"; then
    4803         rels="$(echo "$responseHeaders" | tr -d ' <>' | grep -i "^link:" | grep -i 'rel="alternate"' | cut -d : -f 2- | cut -d ';' -f 1)"
    4804         _debug2 "rels" "$rels"
    4805         for rel in $rels; do
    4806           _info "Try rel: $rel"
    4807           if ! _send_signed_request "$rel"; then
    4808             _err "Sign failed, can not download cert:$rel"
    4809             _err "$response"
    4810             continue
    4811           fi
    4812           _relcert="$CERT_PATH.alt"
    4813           _relfullchain="$CERT_FULLCHAIN_PATH.alt"
    4814           _relca="$CA_CERT_PATH.alt"
    4815           echo "$response" >"$_relcert"
    4816           _split_cert_chain "$_relcert" "$_relfullchain" "$_relca"
    4817           if _match_issuer "$_relfullchain" "$_preferred_chain"; then
    4818             _info "Matched issuer in: $rel"
    4819             cat $_relcert >"$CERT_PATH"
    4820             cat $_relfullchain >"$CERT_FULLCHAIN_PATH"
    4821             cat $_relca >"$CA_CERT_PATH"
    4822             break
    4823           fi
    4824         done
    4825       fi
    4826     fi
    4827   else
    4828     if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
    4829       _err "Sign failed. $response"
    4830       _on_issue_err "$_post_hook"
    4831       return 1
    4832     fi
    4833     _rcert="$response"
    4834     Le_LinkCert="$(grep -i '^Location.*$' "$HTTP_HEADER" | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
    4835     echo "$BEGIN_CERT" >"$CERT_PATH"
    4836 
    4837     #if ! _get "$Le_LinkCert" | _base64 "multiline"  >> "$CERT_PATH" ; then
    4838     #  _debug "Get cert failed. Let's try last response."
    4839     #  printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >> "$CERT_PATH"
    4840     #fi
    4841 
    4842     if ! printf -- "%s" "$_rcert" | _dbase64 "multiline" | _base64 "multiline" >>"$CERT_PATH"; then
    4843       _debug "Try cert link."
    4844       _get "$Le_LinkCert" | _base64 "multiline" >>"$CERT_PATH"
    4845     fi
    4846 
    4847     echo "$END_CERT" >>"$CERT_PATH"
     4917    _link_cert_retry="$(_math $_link_cert_retry + 1)"
     4918  done
     4919
     4920  if [ -z "$Le_LinkCert" ]; then
     4921    _err "Sign failed, can not get Le_LinkCert, retry time limit."
     4922    _err "$response"
     4923    _on_issue_err "$_post_hook"
     4924    return 1
     4925  fi
     4926  _info "Downloading cert."
     4927  _info "Le_LinkCert" "$Le_LinkCert"
     4928  if ! _send_signed_request "$Le_LinkCert"; then
     4929    _err "Sign failed, can not download cert:$Le_LinkCert."
     4930    _err "$response"
     4931    _on_issue_err "$_post_hook"
     4932    return 1
     4933  fi
     4934
     4935  echo "$response" >"$CERT_PATH"
     4936  _split_cert_chain "$CERT_PATH" "$CERT_FULLCHAIN_PATH" "$CA_CERT_PATH"
     4937  if [ -z "$_preferred_chain" ]; then
     4938    _preferred_chain=$(_readcaconf DEFAULT_PREFERRED_CHAIN)
     4939  fi
     4940  if [ "$_preferred_chain" ] && [ -f "$CERT_FULLCHAIN_PATH" ]; then
     4941    if [ "$DEBUG" ]; then
     4942      _debug "default chain issuers: " "$(_get_chain_issuers "$CERT_FULLCHAIN_PATH")"
     4943    fi
     4944    if ! _match_issuer "$CERT_FULLCHAIN_PATH" "$_preferred_chain"; then
     4945      rels="$(echo "$responseHeaders" | tr -d ' <>' | grep -i "^link:" | grep -i 'rel="alternate"' | cut -d : -f 2- | cut -d ';' -f 1)"
     4946      _debug2 "rels" "$rels"
     4947      for rel in $rels; do
     4948        _info "Try rel: $rel"
     4949        if ! _send_signed_request "$rel"; then
     4950          _err "Sign failed, can not download cert:$rel"
     4951          _err "$response"
     4952          continue
     4953        fi
     4954        _relcert="$CERT_PATH.alt"
     4955        _relfullchain="$CERT_FULLCHAIN_PATH.alt"
     4956        _relca="$CA_CERT_PATH.alt"
     4957        echo "$response" >"$_relcert"
     4958        _split_cert_chain "$_relcert" "$_relfullchain" "$_relca"
     4959        if [ "$DEBUG" ]; then
     4960          _debug "rel chain issuers: " "$(_get_chain_issuers "$_relfullchain")"
     4961        fi
     4962        if _match_issuer "$_relfullchain" "$_preferred_chain"; then
     4963          _info "Matched issuer in: $rel"
     4964          cat $_relcert >"$CERT_PATH"
     4965          cat $_relfullchain >"$CERT_FULLCHAIN_PATH"
     4966          cat $_relca >"$CA_CERT_PATH"
     4967          rm -f "$_relcert"
     4968          rm -f "$_relfullchain"
     4969          rm -f "$_relca"
     4970          break
     4971        fi
     4972        rm -f "$_relcert"
     4973        rm -f "$_relfullchain"
     4974        rm -f "$_relca"
     4975      done
     4976    fi
    48484977  fi
    48494978
    … …  
    48624991    cat "$CERT_PATH"
    48634992
    4864     _info "Your cert is in $(__green " $CERT_PATH ")"
     4993    _info "Your cert is in: $(__green "$CERT_PATH")"
    48654994
    48664995    if [ -f "$CERT_KEY_PATH" ]; then
    4867       _info "Your cert key is in $(__green " $CERT_KEY_PATH ")"
     4996      _info "Your cert key is in: $(__green "$CERT_KEY_PATH")"
    48684997    fi
    48694998
    … …  
    48745003  fi
    48755004
    4876   if [ "$ACME_VERSION" = "2" ]; then
    4877     _debug "v2 chain."
    4878   else
    4879     cp "$CERT_PATH" "$CERT_FULLCHAIN_PATH"
    4880     Le_LinkIssuer=$(grep -i '^Link' "$HTTP_HEADER" | _head_n 1 | cut -d " " -f 2 | cut -d ';' -f 1 | tr -d '<>')
    4881 
    4882     if [ "$Le_LinkIssuer" ]; then
    4883       if ! _contains "$Le_LinkIssuer" ":"; then
    4884         _info "$(__red "Relative issuer link found.")"
    4885         Le_LinkIssuer="$_ACME_SERVER_HOST$Le_LinkIssuer"
    4886       fi
    4887       _debug Le_LinkIssuer "$Le_LinkIssuer"
    4888       _savedomainconf "Le_LinkIssuer" "$Le_LinkIssuer"
    4889 
    4890       _link_issuer_retry=0
    4891       _MAX_ISSUER_RETRY=5
    4892       while [ "$_link_issuer_retry" -lt "$_MAX_ISSUER_RETRY" ]; do
    4893         _debug _link_issuer_retry "$_link_issuer_retry"
    4894         if [ "$ACME_VERSION" = "2" ]; then
    4895           if _send_signed_request "$Le_LinkIssuer"; then
    4896             echo "$response" >"$CA_CERT_PATH"
    4897             break
    4898           fi
    4899         else
    4900           if _get "$Le_LinkIssuer" >"$CA_CERT_PATH.der"; then
    4901             echo "$BEGIN_CERT" >"$CA_CERT_PATH"
    4902             _base64 "multiline" <"$CA_CERT_PATH.der" >>"$CA_CERT_PATH"
    4903             echo "$END_CERT" >>"$CA_CERT_PATH"
    4904             if ! _checkcert "$CA_CERT_PATH"; then
    4905               _err "Can not get the ca cert."
    4906               break
    4907             fi
    4908             cat "$CA_CERT_PATH" >>"$CERT_FULLCHAIN_PATH"
    4909             rm -f "$CA_CERT_PATH.der"
    4910             break
    4911           fi
    4912         fi
    4913         _link_issuer_retry=$(_math $_link_issuer_retry + 1)
    4914         _sleep "$_link_issuer_retry"
    4915       done
    4916       if [ "$_link_issuer_retry" = "$_MAX_ISSUER_RETRY" ]; then
    4917         _err "Max retry for issuer ca cert is reached."
    4918       fi
    4919     else
    4920       _debug "No Le_LinkIssuer header found."
    4921     fi
    4922   fi
    4923   [ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in $(__green " $CA_CERT_PATH ")"
    4924   [ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green " $CERT_FULLCHAIN_PATH ")"
     5005  [ -f "$CA_CERT_PATH" ] && _info "The intermediate CA cert is in: $(__green "$CA_CERT_PATH")"
     5006  [ -f "$CERT_FULLCHAIN_PATH" ] && _info "And the full chain certs is there: $(__green "$CERT_FULLCHAIN_PATH")"
    49255007
    49265008  Le_CertCreateTime=$(_time)
    … …  
    50335115  . "$DOMAIN_CONF"
    50345116  _debug Le_API "$Le_API"
    5035 
    5036   if [ "$Le_API" = "$LETSENCRYPT_CA_V1" ]; then
    5037     _cleardomainconf Le_API
    5038     Le_API="$DEFAULT_CA"
    5039   fi
    5040   if [ "$Le_API" = "$LETSENCRYPT_STAGING_CA_V1" ]; then
    5041     _cleardomainconf Le_API
    5042     Le_API="$DEFAULT_STAGING_CA"
     5117  if [ -z "$Le_API" ] || [ "$CA_LETSENCRYPT_V1" = "$Le_API" ]; then
     5118    #if this is from an old version, Le_API is empty,
     5119    #so, we force to use letsencrypt server
     5120    Le_API="$CA_LETSENCRYPT_V2"
    50435121  fi
    50445122
    50455123  if [ "$Le_API" ]; then
     5124    if [ "$Le_API" != "$ACME_DIRECTORY" ]; then
     5125      _clearAPI
     5126    fi
    50465127    export ACME_DIRECTORY="$Le_API"
    50475128    #reload ca configs
    … …  
    50515132    _debug3 "initpath again."
    50525133    _initpath "$Le_Domain" "$_isEcc"
     5134    _initAPI
    50535135  fi
    50545136
    … …  
    52195301  _local_addr="${11}"
    52205302  _challenge_alias="${12}"
     5303  _preferred_chain="${13}"
    52215304
    52225305  _csrsubj=$(_readSubjectFromCSR "$_csrfile")
    … …  
    52565339  fi
    52575340
    5258   if [ -z "$ACME_VERSION" ] && _contains "$_csrsubj,$_csrdomainlist" "*."; then
    5259     export ACME_VERSION=2
    5260   fi
    52615341  _initpath "$_csrsubj" "$_csrkeylength"
    52625342  mkdir -p "$DOMAIN_PATH"
    … …  
    52655345  cp "$_csrfile" "$CSR_PATH"
    52665346
    5267   issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias"
     5347  issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias" "$_preferred_chain"
    52685348
    52695349}
    … …  
    54685548
    54695549  if [ "$_real_cert" ]; then
    5470     _info "Installing cert to:$_real_cert"
     5550    _info "Installing cert to: $_real_cert"
    54715551    if [ -f "$_real_cert" ] && [ ! "$_ACME_IS_RENEW" ]; then
    54725552      cp "$_real_cert" "$_backup_path/cert.bak"
    … …  
    54765556
    54775557  if [ "$_real_ca" ]; then
    5478     _info "Installing CA to:$_real_ca"
     5558    _info "Installing CA to: $_real_ca"
    54795559    if [ "$_real_ca" = "$_real_cert" ]; then
    54805560      echo "" >>"$_real_ca"
    … …  
    54895569
    54905570  if [ "$_real_key" ]; then
    5491     _info "Installing key to:$_real_key"
     5571    _info "Installing key to: $_real_key"
    54925572    if [ -f "$_real_key" ] && [ ! "$_ACME_IS_RENEW" ]; then
    54935573      cp "$_real_key" "$_backup_path/key.bak"
    … …  
    55025582
    55035583  if [ "$_real_fullchain" ]; then
    5504     _info "Installing full chain to:$_real_fullchain"
     5584    _info "Installing full chain to: $_real_fullchain"
    55055585    if [ -f "$_real_fullchain" ] && [ ! "$_ACME_IS_RENEW" ]; then
    55065586      cp "$_real_fullchain" "$_backup_path/fullchain.bak"
    … …  
    56705750  cr="$($_CRONTAB -l | grep "$PROJECT_ENTRY --cron")"
    56715751  if [ "$cr" ]; then
    5672     if _exists uname && uname -a | grep solaris >/dev/null; then
     5752    if _exists uname && uname -a | grep SunOS >/dev/null; then
    56735753      $_CRONTAB -l | sed "/$PROJECT_ENTRY --cron/d" | $_CRONTAB --
    56745754    else
    … …  
    57105790  fi
    57115791
     5792  . "$DOMAIN_CONF"
     5793  _debug Le_API "$Le_API"
     5794
     5795  if [ "$Le_API" ]; then
     5796    if [ "$Le_API" != "$ACME_DIRECTORY" ]; then
     5797      _clearAPI
     5798    fi
     5799    export ACME_DIRECTORY="$Le_API"
     5800    #reload ca configs
     5801    ACCOUNT_KEY_PATH=""
     5802    ACCOUNT_JSON_PATH=""
     5803    CA_CONF=""
     5804    _debug3 "initpath again."
     5805    _initpath "$Le_Domain" "$_isEcc"
     5806    _initAPI
     5807  fi
     5808
    57125809  cert="$(_getfile "${CERT_PATH}" "${BEGIN_CERT}" "${END_CERT}" | tr -d "\r\n" | _url_replace)"
    57135810
    … …  
    57195816  _initAPI
    57205817
    5721   if [ "$ACME_VERSION" = "2" ]; then
    5722     data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
    5723   else
    5724     data="{\"resource\": \"revoke-cert\", \"certificate\": \"$cert\"}"
    5725   fi
     5818  data="{\"certificate\": \"$cert\",\"reason\":$_reason}"
     5819
    57265820  uri="${ACME_REVOKE_CERT}"
    57275821
    … …  
    57925886  _d_domain="$1"
    57935887  _d_type="$2"
    5794   _initpath
    5795 
    5796   if [ "$ACME_VERSION" = "2" ]; then
    5797     _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
    5798     if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
    5799       _err "Can not get domain new order."
    5800       return 1
    5801     fi
    5802     _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
    5803     _debug2 _authorizations_seg "$_authorizations_seg"
    5804     if [ -z "$_authorizations_seg" ]; then
    5805       _err "_authorizations_seg not found."
    5806       _clearup
    5807       _on_issue_err "$_post_hook"
    5808       return 1
    5809     fi
    5810 
    5811     authzUri="$_authorizations_seg"
    5812     _debug2 "authzUri" "$authzUri"
    5813     if ! _send_signed_request "$authzUri"; then
    5814       _err "get to authz error."
    5815       _err "_authorizations_seg" "$_authorizations_seg"
    5816       _err "authzUri" "$authzUri"
    5817       _clearup
    5818       _on_issue_err "$_post_hook"
    5819       return 1
    5820     fi
    5821 
    5822     response="$(echo "$response" | _normalizeJson)"
    5823     _debug2 response "$response"
    5824     _URL_NAME="url"
    5825   else
    5826     if ! __get_domain_new_authz "$_d_domain"; then
    5827       _err "Can not get domain new authz token."
    5828       return 1
    5829     fi
    5830 
    5831     authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n")"
    5832     _debug "authzUri" "$authzUri"
    5833     if [ "$code" ] && [ ! "$code" = '201' ]; then
    5834       _err "new-authz error: $response"
    5835       return 1
    5836     fi
    5837     _URL_NAME="uri"
    5838   fi
    5839 
    5840   entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
     5888  _initpath "$_d_domain" "$_d_type"
     5889
     5890  . "$DOMAIN_CONF"
     5891  _debug Le_API "$Le_API"
     5892
     5893  if [ "$Le_API" ]; then
     5894    if [ "$Le_API" != "$ACME_DIRECTORY" ]; then
     5895      _clearAPI
     5896    fi
     5897    export ACME_DIRECTORY="$Le_API"
     5898    #reload ca configs
     5899    ACCOUNT_KEY_PATH=""
     5900    ACCOUNT_JSON_PATH=""
     5901    CA_CONF=""
     5902    _debug3 "initpath again."
     5903    _initpath "$Le_Domain" "$_d_type"
     5904    _initAPI
     5905  fi
     5906
     5907  _identifiers="{\"type\":\"dns\",\"value\":\"$_d_domain\"}"
     5908  if ! _send_signed_request "$ACME_NEW_ORDER" "{\"identifiers\": [$_identifiers]}"; then
     5909    _err "Can not get domain new order."
     5910    return 1
     5911  fi
     5912  _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
     5913  _debug2 _authorizations_seg "$_authorizations_seg"
     5914  if [ -z "$_authorizations_seg" ]; then
     5915    _err "_authorizations_seg not found."
     5916    _clearup
     5917    _on_issue_err "$_post_hook"
     5918    return 1
     5919  fi
     5920
     5921  authzUri="$_authorizations_seg"
     5922  _debug2 "authzUri" "$authzUri"
     5923  if ! _send_signed_request "$authzUri"; then
     5924    _err "get to authz error."
     5925    _err "_authorizations_seg" "$_authorizations_seg"
     5926    _err "authzUri" "$authzUri"
     5927    _clearup
     5928    _on_issue_err "$_post_hook"
     5929    return 1
     5930  fi
     5931
     5932  response="$(echo "$response" | _normalizeJson)"
     5933  _debug2 response "$response"
     5934  _URL_NAME="url"
     5935
     5936  entries="$(echo "$response" | tr '][' '==' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n\n' | grep "\"status\": *\"valid\"")"
    58415937  if [ -z "$entries" ]; then
    58425938    _info "No valid entries found."
    … …  
    58915987    _info "Deactivate: $_vtype"
    58925988
    5893     if [ "$ACME_VERSION" = "2" ]; then
    5894       _djson="{\"status\":\"deactivated\"}"
    5895     else
    5896       _djson="{\"resource\": \"authz\", \"status\":\"deactivated\"}"
    5897     fi
     5989    _djson="{\"status\":\"deactivated\"}"
    58985990
    58995991    if _send_signed_request "$authzUri" "$_djson" && _contains "$response" '"deactivated"'; then
    … …  
    61026194}
    61036195
    6104 # nocron confighome noprofile
     6196# nocron confighome noprofile accountemail
    61056197install() {
    61066198
    … …  
    61126204  _c_home="$2"
    61136205  _noprofile="$3"
     6206  _accountemail="$4"
     6207
    61146208  if ! _initpath; then
    61156209    _err "Install failed."
    … …  
    62286322      done
    62296323    fi
     6324  fi
     6325
     6326  if [ "$_accountemail" ]; then
     6327    _saveaccountconf "ACCOUNT_EMAIL" "$_accountemail"
    62306328  fi
    62316329
    … …  
    64526550  --set-default-ca         Used with '--server', Set the default CA to use.
    64536551                           See: $_SERVER_WIKI
     6552  --set-default-chain      Set the default preferred chain for a CA.
     6553                           See: $_PREFERRED_CHAIN_WIKI
    64546554
    64556555
    … …  
    65086608  --config-home <directory>         Specifies the home dir to save all the configurations.
    65096609  --useragent <string>              Specifies the user agent string. it will be saved for future use too.
    6510   -m, --accountemail <email>        Specifies the account email, only valid for the '--install' and '--update-account' command.
     6610  -m, --email <email>               Specifies the account email, only valid for the '--install' and '--update-account' command.
    65116611  --accountkey <file>               Specifies the account key path, only valid for the '--install' command.
    65126612  --days <ndays>                    Specifies the days to renew the cert when using '--issue' command. The default value is $DEFAULT_RENEW days.
    … …  
    65196619  --ca-bundle <file>                Specifies the path to the CA certificate bundle to verify api server's certificate.
    65206620  --ca-path <directory>             Specifies directory containing CA certificates in PEM format, used by wget or curl.
    6521   --nocron                          Only valid for '--install' command, which means: do not install the default cron job.
     6621  --no-cron                         Only valid for '--install' command, which means: do not install the default cron job.
    65226622                                    In this case, the certs will not be renewed automatically.
    6523   --noprofile                       Only valid for '--install' command, which means: do not install aliases to user profile.
     6623  --no-profile                      Only valid for '--install' command, which means: do not install aliases to user profile.
    65246624  --no-color                        Do not output color text.
    65256625  --force-color                     Force output of color text. Useful for non-interactive use with the aha tool for HTML E-Mails.
    … …  
    65596659}
    65606660
    6561 # nocron noprofile
    6562 _installOnline() {
     6661installOnline() {
    65636662  _info "Installing from online archive."
    6564   _nocron="$1"
    6565   _noprofile="$2"
    6566   if [ ! "$BRANCH" ]; then
    6567     BRANCH="master"
    6568   fi
    6569 
    6570   target="$PROJECT/archive/$BRANCH.tar.gz"
     6663
     6664  _branch="$BRANCH"
     6665  if [ -z "$_branch" ]; then
     6666    _branch="master"
     6667  fi
     6668
     6669  target="$PROJECT/archive/$_branch.tar.gz"
    65716670  _info "Downloading $target"
    6572   localname="$BRANCH.tar.gz"
     6671  localname="$_branch.tar.gz"
    65736672  if ! _get "$target" >$localname; then
    65746673    _err "Download error."
    … …  
    65826681    fi
    65836682
    6584     cd "$PROJECT_NAME-$BRANCH"
     6683    cd "$PROJECT_NAME-$_branch"
    65856684    chmod +x $PROJECT_ENTRY
    6586     if ./$PROJECT_ENTRY install "$_nocron" "" "$_noprofile"; then
     6685    if ./$PROJECT_ENTRY --install "$@"; then
    65876686      _info "Install success!"
    65886687      _initpath
    … …  
    65926691    cd ..
    65936692
    6594     rm -rf "$PROJECT_NAME-$BRANCH"
     6693    rm -rf "$PROJECT_NAME-$_branch"
    65956694    rm -f "$localname"
    65966695  )
    … …  
    66016700  shift
    66026701  _hash_url="https://api.github.com/repos/acmesh-official/$PROJECT_NAME/git/refs/$_hash_path"
    6603   _get $_hash_url | tr -d "\r\n" | tr '{},' '\n' | grep '"sha":' | cut -d '"' -f 4
     6702  _get $_hash_url | tr -d "\r\n" | tr '{},' '\n\n\n' | grep '"sha":' | cut -d '"' -f 4
    66046703}
    66056704
    … …  
    66206719    export LE_WORKING_DIR
    66216720    cd "$LE_WORKING_DIR"
    6622     _installOnline "nocron" "noprofile"
     6721    installOnline "--nocron" "--noprofile"
    66236722  ); then
    66246723    _info "Upgrade success!"
    … …  
    66746773}
    66756774
    6676 #server
     6775#server  #keylength
    66776776_selectServer() {
    66786777  _server="$1"
     6778  _skeylength="$2"
    66796779  _server_lower="$(echo "$_server" | _lower_case)"
    66806780  _sindex=0
    … …  
    66876787        _debug2 "_selectServer match $sname"
    66886788        _serverdir="$(_getfield "$CA_SERVERS" $_sindex)"
     6789        if [ "$_serverdir" = "$CA_SSLCOM_RSA" ] && _isEccKey "$_skeylength"; then
     6790          _serverdir="$CA_SSLCOM_ECC"
     6791        fi
    66896792        _debug "Selected server: $_serverdir"
    66906793        ACME_DIRECTORY="$_serverdir"
    … …  
    67036806  if [ -z "$caurl" ]; then
    67046807    caurl="$DEFAULT_CA"
     6808  fi
     6809  if [ "$CA_SSLCOM_ECC" = "$caurl" ]; then
     6810    caurl="$CA_SSLCOM_RSA" #just hack to get the short name
    67056811  fi
    67066812  caurl_lower="$(echo $caurl | _lower_case)"
    … …  
    67306836  _saveaccountconf "DEFAULT_ACME_SERVER" "$ACME_DIRECTORY"
    67316837  _info "Changed default CA to: $(__green "$ACME_DIRECTORY")"
     6838}
     6839
     6840#preferred-chain
     6841setdefaultchain() {
     6842  _initpath
     6843  _preferred_chain="$1"
     6844  if [ -z "$_preferred_chain" ]; then
     6845    _err "Please give a '--preferred-chain value' value."
     6846    return 1
     6847  fi
     6848  mkdir -p "$CA_DIR"
     6849  _savecaconf "DEFAULT_PREFERRED_CHAIN" "$_preferred_chain"
    67326850}
    67336851
    … …  
    68006918      _CMD="install"
    68016919      ;;
     6920    --install-online)
     6921      shift
     6922      installOnline "$@"
     6923      return
     6924      ;;
    68026925    --uninstall)
    68036926      _CMD="uninstall"
    … …  
    68777000    --set-default-ca)
    68787001      _CMD="setdefaultca"
     7002      ;;
     7003    --set-default-chain)
     7004      _CMD="setdefaultchain"
    68797005      ;;
    68807006    -d | --domain)
    … …  
    68917017        fi
    68927018
    6893         if _startswith "$_dvalue" "*."; then
    6894           _debug "Wildcard domain"
    6895           export ACME_VERSION=2
    6896         fi
    68977019        if [ -z "$_domain" ]; then
    68987020          _domain="$_dvalue"
    … …  
    69177039    --server)
    69187040      _server="$2"
    6919       _selectServer "$_server"
    69207041      shift
    69217042      ;;
    … …  
    70167137      shift
    70177138      ;;
    7018 
    70197139    --keylength | -k)
    70207140      _keylength="$2"
    … …  
    70257145      shift
    70267146      ;;
    7027 
    70287147    --cert-file | --certpath)
    70297148      _cert_file="$2"
    … …  
    70747193      shift
    70757194      ;;
    7076     -m | --accountemail)
     7195    -m | --email | --accountemail)
    70777196      _accountemail="$2"
    7078       ACCOUNT_EMAIL="$_accountemail"
     7197      export ACCOUNT_EMAIL="$_accountemail"
    70797198      shift
    70807199      ;;
    … …  
    71197238      shift
    71207239      ;;
    7121     --nocron)
     7240    --no-cron | --nocron)
    71227241      _nocron="1"
    71237242      ;;
    7124     --noprofile)
     7243    --no-profile | --noprofile)
    71257244      _noprofile="1"
    71267245      ;;
    … …  
    72887407    shift 1
    72897408  done
     7409
     7410  if [ "$_server" ]; then
     7411    _selectServer "$_server" "${_ecc:-$_keylength}"
     7412  fi
    72907413
    72917414  if [ "${_CMD}" != "install" ]; then
    … …  
    73427465  _debug "Running cmd: ${_CMD}"
    73437466  case "${_CMD}" in
    7344   install) install "$_nocron" "$_confighome" "$_noprofile" ;;
     7467  install) install "$_nocron" "$_confighome" "$_noprofile" "$_accountemail" ;;
    73457468  uninstall) uninstall "$_nocron" ;;
    73467469  upgrade) upgrade ;;
    … …  
    73527475    ;;
    73537476  signcsr)
    7354     signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias"
     7477    signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain"
    73557478    ;;
    73567479  showcsr)
    … …  
    74117534    setdefaultca
    74127535    ;;
     7536  setdefaultchain)
     7537    setdefaultchain "$_preferred_chain"
     7538    ;;
    74137539  *)
    74147540    if [ "$_CMD" ]; then
    … …  
    74557581}
    74567582
    7457 if [ "$INSTALLONLINE" ]; then
    7458   INSTALLONLINE=""
    7459   _installOnline
    7460   exit
    7461 fi
    7462 
    74637583main() {
    74647584  [ -z "$1" ] && showhelp && return

  • npl/syn3/acme/root/usr/bin/syn3-acme-issue

    r7c410f9 r105afb5  
    1515
    1616if [ "$EXIT" == "0" ]; then
    17         cat /usr/webint/ssl/server.crt /usr/webint/ssl/server.key  > /usr/webint/ssl/certandkey.pem
     17        cat /usr/webint/ssl/server.crt /usr/webint/ssl/server.pem  > /usr/webint/ssl/certandkey.pem
    1818        syn3-state certbot OK "SSL certificate valid."
    1919fi

  • npl/syn3/acme/root/usr/bin/syn3-acme-renew

    r7c410f9 r105afb5  
    1515
    1616if [ "$EXIT" == "0" ]; then
    17         cat /usr/webint/ssl/server.crt /usr/webint/ssl/server.key  > /usr/webint/ssl/certandkey.pem
     17        cat /usr/webint/ssl/server.crt /usr/webint/ssl/server.pem  > /usr/webint/ssl/certandkey.pem
    1818        syn3-state certbot OK "SSL certificate valid. `cat $STATUS`"
    1919else

  • npl/syn3/acme/syn3_acme.build

    r7c410f9 r105afb5  
    1 10
     112

  • npl/syn3/acme/syn3_acme.md5

    r7c410f9 r105afb5  
    11d41d8cd98f00b204e9800998ecf8427e  ./root/etc/webint/SSL_DOMAINS.new
    2 0418c2dac1c09a1e0a5a923de7155251  ./root/usr/bin/acme.sh
     241f48d3c2742cbbdf0fe9b7bf77740c0  ./root/usr/bin/acme.sh
    33a0e5403f61c08e4eda04cd2e61d7938a  ./root/usr/bin/syn3-acme
    4 59aa594e0d86791b3aa9b7b1a3e88e42  ./root/usr/bin/syn3-acme-issue
    5 917bbc278f45bd8ab36a946d4898dd0f  ./root/usr/bin/syn3-acme-renew
    6 0301b5ee1cb78f1410fe47edbf32e780  ./syn3_acme.pkg
     4a6acd24402cd102ba0fa6698140dc0b2  ./root/usr/bin/syn3-acme-issue
     54a90cca626fec2de3d266c94c0e7d321  ./root/usr/bin/syn3-acme-renew
     68bf81f0d178c08b77421b11d71fcf347  ./syn3_acme.pkg
    771a66f2a0cb707f264b0268ee3d4956d3  ./syn3_acme.SlackBuild
    8 6c17d788610977961a07f821dad6ccc3  ./syn3_acme.SlackBuild.log.gz
     833724e469f08288ccd67b04f39cae180  ./syn3_acme.SlackBuild.log.gz

  • npl/system/ca_certificates/ca-certificates.SlackBuild.orig

    r7c410f9 r105afb5  
    1 #!/bin/sh
     1#!/bin/bash
    22
    33# Slackware build script for ca-certificates
    44
    55# Copyright 2009,2011  Robby Workman  Northport, AL, USA
    6 # Copyright 2012, 2013, 2015, 2016  Patrick J. Volkerding, Sebeka, MN, USA
     6# Copyright 2012, 2013, 2015, 2016, 2018  Patrick J. Volkerding, Sebeka, MN, USA
    77# All rights reserved.
    88#
    … …  
    2424# ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    2525
     26cd $(dirname $0) ; CWD=$(pwd)
     27
    2628PKGNAM=ca-certificates
    27 VERSION=${VERSION:-20161130}
     29VERSION=${VERSION:-$(echo certdata-*.txt.xz | cut -f 2 -d - | cut -f 1 -d .)}
    2830ARCH=noarch
    2931BUILD=${BUILD:-1_slack14.2}
    3032
    31 TARVERSION=${VERSION}+nmu1
     33# If the variable PRINT_PACKAGE_NAME is set, then this script will report what
     34# the name of the created package would be, and then exit. This information
     35# could be useful to other scripts.
     36if [ ! -z "${PRINT_PACKAGE_NAME}" ]; then
     37  echo "$PKGNAM-$VERSION-$ARCH-$BUILD.txz"
     38  exit 0
     39fi
    3240
    33 CWD=$(pwd)
     41TARVERSION=${VERSION}
     42
    3443TMP=${TMP:-/tmp}
    3544PKG=$TMP/package-$PKGNAM
    … …  
    3948cd $TMP
    4049
    41 # Need both $PKGNAM and $PKGNAM-$VERSION since upstream can't decide how
    42 # to package their tarball:
    43 rm -rf $PKGNAM $PKGNAM-$VERSION
     50rm -rf $PKGNAM
    4451
    4552# Extract the tarball:
    46 tar xvf $CWD/${PKGNAM}_$TARVERSION.tar.?z || exit 1
     53tar xvf $CWD/${PKGNAM}.tar.?z || exit 1
    4754
    48 # Again, both $PKGNAM and $PKGNAM-$VERSION are needed here:
    49 cd $PKGNAM-$VERSION || cd $PKGNAM || exit 1
     55cd $PKGNAM || exit 1
    5056
    5157chown -R root:root .
    … …  
    5662 -exec chmod 644 {} \;
    5763
    58 # Obsolete?
    59 #zcat $CWD/patches/fixup_DESTDIR.diff.gz | patch -p1 || exit 1
     64# Remove incompatible command operators used to call 'run-parts':
     65zcat $CWD/fixup_update-ca-certificates.diff.gz | patch -p1 || exit 1
    6066
    61 # Remove incompatible command operators used to call 'run-parts':
    62 zcat $CWD/patches/fixup_update-ca-certificates.diff.gz | patch -p1 || exit 1
     67# Use "c_rehash" rather than "openssl rehash". They act mostly the same, but
     68# the openssl builtin is not available on older versions of Slackware, while
     69# c_rehash will always be there.
     70zcat $CWD/update-ca-certificates.c_rehash.diff.gz | patch -p1 || exit 1
     71
     72# Update to certdata.txt from $CWD:
     73xzcat $CWD/certdata-${VERSION}.txt.xz > mozilla/certdata.txt
    6374
    6475make || exit 1
    6576make install DESTDIR=$PKG || exit 1
    6677
     78# Remove expired certificate:
     79if [ -r $PKG//usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt ]; then
     80  rm -f $PKG//usr/share/ca-certificates/mozilla/DST_Root_CA_X3.crt
     81fi
     82
    6783mkdir -p $PKG/etc/ca-certificates/update.d
    6884printf "# Automatically generated by $PKGNAM-$VERSION \n#\n" \
    69   > $PKG/etc/ca-certificates.conf.new
     85  > $PKG/etc/ca-certificates.conf
    7086( cd $PKG/usr/share/ca-certificates
    7187  find . -name '*.crt' | sort | cut -b3-
    72 ) >> $PKG/etc/ca-certificates.conf.new
     88) >> $PKG/etc/ca-certificates.conf
    7389
    7490mkdir -p $PKG/usr/man/man8
    … …  
    7793
    7894mkdir -p $PKG/usr/doc/$PKGNAM-$VERSION
    79 mv debian/NEWS debian/NEWS.Debian
    80 cp -a debian/NEWS.Debian debian/README.Debian $PKG/usr/doc/$PKGNAM-$VERSION
     95cp -a docs/* $PKG/usr/doc/$PKGNAM-$VERSION
    8196
    8297mkdir -p $PKG/var/log/setup

  • npl/system/ca_certificates/ca_certificates.SlackBuild

    r7c410f9 r105afb5  
    33# Automaticly created by importpackage v1.0
    44# Imported from: https://mirrors.slackware.com/slackware/slackware-14.2/patches/source/ca-certificates/
    5 # Created at Thu Sep 20 18:32:49 CEST 2018
     5# Created at ma 29 nov 2021 11:53:10 CET
    66
    77
    … …  
    1111source ./ca-certificates.SlackBuild.orig
    1212
    13 mkdir -p /tmp/package-ca-certificates/etc/cron.weekly
    14 ln -s /usr/sbin/update-ca-certificates /tmp/package-ca-certificates/etc/cron.weekly
    1513
    1614############ make syn3 packages

  • npl/system/ca_certificates/ca_certificates.build

    r7c410f9 r105afb5  
    1 6
     17

  • npl/system/ca_certificates/ca_certificates.md5

    r7c410f9 r105afb5  
    1 a09e8b63126188fd0ed77f6fbaf5d35f  ./ca-certificates_20161130+nmu1.tar.xz
    2 f357913107c91908803032be7651db56  ./ca_certificates_dev.pkg
    3 b32269196c2fa44651fb14b021430eec  ./ca_certificates.pkg
    4 6cb73b8350729401c29f1b2e15cff2b8  ./ca_certificates.SlackBuild
    5 5d289f1bc67afe47662457accc53963d  ./ca_certificates.SlackBuild.log.gz
    6 c23d716a27384ed57c9085d400d4cbf9  ./ca-certificates.SlackBuild.orig
    7 d14bfbd360d69256b0f5a916301fdb5a  ./doinst.sh.gz
    8 260654f21ca5431270192d94f421cfc2  ./patches/fixup_DESTDIR.diff.gz
    9 cc23ac9b45fa4649ade60f64fe02eb7d  ./patches/fixup_update-ca-certificates.diff.gz
     1c503ec33059aacb4f4a88081cc2bd969  ./ca_certificates_dev.pkg
     21c80d0320a10ae55a9122f1053cd2074  ./ca_certificates.pkg
     3bdb5f5c4ba574445ab0819e345f42081  ./ca_certificates.SlackBuild
     4648c1c4d1fbd9ded03c092cb18607fe7  ./ca_certificates.SlackBuild.log.gz
     5b0263ee8f963696cf657d84d49a13ed5  ./ca-certificates.SlackBuild.orig
     6a36a44cf0586536772c200fd9ee10fa7  ./ca-certificates.tar.xz
     754a1ef614be13310a71f99a506d522bc  ./certdata-20211005.txt.xz
     82bc10162481837f7b4c8c7532dca0854  ./doinst.sh.gz
     9cc23ac9b45fa4649ade60f64fe02eb7d  ./fixup_update-ca-certificates.diff.gz
     1090833611bbc0db730880e8eb4ca7ca97  ./get-certdata.txt.sh
    10115dbe990e59d512ceb425ea6475ef0ae0  ./setup.11.cacerts
    11 026b3a65d346d6d845f3497819b42fdb  ./slack-desc
     1295c835581d5db3a3188e00f437d83dec  ./slack-desc
     13e64b203a2dc95ad7de22be3f7e6d4739  ./update-ca-certificates.c_rehash.diff.gz

  • npl/system/ca_certificates/ca_certificates.pkg

    • Property mode changed from 100755 to 100644

  • npl/system/ca_certificates/ca_certificates.version

    r7c410f9 r105afb5  
    1 20161130
     120211005

  • npl/system/ca_certificates/ca_certificates_dev.build

    r7c410f9 r105afb5  
    1 6
     17

  • npl/system/ca_certificates/ca_certificates_dev.version

    r7c410f9 r105afb5  
    1 20161130
     120211005

  • npl/system/ca_certificates/slack-desc

    r7c410f9 r105afb5  
    11# HOW TO EDIT THIS FILE:
    2 # The "handy ruler" below makes it easier to edit a package description.  Line
     2# The "handy ruler" below makes it easier to edit a package description. Line
    33# up the first '|' above the ':' following the base package name, and the '|'
    4 # on the right side marks the last column you can put a character in.  You must
    5 # make exactly 11 lines for the formatting to be correct.  It's also
     4# on the right side marks the last column you can put a character in. You must
     5# make exactly 11 lines for the formatting to be correct. It's also
    66# customary to leave one space after the ':'.
    77
    … …  
    1212ca-certificates: applications to check for the authenticity of SSL connections.
    1313ca-certificates:
    14 ca-certificates: Homepage: http://packages.qa.debian.org/c/ca-certificates.html
    1514ca-certificates:
    1615ca-certificates:
    … …  
    1817ca-certificates:
    1918ca-certificates:
     19ca-certificates:
Note: See TracChangeset for help on using the changeset viewer.