From 861df496707b2837d1972f76ce5c8c1fdf2d19d7 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 9 Mar 2018 16:29:47 +0100
Subject: [PATCH 001/246] Add All-inkl kasserver script.

---
 README.md         |   1 +
 dnsapi/dns_kas.sh | 153 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 154 insertions(+)
 create mode 100755 dnsapi/dns_kas.sh

diff --git a/README.md b/README.md
index bfcb477f..ed84f4a7 100644
--- a/README.md
+++ b/README.md
@@ -328,6 +328,7 @@ You don't have to do anything manually!
 1. zonomi.com DNS API
 1. DreamHost.com API
 1. DirectAdmin API
+1. All-inkl/Kasserver API
 
 
 And: 
diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
new file mode 100755
index 00000000..64a44720
--- /dev/null
+++ b/dnsapi/dns_kas.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env sh
+########################################################################
+# All-inkl Kasserver hook script for acme.sh
+#
+# Environment variables:
+#
+#  - $KAS_Login (Kasserver API login name)
+#  - $KAS_Authtype (Kasserver API auth type. Default: sha1)
+#  - $KAS_Authdata (Kasserver API auth data.)
+#
+# Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
+# Credits: Inspired by dns_he.sh. Thanks a lot man!
+# Git repo: TODO
+# TODO: Better Error handling
+# TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
+#       => Get all root zones and compare once the provider offers that.
+
+KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
+
+########  Public functions #####################
+
+dns_kas_add() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 All-inkl/Kasserver hook"
+  _info "Adding or Updating $_full_domain DNS TXT entry on All-inkl/Kasserver"
+
+  _check_and_save
+  _get_zone "$_full_domain"
+  _get_record_name "$_full_domain"
+  _get_record_id
+
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&var1=record_name"
+  params="$params&wert1=$_record_name"
+  params="$params&var2=record_type"
+  params="$params&wert2=TXT"
+  params="$params&var3=record_data"
+  params="$params&wert3=$_txt_value"
+  params="$params&var4=record_aux"
+  params="$params&wert4=0"
+  # If there is no record_id create the record
+  if [ -z "$_record_id" ]; then
+    _info "Creating TXT DNS record"
+    params="$params&kas_action=add_dns_settings"
+    params="$params&var5=zone_host"
+    params="$params&wert5=$_zone"
+  else # Update the existing record
+    _info "Updating existing TXT DNS record"
+    params="$params&kas_action=update_dns_settings"
+    params="$params&var5=record_id"
+    params="$params&wert5=$_record_id"
+  fi
+
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+
+  if ! _contains "$response" "TRUE"; then
+    _err "An unkown error occurred, please check manually."
+    return 1
+  fi
+  return 0
+}
+
+dns_kas_rm() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 All-inkl/Kasserver hook"
+  _info "Cleaning up after All-inkl/Kasserver hook"
+  _info "Removing $_full_domain DNS TXT entry on All-inkl/Kasserver"
+
+  _check_and_save
+  _get_zone "$_full_domain"
+  _get_record_name "$_full_domain"
+  _get_record_id
+
+  # If there is a record_id, delete the entry
+  if [ -n "$_record_id" ]; then
+    params="?kas_login=$KAS_Login"
+    params="$params&kas_auth_type=$KAS_Authtype"
+    params="$params&kas_auth_data=$KAS_Authdata"
+    params="$params&kas_action=delete_dns_settings"
+    params="$params&var1=record_id"
+    params="$params&wert1=$_record_id"
+    response="$(_get "$KAS_Api$params")"
+    _debug2 "response" "$response"
+    if ! _contains "$response" "TRUE"; then
+      _err "Either the txt record is not found or another error occurred, please check manually."
+      return 1
+    fi
+  else # Cannot delete or unkown error
+    _err "No record_id found that can be deleted. Please check manually."
+    return 1
+  fi
+
+ return 0
+}
+
+########################## PRIVATE FUNCTIONS ###########################
+
+# Checks for the ENV variables and saves them
+_check_and_save() {
+  KAS_Login="${KAS_Login:-$(_readaccountconf_mutable KAS_Login)}"
+  KAS_Authtype="${KAS_Authtype:-$(_readaccountconf_mutable KAS_Authtype)}"
+  KAS_Authdata="${KAS_Authdata:-$(_readaccountconf_mutable KAS_Authdata)}"
+
+  if [ -z "$KAS_Login" ] || [ -z "$KAS_Authtype" ] || [ -z "$KAS_Authdata" ]; then
+    KAS_Login=
+    KAS_Authtype=
+    KAS_Authdata=
+    _err "No auth details provided. Please set user credentials using the \$KAS_Login, \$KAS_Authtype, and \$KAS_Authdata environment variables."
+    return 1
+  fi
+  _saveaccountconf_mutable KAS_Login "$KAS_Login"
+  _saveaccountconf_mutable KAS_Authtype "$KAS_Authtype"
+  _saveaccountconf_mutable KAS_Authdata "$KAS_Authdata"
+  return 0
+}
+
+# Gets back the base domain/zone.
+# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+_get_zone() {
+  _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
+}
+
+# Removes the domain/subdomain from the entry since kasserver
+# cannot handle _full_domain
+# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+_get_record_name() {
+  _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+}
+
+# Retrieve the DNS record ID
+_get_record_id() {
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&kas_action=get_dns_settings"
+  params="$params&var1=zone_host"
+  params="$params&wert1=$_zone"
+
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+
+  _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  _debug2 _record_id "$_record_id"
+
+  return 0
+}

From 32d7bd5ab1d390d67a2705dfa8c3914e4f43d00a Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 9 Mar 2018 16:33:35 +0100
Subject: [PATCH 002/246] Add own github repository URL.

---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 64a44720..647a7bb2 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -10,7 +10,7 @@
 #
 # Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
-# Git repo: TODO
+# Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 # TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
 #       => Get all root zones and compare once the provider offers that.

From cbf0ceacd57fe16f27fa6150ffd2b180d796f3b3 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 14:51:16 +0100
Subject: [PATCH 003/246] Update dnsapi Readme.

---
 dnsapi/README.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 8b4a8358..ec6233fc 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -784,6 +784,27 @@ acme.sh --issue --dns dns_da -d example.com -d www.example.com
 
 The `DA_Api` and `DA_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+## 42. Use All-inkl Kasserver API
+
+All-inkl Kasserver API (https://kasapi.kasserver.com/dokumentation) needs you to set your Login credentials like so:
+
+```
+export KAS_Login="yourusername"
+export KAS_Authtype="sha1"
+export KAS_Authdata="password"
+```
+
+Note: Please for now always set the `KAS_Authtype` always simply to `sha1`.
+
+Then you can issue your certificate:
+
+```
+acme.sh --issue --dns dns_kas -d example.com -d www.example.com
+```
+
+The `KAS_Login`, `KAS_Authtype` and `KAS_Authdata` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+Please report any issues to https://github.com/phlegx/acme.sh.
 
 # Use custom API
 

From e431df06ab6457292e9d82e03f4d5ca015d0b85d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 14:54:08 +0100
Subject: [PATCH 004/246] Only create entry. Remove update.

---
 dnsapi/dns_kas.sh | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 647a7bb2..518b2830 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -30,6 +30,7 @@ dns_kas_add() {
   _get_record_name "$_full_domain"
   _get_record_id
 
+  _info "Creating TXT DNS record"
   params="?kas_login=$KAS_Login"
   params="$params&kas_auth_type=$KAS_Authtype"
   params="$params&kas_auth_data=$KAS_Authdata"
@@ -41,18 +42,9 @@ dns_kas_add() {
   params="$params&wert3=$_txt_value"
   params="$params&var4=record_aux"
   params="$params&wert4=0"
-  # If there is no record_id create the record
-  if [ -z "$_record_id" ]; then
-    _info "Creating TXT DNS record"
-    params="$params&kas_action=add_dns_settings"
-    params="$params&var5=zone_host"
-    params="$params&wert5=$_zone"
-  else # Update the existing record
-    _info "Updating existing TXT DNS record"
-    params="$params&kas_action=update_dns_settings"
-    params="$params&var5=record_id"
-    params="$params&wert5=$_record_id"
-  fi
+  params="$params&kas_action=add_dns_settings"
+  params="$params&var5=zone_host"
+  params="$params&wert5=$_zone"
 
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"

From 11bfb1e5fd679a21477c393f9cfc19004e72d306 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 15:02:47 +0100
Subject: [PATCH 005/246] Fix return values of some functions.

---
 dnsapi/dns_kas.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 518b2830..dc87bee4 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -116,6 +116,7 @@ _check_and_save() {
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone() {
   _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
+  return 0
 }
 
 # Removes the domain/subdomain from the entry since kasserver
@@ -124,6 +125,7 @@ _get_zone() {
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_record_name() {
   _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+  return 0
 }
 
 # Retrieve the DNS record ID

From 26b5180bf71f007f55c0264aba76defa0574626c Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 15:49:40 +0100
Subject: [PATCH 006/246] Rename full_domain and txt_value variables.

---
 dnsapi/dns_kas.sh | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index dc87bee4..0eda1d36 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -20,14 +20,14 @@ KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
 ########  Public functions #####################
 
 dns_kas_add() {
-  _full_domain=$1
-  _txt_value=$2
+  _fulldomain=$1
+  _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
-  _info "Adding or Updating $_full_domain DNS TXT entry on All-inkl/Kasserver"
+  _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_full_domain"
-  _get_record_name "$_full_domain"
+  _get_zone "$_fulldomain"
+  _get_record_name "$_fulldomain"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -39,7 +39,7 @@ dns_kas_add() {
   params="$params&var2=record_type"
   params="$params&wert2=TXT"
   params="$params&var3=record_data"
-  params="$params&wert3=$_txt_value"
+  params="$params&wert3=$_txtvalue"
   params="$params&var4=record_aux"
   params="$params&wert4=0"
   params="$params&kas_action=add_dns_settings"
@@ -57,15 +57,15 @@ dns_kas_add() {
 }
 
 dns_kas_rm() {
-  _full_domain=$1
-  _txt_value=$2
+  _fulldomain=$1
+  _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
-  _info "Removing $_full_domain DNS TXT entry on All-inkl/Kasserver"
+  _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_full_domain"
-  _get_record_name "$_full_domain"
+  _get_zone "$_fulldomain"
+  _get_record_name "$_fulldomain"
   _get_record_id
 
   # If there is a record_id, delete the entry
@@ -86,7 +86,6 @@ dns_kas_rm() {
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
-
  return 0
 }
 
@@ -120,7 +119,7 @@ _get_zone() {
 }
 
 # Removes the domain/subdomain from the entry since kasserver
-# cannot handle _full_domain
+# cannot handle _fulldomain
 # TODO Get a list of all possible root zones and compare (Currently not possible via provider)
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_record_name() {
@@ -141,7 +140,12 @@ _get_record_id() {
   _debug2 "response" "$response"
 
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  echo "###########################"
+  echo "$_record_name"
+  echo "$_record_id"
+  echo "###########################"
+  echo "$response"
+  echo "###########################"
   _debug2 _record_id "$_record_id"
-
   return 0
 }

From cb4a2cf02921d538edc497f0af0d479df04ffb90 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 16:47:47 +0100
Subject: [PATCH 007/246] remove debug output

---
 dnsapi/dns_kas.sh | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 0eda1d36..c3941d90 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -140,12 +140,6 @@ _get_record_id() {
   _debug2 "response" "$response"
 
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
-  echo "###########################"
-  echo "$_record_name"
-  echo "$_record_id"
-  echo "###########################"
-  echo "$response"
-  echo "###########################"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 68f66ca101ba04bf3abc3fb97f1f0162d6a2506c Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Thu, 2 Aug 2018 16:20:48 +0200
Subject: [PATCH 008/246] Add default delay for the calls to KAS api since they
 are very restrictive with that.

---
 dnsapi/dns_kas.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index c3941d90..3b608d43 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -45,7 +45,8 @@ dns_kas_add() {
   params="$params&kas_action=add_dns_settings"
   params="$params&var5=zone_host"
   params="$params&wert5=$_zone"
-
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
@@ -76,6 +77,8 @@ dns_kas_rm() {
     params="$params&kas_action=delete_dns_settings"
     params="$params&var1=record_id"
     params="$params&wert1=$_record_id"
+    _debug2 "Wait for 10 seconds by default before calling KAS API."
+    sleep 10
     response="$(_get "$KAS_Api$params")"
     _debug2 "response" "$response"
     if ! _contains "$response" "TRUE"; then
@@ -136,6 +139,8 @@ _get_record_id() {
   params="$params&var1=zone_host"
   params="$params&wert1=$_zone"
 
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 

From 1ef7fd36590068fd83631318c13b79bf384e0046 Mon Sep 17 00:00:00 2001
From: Dominic Jonas <djonas@haprotec.de>
Date: Wed, 5 Jun 2019 11:38:41 +0200
Subject: [PATCH 009/246] support to delete multiple entries

---
 dnsapi/dns_kas.sh | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 3b608d43..14c0b378 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -69,27 +69,33 @@ dns_kas_rm() {
   _get_record_name "$_fulldomain"
   _get_record_id
 
-  # If there is a record_id, delete the entry
+  # If there is a record_id, delete the entry   
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
     params="$params&kas_auth_type=$KAS_Authtype"
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
-    params="$params&var1=record_id"
-    params="$params&wert1=$_record_id"
-    _debug2 "Wait for 10 seconds by default before calling KAS API."
-    sleep 10
-    response="$(_get "$KAS_Api$params")"
-    _debug2 "response" "$response"
-    if ! _contains "$response" "TRUE"; then
-      _err "Either the txt record is not found or another error occurred, please check manually."
-      return 1
-    fi
+    
+    # split it into a seperated list, if there where multiples entries made
+    records=($_record_id)
+    for i in "${records[@]}"
+    do
+      params2="$params&var1=record_id"
+      params2="$params2&wert1=$i"
+      _debug2 "Wait for 10 seconds by default before calling KAS API."
+      sleep 10
+      response="$(_get "$KAS_Api$params2")"
+      _debug2 "response" "$response"
+      if ! _contains "$response" "TRUE"; then
+        _err "Either the txt record is not found or another error occurred, please check manually."
+        return 1
+      fi
+    done
   else # Cannot delete or unkown error
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
- return 0
+return 0
 }
 
 ########################## PRIVATE FUNCTIONS ###########################
@@ -147,4 +153,4 @@ _get_record_id() {
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
   _debug2 _record_id "$_record_id"
   return 0
-}
+}
\ No newline at end of file

From ae66c6f0b484ce5c451ff8c195f382115b3d15a0 Mon Sep 17 00:00:00 2001
From: David Kerr <david@kerr.net>
Date: Thu, 11 Jul 2019 15:46:17 -0400
Subject: [PATCH 010/246] Fix bug (in egrep regex) reported by @maks2018 in
 issue 2305

Fix bug reported by @maks2018 in issue https://github.com/Neilpang/acme.sh/issues/2305 by updating the regex in egrep of the subdomain html page.
---
 dnsapi/dns_freedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index e76e6495..ec845f89 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -305,7 +305,7 @@ _freedns_domain_id() {
 
     domain_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
-      | _egrep_o "edit\.php\?edit_domain_id=[0-9a-zA-Z]+" \
+      | _egrep_o "edit\.php?edit_domain_id=[0-9a-zA-Z]*" \
       | cut -d = -f 2)"
     # The above beauty extracts domain ID from the html page...
     # strip out all blank space and new lines. Then insert newlines
@@ -352,7 +352,7 @@ _freedns_data_id() {
     data_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
-      | _egrep_o "edit\.php\?data_id=[0-9a-zA-Z]+" \
+      | _egrep_o "edit\.php?data_id=[0-9a-zA-Z]*" \
       | cut -d = -f 2)"
     # The above beauty extracts data ID from the html page...
     # strip out all blank space and new lines. Then insert newlines

From 2ce9fb976024373850bb1de1e9ed939a995d3378 Mon Sep 17 00:00:00 2001
From: David Kerr <david@kerr.net>
Date: Thu, 11 Jul 2019 18:06:56 -0400
Subject: [PATCH 011/246] Work around bug in _egrep_o() function

_egrep_o() function accepts extended regex and on systems that do not have egrep uses sed to emulate egrep.
This is failing on the specific regex I was using before my last commit... https://github.com/dkerr64/acme.sh/commit/ae66c6f0b484ce5c451ff8c195f382115b3d15a0
The problem is that I fixed it by passing in non-extended regex which then fails on systems that do have egrep.  So I am no longer using _egrep_o.
---
 dnsapi/dns_freedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index ec845f89..8a48cf77 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -305,7 +305,7 @@ _freedns_domain_id() {
 
     domain_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
-      | _egrep_o "edit\.php?edit_domain_id=[0-9a-zA-Z]*" \
+      | grep -o "edit\.php?edit_domain_id=[0-9a-zA-Z]*" \
       | cut -d = -f 2)"
     # The above beauty extracts domain ID from the html page...
     # strip out all blank space and new lines. Then insert newlines
@@ -352,7 +352,7 @@ _freedns_data_id() {
     data_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
-      | _egrep_o "edit\.php?data_id=[0-9a-zA-Z]*" \
+      | grep -o "edit\.php?data_id=[0-9a-zA-Z]*" \
       | cut -d = -f 2)"
     # The above beauty extracts data ID from the html page...
     # strip out all blank space and new lines. Then insert newlines

From 5f944743304976a55c1e974c5835c5b2996c2ce2 Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Sat, 13 Jul 2019 20:01:06 +0800
Subject: [PATCH 012/246] support jdcloud.com (#2390)

fix https://github.com/Neilpang/acme.sh/pull/2390
---
 dnsapi/dns_jd.sh | 286 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 286 insertions(+)
 create mode 100644 dnsapi/dns_jd.sh

diff --git a/dnsapi/dns_jd.sh b/dnsapi/dns_jd.sh
new file mode 100644
index 00000000..d0f2a501
--- /dev/null
+++ b/dnsapi/dns_jd.sh
@@ -0,0 +1,286 @@
+#!/usr/bin/env sh
+
+#
+#JD_ACCESS_KEY_ID="sdfsdfsdfljlbjkljlkjsdfoiwje"
+#JD_ACCESS_KEY_SECRET="xxxxxxx"
+#JD_REGION="cn-north-1"
+
+_JD_ACCOUNT="https://uc.jdcloud.com/account/accesskey"
+
+_JD_PROD="clouddnsservice"
+_JD_API="jdcloud-api.com"
+
+_JD_API_VERSION="v1"
+_JD_DEFAULT_REGION="cn-north-1"
+
+_JD_HOST="$_JD_PROD.$_JD_API"
+
+########  Public functions #####################
+
+#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_jd_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  JD_ACCESS_KEY_ID="${JD_ACCESS_KEY_ID:-$(_readaccountconf_mutable JD_ACCESS_KEY_ID)}"
+  JD_ACCESS_KEY_SECRET="${JD_ACCESS_KEY_SECRET:-$(_readaccountconf_mutable JD_ACCESS_KEY_SECRET)}"
+  JD_REGION="${JD_REGION:-$(_readaccountconf_mutable JD_REGION)}"
+
+  if [ -z "$JD_ACCESS_KEY_ID" ] || [ -z "$JD_ACCESS_KEY_SECRET" ]; then
+    JD_ACCESS_KEY_ID=""
+    JD_ACCESS_KEY_SECRET=""
+    _err "You haven't specifed the jdcloud api key id or api key secret yet."
+    _err "Please create your key and try again. see $(__green $_JD_ACCOUNT)"
+    return 1
+  fi
+
+  _saveaccountconf_mutable JD_ACCESS_KEY_ID "$JD_ACCESS_KEY_ID"
+  _saveaccountconf_mutable JD_ACCESS_KEY_SECRET "$JD_ACCESS_KEY_SECRET"
+  if [ -z "$JD_REGION" ]; then
+    _debug "Using default region: $_JD_DEFAULT_REGION"
+    JD_REGION="$_JD_DEFAULT_REGION"
+  else
+    _saveaccountconf_mutable JD_REGION "$JD_REGION"
+  fi
+  _JD_BASE_URI="$_JD_API_VERSION/regions/$JD_REGION"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  #_debug "Getting getViewTree"
+
+  _debug "Adding records"
+
+  _addrr="{\"req\":{\"hostRecord\":\"$_sub_domain\",\"hostValue\":\"$txtvalue\",\"ttl\":300,\"type\":\"TXT\",\"viewValue\":-1},\"regionId\":\"$JD_REGION\",\"domainId\":\"$_domain_id\"}"
+  #_addrr='{"req":{"hostRecord":"xx","hostValue":"\"value4\"","jcloudRes":false,"mxPriority":null,"port":null,"ttl":300,"type":"TXT","weight":null,"viewValue":-1},"regionId":"cn-north-1","domainId":"8824"}'
+  if jd_rest POST "domain/$_domain_id/RRAdd" "" "$_addrr"; then
+    _rid="$(echo "$response" | tr '{},' '\n' | grep '"id":' | cut -d : -f 2)"
+    if [ -z "$_rid" ]; then
+      _err "Can not find record id from the result."
+      return 1
+    fi
+    _info "TXT record added successfully."
+    _srid="$(_readdomainconf "JD_CLOUD_RIDS")"
+    if [ "$_srid" ]; then
+      _rid="$_srid,$_rid"
+    fi
+    _savedomainconf "JD_CLOUD_RIDS" "$_rid"
+    return 0
+  fi
+
+  return 1
+}
+
+dns_jd_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  JD_ACCESS_KEY_ID="${JD_ACCESS_KEY_ID:-$(_readaccountconf_mutable JD_ACCESS_KEY_ID)}"
+  JD_ACCESS_KEY_SECRET="${JD_ACCESS_KEY_SECRET:-$(_readaccountconf_mutable JD_ACCESS_KEY_SECRET)}"
+  JD_REGION="${JD_REGION:-$(_readaccountconf_mutable JD_REGION)}"
+
+  if [ -z "$JD_REGION" ]; then
+    _debug "Using default region: $_JD_DEFAULT_REGION"
+    JD_REGION="$_JD_DEFAULT_REGION"
+  fi
+
+  _JD_BASE_URI="$_JD_API_VERSION/regions/$JD_REGION"
+
+  _info "Getting existing records for $fulldomain"
+  _srid="$(_readdomainconf "JD_CLOUD_RIDS")"
+  _debug _srid "$_srid"
+
+  if [ -z "$_srid" ]; then
+    _err "Not rid skip"
+    return 0
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _cleardomainconf JD_CLOUD_RIDS
+
+  _aws_tmpl_xml="{\"ids\":[$_srid],\"action\":\"del\",\"regionId\":\"$JD_REGION\",\"domainId\":\"$_domain_id\"}"
+
+  if jd_rest POST "domain/$_domain_id/RROperate" "" "$_aws_tmpl_xml" && _contains "$response" "\"code\":\"OK\""; then
+    _info "TXT record deleted successfully."
+    return 0
+  fi
+  return 1
+
+}
+
+####################  Private functions below ##################################
+
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug2 "Checking domain: $h"
+    if ! jd_rest GET "domain"; then
+      _err "error get domain list"
+      return 1
+    fi
+    if [ -z "$h" ]; then
+      #not valid
+      _err "Invalid domain"
+      return 1
+    fi
+
+    if _contains "$response" "\"domainName\":\"$h\""; then
+      hostedzone="$(echo "$response" | tr '{}' '\n' | grep "\"domainName\":\"$h\"")"
+      _debug hostedzone "$hostedzone"
+      if [ "$hostedzone" ]; then
+        _domain_id="$(echo "$hostedzone" | tr ',' '\n' | grep "\"id\":" | cut -d : -f 2)"
+        if [ "$_domain_id" ]; then
+          _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+          _domain=$h
+          return 0
+        fi
+      fi
+      _err "Can't find domain with id: $h"
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+
+  return 1
+}
+
+#method uri qstr data
+jd_rest() {
+  mtd="$1"
+  ep="$2"
+  qsr="$3"
+  data="$4"
+
+  _debug mtd "$mtd"
+  _debug ep "$ep"
+  _debug qsr "$qsr"
+  _debug data "$data"
+
+  CanonicalURI="/$_JD_BASE_URI/$ep"
+  _debug2 CanonicalURI "$CanonicalURI"
+
+  CanonicalQueryString="$qsr"
+  _debug2 CanonicalQueryString "$CanonicalQueryString"
+
+  RequestDate="$(date -u +"%Y%m%dT%H%M%SZ")"
+  #RequestDate="20190713T082155Z" ######################################################
+  _debug2 RequestDate "$RequestDate"
+  export _H1="X-Jdcloud-Date: $RequestDate"
+
+  RequestNonce="2bd0852a-8bae-4087-b2d5-$(_time)"
+  #RequestNonce="894baff5-72d4-4244-883a-7b2eb51e7fbe" #################################
+  _debug2 RequestNonce "$RequestNonce"
+  export _H2="X-Jdcloud-Nonce: $RequestNonce"
+
+  if [ "$data" ]; then
+    CanonicalHeaders="content-type:application/json\n"
+    SignedHeaders="content-type;"
+  else
+    CanonicalHeaders=""
+    SignedHeaders=""
+  fi
+  CanonicalHeaders="${CanonicalHeaders}host:$_JD_HOST\nx-jdcloud-date:$RequestDate\nx-jdcloud-nonce:$RequestNonce\n"
+  SignedHeaders="${SignedHeaders}host;x-jdcloud-date;x-jdcloud-nonce"
+
+  _debug2 CanonicalHeaders "$CanonicalHeaders"
+  _debug2 SignedHeaders "$SignedHeaders"
+
+  Hash="sha256"
+
+  RequestPayload="$data"
+  _debug2 RequestPayload "$RequestPayload"
+
+  RequestPayloadHash="$(printf "%s" "$RequestPayload" | _digest "$Hash" hex | _lower_case)"
+  _debug2 RequestPayloadHash "$RequestPayloadHash"
+
+  CanonicalRequest="$mtd\n$CanonicalURI\n$CanonicalQueryString\n$CanonicalHeaders\n$SignedHeaders\n$RequestPayloadHash"
+  _debug2 CanonicalRequest "$CanonicalRequest"
+
+  HashedCanonicalRequest="$(printf "$CanonicalRequest%s" | _digest "$Hash" hex)"
+  _debug2 HashedCanonicalRequest "$HashedCanonicalRequest"
+
+  Algorithm="JDCLOUD2-HMAC-SHA256"
+  _debug2 Algorithm "$Algorithm"
+
+  RequestDateOnly="$(echo "$RequestDate" | cut -c 1-8)"
+  _debug2 RequestDateOnly "$RequestDateOnly"
+
+  Region="$JD_REGION"
+  Service="$_JD_PROD"
+
+  CredentialScope="$RequestDateOnly/$Region/$Service/jdcloud2_request"
+  _debug2 CredentialScope "$CredentialScope"
+
+  StringToSign="$Algorithm\n$RequestDate\n$CredentialScope\n$HashedCanonicalRequest"
+
+  _debug2 StringToSign "$StringToSign"
+
+  kSecret="JDCLOUD2$JD_ACCESS_KEY_SECRET"
+
+  _secure_debug2 kSecret "$kSecret"
+
+  kSecretH="$(printf "%s" "$kSecret" | _hex_dump | tr -d " ")"
+  _secure_debug2 kSecretH "$kSecretH"
+
+  kDateH="$(printf "$RequestDateOnly%s" | _hmac "$Hash" "$kSecretH" hex)"
+  _debug2 kDateH "$kDateH"
+
+  kRegionH="$(printf "$Region%s" | _hmac "$Hash" "$kDateH" hex)"
+  _debug2 kRegionH "$kRegionH"
+
+  kServiceH="$(printf "$Service%s" | _hmac "$Hash" "$kRegionH" hex)"
+  _debug2 kServiceH "$kServiceH"
+
+  kSigningH="$(printf "%s" "jdcloud2_request" | _hmac "$Hash" "$kServiceH" hex)"
+  _debug2 kSigningH "$kSigningH"
+
+  signature="$(printf "$StringToSign%s" | _hmac "$Hash" "$kSigningH" hex)"
+  _debug2 signature "$signature"
+
+  Authorization="$Algorithm Credential=$JD_ACCESS_KEY_ID/$CredentialScope, SignedHeaders=$SignedHeaders, Signature=$signature"
+  _debug2 Authorization "$Authorization"
+
+  _H3="Authorization: $Authorization"
+  _debug _H3 "$_H3"
+
+  url="https://$_JD_HOST$CanonicalURI"
+  if [ "$qsr" ]; then
+    url="https://$_JD_HOST$CanonicalURI?$qsr"
+  fi
+
+  if [ "$mtd" = "GET" ]; then
+    response="$(_get "$url")"
+  else
+    response="$(_post "$data" "$url" "" "$mtd" "application/json")"
+  fi
+
+  _ret="$?"
+  _debug2 response "$response"
+  if [ "$_ret" = "0" ]; then
+    if _contains "$response" "\"error\""; then
+      _err "Response error:$response"
+      return 1
+    fi
+  fi
+
+  return "$_ret"
+}

From 55dea4ee9d2187912ecf97689e12a6e8183a1091 Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Sat, 27 Jul 2019 11:48:29 +0800
Subject: [PATCH 013/246] sync (#2404)

* support jdcloud.com

* fix format

* ttl 3000

* Escape slashes (#2375)

* Change 1.1.1.1 to 1.0.0.1 to probe compatibility (#2330)

As we can see, 1.1.1.1 is not routed or routed to an Intranet devices due to historical reason. Change 1.1.1.1 to 1.0.0.1 will have a better compatibility. I found this problem on my Tencent Cloud server.

* check empty id

* fix error

* Add dnsapi for Vultr (#2370)

* Add Vultr dns api

* PushOver notifications (#2325)

* PushOver notifications, using AppToken, UserKey, and optional sounds

* fix errors

* added dns api support for hexonet (#1776)

* update

* minor

* support new Cloudflare Token format
fix https://github.com/Neilpang/acme.sh/issues/2398

* fix wildcard domain name

* add more info

* fix https://github.com/Neilpang/acme.sh/issues/2377

* fix format

* fix format
---
 acme.sh                 |   6 +-
 deploy/docker.sh        |   4 +-
 dnsapi/dns_cf.sh        |  87 ++++++++++-----------
 dnsapi/dns_hexonet.sh   | 156 ++++++++++++++++++++++++++++++++++++++
 dnsapi/dns_namecheap.sh |   2 +-
 dnsapi/dns_namesilo.sh  |  11 ++-
 dnsapi/dns_vultr.sh     | 163 ++++++++++++++++++++++++++++++++++++++++
 notify/pushover.sh      |  63 ++++++++++++++++
 8 files changed, 443 insertions(+), 49 deletions(-)
 create mode 100755 dnsapi/dns_hexonet.sh
 create mode 100644 dnsapi/dns_vultr.sh
 create mode 100644 notify/pushover.sh

diff --git a/acme.sh b/acme.sh
index 67fcdcb5..891d2e1e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3035,11 +3035,13 @@ _clearupdns() {
     d=$(_getfield "$entry" 1)
     txtdomain=$(_getfield "$entry" 2)
     aliasDomain=$(_getfield "$entry" 3)
+    _currentRoot=$(_getfield "$entry" 4)
     txt=$(_getfield "$entry" 5)
     d_api=$(_getfield "$entry" 6)
     _debug "d" "$d"
     _debug "txtdomain" "$txtdomain"
     _debug "aliasDomain" "$aliasDomain"
+    _debug "_currentRoot" "$_currentRoot"
     _debug "txt" "$txt"
     _debug "d_api" "$d_api"
     if [ "$d_api" = "$txt" ]; then
@@ -3621,7 +3623,7 @@ _ns_purge_cf() {
   _cf_d="$1"
   _cf_d_type="$2"
   _debug "Cloudflare purge $_cf_d_type record for domain $_cf_d"
-  _cf_purl="https://1.1.1.1/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
+  _cf_purl="https://1.0.0.1/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
   response="$(_post "" "$_cf_purl")"
   _debug2 response "$response"
 }
@@ -6787,7 +6789,7 @@ _process() {
       _debug "Using server: $_server"
     fi
   fi
-
+  _debug "Running cmd: ${_CMD}"
   case "${_CMD}" in
     install) install "$_nocron" "$_confighome" "$_noprofile" ;;
     uninstall) uninstall "$_nocron" ;;
diff --git a/deploy/docker.sh b/deploy/docker.sh
index 4e550991..05333b3f 100755
--- a/deploy/docker.sh
+++ b/deploy/docker.sh
@@ -126,6 +126,7 @@ docker_deploy() {
   fi
 
   if [ "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD" ]; then
+    _info "Reloading: $DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"
     if ! _docker_exec "$_cid" "$DEPLOY_DOCKER_CONTAINER_RELOAD_CMD"; then
       return 1
     fi
@@ -223,7 +224,8 @@ _docker_cp() {
     _debug2 "_frompath" "$_frompath"
     _toname="$(basename "$_to")"
     _debug2 "_toname" "$_toname"
-    if ! tar --transform="s,$_frompath,$_toname," -cz "$_from" 2>/dev/null | _curl_unix_sock "$_DOCKER_SOCK" PUT "/containers/$_dcid/archive?noOverwriteDirNonDir=1&path=$(printf "%s" "$_dir" | _url_encode)" '@-' "Content-Type: application/octet-stream"; then
+    _debug2 "_from" "$_from"
+    if ! tar --transform="s,$(printf "%s" "$_frompath" | tr '*' .),$_toname," -cz "$_from" 2>/dev/null | _curl_unix_sock "$_DOCKER_SOCK" PUT "/containers/$_dcid/archive?noOverwriteDirNonDir=1&path=$(printf "%s" "$_dir" | _url_encode)" '@-' "Content-Type: application/octet-stream"; then
       _err "copy error"
       return 1
     fi
diff --git a/dnsapi/dns_cf.sh b/dnsapi/dns_cf.sh
index cd93189f..62e40caf 100755
--- a/dnsapi/dns_cf.sh
+++ b/dnsapi/dns_cf.sh
@@ -5,6 +5,9 @@
 #
 #CF_Email="xxxx@sss.com"
 
+#CF_Token="xxxx"
+#CF_Account_ID="xxxx"
+
 CF_Api="https://api.cloudflare.com/client/v4"
 
 ########  Public functions #####################
@@ -14,25 +17,32 @@ dns_cf_add() {
   fulldomain=$1
   txtvalue=$2
 
+  CF_Token="${CF_Token:-$(_readaccountconf_mutable CF_Token)}"
+  CF_Account_ID="${CF_Account_ID:-$(_readaccountconf_mutable CF_Account_ID)}"
   CF_Key="${CF_Key:-$(_readaccountconf_mutable CF_Key)}"
   CF_Email="${CF_Email:-$(_readaccountconf_mutable CF_Email)}"
-  if [ -z "$CF_Key" ] || [ -z "$CF_Email" ]; then
-    CF_Key=""
-    CF_Email=""
-    _err "You didn't specify a Cloudflare api key and email yet."
-    _err "You can get yours from here https://dash.cloudflare.com/profile."
-    return 1
-  fi
 
-  if ! _contains "$CF_Email" "@"; then
-    _err "It seems that the CF_Email=$CF_Email is not a valid email address."
-    _err "Please check and retry."
-    return 1
-  fi
+  if [ "$CF_Token" ]; then
+    _saveaccountconf_mutable CF_Token "$CF_Token"
+    _saveaccountconf_mutable CF_Account_ID "$CF_Account_ID"
+  else
+    if [ -z "$CF_Key" ] || [ -z "$CF_Email" ]; then
+      CF_Key=""
+      CF_Email=""
+      _err "You didn't specify a Cloudflare api key and email yet."
+      _err "You can get yours from here https://dash.cloudflare.com/profile."
+      return 1
+    fi
 
-  #save the api key and email to the account conf file.
-  _saveaccountconf_mutable CF_Key "$CF_Key"
-  _saveaccountconf_mutable CF_Email "$CF_Email"
+    if ! _contains "$CF_Email" "@"; then
+      _err "It seems that the CF_Email=$CF_Email is not a valid email address."
+      _err "Please check and retry."
+      return 1
+    fi
+    #save the api key and email to the account conf file.
+    _saveaccountconf_mutable CF_Key "$CF_Key"
+    _saveaccountconf_mutable CF_Email "$CF_Email"
+  fi
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -71,19 +81,6 @@ dns_cf_add() {
   fi
   _err "Add txt record error."
   return 1
-  #  else
-  #    _info "Updating record"
-  #    record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | head -n 1)
-  #    _debug "record_id" "$record_id"
-  #
-  #    _cf_rest PUT "zones/$_domain_id/dns_records/$record_id" "{\"id\":\"$record_id\",\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":\"$txtvalue\",\"zone_id\":\"$_domain_id\",\"zone_name\":\"$_domain\"}"
-  #    if [ "$?" = "0" ]; then
-  #      _info "Updated, OK"
-  #      return 0
-  #    fi
-  #    _err "Update error"
-  #    return 1
-  #  fi
 
 }
 
@@ -92,15 +89,10 @@ dns_cf_rm() {
   fulldomain=$1
   txtvalue=$2
 
+  CF_Token="${CF_Token:-$(_readaccountconf_mutable CF_Token)}"
+  CF_Account_ID="${CF_Account_ID:-$(_readaccountconf_mutable CF_Account_ID)}"
   CF_Key="${CF_Key:-$(_readaccountconf_mutable CF_Key)}"
   CF_Email="${CF_Email:-$(_readaccountconf_mutable CF_Email)}"
-  if [ -z "$CF_Key" ] || [ -z "$CF_Email" ]; then
-    CF_Key=""
-    CF_Email=""
-    _err "You didn't specify a Cloudflare api key and email yet."
-    _err "You can get yours from here https://dash.cloudflare.com/profile."
-    return 1
-  fi
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
@@ -157,8 +149,14 @@ _get_root() {
       return 1
     fi
 
-    if ! _cf_rest GET "zones?name=$h"; then
-      return 1
+    if [ "$CF_Account_ID" ]; then
+      if ! _cf_rest GET "zones?name=$h&account.id=$CF_Account_ID"; then
+        return 1
+      fi
+    else
+      if ! _cf_rest GET "zones?name=$h"; then
+        return 1
+      fi
     fi
 
     if _contains "$response" "\"name\":\"$h\"" || _contains "$response" '"total_count":1'; then
@@ -182,12 +180,17 @@ _cf_rest() {
   data="$3"
   _debug "$ep"
 
-  email_trimmed=$(echo $CF_Email | tr -d '"')
-  key_trimmed=$(echo $CF_Key | tr -d '"')
+  email_trimmed=$(echo "$CF_Email" | tr -d '"')
+  key_trimmed=$(echo "$CF_Key" | tr -d '"')
+  token_trimmed=$(echo "$CF_Token" | tr -d '"')
 
-  export _H1="X-Auth-Email: $email_trimmed"
-  export _H2="X-Auth-Key: $key_trimmed"
-  export _H3="Content-Type: application/json"
+  export _H1="Content-Type: application/json"
+  if [ "$token_trimmed" ]; then
+    export _H2="Authorization: Bearer $token_trimmed"
+  else
+    export _H2="X-Auth-Email: $email_trimmed"
+    export _H3="X-Auth-Key: $key_trimmed"
+  fi
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"
diff --git a/dnsapi/dns_hexonet.sh b/dnsapi/dns_hexonet.sh
new file mode 100755
index 00000000..f1503118
--- /dev/null
+++ b/dnsapi/dns_hexonet.sh
@@ -0,0 +1,156 @@
+#!/usr/bin/env sh
+
+#
+# Hexonet_Login="username!roleId"
+#
+# Hexonet_Password="rolePassword"
+
+Hexonet_Api="https://coreapi.1api.net/api/call.cgi"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_hexonet_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  Hexonet_Login="${Hexonet_Login:-$(_readaccountconf_mutable Hexonet_Login)}"
+  Hexonet_Password="${Hexonet_Password:-$(_readaccountconf_mutable Hexonet_Password)}"
+  if [ -z "$Hexonet_Login" ] || [ -z "$Hexonet_Password" ]; then
+    Hexonet_Login=""
+    Hexonet_Password=""
+    _err "You must export variables: Hexonet_Login and Hexonet_Password"
+    return 1
+  fi
+
+  if ! _contains "$Hexonet_Login" "!"; then
+    _err "It seems that the Hexonet_Login=$Hexonet_Login is not a restrivteed user."
+    _err "Please check and retry."
+    return 1
+  fi
+
+  #save the username and password to the account conf file.
+  _saveaccountconf_mutable Hexonet_Login "$Hexonet_Login"
+  _saveaccountconf_mutable Hexonet_Password "$Hexonet_Password"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _hexonet_rest "&command=QueryDNSZoneRRList&dnszone=${h}.&RRTYPE=TXT"
+
+  if ! _contains "$response" "CODE=200"; then
+    _err "Error"
+    return 1
+  fi
+
+  _info "Adding record"
+  if _hexonet_rest "command=UpdateDNSZone&dnszone=${_domain}.&addrr0=${_sub_domain}%20IN%20TXT%20${txtvalue}"; then
+    if _contains "$response" "CODE=200"; then
+      _info "Added, OK"
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+  return 1
+
+}
+
+#fulldomain txtvalue
+dns_hexonet_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  Hexonet_Login="${Hexonet_Login:-$(_readaccountconf_mutable Hexonet_Login)}"
+  Hexonet_Password="${Hexonet_Password:-$(_readaccountconf_mutable Hexonet_Password)}"
+  if [ -z "$Hexonet_Login" ] || [ -z "$Hexonet_Password" ]; then
+    Hexonet_Login=""
+    Hexonet_Password=""
+    _err "You must export variables: Hexonet_Login and Hexonet_Password"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _hexonet_rest "&command=QueryDNSZoneRRList&dnszone=${h}.&RRTYPE=TXT&RR=${txtvalue}"
+
+  if ! _contains "$response" "CODE=200"; then
+    _err "Error"
+    return 1
+  fi
+
+  count=$(printf "%s\n" "$response" | _egrep_o "PROPERTY[TOTAL][0]=" | cut -d = -f 2)
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Don't need to remove."
+  else
+    if ! _hexonet_rest "&command=UpdateDNSZone&dnszone=${_domain}.&delrr0='${_sub_domain}%20IN%20TXT%20\"${txtvalue}\""; then
+      _err "Delete record error."
+      return 1
+    fi
+    _contains "$response" "CODE=200"
+  fi
+
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if ! _hexonet_rest "&command=QueryDNSZoneRRList&dnszone=${h}."; then
+      return 1
+    fi
+
+    if _contains "$response" "CODE=200"; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_hexonet_rest() {
+  query_params="$1"
+  _debug "$query_params"
+
+  response="$(_get "${Hexonet_Api}?s_login=${Hexonet_Login}&s_pw=${Hexonet_Password}&${query_params}")"
+
+  if [ "$?" != "0" ]; then
+    _err "error $query_params"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}
diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index 6553deb6..a82e12d7 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -164,7 +164,7 @@ _namecheap_set_publicip() {
     _debug sourceip "$NAMECHEAP_SOURCEIP"
 
     ip=$(echo "$NAMECHEAP_SOURCEIP" | _egrep_o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-    addr=$(echo "$NAMECHEAP_SOURCEIP" | _egrep_o '(http|https)://.*')
+    addr=$(echo "$NAMECHEAP_SOURCEIP" | _egrep_o '(http|https):\/\/.*')
 
     _debug2 ip "$ip"
     _debug2 addr "$addr"
diff --git a/dnsapi/dns_namesilo.sh b/dnsapi/dns_namesilo.sh
index dc1a4fda..ed6d0e08 100755
--- a/dnsapi/dns_namesilo.sh
+++ b/dnsapi/dns_namesilo.sh
@@ -59,9 +59,14 @@ dns_namesilo_rm() {
   if _namesilo_rest GET "dnsListRecords?version=1&type=xml&key=$Namesilo_Key&domain=$_domain"; then
     retcode=$(printf "%s\n" "$response" | _egrep_o "<code>300")
     if [ "$retcode" ]; then
-      _record_id=$(printf "%s\n" "$response" | _egrep_o "<record_id>([^<]*)</record_id><type>TXT</type><host>$fulldomain</host>" | _egrep_o "<record_id>([^<]*)</record_id>" | sed -r "s/<record_id>([^<]*)<\/record_id>/\1/" | tail -n 1)
-      _debug record_id "$_record_id"
-      _info "Successfully retrieved the record id for ACME challenge."
+      _record_id=$(echo "$response" | _egrep_o "<record_id>([^<]*)</record_id><type>TXT</type><host>$fulldomain</host>" | _egrep_o "<record_id>([^<]*)</record_id>" | sed -r "s/<record_id>([^<]*)<\/record_id>/\1/" | tail -n 1)
+      _debug _record_id "$_record_id"
+      if [ "$_record_id" ]; then
+        _info "Successfully retrieved the record id for ACME challenge."
+      else
+        _info "Empty record id, it seems no such record."
+        return 0
+      fi
     else
       _err "Unable to retrieve the record id."
       return 1
diff --git a/dnsapi/dns_vultr.sh b/dnsapi/dns_vultr.sh
new file mode 100644
index 00000000..f15e7c49
--- /dev/null
+++ b/dnsapi/dns_vultr.sh
@@ -0,0 +1,163 @@
+#!/usr/bin/env sh
+
+#
+#VULTR_API_KEY=000011112222333344445555666677778888
+
+VULTR_Api="https://api.vultr.com/v1"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_vultr_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  VULTR_API_KEY="${VULTR_API_KEY:-$(_readaccountconf_mutable VULTR_API_KEY)}"
+  if test -z "$VULTR_API_KEY"; then
+    VULTR_API_KEY=''
+    _err 'VULTR_API_KEY was not exported'
+    return 1
+  fi
+
+  _saveaccountconf_mutable VULTR_API_KEY "$VULTR_API_KEY"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug 'Getting txt records'
+  _vultr_rest GET "dns/records?domain=$_domain"
+
+  if printf "%s\n" "$response" | grep "\"type\":\"TXT\",\"name\":\"$fulldomain\"" >/dev/null; then
+    _err 'Error'
+    return 1
+  fi
+
+  if ! _vultr_rest POST 'dns/create_record' "domain=$_domain&name=$_sub_domain&data=\"$txtvalue\"&type=TXT"; then
+    _err "$response"
+    return 1
+  fi
+
+  _debug2 _response "$response"
+  return 0
+}
+
+#fulldomain txtvalue
+dns_vultr_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  VULTR_API_KEY="${VULTR_API_KEY:-$(_readaccountconf_mutable VULTR_API_KEY)}"
+  if test -z "$VULTR_API_KEY"; then
+    VULTR_API_KEY=""
+    _err 'VULTR_API_KEY was not exported'
+    return 1
+  fi
+
+  _saveaccountconf_mutable VULTR_API_KEY "$VULTR_API_KEY"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug 'Getting txt records'
+  _vultr_rest GET "dns/records?domain=$_domain"
+
+  if printf "%s\n" "$response" | grep "\"type\":\"TXT\",\"name\":\"$fulldomain\"" >/dev/null; then
+    _err 'Error'
+    return 1
+  fi
+
+  _record_id="$(echo "$response" | tr '{}' '\n' | grep '"TXT"' | grep "$txtvalue" | tr ',' '\n' | grep -i 'RECORDID' | cut -d : -f 2)"
+  _debug _record_id "$_record_id"
+  if [ "$_record_id" ]; then
+    _info "Successfully retrieved the record id for ACME challenge."
+  else
+    _info "Empty record id, it seems no such record."
+    return 0
+  fi
+
+  if ! _vultr_rest POST 'dns/delete_record' "domain=$_domain&RECORDID=$_record_id"; then
+    _err "$response"
+    return 1
+  fi
+
+  _debug2 _response "$response"
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if ! _vultr_rest GET "dns/list"; then
+      return 1
+    fi
+
+    if printf "%s\n" "$response" | grep '^\[.*\]' >/dev/null; then
+      if _contains "$response" "\"domain\":\"$_domain\""; then
+        _sub_domain="$(echo "$fulldomain" | sed "s/\\.$_domain\$//")"
+        _domain=$_domain
+        return 0
+      else
+        _err 'Invalid domain'
+        return 1
+      fi
+    else
+      _err "$response"
+      return 1
+    fi
+    i=$(_math "$i" + 1)
+  done
+
+  return 1
+}
+
+_vultr_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  api_key_trimmed=$(echo $VULTR_API_KEY | tr -d '"')
+
+  export _H1="Api-Key: $api_key_trimmed"
+  export _H2='Content-Type: application/x-www-form-urlencoded'
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$VULTR_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$VULTR_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Error $ep"
+    return 1
+  fi
+
+  _debug2 response "$response"
+  return 0
+}
diff --git a/notify/pushover.sh b/notify/pushover.sh
new file mode 100644
index 00000000..a07cbd3d
--- /dev/null
+++ b/notify/pushover.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env sh
+
+#Support for pushover.net's api. Push notification platform for multiple platforms
+#PUSHOVER_TOKEN="" Required, pushover application token
+#PUSHOVER_USER="" Required, pushover userkey
+#PUSHOVER_DEVICE="" Optional, Specific device or devices by hostnames, joining multiples with a comma (such as device=iphone,nexus5)
+#PUSHOVER_PRIORITY="" Optional, Lowest Priority (-2), Low Priority (-1), Normal Priority (0), High Priority (1)
+
+PUSHOVER_URI="https://api.pushover.net/1/messages.json"
+
+pushover_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_statusCode" "$_statusCode"
+
+  PUSHOVER_TOKEN="${PUSHOVER_TOKEN:-$(_readaccountconf_mutable PUSHOVER_TOKEN)}"
+  if [ -z "$PUSHOVER_TOKEN" ]; then
+    PUSHOVER_TOKEN=""
+    _err "You didn't specify a PushOver application token yet."
+    return 1
+  fi
+  _saveaccountconf_mutable PUSHOVER_TOKEN "$PUSHOVER_TOKEN"
+
+  PUSHOVER_USER="${PUSHOVER_USER:-$(_readaccountconf_mutable PUSHOVER_USER)}"
+  if [ -z "$PUSHOVER_USER" ]; then
+    PUSHOVER_USER=""
+    _err "You didn't specify a PushOver UserKey yet."
+    return 1
+  fi
+  _saveaccountconf_mutable PUSHOVER_USER "$PUSHOVER_USER"
+
+  PUSHOVER_DEVICE="${PUSHOVER_DEVICE:-$(_readaccountconf_mutable PUSHOVER_DEVICE)}"
+  if [ "$PUSHOVER_DEVICE" ]; then
+    _saveaccountconf_mutable PUSHOVER_DEVICE "$PUSHOVER_DEVICE"
+  fi
+
+  PUSHOVER_PRIORITY="${PUSHOVER_PRIORITY:-$(_readaccountconf_mutable PUSHOVER_PRIORITY)}"
+  if [ "$PUSHOVER_PRIORITY" ]; then
+    _saveaccountconf_mutable PUSHOVER_PRIORITY "$PUSHOVER_PRIORITY"
+  fi
+
+  PUSHOVER_SOUND="${PUSHOVER_SOUND:-$(_readaccountconf_mutable PUSHOVER_SOUND)}"
+  if [ "$PUSHOVER_SOUND" ]; then
+    _saveaccountconf_mutable PUSHOVER_SOUND "$PUSHOVER_SOUND"
+  fi
+
+  export _H1="Content-Type: application/json"
+  _content="$(printf "*%s*\n" "$_content" | _json_encode)"
+  _subject="$(printf "*%s*\n" "$_subject" | _json_encode)"
+  _data="{\"token\": \"$PUSHOVER_TOKEN\",\"user\": \"$PUSHOVER_USER\",\"title\": \"$_subject\",\"message\": \"$_content\",\"sound\": \"$PUSHOVER_SOUND\", \"device\": \"$PUSHOVER_DEVICE\", \"priority\": \"$PUSHOVER_PRIORITY\"}"
+
+  response="" #just make shellcheck happy
+  if _post "$_data" "$PUSHOVER_URI"; then
+    if _contains "$response" "{\"status\":1"; then
+      _info "PUSHOVER send success."
+      return 0
+    fi
+  fi
+  _err "PUSHOVER send error."
+  _err "$response"
+  return 1
+}

From b9b2cd278b098b7e43143e58809878f1e8fbcf2b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 29 Jul 2019 21:12:19 +0800
Subject: [PATCH 014/246] fix https://github.com/Neilpang/acme.sh/pull/2275

---
 acme.sh          | 4 ++--
 dnsapi/dns_dp.sh | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index 891d2e1e..66d9b7a8 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3623,7 +3623,7 @@ _ns_purge_cf() {
   _cf_d="$1"
   _cf_d_type="$2"
   _debug "Cloudflare purge $_cf_d_type record for domain $_cf_d"
-  _cf_purl="https://1.0.0.1/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
+  _cf_purl="https://cloudflare-dns.com/api/v1/purge?domain=$_cf_d&type=$_cf_d_type"
   response="$(_post "" "$_cf_purl")"
   _debug2 response "$response"
 }
@@ -3682,11 +3682,11 @@ _check_dns_entries() {
       fi
       _left=1
       _info "Not valid yet, let's wait 10 seconds and check next one."
-      _sleep 10
       __purge_txt "$txtdomain"
       if [ "$txtdomain" != "$aliasDomain" ]; then
         __purge_txt "$aliasDomain"
       fi
+      _sleep 10
     done
     if [ "$_left" ]; then
       _info "Let's wait 10 seconds and check again".
diff --git a/dnsapi/dns_dp.sh b/dnsapi/dns_dp.sh
index 6bbf149e..480c1f9a 100755
--- a/dnsapi/dns_dp.sh
+++ b/dnsapi/dns_dp.sh
@@ -63,7 +63,7 @@ dns_dp_rm() {
     return 0
   fi
 
-  record_id=$(echo "$response" | tr "{" "\n" | grep "$txtvalue" | grep '^"id"' | cut -d : -f 2 | cut -d '"' -f 2)
+  record_id=$(echo "$response" | tr "{" "\n" | grep -- "$txtvalue" | grep '^"id"' | cut -d : -f 2 | cut -d '"' -f 2)
   _debug record_id "$record_id"
   if [ -z "$record_id" ]; then
     _err "Can not get record id."

From 75191e71870abdb35365d057ffd746e8cd8d5b4f Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 31 Jul 2019 23:22:07 +0800
Subject: [PATCH 015/246] fix https://github.com/Neilpang/acme.sh/issues/2417

---
 acme.sh | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 66d9b7a8..8bff2e84 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5932,8 +5932,11 @@ _send_notify() {
   _send_err=0
   for _n_hook in $(echo "$_nhooks" | tr ',' " "); do
     _n_hook_file="$(_findHook "" $_SUB_FOLDER_NOTIFY "$_n_hook")"
-    _info "Found $_n_hook_file"
-
+    _info "Found $_n_hook_file for $_n_hook"
+    if [ -z "$_n_hook_file" ]; then
+      _err "Can not find the hook file for $_n_hook"
+      continue
+    fi
     if ! (
       if ! . "$_n_hook_file"; then
         _err "Load file $_n_hook_file error. Please check your api file and try again."

From d42cf6daebfd134dca7af41b47aac34866b6a771 Mon Sep 17 00:00:00 2001
From: James Qian <sotux82@gmail.com>
Date: Mon, 5 Aug 2019 21:35:03 +0800
Subject: [PATCH 016/246] dnsapi: fix typo in dns_desec.sh (#2427)

Signed-off-by: James Qian <sotux82@gmail.com>
---
 dnsapi/dns_desec.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_desec.sh b/dnsapi/dns_desec.sh
index 6488b7fb..61d080bd 100644
--- a/dnsapi/dns_desec.sh
+++ b/dnsapi/dns_desec.sh
@@ -25,8 +25,8 @@ dns_desec_add() {
   if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
     DEDYN_TOKEN=""
     DEDYN_NAME=""
-    _err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
-    _err "Please create you key and try again."
+    _err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
+    _err "Please create your key and try again."
     _err "e.g."
     _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
     _err "export DEDYN_NAME=foobar.dedyn.io"
@@ -92,8 +92,8 @@ dns_desec_rm() {
   if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
     DEDYN_TOKEN=""
     DEDYN_NAME=""
-    _err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
-    _err "Please create you key and try again."
+    _err "You did not specify DEDYN_TOKEN and DEDYN_NAME yet."
+    _err "Please create your key and try again."
     _err "e.g."
     _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
     _err "export DEDYN_NAME=foobar.dedyn.io"

From d74dfb1f5c333c911d150f7a7485ff99b8c984b4 Mon Sep 17 00:00:00 2001
From: lcdtyph <lcdtyph@gmail.com>
Date: Mon, 5 Aug 2019 21:38:32 +0800
Subject: [PATCH 017/246] IFTTT Webhooks Notification (#2416)

* IFTTT webhooks Notification

* use sh instead of bash

* don't save value that is not set
---
 notify/ifttt.sh | 86 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)
 create mode 100644 notify/ifttt.sh

diff --git a/notify/ifttt.sh b/notify/ifttt.sh
new file mode 100644
index 00000000..8a14f5f5
--- /dev/null
+++ b/notify/ifttt.sh
@@ -0,0 +1,86 @@
+#!/usr/bin/env sh
+
+#Support ifttt.com webhooks api
+
+#IFTTT_API_KEY="xxxx"
+#IFTTT_EVENT_NAME="yyyy"
+
+#IFTTT_SUBJECT_KEY="value1|value2|value3"      #optional, use "value1" as default
+#IFTTT_CONTENT_KEY="value1|value2|value3"      #optional, use "value2" as default
+
+_IFTTT_AVAIL_MSG_KEYS="value1,value2,value3"
+
+# subject  content statusCode
+ifttt_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_subject" "$_subject"
+  _debug "_content" "$_content"
+  _debug "_statusCode" "$_statusCode"
+
+  IFTTT_API_KEY="${IFTTT_API_KEY:-$(_readaccountconf_mutable IFTTT_API_KEY)}"
+  if [ -z "$IFTTT_API_KEY" ]; then
+    IFTTT_API_KEY=""
+    _err "You didn't specify a ifttt webhooks api key IFTTT_API_KEY yet."
+    _err "You can get yours from https://ifttt.com"
+    return 1
+  fi
+  _saveaccountconf_mutable IFTTT_API_KEY "$IFTTT_API_KEY"
+
+  IFTTT_EVENT_NAME="${IFTTT_EVENT_NAME:-$(_readaccountconf_mutable IFTTT_EVENT_NAME)}"
+  if [ -z "$IFTTT_EVENT_NAME" ]; then
+    IFTTT_EVENT_NAME=""
+    _err "You didn't specify a ifttt webhooks event name IFTTT_EVENT_NAME yet."
+    return 1
+  fi
+  _saveaccountconf_mutable IFTTT_EVENT_NAME "$IFTTT_EVENT_NAME"
+
+  IFTTT_SUBJECT_KEY="${IFTTT_SUBJECT_KEY:-$(_readaccountconf_mutable IFTTT_SUBJECT_KEY)}"
+  if [ -z "$IFTTT_SUBJECT_KEY" ]; then
+    IFTTT_SUBJECT_KEY="value1"
+    _info "The IFTTT_SUBJECT_KEY is not set, so use the default value1 as key."
+  elif ! _hasfield "$_IFTTT_AVAIL_MSG_KEYS" "$IFTTT_SUBJECT_KEY"; then
+    _err "The IFTTT_SUBJECT_KEY \"$IFTTT_SUBJECT_KEY\" is not available, should be one of $_IFTTT_AVAIL_MSG_KEYS"
+    IFTTT_SUBJECT_KEY=""
+    return 1
+  else
+    _saveaccountconf_mutable IFTTT_SUBJECT_KEY "$IFTTT_SUBJECT_KEY"
+  fi
+
+  IFTTT_CONTENT_KEY="${IFTTT_CONTENT_KEY:-$(_readaccountconf_mutable IFTTT_CONTENT_KEY)}"
+  if [ -z "$IFTTT_CONTENT_KEY" ]; then
+    IFTTT_CONTENT_KEY="value2"
+    _info "The IFTTT_CONTENT_KEY is not set, so use the default value2 as key."
+  elif ! _hasfield "$_IFTTT_AVAIL_MSG_KEYS" "$IFTTT_CONTENT_KEY"; then
+    _err "The IFTTT_CONTENT_KEY \"$IFTTT_CONTENT_KEY\" is not available, should be one of $_IFTTT_AVAIL_MSG_KEYS"
+    IFTTT_CONTENT_KEY=""
+    return 1
+  else
+    _saveaccountconf_mutable IFTTT_CONTENT_KEY "$IFTTT_CONTENT_KEY"
+  fi
+
+  if [ "$IFTTT_SUBJECT_KEY" = "$IFTTT_CONTENT_KEY" ]; then
+    IFTTT_SUBJECT_KEY=""
+    IFTTT_CONTENT_KEY=""
+    _err "The IFTTT_SUBJECT_KEY must not be same as IFTTT_CONTENT_KEY."
+    return 1
+  fi
+
+  IFTTT_API_URL="https://maker.ifttt.com/trigger/$IFTTT_EVENT_NAME/with/key/$IFTTT_API_KEY"
+
+  _content=$(echo "$_content" | _json_encode)
+  _subject=$(echo "$_subject" | _json_encode)
+  _data="{\"$IFTTT_SUBJECT_KEY\": \"$_subject\", \"$IFTTT_CONTENT_KEY\": \"$_content\"}"
+
+  response="" #just make shellcheck happy
+  if _post "$_data" "$IFTTT_API_URL" "" "POST" "application/json"; then
+    if _contains "$response" "Congratulations"; then
+      _info "IFTTT webhooks event fired success."
+      return 0
+    fi
+  fi
+  _err "IFTTT webhooks event fired error."
+  _err "$response"
+  return 1
+}

From 143eac092ce8b8fe7c068809449ce7a5b71f3ea2 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 5 Aug 2019 22:03:56 +0800
Subject: [PATCH 018/246] fix notify message

---
 acme.sh            |  5 +++--
 notify/ifttt.sh    | 12 ++++++------
 notify/pushover.sh | 12 ++++++------
 notify/sendgrid.sh | 12 ++++++------
 4 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/acme.sh b/acme.sh
index 8bff2e84..8452d588 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5932,7 +5932,8 @@ _send_notify() {
   _send_err=0
   for _n_hook in $(echo "$_nhooks" | tr ',' " "); do
     _n_hook_file="$(_findHook "" $_SUB_FOLDER_NOTIFY "$_n_hook")"
-    _info "Found $_n_hook_file for $_n_hook"
+    _info "Sending via: $_n_hook"
+    _debug "Found $_n_hook_file for $_n_hook"
     if [ -z "$_n_hook_file" ]; then
       _err "Can not find the hook file for $_n_hook"
       continue
@@ -5971,7 +5972,7 @@ _set_notify_hook() {
   _nhooks="$1"
 
   _test_subject="Hello, this is notification from $PROJECT_NAME"
-  _test_content="If you receive this email, your notification works."
+  _test_content="If you receive this message, your notification works."
 
   _send_notify "$_test_subject" "$_test_content" "$_nhooks" 0
 
diff --git a/notify/ifttt.sh b/notify/ifttt.sh
index 8a14f5f5..7b829639 100644
--- a/notify/ifttt.sh
+++ b/notify/ifttt.sh
@@ -73,13 +73,13 @@ ifttt_send() {
   _subject=$(echo "$_subject" | _json_encode)
   _data="{\"$IFTTT_SUBJECT_KEY\": \"$_subject\", \"$IFTTT_CONTENT_KEY\": \"$_content\"}"
 
-  response="" #just make shellcheck happy
-  if _post "$_data" "$IFTTT_API_URL" "" "POST" "application/json"; then
-    if _contains "$response" "Congratulations"; then
-      _info "IFTTT webhooks event fired success."
-      return 0
-    fi
+  response="$(_post "$_data" "$IFTTT_API_URL" "" "POST" "application/json")"
+
+  if [ "$?" = "0" ] && _contains "$response" "Congratulations"; then
+    _info "IFTTT webhooks event fired success."
+    return 0
   fi
+
   _err "IFTTT webhooks event fired error."
   _err "$response"
   return 1
diff --git a/notify/pushover.sh b/notify/pushover.sh
index a07cbd3d..0f99739a 100644
--- a/notify/pushover.sh
+++ b/notify/pushover.sh
@@ -50,13 +50,13 @@ pushover_send() {
   _subject="$(printf "*%s*\n" "$_subject" | _json_encode)"
   _data="{\"token\": \"$PUSHOVER_TOKEN\",\"user\": \"$PUSHOVER_USER\",\"title\": \"$_subject\",\"message\": \"$_content\",\"sound\": \"$PUSHOVER_SOUND\", \"device\": \"$PUSHOVER_DEVICE\", \"priority\": \"$PUSHOVER_PRIORITY\"}"
 
-  response="" #just make shellcheck happy
-  if _post "$_data" "$PUSHOVER_URI"; then
-    if _contains "$response" "{\"status\":1"; then
-      _info "PUSHOVER send success."
-      return 0
-    fi
+  response="$(_post "$_data" "$PUSHOVER_URI")"
+
+  if [ "$?" = "0" ] && _contains "$response" "{\"status\":1"; then
+    _info "PUSHOVER send success."
+    return 0
   fi
+
   _err "PUSHOVER send error."
   _err "$response"
   return 1
diff --git a/notify/sendgrid.sh b/notify/sendgrid.sh
index 5c5bfdba..0d5ea3b3 100644
--- a/notify/sendgrid.sh
+++ b/notify/sendgrid.sh
@@ -42,13 +42,13 @@ sendgrid_send() {
 
   _content="$(echo "$_content" | _json_encode)"
   _data="{\"personalizations\": [{\"to\": [{\"email\": \"$SENDGRID_TO\"}]}],\"from\": {\"email\": \"$SENDGRID_FROM\"},\"subject\": \"$_subject\",\"content\": [{\"type\": \"text/plain\", \"value\": \"$_content\"}]}"
-  response="" #just make shellcheck happy
-  if _post "$_data" "https://api.sendgrid.com/v3/mail/send"; then
-    if [ -z "$response" ]; then
-      _info "sendgrid send sccess."
-      return 0
-    fi
+  response="$(_post "$_data" "https://api.sendgrid.com/v3/mail/send")"
+
+  if [ "$?" = "0" ] && [ -z "$response" ]; then
+    _info "sendgrid send sccess."
+    return 0
   fi
+
   _err "sendgrid send error."
   _err "$response"
   return 1

From 874bd093cb5076613f74aac84168952af0e27f9f Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Mon, 5 Aug 2019 22:35:40 +0800
Subject: [PATCH 019/246] fix https://github.com/Neilpang/acme.sh/issues/2409
 (#2430)

---
 dnsapi/dns_he.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index df00c746..caa4d2c4 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -134,9 +134,9 @@ _find_zone() {
   _zone_ids=$(echo "$_matches" | _egrep_o "hosted_dns_zoneid=[0-9]*&" | cut -d = -f 2 | tr -d '&')
   _zone_names=$(echo "$_matches" | _egrep_o "name=.*onclick" | cut -d '"' -f 2)
   _debug2 "These are the zones on this HE account:"
-  _debug2 "$_zone_names"
+  _debug2 "_zone_names" "$_zone_names"
   _debug2 "And these are their respective IDs:"
-  _debug2 "$_zone_ids"
+  _debug2 "_zone_ids" "$_zone_ids"
   if [ -z "$_zone_names" ] || [ -z "$_zone_ids" ]; then
     _err "Can not get zone names."
     return 1
@@ -154,10 +154,14 @@ _find_zone() {
 
     _debug "Looking for zone \"${_attempted_zone}\""
 
-    line_num="$(echo "$_zone_names" | grep -n "^$_attempted_zone" | cut -d : -f 1)"
-
+    line_num="$(echo "$_zone_names" | grep -n "^$_attempted_zone\$" | _head_n 1 | cut -d : -f 1)"
+    _debug2 line_num "$line_num"
     if [ "$line_num" ]; then
       _zone_id=$(echo "$_zone_ids" | sed -n "${line_num}p")
+      if [ -z "$_zone_id" ]; then
+        _err "Can not find zone id."
+        return 1
+      fi
       _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi

From c7849a43e13fd98f2452613165561e547b2606df Mon Sep 17 00:00:00 2001
From: mleo2003 <mleo2003@gmail.com>
Date: Tue, 6 Aug 2019 06:41:12 -0700
Subject: [PATCH 020/246] Add variable exports for Successful Post Hook and
 Renew Hook calls (#2431)

---
 acme.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/acme.sh b/acme.sh
index 8452d588..4742e611 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3265,6 +3265,11 @@ _on_issue_success() {
   if [ "$_chk_post_hook" ]; then
     _info "Run post hook:'$_chk_post_hook'"
     if ! (
+      export CERT_PATH
+      export CERT_KEY_PATH
+      export CA_CERT_PATH
+      export CERT_FULLCHAIN_PATH
+      export Le_Domain="$_main_domain"
       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
     ); then
       _err "Error when run post hook."
@@ -3276,6 +3281,11 @@ _on_issue_success() {
   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
     _info "Run renew hook:'$_chk_renew_hook'"
     if ! (
+      export CERT_PATH
+      export CERT_KEY_PATH
+      export CA_CERT_PATH
+      export CERT_FULLCHAIN_PATH
+      export Le_Domain="$_main_domain"
       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
     ); then
       _err "Error when run renew hook."

From f82ff90f0670becb8b2c63e9eea591361a380ca7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=A2=D0=B8=D0=BC=D1=83=D1=80=20=D0=AF=D1=85=D0=B8=D0=BD?=
 <temofffey@gmail.com>
Date: Sun, 11 Aug 2019 06:41:57 +0300
Subject: [PATCH 021/246] fixed json parse regex for support api gcore_cdn
 (#2381)

---
 deploy/gcore_cdn.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deploy/gcore_cdn.sh b/deploy/gcore_cdn.sh
index e0921bcb..bbda58ef 100644
--- a/deploy/gcore_cdn.sh
+++ b/deploy/gcore_cdn.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env sh
 
 # Here is the script to deploy the cert to G-Core CDN service (https://gcorelabs.com/ru/) using the G-Core Labs API (https://docs.gcorelabs.com/cdn/).
-# Uses command line curl for send requests and jq for parse responses.
 # Returns 0 when success.
 #
 # Written by temoffey <temofffey@gmail.com>
@@ -117,7 +116,7 @@ gcore_cdn_deploy() {
   _debug _request "$_request"
   _response=$(_post "$_request" "https://api.gcdn.co/resources/$_resourceId" '' "PUT")
   _debug _response "$_response"
-  _regex=".*\"sslData\":\([0-9]*\)}.*$"
+  _regex=".*\"sslData\":\([0-9]*\).*$"
   _debug _regex "$_regex"
   _sslDataNew=$(echo "$_response" | sed -n "s/$_regex/\1/p")
   _debug _sslDataNew "$_sslDataNew"

From ee38cccad8f76b807206165324e7bf771aa981dc Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Sun, 11 Aug 2019 11:56:59 +0800
Subject: [PATCH 022/246] sync (#2436)

* fix https://github.com/Neilpang/acme.sh/issues/2409 (#2430)

* Add variable exports for Successful Post Hook and Renew Hook calls (#2431)

* fixed json parse regex for support api gcore_cdn (#2381)
---
 acme.sh             | 10 ++++++++++
 deploy/gcore_cdn.sh |  3 +--
 dnsapi/dns_he.sh    | 12 ++++++++----
 3 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index 8452d588..4742e611 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3265,6 +3265,11 @@ _on_issue_success() {
   if [ "$_chk_post_hook" ]; then
     _info "Run post hook:'$_chk_post_hook'"
     if ! (
+      export CERT_PATH
+      export CERT_KEY_PATH
+      export CA_CERT_PATH
+      export CERT_FULLCHAIN_PATH
+      export Le_Domain="$_main_domain"
       cd "$DOMAIN_PATH" && eval "$_chk_post_hook"
     ); then
       _err "Error when run post hook."
@@ -3276,6 +3281,11 @@ _on_issue_success() {
   if [ "$IS_RENEW" ] && [ "$_chk_renew_hook" ]; then
     _info "Run renew hook:'$_chk_renew_hook'"
     if ! (
+      export CERT_PATH
+      export CERT_KEY_PATH
+      export CA_CERT_PATH
+      export CERT_FULLCHAIN_PATH
+      export Le_Domain="$_main_domain"
       cd "$DOMAIN_PATH" && eval "$_chk_renew_hook"
     ); then
       _err "Error when run renew hook."
diff --git a/deploy/gcore_cdn.sh b/deploy/gcore_cdn.sh
index e0921bcb..bbda58ef 100644
--- a/deploy/gcore_cdn.sh
+++ b/deploy/gcore_cdn.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env sh
 
 # Here is the script to deploy the cert to G-Core CDN service (https://gcorelabs.com/ru/) using the G-Core Labs API (https://docs.gcorelabs.com/cdn/).
-# Uses command line curl for send requests and jq for parse responses.
 # Returns 0 when success.
 #
 # Written by temoffey <temofffey@gmail.com>
@@ -117,7 +116,7 @@ gcore_cdn_deploy() {
   _debug _request "$_request"
   _response=$(_post "$_request" "https://api.gcdn.co/resources/$_resourceId" '' "PUT")
   _debug _response "$_response"
-  _regex=".*\"sslData\":\([0-9]*\)}.*$"
+  _regex=".*\"sslData\":\([0-9]*\).*$"
   _debug _regex "$_regex"
   _sslDataNew=$(echo "$_response" | sed -n "s/$_regex/\1/p")
   _debug _sslDataNew "$_sslDataNew"
diff --git a/dnsapi/dns_he.sh b/dnsapi/dns_he.sh
index df00c746..caa4d2c4 100755
--- a/dnsapi/dns_he.sh
+++ b/dnsapi/dns_he.sh
@@ -134,9 +134,9 @@ _find_zone() {
   _zone_ids=$(echo "$_matches" | _egrep_o "hosted_dns_zoneid=[0-9]*&" | cut -d = -f 2 | tr -d '&')
   _zone_names=$(echo "$_matches" | _egrep_o "name=.*onclick" | cut -d '"' -f 2)
   _debug2 "These are the zones on this HE account:"
-  _debug2 "$_zone_names"
+  _debug2 "_zone_names" "$_zone_names"
   _debug2 "And these are their respective IDs:"
-  _debug2 "$_zone_ids"
+  _debug2 "_zone_ids" "$_zone_ids"
   if [ -z "$_zone_names" ] || [ -z "$_zone_ids" ]; then
     _err "Can not get zone names."
     return 1
@@ -154,10 +154,14 @@ _find_zone() {
 
     _debug "Looking for zone \"${_attempted_zone}\""
 
-    line_num="$(echo "$_zone_names" | grep -n "^$_attempted_zone" | cut -d : -f 1)"
-
+    line_num="$(echo "$_zone_names" | grep -n "^$_attempted_zone\$" | _head_n 1 | cut -d : -f 1)"
+    _debug2 line_num "$line_num"
     if [ "$line_num" ]; then
       _zone_id=$(echo "$_zone_ids" | sed -n "${line_num}p")
+      if [ -z "$_zone_id" ]; then
+        _err "Can not find zone id."
+        return 1
+      fi
       _debug "Found relevant zone \"$_attempted_zone\" with id \"$_zone_id\" - will be used for domain \"$_domain\"."
       return 0
     fi

From 5bdfdfefbebd7ee4f95f7009947f56a25db07c4a Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sun, 11 Aug 2019 14:07:36 +0800
Subject: [PATCH 023/246] start 2.8.3 Forbidden sudo

---
 acme.sh | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 4742e611..72bf0700 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=2.8.2
+VER=2.8.3
 
 PROJECT_NAME="acme.sh"
 
@@ -135,6 +135,8 @@ _DNS_MANUAL_WIKI="https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode"
 
 _NOTIFY_WIKI="https://github.com/Neilpang/acme.sh/wiki/notify"
 
+_SUDO_WIKI="https://github.com/Neilpang/acme.sh/wiki/sudo"
+
 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 
 _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
@@ -6233,6 +6235,23 @@ _processAccountConf() {
 
 }
 
+_checkSudo() {
+  if [ "$SUDO_GID" ] && [ "$SUDO_COMMAND" ] && [ "$SUDO_USER" ] && [ "$SUDO_UID" ]; then
+    if [ "$SUDO_USER" = "root" ] && [ "$SUDO_UID" = "0" ]; then
+      #it's root using sudo, no matter it's using sudo or not, just fine
+      return 0
+    fi
+    if [ "$SUDO_COMMAND" = "/bin/su" ]; then
+      #it's a normal user doing "sudo su"
+      #fine
+      return 0
+    fi
+    #otherwise
+    return 1
+  fi
+  return 0
+}
+
 _process() {
   _CMD=""
   _domain=""
@@ -6761,6 +6780,14 @@ _process() {
   done
 
   if [ "${_CMD}" != "install" ]; then
+    if [ "$__INTERACTIVE" ] && ! _checkSudo; then
+      if [ -z "$FORCE" ]; then
+        #Use "echo" here, instead of _info. it's too early
+        echo "It seems that you are using sudo, please read this link first:"
+        echo "$_SUDO_WIKI"
+        return 1
+      fi
+    fi
     __initHome
     if [ "$_log" ]; then
       if [ -z "$_logfile" ]; then

From a3361806ab49043fca46f81a0edc2357b7d3947c Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Sun, 11 Aug 2019 22:43:07 +0800
Subject: [PATCH 024/246] sync (#2437)

* fix https://github.com/Neilpang/acme.sh/issues/2409 (#2430)

* Add variable exports for Successful Post Hook and Renew Hook calls (#2431)

* fixed json parse regex for support api gcore_cdn (#2381)

* start 2.8.3 Forbidden sudo
---
 acme.sh | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 4742e611..72bf0700 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=2.8.2
+VER=2.8.3
 
 PROJECT_NAME="acme.sh"
 
@@ -135,6 +135,8 @@ _DNS_MANUAL_WIKI="https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode"
 
 _NOTIFY_WIKI="https://github.com/Neilpang/acme.sh/wiki/notify"
 
+_SUDO_WIKI="https://github.com/Neilpang/acme.sh/wiki/sudo"
+
 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 
 _DNS_MANUAL_WARN="It seems that you are using dns manual mode. please take care: $_DNS_MANUAL_ERR"
@@ -6233,6 +6235,23 @@ _processAccountConf() {
 
 }
 
+_checkSudo() {
+  if [ "$SUDO_GID" ] && [ "$SUDO_COMMAND" ] && [ "$SUDO_USER" ] && [ "$SUDO_UID" ]; then
+    if [ "$SUDO_USER" = "root" ] && [ "$SUDO_UID" = "0" ]; then
+      #it's root using sudo, no matter it's using sudo or not, just fine
+      return 0
+    fi
+    if [ "$SUDO_COMMAND" = "/bin/su" ]; then
+      #it's a normal user doing "sudo su"
+      #fine
+      return 0
+    fi
+    #otherwise
+    return 1
+  fi
+  return 0
+}
+
 _process() {
   _CMD=""
   _domain=""
@@ -6761,6 +6780,14 @@ _process() {
   done
 
   if [ "${_CMD}" != "install" ]; then
+    if [ "$__INTERACTIVE" ] && ! _checkSudo; then
+      if [ -z "$FORCE" ]; then
+        #Use "echo" here, instead of _info. it's too early
+        echo "It seems that you are using sudo, please read this link first:"
+        echo "$_SUDO_WIKI"
+        return 1
+      fi
+    fi
     __initHome
     if [ "$_log" ]; then
       if [ -z "$_logfile" ]; then

From 9b173dcd7149dd9fa50d621bf21fe4a874616240 Mon Sep 17 00:00:00 2001
From: Sky Chen <icksky4@gmail.com>
Date: Thu, 15 Aug 2019 14:23:12 +0800
Subject: [PATCH 025/246] fixed #2441: dns_namesilo.sh _get_root (#2442)

fixed #2441: dns_namesilo.sh _get_root (#2442)
---
 dnsapi/dns_namesilo.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_namesilo.sh b/dnsapi/dns_namesilo.sh
index ed6d0e08..0b87b7f7 100755
--- a/dnsapi/dns_namesilo.sh
+++ b/dnsapi/dns_namesilo.sh
@@ -110,7 +110,7 @@ _get_root() {
       return 1
     fi
 
-    if _contains "$response" "$host"; then
+    if _contains "$response" "<domain>$host"; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain="$host"
       return 0

From 0b2b8b960b07232edd92fed0124a35cbfd969a87 Mon Sep 17 00:00:00 2001
From: David Kerr <david@kerr.net>
Date: Fri, 16 Aug 2019 22:56:22 -0400
Subject: [PATCH 026/246] Replace grep -o with sed

---
 dnsapi/dns_freedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 8a48cf77..ee013662 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -305,7 +305,7 @@ _freedns_domain_id() {
 
     domain_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
-      | grep -o "edit\.php?edit_domain_id=[0-9a-zA-Z]*" \
+      | sed -n 's/.*\(edit\.php?edit_domain_id=[0-9a-zA-Z]*\).*/\1/p' \
       | cut -d = -f 2)"
     # The above beauty extracts domain ID from the html page...
     # strip out all blank space and new lines. Then insert newlines
@@ -352,7 +352,7 @@ _freedns_data_id() {
     data_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
-      | grep -o "edit\.php?data_id=[0-9a-zA-Z]*" \
+      | sed -n 's/.*\(edit\.php?data_id=[0-9a-zA-Z]*\).*/\1/p' \
       | cut -d = -f 2)"
     # The above beauty extracts data ID from the html page...
     # strip out all blank space and new lines. Then insert newlines

From e0deca33d00f6e8dfd9473b1d2bbf83132fb2e72 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 14:27:23 +0200
Subject: [PATCH 027/246] Added Leaseweb API for dns-01 verification

---
 dnsapi/dns_leaseweb.sh | 130 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 130 insertions(+)
 create mode 100644 dnsapi/dns_leaseweb.sh

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
new file mode 100644
index 00000000..3edf55f0
--- /dev/null
+++ b/dnsapi/dns_leaseweb.sh
@@ -0,0 +1,130 @@
+#!/usr/bin/env sh
+
+#Author: Rolph Haspers <r.haspers@global.leaseweb.com>
+#Utilize leaseweb.com API to finish dns-01 verifications.
+#Requires a Leaseweb API Key (export LSW_Key="Your Key")
+########  Public functions #####################
+
+LSW_API="https://api.leaseweb.com/hosting/v2/domains/"
+
+#Usage: dns_leaseweb_add   _acme-challenge.www.domain.com
+dns_leaseweb_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  LSW_Key="${LSW_Key:-$(_readaccountconf_mutable LSW_Key)}"
+  if [ -z "$LSW_Key" ]; then
+    LSW_Key=""
+    _err "You don't specify Leaseweb api key yet."
+    _err "Please create your key and try again."
+    return 1
+  fi
+
+  #save the api key to the account conf file.
+  _saveaccountconf_mutable LSW_Key "$LSW_Key"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _root_domain "$_domain"
+  _debug _domain "$fulldomain"
+
+  if _lsw_api "POST"  "$_domain" "$fulldomain" "$txtvalue"; then
+    if [ "$_code" = "201" ]; then
+      _info "Added, OK"
+      return 0
+    else
+      _err "Add txt record error, invalid code. Code: $_code"
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+
+  return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_leaseweb_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  LSW_Key="${LSW_Key:-$(_readaccountconf_mutable LSW_Key)}"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  
+  _debug _root_domain "$_domain"
+  _debug _domain "$fulldomain"
+
+  if _lsw_api "DELETE"  "$_domain" "$fulldomain" "$txtvalue"; then
+    if [ "$_code" = "204" ]; then
+      _info "Deleted, OK"
+      return 0
+    else
+      _err "Delete txt record error."
+      return 1
+    fi
+  fi
+  _err "Delete txt record error."
+
+  return 1
+}
+
+
+####################  Private functions below ##################################
+# _acme-challenge.www.domain.com
+# returns
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i="$(echo "$fulldomain" | tr '.' ' ' | wc -w)"
+  i=$(_math "$i" - 1)
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+    if [ -z "$h" ]; then
+      return 1
+    fi
+    _domain="$h"
+    return 0
+  done
+  _debug "$domain not found"
+  return 1
+}
+
+_lsw_api() {
+  cmd=$1
+  domain=$2
+  fulldomain=$3
+  txtvalue=$4
+
+  # Construct the HTTP Authorization header
+  export _H2="Content-Type: application/json"
+  export _H1="X-Lsw-Auth: ${LSW_Key}"
+
+  if [ "$cmd" == "POST" ]; then
+    data="{\"name\": \"$fulldomain.\",\"type\": \"TXT\",\"content\": [\"$txtvalue\"],\"ttl\": 60}"
+	  response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"   
+    _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+	  _debug "http response code $_code"
+	  _debug response "$response"
+    return 0
+  fi
+
+  if [ "$cmd" == "DELETE" ]; then
+    response="$(_post "" "$LSW_API/$domain/resourceRecordSets/$fulldomain/TXT" "" "DELETE")"
+    _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+    _debug "http response code $_code"
+    _debug response "$response"
+    return 0
+  fi
+
+  return 1
+}
\ No newline at end of file

From 54b38086e5abc37c48dcb55ffd2f3800098dd126 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 15:39:19 +0200
Subject: [PATCH 028/246] Fix style issues

---
 dnsapi/dns_leaseweb.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 3edf55f0..61609919 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -32,7 +32,7 @@ dns_leaseweb_add() {
   _debug _root_domain "$_domain"
   _debug _domain "$fulldomain"
 
-  if _lsw_api "POST"  "$_domain" "$fulldomain" "$txtvalue"; then
+  if _lsw_api "POST" "$_domain" "$fulldomain" "$txtvalue"; then
     if [ "$_code" = "201" ]; then
       _info "Added, OK"
       return 0
@@ -63,7 +63,7 @@ dns_leaseweb_rm() {
   _debug _root_domain "$_domain"
   _debug _domain "$fulldomain"
 
-  if _lsw_api "DELETE"  "$_domain" "$fulldomain" "$txtvalue"; then
+  if _lsw_api "DELETE" "$_domain" "$fulldomain" "$txtvalue"; then
     if [ "$_code" = "204" ]; then
       _info "Deleted, OK"
       return 0
@@ -109,16 +109,16 @@ _lsw_api() {
   export _H2="Content-Type: application/json"
   export _H1="X-Lsw-Auth: ${LSW_Key}"
 
-  if [ "$cmd" == "POST" ]; then
+  if [ "$cmd" = "POST" ]; then
     data="{\"name\": \"$fulldomain.\",\"type\": \"TXT\",\"content\": [\"$txtvalue\"],\"ttl\": 60}"
-	  response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"   
+    response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"   
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
-	  _debug "http response code $_code"
-	  _debug response "$response"
+    _debug "http response code $_code"
+    _debug response "$response"
     return 0
   fi
 
-  if [ "$cmd" == "DELETE" ]; then
+  if [ "$cmd" = "DELETE" ]; then
     response="$(_post "" "$LSW_API/$domain/resourceRecordSets/$fulldomain/TXT" "" "DELETE")"
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
     _debug "http response code $_code"
@@ -127,4 +127,4 @@ _lsw_api() {
   fi
 
   return 1
-}
\ No newline at end of file
+}

From 400c31d03162a596fcbb22330e38df26b960eac0 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 16:01:51 +0200
Subject: [PATCH 029/246] Fixed another styling issue (trailing spaces)

---
 dnsapi/dns_leaseweb.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 61609919..a792290b 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -111,7 +111,7 @@ _lsw_api() {
 
   if [ "$cmd" = "POST" ]; then
     data="{\"name\": \"$fulldomain.\",\"type\": \"TXT\",\"content\": [\"$txtvalue\"],\"ttl\": 60}"
-    response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"   
+    response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
     _debug "http response code $_code"
     _debug response "$response"

From 0ac37981cbd384ddfa7ccb890ccf4facb6c396ec Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 16:04:16 +0200
Subject: [PATCH 030/246] Styling, newline removed

---
 dnsapi/dns_leaseweb.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index a792290b..17038f46 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -77,7 +77,6 @@ dns_leaseweb_rm() {
   return 1
 }
 
-
 ####################  Private functions below ##################################
 # _acme-challenge.www.domain.com
 # returns

From 4a81205e04f22f0de645d117e243794ba6ca403a Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 16:22:48 +0200
Subject: [PATCH 031/246] Styling, trailing space

---
 dnsapi/dns_leaseweb.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 17038f46..c9df4dc6 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -59,7 +59,7 @@ dns_leaseweb_rm() {
     _err "invalid domain"
     return 1
   fi
-  
+
   _debug _root_domain "$_domain"
   _debug _domain "$fulldomain"
 

From f0d6d46766c8484e32010b2dc624130650900a3c Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Mon, 19 Aug 2019 17:27:19 +0200
Subject: [PATCH 032/246] Added link to API docs

---
 dnsapi/dns_leaseweb.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index c9df4dc6..976ad5ac 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -3,6 +3,7 @@
 #Author: Rolph Haspers <r.haspers@global.leaseweb.com>
 #Utilize leaseweb.com API to finish dns-01 verifications.
 #Requires a Leaseweb API Key (export LSW_Key="Your Key")
+#See http://developer.leaseweb.com for more information.
 ########  Public functions #####################
 
 LSW_API="https://api.leaseweb.com/hosting/v2/domains/"

From 0ca46774ac207517724eb48338c04a4dbde0728a Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Mon, 2 Sep 2019 10:36:10 +0800
Subject: [PATCH 033/246] Create FUNDING.yml

---
 .github/FUNDING.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 .github/FUNDING.yml

diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 00000000..24be2c47
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,12 @@
+# These are supported funding model platforms
+
+github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
+patreon: # Replace with a single Patreon username
+open_collective: acmesh
+ko_fi: # Replace with a single Ko-fi username
+tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
+community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
+liberapay: # Replace with a single Liberapay username
+issuehunt: # Replace with a single IssueHunt username
+otechie: # Replace with a single Otechie username
+custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']

From 1081d98bf9fac753a504a78af868eca444c73be1 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 5 Sep 2019 22:05:54 +0800
Subject: [PATCH 034/246] support to specify the nginx or site conf for nginx
 mode. https://github.com/Neilpang/acme.sh/issues/2469

---
 acme.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/acme.sh b/acme.sh
index 72bf0700..3ce377e8 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2799,6 +2799,11 @@ _setNginx() {
       _debug NGINX_CONF "$NGINX_CONF"
       NGINX_CONF="$(echo "$NGINX_CONF" | cut -d = -f 2)"
       _debug NGINX_CONF "$NGINX_CONF"
+      if [ -z "$NGINX_CONF" ]; then
+        _err "Can not find nginx conf."
+        NGINX_CONF=""
+        return 1
+      fi
       if [ ! -f "$NGINX_CONF" ]; then
         _err "'$NGINX_CONF' doesn't exist."
         NGINX_CONF=""
@@ -6503,6 +6508,10 @@ _process() {
         ;;
       --nginx)
         wvalue="$NGINX"
+        if [ "$2" ] && ! _startswith "$2" "-"; then
+          wvalue="$NGINX$2"
+          shift
+        fi
         if [ -z "$_webroot" ]; then
           _webroot="$wvalue"
         else

From 6b817d4563494e64d40d403c90746c869a3db73a Mon Sep 17 00:00:00 2001
From: Phil Porada <pgporada@users.noreply.github.com>
Date: Thu, 5 Sep 2019 10:15:28 -0400
Subject: [PATCH 035/246] Set TXT record TTL to minimum possible value (#2465)

---
 dnsapi/dns_linode_v4.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index c9a83c77..ee7ee892 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -31,7 +31,8 @@ dns_linode_v4_add() {
   _payload="{
               \"type\": \"TXT\",
               \"name\": \"$_sub_domain\",
-              \"target\": \"$txtvalue\"
+              \"target\": \"$txtvalue\",
+              \"ttl_sec\": 300
             }"
 
   if _rest POST "/$_domain_id/records" "$_payload" && [ -n "$response" ]; then

From 80d63dbb7cef07b14ec05d6d017689c19aec40a2 Mon Sep 17 00:00:00 2001
From: Kent Varmedal <kent@domeneshop.no>
Date: Thu, 5 Sep 2019 16:26:28 +0200
Subject: [PATCH 036/246] Add support for Domeneshop DNS API (#2458)

* Add support for Domeneshop DNS API

* Fix double quotes after build fail

* Fixing formating errors
---
 dnsapi/dns_domeneshop.sh | 155 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 155 insertions(+)
 create mode 100644 dnsapi/dns_domeneshop.sh

diff --git a/dnsapi/dns_domeneshop.sh b/dnsapi/dns_domeneshop.sh
new file mode 100644
index 00000000..9a3791f4
--- /dev/null
+++ b/dnsapi/dns_domeneshop.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env sh
+
+DOMENESHOP_Api_Endpoint="https://api.domeneshop.no/v0"
+
+#####################  Public functions #####################
+
+# Usage: dns_domeneshop_add <full domain> <txt record>
+# Example: dns_domeneshop_add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_domeneshop_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  # Get token and secret
+  DOMENESHOP_Token="${DOMENESHOP_Token:-$(_readaccountconf_mutable DOMENESHOP_Token)}"
+  DOMENESHOP_Secret="${DOMENESHOP_Secret:-$(_readaccountconf_mutable DOMENESHOP_Secret)}"
+
+  if [ -z "$DOMENESHOP_Token" ] || [ -z "$DOMENESHOP_Secret" ]; then
+    DOMENESHOP_Token=""
+    DOMENESHOP_Secret=""
+    _err "You need to spesify a Domeneshop/Domainnameshop API Token and Secret."
+    return 1
+  fi
+
+  # Save the api token and secret.
+  _saveaccountconf_mutable DOMENESHOP_Token "$DOMENESHOP_Token"
+  _saveaccountconf_mutable DOMENESHOP_Secret "$DOMENESHOP_Secret"
+
+  # Get the domain name id
+  if ! _get_domainid "$fulldomain"; then
+    _err "Did not find domainname"
+    return 1
+  fi
+
+  # Create record
+  _domeneshop_rest POST "domains/$_domainid/dns" "{\"type\":\"TXT\",\"host\":\"$_sub_domain\",\"data\":\"$txtvalue\",\"ttl\":120}"
+}
+
+# Usage: dns_domeneshop_rm <full domain> <txt record>
+# Example: dns_domeneshop_rm _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_domeneshop_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  # Get token and secret
+  DOMENESHOP_Token="${DOMENESHOP_Token:-$(_readaccountconf_mutable DOMENESHOP_Token)}"
+  DOMENESHOP_Secret="${DOMENESHOP_Secret:-$(_readaccountconf_mutable DOMENESHOP_Secret)}"
+
+  if [ -z "$DOMENESHOP_Token" ] || [ -z "$DOMENESHOP_Secret" ]; then
+    DOMENESHOP_Token=""
+    DOMENESHOP_Secret=""
+    _err "You need to spesify a Domeneshop/Domainnameshop API Token and Secret."
+    return 1
+  fi
+
+  # Get the domain name id
+  if ! _get_domainid "$fulldomain"; then
+    _err "Did not find domainname"
+    return 1
+  fi
+
+  # Find record
+  if ! _get_recordid "$_domainid" "$_sub_domain" "$txtvalue"; then
+    _err "Did not find dns record"
+    return 1
+  fi
+
+  # Remove record
+  _domeneshop_rest DELETE "domains/$_domainid/dns/$_recordid"
+}
+
+#####################  Private functions #####################
+
+_get_domainid() {
+  domain=$1
+
+  # Get domains
+  _domeneshop_rest GET "domains"
+
+  if ! _contains "$response" "\"id\":"; then
+    _err "failed to get domain names"
+    return 1
+  fi
+
+  i=2
+  p=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug "h" "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"$h\"" >/dev/null; then
+      # We have found the domain name.
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      _domainid=$(printf "%s" "$response" | _egrep_o "[^{]*\"domain\":\"$_domain\"[^}]*" | _egrep_o "\"id\":[0-9]+" | cut -d : -f 2)
+      return 0
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_get_recordid() {
+  domainid=$1
+  subdomain=$2
+  txtvalue=$3
+
+  # Get all dns records for the domainname
+  _domeneshop_rest GET "domains/$domainid/dns"
+
+  if ! _contains "$response" "\"id\":"; then
+    _debug "No records in dns"
+    return 1
+  fi
+
+  if ! _contains "$response" "\"host\":\"$subdomain\""; then
+    _debug "Record does not exist"
+    return 1
+  fi
+
+  # Get the id of the record in question
+  _recordid=$(printf "%s" "$response" | _egrep_o "[^{]*\"host\":\"$subdomain\"[^}]*" | _egrep_o "[^{]*\"data\":\"$txtvalue\"[^}]*" | _egrep_o "\"id\":[0-9]+" | cut -d : -f 2)
+  if [ -z "$_recordid" ]; then
+    return 1
+  fi
+  return 0
+}
+
+_domeneshop_rest() {
+  method=$1
+  endpoint=$2
+  data=$3
+
+  credentials=$(printf "%b" "$DOMENESHOP_Token:$DOMENESHOP_Secret" | _base64)
+
+  export _H1="Authorization: Basic $credentials"
+  export _H2="Content-Type: application/json"
+
+  if [ "$method" != "GET" ]; then
+    response="$(_post "$data" "$DOMENESHOP_Api_Endpoint/$endpoint" "" "$method")"
+  else
+    response="$(_get "$DOMENESHOP_Api_Endpoint/$endpoint")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $endpoint"
+    return 1
+  fi
+
+  return 0
+}

From b9994e52eb24e2389ca6e29fc79046d92e57e758 Mon Sep 17 00:00:00 2001
From: fgma <30936930+fgma@users.noreply.github.com>
Date: Thu, 5 Sep 2019 16:28:47 +0200
Subject: [PATCH 037/246] Notify xmpp (#2407)

* notify via xmpp (using sendxmpp)

* fix formatting in notify/xmpp.sh

* minor cleanup
---
 notify/xmpp.sh | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 notify/xmpp.sh

diff --git a/notify/xmpp.sh b/notify/xmpp.sh
new file mode 100644
index 00000000..580f471e
--- /dev/null
+++ b/notify/xmpp.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env sh
+
+#Support xmpp via sendxmpp
+
+#XMPP_BIN="/usr/bin/sendxmpp"
+#XMPP_BIN_ARGS="-n -t --tls-ca-path=/etc/ssl/certs"
+#XMPP_TO="zzzz@example.com"
+
+xmpp_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_subject" "$_subject"
+  _debug "_content" "$_content"
+  _debug "_statusCode" "$_statusCode"
+
+  XMPP_BIN="${XMPP_BIN:-$(_readaccountconf_mutable XMPP_BIN)}"
+  if [ -n "$XMPP_BIN" ] && ! _exists "$XMPP_BIN"; then
+    _err "It seems that the command $XMPP_BIN is not in path."
+    return 1
+  fi
+  _XMPP_BIN=$(_xmpp_bin)
+  if [ -n "$XMPP_BIN" ]; then
+    _saveaccountconf_mutable XMPP_BIN "$XMPP_BIN"
+  else
+    _clearaccountconf "XMPP_BIN"
+  fi
+
+  XMPP_BIN_ARGS="${XMPP_BIN_ARGS:-$(_readaccountconf_mutable XMPP_BIN_ARGS)}"
+  if [ -n "$XMPP_BIN_ARGS" ]; then
+    _saveaccountconf_mutable XMPP_BIN_ARGS "$XMPP_BIN_ARGS"
+  else
+    _clearaccountconf "XMPP_BIN_ARGS"
+  fi
+
+  XMPP_TO="${XMPP_TO:-$(_readaccountconf_mutable XMPP_TO)}"
+  if [ -n "$XMPP_TO" ]; then
+    if ! _xmpp_valid "$XMPP_TO"; then
+      _err "It seems that the XMPP_TO=$XMPP_TO is not a valid xmpp address."
+      return 1
+    fi
+
+    _saveaccountconf_mutable XMPP_TO "$XMPP_TO"
+  fi
+
+  result=$({ _xmpp_message | eval "$(_xmpp_cmnd)"; } 2>&1)
+
+  # shellcheck disable=SC2181
+  if [ $? -ne 0 ]; then
+    _debug "xmpp send error."
+    _err "$result"
+    return 1
+  fi
+
+  _debug "xmpp send success."
+  return 0
+}
+
+_xmpp_bin() {
+  if [ -n "$XMPP_BIN" ]; then
+    _XMPP_BIN="$XMPP_BIN"
+  elif _exists "sendxmpp"; then
+    _XMPP_BIN="sendxmpp"
+  else
+    _err "Please install sendxmpp first."
+    return 1
+  fi
+
+  echo "$_XMPP_BIN"
+}
+
+_xmpp_cmnd() {
+  case $(basename "$_XMPP_BIN") in
+    sendxmpp)
+      echo "'$_XMPP_BIN' '$XMPP_TO' $XMPP_BIN_ARGS"
+      ;;
+    *)
+      _err "Command $XMPP_BIN is not supported, use sendxmpp."
+      return 1
+      ;;
+  esac
+}
+
+_xmpp_message() {
+  echo "$_subject"
+}
+
+_xmpp_valid() {
+  _contains "$1" "@"
+}

From 4bf1f579f51d7343c1b643f7bb357ba9e48d0cd6 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 16:28:57 +0200
Subject: [PATCH 038/246] Add OPNsense Bind API Support

---
 dnsapi/dns_opnsense.sh | 262 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 262 insertions(+)
 create mode 100755 dnsapi/dns_opnsense.sh

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
new file mode 100755
index 00000000..aa123541
--- /dev/null
+++ b/dnsapi/dns_opnsense.sh
@@ -0,0 +1,262 @@
+#!/usr/bin/env sh
+
+#OPNsense Bind API
+#https://docs.opnsense.org/development/api.html
+#
+#OPNs_Host="opnsense.example.com"
+#OPNs_Port="443"
+#OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
+#OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
+#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+
+########  Public functions #####################
+#Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
+#fulldomain
+#txtvalue
+dns_opnsense_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! set_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+#fulldomain
+dns_opnsense_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! rm_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+set_record() {
+  _info "Adding record"
+  fulldomain=$1
+  new_challenge=$2
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _return_str=""
+  _record_string=""
+  _build_record_string "$_domainid" "$_host" "$new_challenge"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Update
+    if _opns_rest "POST" "/record/setRecord/${_uuid}" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+
+  else
+    #create
+    if _opns_rest "POST" "/record/addRecord" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+  fi
+
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
+  then
+    _opns_rest "POST" "/service/reconfigure" "{}"
+    _debug "Record created"
+  else
+    _err "Error createing record $_record_string"
+    return 1
+  fi
+
+  return 0
+}
+
+rm_record() {
+  _info "Remove record"
+  fulldomain=$1
+  new_challenge="$2"
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Delete
+    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
+      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+        _opns_rest "POST" "/service/reconfigure" "{}"
+        _debug "Record deleted"
+      else
+        _err "Error delteting record $fulldomain"
+        return 1
+      fi
+    else
+        _err "Error delteting record $fulldomain"
+        return 1
+    fi
+  else
+    _info "Record not found, nothing to remove"
+  fi
+
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _domainid=domid
+ #_domain=domain.com
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  if _opns_rest "GET" "/domain/get"; then
+    _domain_response="$response"
+  else
+    return 1
+  fi
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+    _debug h "$h"
+    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+
+    if [ -n "$id" ];then
+      _debug id "$id"
+      _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain="${h}"
+      _domainid="${id}"
+      return 0
+    fi
+    p=$i
+    i=$(_math $i + 1)
+  done
+  _debug "$domain not found"
+
+  return 1
+}
+
+_opns_rest() {
+  method=$1
+  ep=$2
+  data=$3
+  #Percent encode user and token
+  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
+  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  export _H1="Content-Type: application/json"
+  if [ ! "$method" = "GET" ]; then
+    _debug data "$data"
+    export _H1="Content-Type: application/json"
+    response="$(_post "$data" "$opnsense_url" "" "$method")"
+  else
+    export _H1=""
+    response="$(_get "$opnsense_url")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+
+  return 0
+}
+
+_build_record_string() {
+  _record_string="{\"record\":{\"enabled\":\"1\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"}}"
+}
+
+_existingchallenge() {
+  if _opns_rest "GET" "/record/searchRecord"; then
+    _record_response="$response"
+  else
+    return 1
+  fi
+  _uuid=""
+  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+
+  if [ -n "$_uuid" ];then
+    _debug uuid "$_uuid"
+    return 0
+  fi
+  _debug "${2}.$1{1} record not found"
+
+  return 1
+}
+
+_opns_check_auth() {
+  OPNs_Host="${OPNs_Host:-$(_readaccountconf_mutable OPNs_Host)}"
+  OPNs_Port="${OPNs_Port:-$(_readaccountconf_mutable OPNs_Port)}"
+  OPNs_Key="${OPNs_Key:-$(_readaccountconf_mutable OPNs_Key)}"
+  OPNs_Token="${OPNs_Token:-$(_readaccountconf_mutable OPNs_Token)}"
+  OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
+
+  if [ -z "$OPNs_Host" ]; then
+    OPNs_Host="localhost"
+    _err "You don't specify OPNsense address."
+  fi
+
+  if [ -z "$OPNs_Port" ]; then
+    OPNs_Port="443"
+    _err "You don't specify OPNsense Port."
+  fi
+
+  if [ -z "$OPNs_Api_Insecure" ]; then
+    OPNs_Api_Insecure="0"
+  fi
+
+  if [ -z "$OPNs_Key" ]; then
+    OPNs_Key=""
+    _err "You don't specify OPNsense api key id."
+    _err "Please set you OPNs_Key and try again."
+    return 1
+  fi
+
+  if [ -z "$OPNs_Token" ]; then
+    OPNs_Token=""
+    _err "You don't specify OPNsense token."
+    _err "Please create you OPNs_Token and try again."
+    return 1
+  fi
+
+  #save the api addr and key to the account conf file.
+  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
+  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
+  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
+  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
+  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+
+  if ! _opns_rest "GET" "/general/get";then
+    _err "Can't Access OPNsense"
+    return 1
+  fi
+  return 0
+}

From dfb4883c936bed4377424aa3df3bb4a5a4576c2c Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:17:32 +0200
Subject: [PATCH 039/246] Some fixes

---
 dnsapi/dns_opnsense.sh | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index aa123541..8b7942a7 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -7,7 +7,7 @@
 #OPNs_Port="443"
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -74,8 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
-  then
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -103,8 +102,8 @@ rm_record() {
   _uuid=""
   if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
     # Delete
-    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
-      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+    if _opns_rest "POST" "/record/delRecord/${_uuid}" "\{\}"; then
+      if echo "$_return_str" | _egrep_o "\"result\":\"deleted\"" >/dev/null; then
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
@@ -112,8 +111,8 @@ rm_record() {
         return 1
       fi
     else
-        _err "Error delteting record $fulldomain"
-        return 1
+      _err "Error delteting record $fulldomain"
+      return 1
     fi
   else
     _info "Record not found, nothing to remove"
@@ -126,7 +125,7 @@ rm_record() {
 #_acme-challenge.www.domain.com
 #returns
 # _domainid=domid
- #_domain=domain.com
+#_domain=domain.com
 _get_root() {
   domain=$1
   i=2
@@ -144,9 +143,9 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
 
-    if [ -n "$id" ];then
+    if [ -n "$id" ]; then
       _debug id "$id"
       _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain="${h}"
@@ -166,8 +165,8 @@ _opns_rest() {
   ep=$2
   data=$3
   #Percent encode user and token
-  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
-  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+  key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
+  token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
   export _H1="Content-Type: application/json"
@@ -200,9 +199,9 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
 
-  if [ -n "$_uuid" ];then
+  if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"
     return 0
   fi
@@ -254,7 +253,7 @@ _opns_check_auth() {
   _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
-  if ! _opns_rest "GET" "/general/get";then
+  if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1
   fi

From ec654d2355b47571f6d6fc1cbfcc3a8e808491c3 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:24:00 +0200
Subject: [PATCH 040/246] More space removing

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 8b7942a7..ac8be539 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -74,7 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
+  if echo "$_return_str" | _egrep_o "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -143,7 +143,7 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
 
     if [ -n "$id" ]; then
       _debug id "$id"
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From bfa6e52470de86363112c4e265721cd36ed2e400 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 20:50:20 +0200
Subject: [PATCH 041/246] another whitespace

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ac8be539..ff6f8a54 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
+  _uuid=$(echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From 815a3be48b5d389eae234a5ffefb5eaa56492813 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 14 Sep 2019 11:21:55 +0800
Subject: [PATCH 042/246] fix https://github.com/Neilpang/acme.sh/issues/2478
 support `sudo -i` and `sudo -s`

---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 3ce377e8..980dc02f 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6246,8 +6246,8 @@ _checkSudo() {
       #it's root using sudo, no matter it's using sudo or not, just fine
       return 0
     fi
-    if [ "$SUDO_COMMAND" = "/bin/su" ]; then
-      #it's a normal user doing "sudo su"
+    if [ "$SUDO_COMMAND" = "/bin/su" ] || [ "$SUDO_COMMAND" = "/bin/bash" ]; then
+      #it's a normal user doing "sudo su", or `sudo -i` or `sudo -s`
       #fine
       return 0
     fi

From 950d024a117665bcc31a2417360f7b941e16bad6 Mon Sep 17 00:00:00 2001
From: Boot Lee <82433808@qq.com>
Date: Sat, 14 Sep 2019 23:06:25 +0800
Subject: [PATCH 043/246] fix grep error when txt value begin with - char
 (#2471)

---
 dnsapi/dns_ali.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ali.sh b/dnsapi/dns_ali.sh
index 543a0a54..0c2365d7 100755
--- a/dnsapi/dns_ali.sh
+++ b/dnsapi/dns_ali.sh
@@ -185,7 +185,7 @@ _clean() {
     return 1
   fi
 
-  record_id="$(echo "$response" | tr '{' "\n" | grep "$_sub_domain" | grep "$txtvalue" | tr "," "\n" | grep RecordId | cut -d '"' -f 4)"
+  record_id="$(echo "$response" | tr '{' "\n" | grep "$_sub_domain" | grep -- "$txtvalue" | tr "," "\n" | grep RecordId | cut -d '"' -f 4)"
   _debug2 record_id "$record_id"
 
   if [ -z "$record_id" ]; then

From 5723fd112fb9238cd09b6cb2737f328d35746eb7 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 24 Sep 2019 20:00:21 +0800
Subject: [PATCH 044/246] fix HEAD request against the new LE CDN. curl is
 fixed

---
 README.md | 2 +-
 acme.sh   | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ab3412c1..6c6a7436 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-[![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+<img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
 - Full ACME protocol implementation.
 - Support ACME v1 and ACME v2
diff --git a/acme.sh b/acme.sh
index 980dc02f..2cb577e1 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1697,6 +1697,9 @@ _post() {
     if [ "$HTTPS_INSECURE" ]; then
       _CURL="$_CURL --insecure  "
     fi
+    if [ "$httpmethod" = "HEAD" ]; then
+      _CURL="$_CURL -I  "
+    fi
     _debug "_CURL" "$_CURL"
     if [ "$needbase64" ]; then
       if [ "$_postContentType" ]; then

From 51b4a9e3509906b86aae4c25a350f8bcdf2d3f8c Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 24 Sep 2019 20:50:24 +0800
Subject: [PATCH 045/246] fix HEAD request against the new LE CDN. wget is
 fixed

---
 acme.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/acme.sh b/acme.sh
index 2cb577e1..cfcd3575 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1727,6 +1727,9 @@ _post() {
     if [ "$HTTPS_INSECURE" ]; then
       _WGET="$_WGET --no-check-certificate "
     fi
+    if [ "$httpmethod" = "HEAD" ]; then
+      _WGET="$_WGET --read-timeout=3.0  --tries=2  "
+    fi
     _debug "_WGET" "$_WGET"
     if [ "$needbase64" ]; then
       if [ "$httpmethod" = "POST" ]; then
@@ -1749,6 +1752,12 @@ _post() {
         else
           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
         fi
+      elif [ "$httpmethod" = "HEAD" ]; then
+        if [ "$_postContentType" ]; then
+          response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        else
+          response="$($_WGET --spider -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        fi
       else
         if [ "$_postContentType" ]; then
           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"

From 1ba4ab2bd1d200962b7d611e3aeefcf2d32cc48b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 24 Sep 2019 22:10:36 +0800
Subject: [PATCH 046/246] fix https://github.com/Neilpang/acme.sh/issues/2503

---
 acme.sh | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/acme.sh b/acme.sh
index cfcd3575..39c07cbe 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1702,16 +1702,32 @@ _post() {
     fi
     _debug "_CURL" "$_CURL"
     if [ "$needbase64" ]; then
-      if [ "$_postContentType" ]; then
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+      if [ "$body" ]; then
+        if [ "$_postContentType" ]; then
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+        else
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+        fi
       else
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+        if [ "$_postContentType" ]; then
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
+        else
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url" | _base64)"
+        fi
       fi
     else
-      if [ "$_postContentType" ]; then
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+      if [ "$body" ]; then
+        if [ "$_postContentType" ]; then
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+        else
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+        fi
       else
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+        if [ "$_postContentType" ]; then
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
+        else
+          response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" "$_post_url")"
+        fi
       fi
     fi
     _ret="$?"
@@ -1890,7 +1906,7 @@ _send_signed_request() {
       if [ "$ACME_NEW_NONCE" ]; then
         _debug2 "Get nonce with HEAD. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
         nonceurl="$ACME_NEW_NONCE"
-        if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type"; then
+        if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type" >/dev/null; then
           _headers="$(cat "$HTTP_HEADER")"
           _debug2 _headers "$_headers"
           _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"

From be0df07dfbe5e5fda893450305b9bd1cce3c7ff9 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 28 Sep 2019 10:54:31 +0800
Subject: [PATCH 047/246] fix list() performance
 https://github.com/Neilpang/acme.sh/issues/2296

---
 acme.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index 39c07cbe..0ff24c98 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4974,18 +4974,14 @@ list() {
   if [ "$_raw" ]; then
     printf "%s\n" "Main_Domain${_sep}KeyLength${_sep}SAN_Domains${_sep}Created${_sep}Renew"
     for di in "${CERT_HOME}"/*.*/; do
-      if ! [ -d "$di" ]; then
-        _debug "Not directory, skip: $di"
-        continue
-      fi
       d=$(basename "$di")
       _debug d "$d"
       (
         if _endswith "$d" "$ECC_SUFFIX"; then
-          _isEcc=$(echo "$d" | cut -d "$ECC_SEP" -f 2)
+          _isEcc="ecc"
           d=$(echo "$d" | cut -d "$ECC_SEP" -f 1)
         fi
-        _initpath "$d" "$_isEcc"
+        DOMAIN_CONF="$di/$d.conf"
         if [ -f "$DOMAIN_CONF" ]; then
           . "$DOMAIN_CONF"
           printf "%s\n" "$Le_Domain${_sep}\"$Le_Keylength\"${_sep}$Le_Alt${_sep}$Le_CertCreateTimeStr${_sep}$Le_NextRenewTimeStr"

From 10eec7d48c11e91e988be335f5bd4989b628aadb Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 3 Oct 2019 20:37:46 +0800
Subject: [PATCH 048/246] support google dns

---
 acme.sh | 55 +++++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 51 insertions(+), 4 deletions(-)

diff --git a/acme.sh b/acme.sh
index 0ff24c98..bded4ada 100755
--- a/acme.sh
+++ b/acme.sh
@@ -90,6 +90,9 @@ DEBUG_LEVEL_3=3
 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
 DEBUG_LEVEL_NONE=0
 
+DOH_CLOUDFLARE=1
+DOH_GOOGLE=2
+
 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
 
 SYSLOG_ERROR="user.error"
@@ -3636,7 +3639,7 @@ __trigger_validation() {
 }
 
 #endpoint  domain type
-_ns_lookup() {
+_ns_lookup_impl() {
   _ns_ep="$1"
   _ns_domain="$2"
   _ns_type="$3"
@@ -3660,7 +3663,7 @@ _ns_lookup_cf() {
   _cf_ld="$1"
   _cf_ld_type="$2"
   _cf_ep="https://cloudflare-dns.com/dns-query"
-  _ns_lookup "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
 }
 
 #domain, type
@@ -3673,6 +3676,44 @@ _ns_purge_cf() {
   _debug2 response "$response"
 }
 
+#checks if cf server is available
+_ns_is_available_cf() {
+  if _get "https://cloudflare-dns.com"; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+#domain, type
+_ns_lookup_google() {
+  _cf_ld="$1"
+  _cf_ld_type="$2"
+  _cf_ep="https://dns.google/resolve"
+  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+}
+
+#domain, type
+_ns_lookup() {
+  if [ -z "$DOH_USE" ]; then
+    _debug "Detect dns server first."
+    if _ns_is_available_cf; then
+      _debug "Use cloudflare doh server"
+      export DOH_USE=$DOH_CLOUDFLARE
+    else
+      _debug "Use google doh server"
+      export DOH_USE=$DOH_GOOGLE
+    fi
+  fi
+
+  if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+    _ns_lookup_cf "$@"
+  else
+    _ns_lookup_google "$@"
+  fi
+
+}
+
 #txtdomain, alias, txt
 __check_txt() {
   _c_txtdomain="$1"
@@ -3681,7 +3722,7 @@ __check_txt() {
   _debug "_c_txtdomain" "$_c_txtdomain"
   _debug "_c_aliasdomain" "$_c_aliasdomain"
   _debug "_c_txt" "$_c_txt"
-  _answers="$(_ns_lookup_cf "$_c_aliasdomain" TXT)"
+  _answers="$(_ns_lookup "$_c_aliasdomain" TXT)"
   _contains "$_answers" "$_c_txt"
 
 }
@@ -3690,7 +3731,13 @@ __check_txt() {
 __purge_txt() {
   _p_txtdomain="$1"
   _debug _p_txtdomain "$_p_txtdomain"
-  _ns_purge_cf "$_p_txtdomain" "TXT"
+  if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+    _ns_purge_cf "$_p_txtdomain" "TXT"
+  else
+    _debug "no purge api for google dns api, just sleep 5 secs"
+    _sleep 5
+  fi
+
 }
 
 #wait and check each dns entries

From b4a62bfa300b0d4c95a3f279b626227e50a8f0a5 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 3 Oct 2019 20:51:06 +0800
Subject: [PATCH 049/246] let's start 2.8.4

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index bded4ada..041b5b44 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=2.8.3
+VER=2.8.4
 
 PROJECT_NAME="acme.sh"
 

From 477a04760c8558d5385736a6537f3313f2f11b96 Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Thu, 3 Oct 2019 21:00:30 +0800
Subject: [PATCH 050/246] support google public dns (#2522)

* support google dns

* let's start 2.8.4
---
 acme.sh | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 52 insertions(+), 5 deletions(-)

diff --git a/acme.sh b/acme.sh
index 0ff24c98..041b5b44 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=2.8.3
+VER=2.8.4
 
 PROJECT_NAME="acme.sh"
 
@@ -90,6 +90,9 @@ DEBUG_LEVEL_3=3
 DEBUG_LEVEL_DEFAULT=$DEBUG_LEVEL_1
 DEBUG_LEVEL_NONE=0
 
+DOH_CLOUDFLARE=1
+DOH_GOOGLE=2
+
 HIDDEN_VALUE="[hidden](please add '--output-insecure' to see this value)"
 
 SYSLOG_ERROR="user.error"
@@ -3636,7 +3639,7 @@ __trigger_validation() {
 }
 
 #endpoint  domain type
-_ns_lookup() {
+_ns_lookup_impl() {
   _ns_ep="$1"
   _ns_domain="$2"
   _ns_type="$3"
@@ -3660,7 +3663,7 @@ _ns_lookup_cf() {
   _cf_ld="$1"
   _cf_ld_type="$2"
   _cf_ep="https://cloudflare-dns.com/dns-query"
-  _ns_lookup "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
 }
 
 #domain, type
@@ -3673,6 +3676,44 @@ _ns_purge_cf() {
   _debug2 response "$response"
 }
 
+#checks if cf server is available
+_ns_is_available_cf() {
+  if _get "https://cloudflare-dns.com"; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+#domain, type
+_ns_lookup_google() {
+  _cf_ld="$1"
+  _cf_ld_type="$2"
+  _cf_ep="https://dns.google/resolve"
+  _ns_lookup_impl "$_cf_ep" "$_cf_ld" "$_cf_ld_type"
+}
+
+#domain, type
+_ns_lookup() {
+  if [ -z "$DOH_USE" ]; then
+    _debug "Detect dns server first."
+    if _ns_is_available_cf; then
+      _debug "Use cloudflare doh server"
+      export DOH_USE=$DOH_CLOUDFLARE
+    else
+      _debug "Use google doh server"
+      export DOH_USE=$DOH_GOOGLE
+    fi
+  fi
+
+  if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+    _ns_lookup_cf "$@"
+  else
+    _ns_lookup_google "$@"
+  fi
+
+}
+
 #txtdomain, alias, txt
 __check_txt() {
   _c_txtdomain="$1"
@@ -3681,7 +3722,7 @@ __check_txt() {
   _debug "_c_txtdomain" "$_c_txtdomain"
   _debug "_c_aliasdomain" "$_c_aliasdomain"
   _debug "_c_txt" "$_c_txt"
-  _answers="$(_ns_lookup_cf "$_c_aliasdomain" TXT)"
+  _answers="$(_ns_lookup "$_c_aliasdomain" TXT)"
   _contains "$_answers" "$_c_txt"
 
 }
@@ -3690,7 +3731,13 @@ __check_txt() {
 __purge_txt() {
   _p_txtdomain="$1"
   _debug _p_txtdomain "$_p_txtdomain"
-  _ns_purge_cf "$_p_txtdomain" "TXT"
+  if [ "$DOH_USE" = "$DOH_CLOUDFLARE" ] || [ -z "$DOH_USE" ]; then
+    _ns_purge_cf "$_p_txtdomain" "TXT"
+  else
+    _debug "no purge api for google dns api, just sleep 5 secs"
+    _sleep 5
+  fi
+
 }
 
 #wait and check each dns entries

From 683592fa867ef034afea8036096f96f4f58ea00a Mon Sep 17 00:00:00 2001
From: jess <jessachandler@gmail.com>
Date: Thu, 3 Oct 2019 06:01:05 -0700
Subject: [PATCH 051/246] Added financial contributors to the README (#2513)

---
 README.md | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 6c6a7436..faaf9aa9 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-<img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> <img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
 - Full ACME protocol implementation.
 - Support ACME v1 and ACME v2
@@ -451,6 +451,36 @@ TODO:
 2. ACME protocol: https://github.com/ietf-wg-acme/acme
 
 
+## Contributors
+
+### Code Contributors
+
+This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
+<a href="https://github.com/Neilpang/acme.sh/graphs/contributors"><img src="https://opencollective.com/acmesh/contributors.svg?width=890&button=false" /></a>
+
+### Financial Contributors
+
+Become a financial contributor and help us sustain our community. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+#### Individuals
+
+<a href="https://opencollective.com/acmesh"><img src="https://opencollective.com/acmesh/individuals.svg?width=890"></a>
+
+#### Organizations
+
+Support this project with your organization. Your logo will show up here with a link to your website. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+<a href="https://opencollective.com/acmesh/organization/0/website"><img src="https://opencollective.com/acmesh/organization/0/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/1/website"><img src="https://opencollective.com/acmesh/organization/1/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/2/website"><img src="https://opencollective.com/acmesh/organization/2/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/3/website"><img src="https://opencollective.com/acmesh/organization/3/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/4/website"><img src="https://opencollective.com/acmesh/organization/4/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/5/website"><img src="https://opencollective.com/acmesh/organization/5/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/6/website"><img src="https://opencollective.com/acmesh/organization/6/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/7/website"><img src="https://opencollective.com/acmesh/organization/7/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/8/website"><img src="https://opencollective.com/acmesh/organization/8/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/9/website"><img src="https://opencollective.com/acmesh/organization/9/avatar.svg"></a>
+
 # 19. License & Others
 
 License is GPLv3

From 8ef5daa8070d8c8e2d71b366f14d498c27a74261 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 3 Oct 2019 21:14:11 +0800
Subject: [PATCH 052/246] minor, update link

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index faaf9aa9..d5012d68 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> <img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
 - Full ACME protocol implementation.
 - Support ACME v1 and ACME v2

From 54143ae6d40ba8845de392ab8350c525f47a9417 Mon Sep 17 00:00:00 2001
From: neil <8305679+Neilpang@users.noreply.github.com>
Date: Thu, 3 Oct 2019 21:15:32 +0800
Subject: [PATCH 053/246] sync (#2523)

sync
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index faaf9aa9..d5012d68 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> <img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
 - Full ACME protocol implementation.
 - Support ACME v1 and ACME v2

From 72d800ed1098a77f565c14691f164be8ccab969b Mon Sep 17 00:00:00 2001
From: Michael Braunoeder <mib@nic.at>
Date: Sat, 5 Oct 2019 05:47:57 +0200
Subject: [PATCH 054/246] [DNSAPI] add dns_rcode0.sh - Support for
 https://my.rcodezero.at/api-doc (#2489)

* first version dns_rcode0.sh

* fixed URLs for ACME calls

* fixed challenge remove

* read & write Token/URL at rm too

* make info messages debug

* typos fixed

* update rrset only if existing challenge is found

* polish error messages and make "detect root zone" scaleable

* fixed formating issues

* code cleanup, remove some unneeded functions

* removed empty lines

* save rcode0 url only if not default
---
 dnsapi/dns_rcode0.sh | 224 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 224 insertions(+)
 create mode 100755 dnsapi/dns_rcode0.sh

diff --git a/dnsapi/dns_rcode0.sh b/dnsapi/dns_rcode0.sh
new file mode 100755
index 00000000..9ed20e68
--- /dev/null
+++ b/dnsapi/dns_rcode0.sh
@@ -0,0 +1,224 @@
+#!/usr/bin/env sh
+
+#Rcode0 API Integration
+#https://my.rcodezero.at/api-doc
+#
+# log into https://my.rcodezero.at/enableapi and  get your ACME API Token (the ACME API token has limited 
+# access to the REST calls needed for acme.sh only)
+#
+#RCODE0_URL="https://my.rcodezero.at"
+#RCODE0_API_TOKEN="0123456789ABCDEF"
+#RCODE0_TTL=60
+
+DEFAULT_RCODE0_URL="https://my.rcodezero.at"
+DEFAULT_RCODE0_TTL=60
+
+########  Public functions #####################
+#Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
+#fulldomain
+#txtvalue
+dns_rcode0_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  RCODE0_API_TOKEN="${RCODE0_API_TOKEN:-$(_readaccountconf_mutable RCODE0_API_TOKEN)}"
+  RCODE0_URL="${RCODE0_URL:-$(_readaccountconf_mutable RCODE0_URL)}"
+  RCODE0_TTL="${RCODE0_TTL:-$(_readaccountconf_mutable RCODE0_TTL)}"
+
+  if [ -z "$RCODE0_URL" ]; then
+    RCODE0_URL="$DEFAULT_RCODE0_URL"
+  fi
+
+  if [ -z "$RCODE0_API_TOKEN" ]; then
+    RCODE0_API_TOKEN=""
+    _err "Missing Rcode0 ACME API Token."
+    _err "Please login and create your token at httsp://my.rcodezero.at/enableapi and try again."
+    return 1
+  fi
+
+  if [ -z "$RCODE0_TTL" ]; then
+    RCODE0_TTL="$DEFAULT_RCODE0_TTL"
+  fi
+
+  #save the token to the account conf file.
+  _saveaccountconf_mutable RCODE0_API_TOKEN "$RCODE0_API_TOKEN"
+
+  if [ "$RCODE0_URL" != "$DEFAULT_RCODE0_URL" ]; then
+    _saveaccountconf_mutable RCODE0_URL "$RCODE0_URL"
+  fi
+
+  if [ "$RCODE0_TTL" != "$DEFAULT_RCODE0_TTL" ]; then
+    _saveaccountconf_mutable RCODE0_TTL "$RCODE0_TTL"
+  fi
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "No 'MASTER' zone for $fulldomain found at RcodeZero Anycast."
+    return 1
+  fi
+  _debug _domain "$_domain"
+
+  _debug "Adding record"
+
+  _record_string=""
+  _build_record_string "$txtvalue"
+  _list_existingchallenges
+  for oldchallenge in $_existing_challenges; do
+    _build_record_string "$oldchallenge"
+  done
+
+  _debug "Challenges: $_existing_challenges"
+
+  if [ -z "$_existing_challenges" ]; then
+    if ! _rcode0_rest "PATCH" "/api/v1/acme/zones/$_domain/rrsets" "[{\"changetype\": \"add\", \"name\": \"$fulldomain.\", \"type\": \"TXT\", \"ttl\": $RCODE0_TTL, \"records\": [$_record_string]}]"; then
+      _err "Add txt record error."
+      return 1
+    fi
+  else
+    # try update in case a records exists (need for wildcard certs)
+    if ! _rcode0_rest "PATCH" "/api/v1/acme/zones/$_domain/rrsets" "[{\"changetype\": \"update\", \"name\": \"$fulldomain.\", \"type\": \"TXT\", \"ttl\": $RCODE0_TTL, \"records\": [$_record_string]}]"; then
+      _err "Set txt record error."
+      return 1
+    fi
+  fi
+
+  return 0
+}
+
+#fulldomain txtvalue
+dns_rcode0_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  RCODE0_API_TOKEN="${RCODE0_API_TOKEN:-$(_readaccountconf_mutable RCODE0_API_TOKEN)}"
+  RCODE0_URL="${RCODE0_URL:-$(_readaccountconf_mutable RCODE0_URL)}"
+  RCODE0_TTL="${RCODE0_TTL:-$(_readaccountconf_mutable RCODE0_TTL)}"
+
+  if [ -z "$RCODE0_URL" ]; then
+    RCODE0_URL="$DEFAULT_RCODE0_URL"
+  fi
+
+  if [ -z "$RCODE0_API_TOKEN" ]; then
+    RCODE0_API_TOKEN=""
+    _err "Missing Rcode0 API Token."
+    _err "Please login and create your token at httsp://my.rcodezero.at/enableapi and try again."
+    return 1
+  fi
+
+  #save the api addr and key to the account conf file.
+  _saveaccountconf_mutable RCODE0_URL "$RCODE0_URL"
+  _saveaccountconf_mutable RCODE0_API_TOKEN "$RCODE0_API_TOKEN"
+
+  if [ "$RCODE0_TTL" != "$DEFAULT_RCODE0_TTL" ]; then
+    _saveaccountconf_mutable RCODE0_TTL "$RCODE0_TTL"
+  fi
+
+  if [ -z "$RCODE0_TTL" ]; then
+    RCODE0_TTL="$DEFAULT_RCODE0_TTL"
+  fi
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug "Remove record"
+
+  #Enumerate existing acme challenges
+  _list_existingchallenges
+
+  if _contains "$_existing_challenges" "$txtvalue"; then
+    #Delete all challenges (PowerDNS API does not allow to delete content)
+    if ! _rcode0_rest "PATCH" "/api/v1/acme/zones/$_domain/rrsets" "[{\"changetype\": \"delete\", \"name\": \"$fulldomain.\", \"type\": \"TXT\"}]"; then
+      _err "Delete txt record error."
+      return 1
+    fi
+    _record_string=""
+    #If the only existing challenge was the challenge to delete: nothing to do
+    if ! [ "$_existing_challenges" = "$txtvalue" ]; then
+      for oldchallenge in $_existing_challenges; do
+        #Build up the challenges to re-add, ommitting the one what should be deleted
+        if ! [ "$oldchallenge" = "$txtvalue" ]; then
+          _build_record_string "$oldchallenge"
+        fi
+      done
+      #Recreate the existing challenges
+      if ! _rcode0_rest "PATCH" "/api/v1/acme/zones/$_domain/rrsets" "[{\"changetype\": \"update\", \"name\": \"$fulldomain.\", \"type\": \"TXT\", \"ttl\": $RCODE0_TTL, \"records\": [$_record_string]}]"; then
+        _err "Set txt record error."
+        return 1
+      fi
+    fi
+  else
+    _info "Record not found, nothing to remove"
+  fi
+
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+
+    _debug "try to find: $h"
+    if _rcode0_rest "GET" "/api/v1/acme/zones/$h"; then
+      if [ "$response" = "[\"found\"]" ]; then
+        _domain="$h"
+        if [ -z "$h" ]; then
+          _domain="=2E"
+        fi
+        return 0
+      elif [ "$response" = "[\"not a master domain\"]" ]; then
+        return 1
+      fi
+    fi
+
+    if [ -z "$h" ]; then
+      return 1
+    fi
+    i=$(_math $i + 1)
+  done
+  _debug "no matching domain for $domain found"
+
+  return 1
+}
+
+_rcode0_rest() {
+  method=$1
+  ep=$2
+  data=$3
+
+  export _H1="Authorization: Bearer $RCODE0_API_TOKEN"
+
+  if [ ! "$method" = "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$RCODE0_URL$ep" "" "$method")"
+  else
+    response="$(_get "$RCODE0_URL$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+
+  return 0
+}
+
+_build_record_string() {
+  _record_string="${_record_string:+${_record_string}, }{\"content\": \"\\\"${1}\\\"\", \"disabled\": false}"
+}
+
+_list_existingchallenges() {
+  _rcode0_rest "GET" "/api/v1/acme/zones/$_domain/rrsets"
+  _existing_challenges=$(echo "$response" | _normalizeJson | _egrep_o "\"name\":\"${fulldomain}[^]]*}" | _egrep_o 'content\":\"\\"[^\\]*' | sed -n 's/^content":"\\"//p')
+  _debug2 "$_existing_challenges"
+}

From 1e7534b9d7a4e629f46c6eb9995db20fcf962d80 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 5 Oct 2019 11:59:04 +0800
Subject: [PATCH 055/246] fix
 https://github.com/Neilpang/acme.sh/issues/2518#issuecomment-538474232

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 041b5b44..cac16d35 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3678,7 +3678,7 @@ _ns_purge_cf() {
 
 #checks if cf server is available
 _ns_is_available_cf() {
-  if _get "https://cloudflare-dns.com"; then
+  if _get "https://cloudflare-dns.com" >/dev/null 2>&1; then
     return 0
   else
     return 1

From ac9f6e3a4135dbc008c4e22af7f649d139690918 Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <hsu@peterdavehello.org>
Date: Sat, 5 Oct 2019 21:06:58 +0800
Subject: [PATCH 056/246] Remove trailing spaces in text files

This issue in the shell scripts will also be detected in the stable
version of shfmt(we are currently using an ancient pre-release of shfmt)
---
 .github/ISSUE_TEMPLATE.md |  2 +-
 .travis.yml               |  4 ++--
 acme.sh                   |  4 ++--
 deploy/qiniu.sh           |  2 +-
 deploy/routeros.sh        |  2 +-
 deploy/vault_cli.sh       |  4 ++--
 dnsapi/dns_da.sh          |  2 +-
 dnsapi/dns_doapi.sh       |  6 +++---
 dnsapi/dns_durabledns.sh  | 10 +++++-----
 dnsapi/dns_euserv.sh      |  2 +-
 dnsapi/dns_freedns.sh     |  2 +-
 dnsapi/dns_me.sh          |  2 +-
 dnsapi/dns_namecheap.sh   |  6 +++---
 dnsapi/dns_nsupdate.sh    |  4 ++--
 dnsapi/dns_rcode0.sh      |  2 +-
 15 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
index 189155e1..53112c6f 100644
--- a/.github/ISSUE_TEMPLATE.md
+++ b/.github/ISSUE_TEMPLATE.md
@@ -5,7 +5,7 @@
 如何调试 https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
 
 If it is a bug report:
-- make sure you are able to repro it on the latest released version. 
+- make sure you are able to repro it on the latest released version.
 You can install the latest version by: `acme.sh --upgrade`
 
 - Search the existing issues.
diff --git a/.travis.yml b/.travis.yml
index 04de1934..e77eb32c 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -34,5 +34,5 @@ script:
 
 matrix:
   fast_finish: true
-  
-  
+
+
diff --git a/acme.sh b/acme.sh
index cac16d35..e060e334 100755
--- a/acme.sh
+++ b/acme.sh
@@ -178,7 +178,7 @@ _printargs() {
     printf -- "%s" "$1='$2'"
   fi
   printf "\n"
-  # return the saved exit status 
+  # return the saved exit status
   return "$_exitstatus"
 }
 
@@ -6215,7 +6215,7 @@ Parameters:
   --branch, -b                      Only valid for '--upgrade' command, specifies the branch name to upgrade to.
 
   --notify-level  0|1|2|3           Set the notification level:  Default value is $NOTIFY_LEVEL_DEFAULT.
-                                     0: disabled, no notification will be sent. 
+                                     0: disabled, no notification will be sent.
                                      1: send notifications only when there is an error.
                                      2: send notifications when a cert is successfully renewed, or there is an error.
                                      3: send notifications when a cert is skipped, renewed, or error.
diff --git a/deploy/qiniu.sh b/deploy/qiniu.sh
index e46e6fb3..13b09651 100644
--- a/deploy/qiniu.sh
+++ b/deploy/qiniu.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-# Script to create certificate to qiniu.com 
+# Script to create certificate to qiniu.com
 #
 # This deployment required following variables
 # export QINIU_AK="QINIUACCESSKEY"
diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index 21c9196f..70fe70a3 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -85,7 +85,7 @@ routeros_deploy() {
   scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
   _info "Trying to push cert '$_cfullchain' to router"
   scp "$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer"
-  DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive 
+  DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive
 source=\"## generated by routeros deploy script in acme.sh
 \n/certificate remove [ find name=$_cdomain.cer_0 ]
 \n/certificate remove [ find name=$_cdomain.cer_1 ]
diff --git a/deploy/vault_cli.sh b/deploy/vault_cli.sh
index b93fdd51..5395d87e 100644
--- a/deploy/vault_cli.sh
+++ b/deploy/vault_cli.sh
@@ -2,10 +2,10 @@
 
 # Here is a script to deploy cert to hashicorp vault
 # (https://www.vaultproject.io/)
-# 
+#
 # it requires the vault binary to be available in PATH, and the following
 # environment variables:
-# 
+#
 # VAULT_PREFIX - this contains the prefix path in vault
 # VAULT_ADDR - vault requires this to find your vault server
 #
diff --git a/dnsapi/dns_da.sh b/dnsapi/dns_da.sh
index 7755c7e1..4e9c4ef0 100755
--- a/dnsapi/dns_da.sh
+++ b/dnsapi/dns_da.sh
@@ -9,7 +9,7 @@
 #
 # User must provide login data and URL to DirectAdmin incl. port.
 # You can create login key, by using the Login Keys function
-# ( https://da.example.com:8443/CMD_LOGIN_KEYS ), which only has access to 
+# ( https://da.example.com:8443/CMD_LOGIN_KEYS ), which only has access to
 # - CMD_API_DNS_CONTROL
 # - CMD_API_SHOW_DOMAINS
 #
diff --git a/dnsapi/dns_doapi.sh b/dnsapi/dns_doapi.sh
index 135f0b03..a001d52c 100755
--- a/dnsapi/dns_doapi.sh
+++ b/dnsapi/dns_doapi.sh
@@ -1,11 +1,11 @@
 #!/usr/bin/env sh
 
 # Official Let's Encrypt API for do.de / Domain-Offensive
-# 
+#
 # This is different from the dns_do adapter, because dns_do is only usable for enterprise customers
 # This API is also available to private customers/individuals
-# 
-# Provide the required LetsEncrypt token like this: 
+#
+# Provide the required LetsEncrypt token like this:
 # DO_LETOKEN="FmD408PdqT1E269gUK57"
 
 DO_API="https://www.do.de/api/letsencrypt"
diff --git a/dnsapi/dns_durabledns.sh b/dnsapi/dns_durabledns.sh
index 9a05eb32..677ae24d 100644
--- a/dnsapi/dns_durabledns.sh
+++ b/dnsapi/dns_durabledns.sh
@@ -147,11 +147,11 @@ _dd_soap() {
 
   # build SOAP XML
   _xml='<?xml version="1.0" encoding="utf-8"?>
-<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" 
-xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" 
-xmlns:tns="urn:'$_urn'" 
-xmlns:types="urn:'$_urn'/encodedTypes" 
-xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
+<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
+xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
+xmlns:tns="urn:'$_urn'"
+xmlns:types="urn:'$_urn'/encodedTypes"
+xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xmlns:xsd="http://www.w3.org/2001/XMLSchema">
   <soap:Body soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">'"$body"'</soap:Body>
 </soap:Envelope>'
diff --git a/dnsapi/dns_euserv.sh b/dnsapi/dns_euserv.sh
index 38101565..cfb4b814 100644
--- a/dnsapi/dns_euserv.sh
+++ b/dnsapi/dns_euserv.sh
@@ -127,7 +127,7 @@ dns_euserv_rm() {
   else
     # find XML block where txtvalue is in. The record_id is allways prior this line!
     _endLine=$(echo "$response" | grep -n '>dns_record_content<.*>'"$txtvalue"'<' | cut -d ':' -f 1)
-    # record_id is the last <name> Tag with a number before the row _endLine, identified by </name><value><struct> 
+    # record_id is the last <name> Tag with a number before the row _endLine, identified by </name><value><struct>
     _record_id=$(echo "$response" | sed -n '1,'"$_endLine"'p' | grep '</name><value><struct>' | _tail_n 1 | sed 's/.*<name>\([0-9]*\)<\/name>.*/\1/')
     _info "Deleting record"
     _euserv_delete_record "$_record_id"
diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index e76e6495..29b18921 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -359,7 +359,7 @@ _freedns_data_id() {
     # before each table row <tr>
     # search for the record type withing each row (e.g. TXT)
     # search for the domain within each row (which is within a <a..>
-    # </a> anchor. And finally extract the domain ID.         
+    # </a> anchor. And finally extract the domain ID.
     if [ -n "$data_id" ]; then
       printf "%s" "$data_id"
       return 0
diff --git a/dnsapi/dns_me.sh b/dnsapi/dns_me.sh
index 382eeedd..98a58411 100644
--- a/dnsapi/dns_me.sh
+++ b/dnsapi/dns_me.sh
@@ -2,7 +2,7 @@
 
 # bug reports to dev@1e.ca
 
-# ME_Key=qmlkdjflmkqdjf	
+# ME_Key=qmlkdjflmkqdjf
 # ME_Secret=qmsdlkqmlksdvnnpae
 
 ME_Api=https://api.dnsmadeeasy.com/V2.0/dns/managed
diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index a82e12d7..2e389265 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -3,10 +3,10 @@
 # Namecheap API
 # https://www.namecheap.com/support/api/intro.aspx
 #
-# Requires Namecheap API key set in 
-#NAMECHEAP_API_KEY, 
+# Requires Namecheap API key set in
+#NAMECHEAP_API_KEY,
 #NAMECHEAP_USERNAME,
-#NAMECHEAP_SOURCEIP 
+#NAMECHEAP_SOURCEIP
 # Due to Namecheap's API limitation all the records of your domain will be read and re applied, make sure to have a backup of your records you could apply if any issue would arise.
 
 ########  Public functions #####################
diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index dfb3672a..cd4b7140 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -27,7 +27,7 @@ dns_nsupdate_add() {
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
   if [ -z "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
+server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
@@ -64,7 +64,7 @@ dns_nsupdate_rm() {
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
   if [ -z "${NSUPDATE_ZONE}" ]; then
     nsupdate -k "${NSUPDATE_KEY}" $nsdebug <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT} 
+server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
 update delete ${fulldomain}. txt
 send
 EOF
diff --git a/dnsapi/dns_rcode0.sh b/dnsapi/dns_rcode0.sh
index 9ed20e68..d3f7f219 100755
--- a/dnsapi/dns_rcode0.sh
+++ b/dnsapi/dns_rcode0.sh
@@ -3,7 +3,7 @@
 #Rcode0 API Integration
 #https://my.rcodezero.at/api-doc
 #
-# log into https://my.rcodezero.at/enableapi and  get your ACME API Token (the ACME API token has limited 
+# log into https://my.rcodezero.at/enableapi and  get your ACME API Token (the ACME API token has limited
 # access to the REST calls needed for acme.sh only)
 #
 #RCODE0_URL="https://my.rcodezero.at"

From dd156d06896c57a2af0f3bd4bb1dffba748dbc2e Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <hsu@peterdavehello.org>
Date: Sat, 5 Oct 2019 21:13:23 +0800
Subject: [PATCH 057/246] Use shallow clone to speed up git clone on Travis CI

Shallow clone is faster than a normal one, there is no need to clone the
whole history of a repository when we only needs its latest or certain
state of commit.
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 04de1934..5f0ce0c4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -28,7 +28,7 @@ script:
   - if [ "$TRAVIS_OS_NAME" = "linux" ]; then shellcheck -V ; fi
   - if [ "$TRAVIS_OS_NAME" = "linux" ]; then shellcheck -e SC2181 **/*.sh && echo "shellcheck OK" ; fi
   - cd ..
-  - git clone https://github.com/Neilpang/acmetest.git && cp -r acme.sh acmetest/ && cd acmetest
+  - git clone --depth 1 https://github.com/Neilpang/acmetest.git && cp -r acme.sh acmetest/ && cd acmetest
   - if [ "$TRAVIS_OS_NAME" = "linux" -a "$NGROK_TOKEN" ]; then sudo TEST_LOCAL="$TEST_LOCAL" NGROK_TOKEN="$NGROK_TOKEN" ./rundocker.sh testplat ubuntu:latest ; fi
   - if [ "$TRAVIS_OS_NAME" = "osx" -a "$NGROK_TOKEN" ]; then sudo TEST_LOCAL="$TEST_LOCAL" NGROK_TOKEN="$NGROK_TOKEN" ACME_OPENSSL_BIN="$ACME_OPENSSL_BIN" ./letest.sh ; fi
 

From bc396e7a90e05704eddf12d728809e72ce77d5dd Mon Sep 17 00:00:00 2001
From: Vadim Kalinnikov <moose@fix.ru>
Date: Sun, 6 Oct 2019 14:38:26 +0300
Subject: [PATCH 058/246] Small fix in dns_vultr.sh

---
 dnsapi/dns_vultr.sh | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_vultr.sh b/dnsapi/dns_vultr.sh
index f15e7c49..0dce2ca1 100644
--- a/dnsapi/dns_vultr.sh
+++ b/dnsapi/dns_vultr.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/bin/bash
 
 #
 #VULTR_API_KEY=000011112222333344445555666677778888
@@ -106,9 +106,9 @@ _get_root() {
   domain=$1
   i=1
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
-    _debug h "$h"
-    if [ -z "$h" ]; then
+    _domain=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$_domain"
+    if [ -z "$_domain" ]; then
       return 1
     fi
 
@@ -119,11 +119,9 @@ _get_root() {
     if printf "%s\n" "$response" | grep '^\[.*\]' >/dev/null; then
       if _contains "$response" "\"domain\":\"$_domain\""; then
         _sub_domain="$(echo "$fulldomain" | sed "s/\\.$_domain\$//")"
-        _domain=$_domain
         return 0
       else
-        _err 'Invalid domain'
-        return 1
+        _debug "Go to next level of $_domain"
       fi
     else
       _err "$response"

From e484f32b1abe2fea12a4b5fb9d13e7eb23996f9a Mon Sep 17 00:00:00 2001
From: Vadim Kalinnikov <moose@fix.ru>
Date: Sun, 6 Oct 2019 14:40:57 +0300
Subject: [PATCH 059/246] - Return shell detect via env

---
 dnsapi/dns_vultr.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_vultr.sh b/dnsapi/dns_vultr.sh
index 0dce2ca1..c7b52e84 100644
--- a/dnsapi/dns_vultr.sh
+++ b/dnsapi/dns_vultr.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env sh
 
 #
 #VULTR_API_KEY=000011112222333344445555666677778888

From 65c950e1a41562b9eca0b23b04a260b18c3335d4 Mon Sep 17 00:00:00 2001
From: MooSE <32853697+moose-kazan@users.noreply.github.com>
Date: Sun, 6 Oct 2019 15:02:48 +0300
Subject: [PATCH 060/246] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d5012d68..faaf9aa9 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> <img src="https://opencollective.com/acmesh/tiers/backers/badge.svg?label=backer&color=brightgreen" /> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
 - Full ACME protocol implementation.
 - Support ACME v1 and ACME v2

From f500c7abcba29d19b2d49d8e3b25d9c6d5e2f726 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 15:47:39 +0200
Subject: [PATCH 061/246] dnsapi/dns_miab.sh MIAB DNS-01 Validation

Know I'm new to contorting to this project. I i've broke conventions please let me know what I've screwed up and I'll set it right as quickly as possible.

Propose this as a new DNS-01 validation script to dynamically add challenge DNS records to MailinaBox (MIAB) DNS. MIAB uses a custom DNS API to manage external DNS records.

The script was originally written by Darven Dissek and can be found in his repository: https://framagit.org/DarvenDissek/acme.sh-MIAB-DNS-API/). This has been forked and some slight cleanup applied and change shebang to UNIx shell. The forked repository can be found here: https://github.com/billgertz/MIAB_dns_api.

Wrote to Darven but received no reply. Support for this script has been submitted to the OPNsense project via this pull request: https://github.com/opnsense/plugins/pull/1531
---
 dnsapi/dns_miab.sh | 273 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 273 insertions(+)
 create mode 100644 dnsapi/dns_miab.sh

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
new file mode 100644
index 00000000..b0a52d7e
--- /dev/null
+++ b/dnsapi/dns_miab.sh
@@ -0,0 +1,273 @@
+#!/usr/bin/env sh
+
+#Name: dns_miab.sh
+#
+#Authors:
+# Darven Dissek 2018
+# William Gertz 2019
+#
+# Thanks to Neil Pang for the code reused from acme.sh from HTTP-01 validation
+# used to communicate with the MailintheBox Custom DNS API
+#Report Bugs here:
+# https://github.com/billgertz/MIAB_dns_api (for dns_miab.sh)
+# https://github.com/Neilpang/acme.sh       (for acme.sh)
+#
+########  Public functions #####################
+
+#Usage: dns_miab_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_miab_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using miab"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  MIAB_Username="${MIAB_Username:-$(_readaccountconf_mutable MIAB_Username)}"
+  MIAB_Password="${MIAB_Password:-$(_readaccountconf_mutable MIAB_Password)}"
+  MIAB_Server="${MIAB_Server:-$(_readaccountconf_mutable MIAB_Server)}"
+
+  #debug log the environmental variables
+  _debug MIAB_Username "$MIAB_Username"
+  _debug MIAB_Password "$MIAB_Password"
+  _debug MIAB_Server "$MIAB_Server"
+
+  if [ -z "$MIAB_Username" ] || [ -z "$MIAB_Password" ] || [ -z "$MIAB_Server" ]; then
+    MIAB_Username=""
+    MIAB_Password=""
+    MIAB_Server=""
+    _err "You didn't specify MIAB_Username or MIAB_Password or MIAB_Server."
+    _err "Please try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
+
+  baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
+
+  #Add the challenge record
+  result="$(_miab_post "$txtvalue" "$baseurl" "" "POST" "" "$MIAB_Username" "$MIAB_Password")"
+
+  _debug result "$result"
+
+  #check if result was good
+  if _contains "$result" "updated DNS"; then
+    _info "Successfully created the txt record"
+    return 0
+  else
+    _err "Error encountered during record addition"
+    _err "$result"
+    return 1
+  fi
+
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_miab_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using miab"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  MIAB_Username="${MIAB_Username:-$(_readaccountconf_mutable MIAB_Username)}"
+  MIAB_Password="${MIAB_Password:-$(_readaccountconf_mutable MIAB_Password)}"
+  MIAB_Server="${MIAB_Server:-$(_readaccountconf_mutable MIAB_Server)}"
+
+  #debug log the environmental variables
+  _debug MIAB_Username "$MIAB_Username"
+  _debug MIAB_Password "$MIAB_Password"
+  _debug MIAB_Server "$MIAB_Server"
+
+  if [ -z "$MIAB_Username" ] || [ -z "$MIAB_Password" ] || [ -z "$MIAB_Server" ]; then
+    MIAB_Username=""
+    MIAB_Password=""
+    MIAB_Server=""
+    _err "You didn't specify MIAB_Username or MIAB_Password or MIAB_Server."
+    _err "Please try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
+
+  baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
+
+  #Remove the challenge record
+  result="$(_miab_post "$txtvalue" "$baseurl" "" "DELETE" "" "$MIAB_Username" "$MIAB_Password")"
+
+  _debug result $result
+
+  #check if result was good
+  if _contains "$result" "updated DNS"; then
+    _info "Successfully created the txt record"
+    return 0
+  else
+    _err "Error encountered during record addition"
+    _err "$result"
+    return 1
+  fi
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+ 
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\[.\"id\":\"[^\"]*\"" | head -n 1 | cut -d : -f 2 | tr -d \")
+
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+        _domain=$h
+        return 0
+      fi
+
+      return 1
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+
+  return 1
+}
+
+# post changes to MIAB dns (taken from acme.sh)
+_miab_post() {
+  body="$1"
+  _post_url="$2"
+  needbase64="$3"
+  httpmethod="$4"
+  _postContentType="$5"
+  username="$6"
+  password="$7"
+
+  if [ -z "$httpmethod" ]; then
+    httpmethod="POST"
+  fi
+
+  _debug $httpmethod
+  _debug "_post_url" "$_post_url"
+  _debug2 "body" "$body"
+  _debug2 "_postContentType" "$_postContentType"
+
+  _inithttp
+
+  if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
+    _CURL="$_ACME_CURL"
+
+    if [ "$HTTPS_INSECURE" ]; then
+      _CURL="$_CURL --insecure  "
+    fi
+
+    _debug "_CURL" "$_CURL"
+ 
+    if [ "$needbase64" ]; then
+      if [ "$_postContentType" ]; then
+        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+      else
+        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
+      fi
+    else
+      if [ "$_postContentType" ]; then
+        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+      else
+        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
+      fi
+    fi
+
+    _ret="$?"
+
+    if [ "$_ret" != "0" ]; then
+      _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
+      if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
+        _err "Here is the curl dump log:"
+        _err "$(cat "$_CURL_DUMP")"
+      fi
+    fi
+
+  elif [ "$_ACME_WGET" ]; then
+    _WGET="$_ACME_WGET"
+
+    if [ "$HTTPS_INSECURE" ]; then
+      _WGET="$_WGET --no-check-certificate "
+    fi
+
+    _debug "_WGET" "$_WGET"
+
+    if [ "$needbase64" ]; then
+
+      	    if [ "$httpmethod" = "POST" ]; then
+        if [ "$_postContentType" ]; then
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
+        else
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
+        fi
+      else
+        if [ "$_postContentType" ]; then
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
+        else
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
+        fi
+      fi
+
+    else
+
+      if [ "$httpmethod" = "POST" ]; then
+        if [ "$_postContentType" ]; then
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        else
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        fi
+      else
+        if [ "$_postContentType" ]; then
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        else
+          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
+        fi
+      fi
+
+    fi
+
+    _ret="$?"
+
+    if [ "$_ret" = "8" ]; then
+      _ret=0
+      _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
+    fi
+
+    if [ "$_ret" != "0" ]; then
+      _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
+    fi
+
+    _sed_i "s/^ *//g" "$HTTP_HEADER"
+
+  else
+    _ret="$?"
+    _err "Neither curl nor wget was found, cannot do $httpmethod."
+  fi
+
+  _debug "_ret" "$_ret"
+  printf "%s" "$response"
+  return $_ret
+}

From 47c33d0344208d0bb47f173d64672e69fc18ac37 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 16:29:23 +0200
Subject: [PATCH 062/246] Cleanup/ removed private function _get_root

Function _get_root() copied from acme.sh and is not needed here. Other cleanup as recommended by acme.sh test bot.
---
 dnsapi/dns_miab.sh | 71 +++++++++++-----------------------------------
 1 file changed, 17 insertions(+), 54 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index b0a52d7e..b68f6705 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -1,16 +1,16 @@
 #!/usr/bin/env sh
 
-#Name: dns_miab.sh
+# Name: dns_miab.sh
 #
-#Authors:
-# Darven Dissek 2018
-# William Gertz 2019
+# Authors:
+#    Darven Dissek 2018
+#    William Gertz 2019
 #
-# Thanks to Neil Pang for the code reused from acme.sh from HTTP-01 validation
-# used to communicate with the MailintheBox Custom DNS API
-#Report Bugs here:
-# https://github.com/billgertz/MIAB_dns_api (for dns_miab.sh)
-# https://github.com/Neilpang/acme.sh       (for acme.sh)
+#     Thanks to Neil Pang for the code reused from acme.sh from HTTP-01 validation
+#     used to communicate with the MailintheBox Custom DNS API
+# Report Bugs here:
+#    https://github.com/billgertz/MIAB_dns_api (for dns_miab.sh)
+#    https://github.com/Neilpang/acme.sh       (for acme.sh)
 #
 ########  Public functions #####################
 
@@ -41,9 +41,9 @@ dns_miab_add() {
   fi
 
   #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
+  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
 
   baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
 
@@ -61,7 +61,6 @@ dns_miab_add() {
     _err "$result"
     return 1
   fi
-
 }
 
 #Usage: fulldomain txtvalue
@@ -92,16 +91,16 @@ dns_miab_rm() {
   fi
 
   #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
+  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
 
   baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
 
   #Remove the challenge record
   result="$(_miab_post "$txtvalue" "$baseurl" "" "DELETE" "" "$MIAB_Username" "$MIAB_Password")"
 
-  _debug result $result
+  _debug result "$result"
 
   #check if result was good
   if _contains "$result" "updated DNS"; then
@@ -115,43 +114,7 @@ dns_miab_rm() {
 }
 
 ####################  Private functions below ##################################
-#_acme-challenge.www.domain.com
-#returns
-# _sub_domain=_acme-challenge.www
-# _domain=domain.com
-# _domain_id=sdjkglgdfewsdfg
-_get_root() {
-  domain=$1
-  i=2
-  p=1
- 
-  while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
-    _debug h "$h"
-    if [ -z "$h" ]; then
-      #not valid
-      return 1
-    fi
-
-    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\[.\"id\":\"[^\"]*\"" | head -n 1 | cut -d : -f 2 | tr -d \")
-
-      if [ "$_domain_id" ]; then
-        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
-        _domain=$h
-        return 0
-      fi
-
-      return 1
-    fi
-
-    p=$i
-    i=$(_math "$i" + 1)
-  done
-
-  return 1
-}
-
+#
 # post changes to MIAB dns (taken from acme.sh)
 _miab_post() {
   body="$1"

From a4ec9f8b44a0ae2a22c4af44d423b58e73fa6fdf Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 16:34:56 +0200
Subject: [PATCH 063/246] Fixed weird spacing on line 180

Um, fixed.
---
 dnsapi/dns_miab.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index b68f6705..c91bf3c8 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -180,7 +180,7 @@ _miab_post() {
 
     if [ "$needbase64" ]; then
 
-      	    if [ "$httpmethod" = "POST" ]; then
+      if [ "$httpmethod" = "POST" ]; then
         if [ "$_postContentType" ]; then
           response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
         else

From 835f9aad91e9995e688b1be8e827f0a6443af746 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 16:47:32 +0200
Subject: [PATCH 064/246] Um that's a wee bit of nit pick.

'Errant' space removed on blank line on line 147.
---
 dnsapi/dns_miab.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index c91bf3c8..8786634d 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -144,7 +144,7 @@ _miab_post() {
     fi
 
     _debug "_CURL" "$_CURL"
- 
+
     if [ "$needbase64" ]; then
       if [ "$_postContentType" ]; then
         response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"

From c06ec7c6bae0cc40daede2121d006b764e73cb47 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 18:15:16 +0200
Subject: [PATCH 065/246] Removed parameters and unused code for _miab_post

Ok, should have noticed earlier that the calls to the private function _miab_post() never used the _needbase64_ or the __postContentType parameters. Parameters and code to handle them has been factored out.
---
 dnsapi/dns_miab.sh | 70 +++++++++-------------------------------------
 1 file changed, 13 insertions(+), 57 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index 8786634d..df2ca6e2 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -48,7 +48,7 @@ dns_miab_add() {
   baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
 
   #Add the challenge record
-  result="$(_miab_post "$txtvalue" "$baseurl" "" "POST" "" "$MIAB_Username" "$MIAB_Password")"
+  result="$(_miab_post "$txtvalue" "$baseurl" "POST" "$MIAB_Username" "$MIAB_Password")"
 
   _debug result "$result"
 
@@ -91,14 +91,14 @@ dns_miab_rm() {
   fi
 
   #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
+  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
 
   baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
 
   #Remove the challenge record
-  result="$(_miab_post "$txtvalue" "$baseurl" "" "DELETE" "" "$MIAB_Username" "$MIAB_Password")"
+  result="$(_miab_post "$txtvalue" "$baseurl" "DELETE" "$MIAB_Username" "$MIAB_Password")"
 
   _debug result "$result"
 
@@ -119,11 +119,9 @@ dns_miab_rm() {
 _miab_post() {
   body="$1"
   _post_url="$2"
-  needbase64="$3"
-  httpmethod="$4"
-  _postContentType="$5"
-  username="$6"
-  password="$7"
+  httpmethod="$3"
+  username="$4"
+  password="$5"
 
   if [ -z "$httpmethod" ]; then
     httpmethod="POST"
@@ -144,21 +142,7 @@ _miab_post() {
     fi
 
     _debug "_CURL" "$_CURL"
-
-    if [ "$needbase64" ]; then
-      if [ "$_postContentType" ]; then
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
-      else
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url" | _base64)"
-      fi
-    else
-      if [ "$_postContentType" ]; then
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "Content-Type: $_postContentType" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
-      else
-        response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
-      fi
-    fi
-
+    response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
     _ret="$?"
 
     if [ "$_ret" != "0" ]; then
@@ -178,40 +162,12 @@ _miab_post() {
 
     _debug "_WGET" "$_WGET"
 
-    if [ "$needbase64" ]; then
-
-      if [ "$httpmethod" = "POST" ]; then
-        if [ "$_postContentType" ]; then
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
-        else
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
-        fi
-      else
-        if [ "$_postContentType" ]; then
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
-        else
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER" | _base64)"
-        fi
-      fi
-
+    if [ "$httpmethod" = "POST" ]; then
+      response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
     else
-
-      if [ "$httpmethod" = "POST" ]; then
-        if [ "$_postContentType" ]; then
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-        else
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-        fi
-      else
-        if [ "$_postContentType" ]; then
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --header "Content-Type: $_postContentType" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-        else
-          response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-        fi
-      fi
-
+      response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
     fi
-
+    
     _ret="$?"
 
     if [ "$_ret" = "8" ]; then

From f323ced4ca0d46c4119a8c4ac3ce67125edce149 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 18:24:14 +0200
Subject: [PATCH 066/246] Style issues and orphan _postContentType debug fix

Fixed spacing and removed unneeded debug for _postContenetType
---
 dnsapi/dns_miab.sh | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index df2ca6e2..e2f4d593 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -91,9 +91,9 @@ dns_miab_rm() {
   fi
 
   #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username  "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password  "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server  "$MIAB_Server"
+  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
 
   baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
 
@@ -130,8 +130,7 @@ _miab_post() {
   _debug $httpmethod
   _debug "_post_url" "$_post_url"
   _debug2 "body" "$body"
-  _debug2 "_postContentType" "$_postContentType"
-
+  
   _inithttp
 
   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
@@ -167,7 +166,7 @@ _miab_post() {
     else
       response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
     fi
-    
+
     _ret="$?"
 
     if [ "$_ret" = "8" ]; then

From f64b061a28bf06f7f1586048615cef090b9c09e9 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Tue, 8 Oct 2019 18:46:35 +0200
Subject: [PATCH 067/246] Style issue

Spaces on blank line on line 133.
---
 dnsapi/dns_miab.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index e2f4d593..d17a1f75 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -130,7 +130,7 @@ _miab_post() {
   _debug $httpmethod
   _debug "_post_url" "$_post_url"
   _debug2 "body" "$body"
-  
+
   _inithttp
 
   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then

From ba7db3edda2c3d4e8265d2c5302b973d6541afd8 Mon Sep 17 00:00:00 2001
From: David Robles <master-nevi@users.noreply.github.com>
Date: Wed, 9 Oct 2019 08:08:05 -0700
Subject: [PATCH 068/246] Use more widely supported options for the "tr"
 command line utility by removing the use of the character class
 representation option. Fixes #2536

---
 dnsapi/dns_freedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index e76e6495..bb80dc44 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -303,7 +303,7 @@ _freedns_domain_id() {
       return 1
     fi
 
-    domain_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    domain_id="$(echo "$htmlpage" | tr -d "\r\n" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
       | _egrep_o "edit\.php\?edit_domain_id=[0-9a-zA-Z]+" \
       | cut -d = -f 2)"
@@ -349,7 +349,7 @@ _freedns_data_id() {
       return 1
     fi
 
-    data_id="$(echo "$htmlpage" | tr -d "[:space:]" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    data_id="$(echo "$htmlpage" | tr -d "\r\n" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
       | _egrep_o "edit\.php\?data_id=[0-9a-zA-Z]+" \

From 252a21e2ae715885e5c45044fe19538e6b009399 Mon Sep 17 00:00:00 2001
From: temoffey <temoffey@inbox.ru>
Date: Thu, 10 Oct 2019 00:36:34 +0300
Subject: [PATCH 069/246] fixed json parse regex for support api gcore_cdn

---
 deploy/gcore_cdn.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/gcore_cdn.sh b/deploy/gcore_cdn.sh
index bbda58ef..a2a35f7b 100644
--- a/deploy/gcore_cdn.sh
+++ b/deploy/gcore_cdn.sh
@@ -77,15 +77,15 @@ gcore_cdn_deploy() {
   _debug _regex "$_regex"
   _resource=$(echo "$_response" | sed 's/},{/},\n{/g' | _egrep_o "$_regex")
   _debug _resource "$_resource"
-  _regex=".*\"id\":\([0-9]*\),.*$"
+  _regex=".*\"id\":\([0-9]*\).*\"rules\".*$"
   _debug _regex "$_regex"
   _resourceId=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
   _debug _resourceId "$_resourceId"
-  _regex=".*\"sslData\":\([0-9]*\)}.*$"
+  _regex=".*\"sslData\":\([0-9]*\).*$"
   _debug _regex "$_regex"
   _sslDataOld=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
   _debug _sslDataOld "$_sslDataOld"
-  _regex=".*\"originGroup\":\([0-9]*\),.*$"
+  _regex=".*\"originGroup\":\([0-9]*\).*$"
   _debug _regex "$_regex"
   _originGroup=$(echo "$_resource" | sed -n "s/$_regex/\1/p")
   _debug _originGroup "$_originGroup"
@@ -101,7 +101,7 @@ gcore_cdn_deploy() {
   _debug _request "$_request"
   _response=$(_post "$_request" "https://api.gcdn.co/sslData")
   _debug _response "$_response"
-  _regex=".*\"id\":\([0-9]*\),.*$"
+  _regex=".*\"id\":\([0-9]*\).*$"
   _debug _regex "$_regex"
   _sslDataAdd=$(echo "$_response" | sed -n "s/$_regex/\1/p")
   _debug _sslDataAdd "$_sslDataAdd"

From aa6112482d90e17b19127b71d5f12d097e13c485 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Sun, 13 Oct 2019 19:56:04 +0200
Subject: [PATCH 070/246] Rewrite to conform to Dev guide

Created _get_root() that tests the requested host is a subdomain to the domains hosted on MailinaBox (MIAB) DNS Server. Created common _miab_rest() used with dns_miab_add(), dns_miab_rm() and _get_root(). Also created barbaric _is_json() to test the response given by the MIAB Custom DNS API at least looks like a JSON file. We should add a hint to use _normalizeJson with JSON responses so _startswith, _endswith won't perplexingly fail.
---
 dnsapi/dns_miab.sh | 273 ++++++++++++++++++++++++---------------------
 1 file changed, 147 insertions(+), 126 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index d17a1f75..313e4eb8 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -6,186 +6,207 @@
 #    Darven Dissek 2018
 #    William Gertz 2019
 #
-#     Thanks to Neil Pang for the code reused from acme.sh from HTTP-01 validation
-#     used to communicate with the MailintheBox Custom DNS API
+#     Thanks to Neil Pang and other developers here for code reused from acme.sh from DNS-01
+#     used to communicate with the MailinaBox Custom DNS API
 # Report Bugs here:
 #    https://github.com/billgertz/MIAB_dns_api (for dns_miab.sh)
 #    https://github.com/Neilpang/acme.sh       (for acme.sh)
 #
 ########  Public functions #####################
 
-#Usage: dns_miab_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+#Usage: dns_miab_add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_miab_add() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using miab"
+  _info "Using miab challange add"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
 
-  MIAB_Username="${MIAB_Username:-$(_readaccountconf_mutable MIAB_Username)}"
-  MIAB_Password="${MIAB_Password:-$(_readaccountconf_mutable MIAB_Password)}"
-  MIAB_Server="${MIAB_Server:-$(_readaccountconf_mutable MIAB_Server)}"
-
-  #debug log the environmental variables
-  _debug MIAB_Username "$MIAB_Username"
-  _debug MIAB_Password "$MIAB_Password"
-  _debug MIAB_Server "$MIAB_Server"
-
-  if [ -z "$MIAB_Username" ] || [ -z "$MIAB_Password" ] || [ -z "$MIAB_Server" ]; then
-    MIAB_Username=""
-    MIAB_Password=""
-    MIAB_Server=""
-    _err "You didn't specify MIAB_Username or MIAB_Password or MIAB_Server."
-    _err "Please try again."
+  #retrieve MIAB environemt vars
+   if ! _retrieve_miab_env; then
+     return 1
+   fi
+  
+  #check domain and seperate into doamin and host
+  if ! _get_root "$fulldomain"; then
+    _err "Cannot find any part of ${fulldomain} is hosted on ${MIAB_Server}"
     return 1
   fi
 
-  #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
+  _debug2 _sub_domain "$_sub_domain"
+  _debug2 _domain "$_domain"
 
-  baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
-
-  #Add the challenge record
-  result="$(_miab_post "$txtvalue" "$baseurl" "POST" "$MIAB_Username" "$MIAB_Password")"
-
-  _debug result "$result"
+  #add the challenge record
+  _api_path="custom/${fulldomain}/txt"
+  _miab_rest "$txtvalue" "$_api_path" "POST"
 
   #check if result was good
-  if _contains "$result" "updated DNS"; then
+  if _contains "$response" "updated DNS"; then
     _info "Successfully created the txt record"
     return 0
   else
-    _err "Error encountered during record addition"
-    _err "$result"
+    _err "Error encountered during record add"
+    _err "$response"
     return 1
   fi
 }
 
-#Usage: fulldomain txtvalue
-#Remove the txt record after validation.
+#Usage: dns_miab_rm  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_miab_rm() {
   fulldomain=$1
   txtvalue=$2
-  _info "Using miab"
+
+  _info "Using miab challage delete"
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
 
-  MIAB_Username="${MIAB_Username:-$(_readaccountconf_mutable MIAB_Username)}"
-  MIAB_Password="${MIAB_Password:-$(_readaccountconf_mutable MIAB_Password)}"
-  MIAB_Server="${MIAB_Server:-$(_readaccountconf_mutable MIAB_Server)}"
+  #retrieve MIAB environemt vars
+   if ! _retrieve_miab_env; then
+     return 1
+   fi
 
-  #debug log the environmental variables
-  _debug MIAB_Username "$MIAB_Username"
-  _debug MIAB_Password "$MIAB_Password"
-  _debug MIAB_Server "$MIAB_Server"
-
-  if [ -z "$MIAB_Username" ] || [ -z "$MIAB_Password" ] || [ -z "$MIAB_Server" ]; then
-    MIAB_Username=""
-    MIAB_Password=""
-    MIAB_Server=""
-    _err "You didn't specify MIAB_Username or MIAB_Password or MIAB_Server."
-    _err "Please try again."
+  #check domain and seperate into doamin and host
+  if ! _get_root "$fulldomain"; then
+    _err "Cannot find any part of ${fulldomain} is hosted on ${MIAB_Server}"
     return 1
   fi
 
-  #save the credentials to the account conf file.
-  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
-  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
-  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
-
-  baseurl="https://$MIAB_Server/admin/dns/custom/$fulldomain/txt"
+  _debug2 _sub_domain "$_sub_domain"
+  _debug2 _domain "$_domain"
 
   #Remove the challenge record
-  result="$(_miab_post "$txtvalue" "$baseurl" "DELETE" "$MIAB_Username" "$MIAB_Password")"
-
-  _debug result "$result"
+  _api_path="custom/${fulldomain}/txt"
+	  _miab_rest "$txtvalue" "$_api_path" "DELETE"
 
   #check if result was good
-  if _contains "$result" "updated DNS"; then
-    _info "Successfully created the txt record"
+  if _contains "$response" "updated DNS"; then
+    _info "Successfully removed the txt record"
     return 0
   else
-    _err "Error encountered during record addition"
-    _err "$result"
+    _err "Error encountered during record remove"
+    _err "$response"
     return 1
   fi
 }
 
 ####################  Private functions below ##################################
 #
-# post changes to MIAB dns (taken from acme.sh)
-_miab_post() {
-  body="$1"
-  _post_url="$2"
-  httpmethod="$3"
-  username="$4"
-  password="$5"
+#Usage: _get_root  _acme-challenge.www.domain.com
+#Returns:
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  _passed_domain=$1
+  _debug _passed_domain "$_passed_domain"
+  _i=2
+  _p=1
 
-  if [ -z "$httpmethod" ]; then
-    httpmethod="POST"
+  #get the zones hosed on MIAB server, must be a json stream
+  _miab_rest "" "zones" "GET"
+
+  _info "_startswith test:$(_startswith "test" "t")"
+  _info "_endstest test:$(_endswith "test" "t")"
+
+  if ! _is_json "$response"; then
+    _err "ERROR fetching domain list"
+    _err "$response"
+    return 1
   fi
 
-  _debug $httpmethod
-  _debug "_post_url" "$_post_url"
-  _debug2 "body" "$body"
+  #cycle through the passed domain seperating out a test domain discarding
+  #   the subdomain by marching thorugh the dots
+  while true; do
+    _test_domain=$(printf "%s" "$_passed_domain" | cut -d . -f ${_i}-100)
+    _debug _test_domain "$_test_domain"
 
-  _inithttp
-
-  if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
-    _CURL="$_ACME_CURL"
-
-    if [ "$HTTPS_INSECURE" ]; then
-      _CURL="$_CURL --insecure  "
+    if [ -z "$_test_domain" ]; then
+      return 1
     fi
 
-    _debug "_CURL" "$_CURL"
-    response="$($_CURL --user-agent "$USER_AGENT" -X $httpmethod --user "$username:$password" -H "$_H1" -H "$_H2" -H "$_H3" -H "$_H4" -H "$_H5" --data "$body" "$_post_url")"
-    _ret="$?"
-
-    if [ "$_ret" != "0" ]; then
-      _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
-      if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
-        _err "Here is the curl dump log:"
-        _err "$(cat "$_CURL_DUMP")"
-      fi
+    #report found if the test domain is in the json response and
+    #   report the subdomain
+    if _contains "$response" "\"$_test_domain\""; then
+      _sub_domain=$(printf "%s" "$_passed_domain" | cut -d . -f 1-${_p})
+      _domain=${_test_domain}
+      return 0
     fi
 
-  elif [ "$_ACME_WGET" ]; then
-    _WGET="$_ACME_WGET"
+    #cycle to the next dot in the passed domain
+    _p=${_i}
+    _i=$(_math "$_i" + 1)
+  done
 
-    if [ "$HTTPS_INSECURE" ]; then
-      _WGET="$_WGET --no-check-certificate "
-    fi
-
-    _debug "_WGET" "$_WGET"
-
-    if [ "$httpmethod" = "POST" ]; then
-      response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --post-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-    else
-      response="$($_WGET -S -O - --user-agent="$USER_AGENT" --header "$_H5" --header "$_H4" --header "$_H3" --header "$_H2" --header "$_H1" --method $httpmethod --body-data="$body" "$_post_url" 2>"$HTTP_HEADER")"
-    fi
-
-    _ret="$?"
-
-    if [ "$_ret" = "8" ]; then
-      _ret=0
-      _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
-    fi
-
-    if [ "$_ret" != "0" ]; then
-      _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
-    fi
-
-    _sed_i "s/^ *//g" "$HTTP_HEADER"
-
-  else
-    _ret="$?"
-    _err "Neither curl nor wget was found, cannot do $httpmethod."
-  fi
-
-  _debug "_ret" "$_ret"
-  printf "%s" "$response"
-  return $_ret
+  return 1
+}
+
+#Usage: _retrieve_miab_env
+#Returns (from store or environment variables):
+# MIAB_Username
+# MIAB_Password
+# MIAB_Server
+#retrieve MIAB environment variables, report errors and quit if problems
+_retrieve_miab_env() {
+  MIAB_Username="${MIAB_Username:-$(_readaccountconf_mutable MIAB_Username)}"
+  MIAB_Password="${MIAB_Password:-$(_readaccountconf_mutable MIAB_Password)}"
+  MIAB_Server="${MIAB_Server:-$(_readaccountconf_mutable MIAB_Server)}"
+
+  #debug log the environmental variables
+  _debug MIAB_Username "$MIAB_Username"
+  _debug MIAB_Password "$MIAB_Password"
+  _debug MIAB_Server "$MIAB_Server"
+
+  #check if MIAB environemt vars set and quit if not
+  if [ -z "$MIAB_Username" ] || [ -z "$MIAB_Password" ] || [ -z "$MIAB_Server" ]; then
+    _err "You didn't specify one or more of MIAB_Username, MIAB_Password or MIAB_Server."
+    _err "Please check these environment variables and try again."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable MIAB_Username "$MIAB_Username"
+  _saveaccountconf_mutable MIAB_Password "$MIAB_Password"
+  _saveaccountconf_mutable MIAB_Server "$MIAB_Server"
+}
+
+#Useage: _miab_rest  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"  "custom/_acme-challenge.www.domain.com/txt  "POST"
+#Returns: "updated DNS: domain.com"
+#rest interface MIAB dns
+_miab_rest() {
+  _data="$1"
+  _api_path="$2"
+  _httpmethod="$3"
+
+  #encode username and password for url
+  _username="$(printf "%s" "$MIAB_Username" | _url_encode)"
+  _password="$(printf "%s" "$MIAB_Password" | _url_encode)"
+  _url="https://${_username}:${_password}@${MIAB_Server}/admin/dns/${_api_path}"
+
+  _debug2 _data "$_data"
+  _debug _api_path "$_api_path"
+  _debug2 _url "$_url"
+  _debug _httpmethod "$_httpmethod"
+
+  if [ "$_httpmethod" = "GET" ]; then
+    response="$(_get "$_url")"
+  else
+    response="$(_post "$_data" "$_url" "" "$_httpmethod")"
+  fi
+
+  _retcode="$?"
+
+  if [ "$_retcode" != "0" ]; then
+    _err "MAAB REST authentication failed on $_httpmethod"
+    return 1
+  fi
+
+  _debug response "$response"
+  return 0
+}
+
+#Usage: _is_json  "\[\n   "mydomain.com"\n]"
+#Reurns "\[\n   "mydomain.com"\n]"
+#returns the string if it begins and ends with square braces
+_is_json() {
+  _str="$(echo "$1" | _normalizeJson)"
+  echo "$_str" | grep '^\[.*\]$' >/dev/null 2>&1
 }

From 7ec52145e807fc15dfb6c1e501183f14b58f3d80 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Sun, 13 Oct 2019 20:02:03 +0200
Subject: [PATCH 071/246] Space style changes.

Local copy of shellcheck somehow missed these, odd.
---
 dnsapi/dns_miab.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index 313e4eb8..7630a744 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -23,10 +23,10 @@ dns_miab_add() {
   _debug txtvalue "$txtvalue"
 
   #retrieve MIAB environemt vars
-   if ! _retrieve_miab_env; then
-     return 1
-   fi
-  
+  if ! _retrieve_miab_env; then
+    return 1
+  fi
+
   #check domain and seperate into doamin and host
   if ! _get_root "$fulldomain"; then
     _err "Cannot find any part of ${fulldomain} is hosted on ${MIAB_Server}"
@@ -61,9 +61,9 @@ dns_miab_rm() {
   _debug txtvalue "$txtvalue"
 
   #retrieve MIAB environemt vars
-   if ! _retrieve_miab_env; then
-     return 1
-   fi
+  if ! _retrieve_miab_env; then
+    return 1
+  fi
 
   #check domain and seperate into doamin and host
   if ! _get_root "$fulldomain"; then
@@ -76,7 +76,7 @@ dns_miab_rm() {
 
   #Remove the challenge record
   _api_path="custom/${fulldomain}/txt"
-	  _miab_rest "$txtvalue" "$_api_path" "DELETE"
+  _miab_rest "$txtvalue" "$_api_path" "DELETE"
 
   #check if result was good
   if _contains "$response" "updated DNS"; then

From 9af85f5a7eedb7d3fd36a01834492e50e8c65138 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Mon, 14 Oct 2019 00:01:25 +0200
Subject: [PATCH 072/246] Updated to use _H1 Authorization: Basic

Updated to use suggested export _H1 env var to supply Authorization Basic credentials. This undocumented support for Basic Authorization, ContentType, etc. needs to be documented in DNSAPI Dev Guide. Removed two stray debugging lines.
---
 dnsapi/dns_miab.sh | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index 7630a744..25a8ffc7 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -26,7 +26,7 @@ dns_miab_add() {
   if ! _retrieve_miab_env; then
     return 1
   fi
-
+ 
   #check domain and seperate into doamin and host
   if ! _get_root "$fulldomain"; then
     _err "Cannot find any part of ${fulldomain} is hosted on ${MIAB_Server}"
@@ -104,9 +104,6 @@ _get_root() {
   #get the zones hosed on MIAB server, must be a json stream
   _miab_rest "" "zones" "GET"
 
-  _info "_startswith test:$(_startswith "test" "t")"
-  _info "_endstest test:$(_endswith "test" "t")"
-
   if ! _is_json "$response"; then
     _err "ERROR fetching domain list"
     _err "$response"
@@ -176,14 +173,15 @@ _miab_rest() {
   _api_path="$2"
   _httpmethod="$3"
 
-  #encode username and password for url
-  _username="$(printf "%s" "$MIAB_Username" | _url_encode)"
-  _password="$(printf "%s" "$MIAB_Password" | _url_encode)"
-  _url="https://${_username}:${_password}@${MIAB_Server}/admin/dns/${_api_path}"
+  #encode username and password for basic authentication
+  _credentials="$(printf "%s" "$MIAB_Username:$MIAB_Password" | _base64)"
+  export _H1="Authorization: Basic $_credentials"
+  _url="https://${MIAB_Server}/admin/dns/${_api_path}"
 
   _debug2 _data "$_data"
   _debug _api_path "$_api_path"
   _debug2 _url "$_url"
+  _debug2 _credentails "$_credentials"
   _debug _httpmethod "$_httpmethod"
 
   if [ "$_httpmethod" = "GET" ]; then
@@ -195,7 +193,7 @@ _miab_rest() {
   _retcode="$?"
 
   if [ "$_retcode" != "0" ]; then
-    _err "MAAB REST authentication failed on $_httpmethod"
+    _err "MIAB REST authentication failed on $_httpmethod"
     return 1
   fi
 

From 933d49b0b09cc886402c59e08de1651e8121d822 Mon Sep 17 00:00:00 2001
From: Bill Gertz <bill.gertz@blockfish.net>
Date: Mon, 14 Oct 2019 00:06:08 +0200
Subject: [PATCH 073/246] Style space change

Extra space on empty line 27.
---
 dnsapi/dns_miab.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index 25a8ffc7..23ff6cee 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -26,7 +26,7 @@ dns_miab_add() {
   if ! _retrieve_miab_env; then
     return 1
   fi
- 
+
   #check domain and seperate into doamin and host
   if ! _get_root "$fulldomain"; then
     _err "Cannot find any part of ${fulldomain} is hosted on ${MIAB_Server}"

From dc5c220e8fc0d605a9c4434b421b9d33960b149c Mon Sep 17 00:00:00 2001
From: rserpent <53250916+rserpent@users.noreply.github.com>
Date: Wed, 16 Oct 2019 15:12:21 +0500
Subject: [PATCH 074/246] dns_nic init

---
 dnsapi/dns_nic.sh | 185 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 185 insertions(+)
 create mode 100644 dnsapi/dns_nic.sh

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
new file mode 100644
index 00000000..277cc2d8
--- /dev/null
+++ b/dnsapi/dns_nic.sh
@@ -0,0 +1,185 @@
+#!/usr/bin/env sh
+
+#
+#NIC_Token="sdfsdfsdfljlbjkljlkjsdfoiwjedfglgkdlfgkfgldfkg"
+#
+#NIC_Username="000000/NIC-D"
+
+#NIC_Password="xxxxxxx"
+
+NIC_Api="https://api.nic.ru"
+
+dns_nic_add() {
+  fulldomain="${1}"
+  txtvalue="${2}"
+
+  NIC_Token="${NIC_Token:-$(_readaccountconf_mutable NIC_Token)}"
+  NIC_Username="${NIC_Username:-$(_readaccountconf_mutable NIC_Username)}"
+  NIC_Password="${NIC_Password:-$(_readaccountconf_mutable NIC_Password)}"
+  if [ -z "$NIC_Token" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
+    NIC_Token=""
+    NIC_Username=""
+    NIC_Password=""
+    _err "You must export variables: NIC_Token, NIC_Username and NIC_Password"
+    return 1
+  fi
+
+  _saveaccountconf_mutable NIC_Customer "$NIC_Token"
+  _saveaccountconf_mutable NIC_Username "$NIC_Username"
+  _saveaccountconf_mutable NIC_Password "$NIC_Password"
+
+  if ! _nic_get_authtoken "$NIC_Username" "$NIC_Password" "$NIC_Token"; then
+    _err "get NIC auth token failed"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+  _debug _service "$_service"
+
+  _info "Adding record"
+  if ! _nic_rest PUT "services/$_service/zones/$_domain/records" "<?xml version=\"1.0\" encoding=\"UTF-8\" ?><request><rr-list><rr><name>$_sub_domain</name><type>TXT</type><txt><string>$txtvalue</string></txt></rr></rr-list></request>"; then
+    _err "Add TXT record error"
+    return 1
+  fi
+
+  if ! _nic_rest POST "services/$_service/zones/$_domain/commit" ""; then
+    return 1
+  fi
+  _info "Added, OK"
+}
+
+dns_nic_rm() {
+  fulldomain="${1}"
+  txtvalue="${2}"
+
+  NIC_Token="${NIC_Token:-$(_readaccountconf_mutable NIC_Token)}"
+  NIC_Username="${NIC_Username:-$(_readaccountconf_mutable NIC_Username)}"
+  NIC_Password="${NIC_Password:-$(_readaccountconf_mutable NIC_Password)}"
+  if [ -z "$NIC_Token" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
+    NIC_Token=""
+    NIC_Username=""
+    NIC_Password=""
+    _err "You must export variables: NIC_Token, NIC_Username and NIC_Password"
+    return 1
+  fi
+
+  if ! _nic_get_authtoken "$NIC_Username" "$NIC_Password" "$NIC_Token"; then
+    _err "get NIC auth token failed"
+    return 1
+  fi
+
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+  _debug _service "$_service"
+
+  if ! _nic_rest GET "services/$_service/zones/$_domain/records"; then
+    _err "Get records error"
+    return 1
+  fi
+
+  _domain_id=$(printf "%s" "$response" | grep "$_sub_domain" | grep "$txtvalue" | sed -r "s/.*<rr id=\"(.*)\".*/\1/g")
+
+  if ! _nic_rest DELETE "services/$_service/zones/$_domain/records/$_domain_id"; then
+    _err "Delete record error"
+    return 1
+  fi
+
+  if ! _nic_rest POST "services/$_service/zones/$_domain/commit" ""; then
+    return 1
+  fi
+}
+
+####################  Private functions below ##################################
+
+_nic_get_authtoken() {
+  username="$1"
+  password="$2"
+  token="$3"
+
+  _info "Getting NIC auth token"
+
+  export _H1="Authorization: Basic $token"
+  export _H2="Content-Type: application/x-www-form-urlencoded"
+
+  res="$(_post "grant_type=password&username=$username&password=$password&scope=%28GET%7CPUT%7CPOST%7CDELETE%29%3A%2Fdns-master%2F.%2B" "$NIC_Api/oauth/token" "" "POST")"
+  if _contains "$res" "access_token"; then
+    _auth_token=$(printf "%s" "$res" | cut -d , -f2 | tr -d "\"" | sed "s/access_token://")
+    _info "Token received"
+    _debug _auth_token "$_auth_token"
+    return 0
+  fi
+  return 1
+}
+
+_get_root() {
+  domain="$1"
+  i=1
+  p=1
+
+  if ! _nic_rest GET "zones"; then
+  return 1
+  fi
+
+  _all_domains=$(printf "%s" "$response" | grep "idn-name" | sed -r "s/.*idn-name=\"(.*)\" name=.*/\1/g")
+  _debug2 _all_domains "$_all_domains"
+
+  while true; do
+   h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+   _debug h "$h"
+
+   if [ -z "$h" ]; then
+     return 1
+   fi
+
+   if _contains "$_all_domains" "^$h$"; then
+     _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+     _domain=$h
+     _service=$(printf "%s" "$response" | grep "$_domain" | sed -r "s/.*service=\"(.*)\".*$/\1/")
+     return 0
+   fi
+   p="$i"
+   i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_nic_rest() {
+  m="$1"
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Content-Type: application/xml"
+  export _H2="Authorization: Bearer $_auth_token"
+
+  if [ "$m" != "GET" ]; then
+  _debug data "$data"
+  response=$(_post "$data" "$NIC_Api/dns-master/$ep" "" "$m")
+  else
+  response=$(_get "$NIC_Api/dns-master/$ep")
+  fi
+
+  if _contains "$response" "<errors>"; then
+  error=$(printf "%s" "$response" | grep "error code" | sed -r "s/.*<error code=.*>(.*)<\/error>/\1/g")
+  _err "Error: $error"
+  return 1
+  fi
+
+  if ! _contains "$response" "<status>success</status>"; then
+   return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From e00f0b4cf1df691c4baf0293d49d380bf98b5e94 Mon Sep 17 00:00:00 2001
From: rserpent <53250916+rserpent@users.noreply.github.com>
Date: Wed, 16 Oct 2019 15:31:50 +0500
Subject: [PATCH 075/246] Update dns_nic.sh

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 277cc2d8..b92d2ac9 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -113,7 +113,7 @@ _nic_get_authtoken() {
   export _H1="Authorization: Basic $token"
   export _H2="Content-Type: application/x-www-form-urlencoded"
 
-  res="$(_post "grant_type=password&username=$username&password=$password&scope=%28GET%7CPUT%7CPOST%7CDELETE%29%3A%2Fdns-master%2F.%2B" "$NIC_Api/oauth/token" "" "POST")"
+  res=$(_post "grant_type=password&username=$username&password=$password&scope=%28GET%7CPUT%7CPOST%7CDELETE%29%3A%2Fdns-master%2F.%2B" "$NIC_Api/oauth/token" "" "POST")
   if _contains "$res" "access_token"; then
     _auth_token=$(printf "%s" "$res" | cut -d , -f2 | tr -d "\"" | sed "s/access_token://")
     _info "Token received"

From ffa5472b31b69cedae6e29bc10edf689176d54a0 Mon Sep 17 00:00:00 2001
From: rserpent <53250916+rserpent@users.noreply.github.com>
Date: Wed, 16 Oct 2019 16:25:38 +0500
Subject: [PATCH 076/246] fix whitespaces

---
 dnsapi/dns_nic.sh | 44 ++++++++++++++++++++++----------------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index b92d2ac9..493b05bc 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -79,7 +79,7 @@ dns_nic_rm() {
     _err "Invalid domain"
     return 1
   fi
-  
+
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
   _debug _service "$_service"
@@ -129,28 +129,28 @@ _get_root() {
   p=1
 
   if ! _nic_rest GET "zones"; then
-  return 1
+    return 1
   fi
 
   _all_domains=$(printf "%s" "$response" | grep "idn-name" | sed -r "s/.*idn-name=\"(.*)\" name=.*/\1/g")
   _debug2 _all_domains "$_all_domains"
 
   while true; do
-   h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
-   _debug h "$h"
+    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+    _debug h "$h"
 
-   if [ -z "$h" ]; then
-     return 1
-   fi
+    if [ -z "$h" ]; then
+      return 1
+    fi
 
-   if _contains "$_all_domains" "^$h$"; then
-     _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
-     _domain=$h
-     _service=$(printf "%s" "$response" | grep "$_domain" | sed -r "s/.*service=\"(.*)\".*$/\1/")
-     return 0
-   fi
-   p="$i"
-   i=$(_math "$i" + 1)
+    if _contains "$_all_domains" "^$h$"; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      _service=$(printf "%s" "$response" | grep "$_domain" | sed -r "s/.*service=\"(.*)\".*$/\1/")
+      return 0
+    fi
+    p="$i"
+    i=$(_math "$i" + 1)
   done
   return 1
 }
@@ -165,20 +165,20 @@ _nic_rest() {
   export _H2="Authorization: Bearer $_auth_token"
 
   if [ "$m" != "GET" ]; then
-  _debug data "$data"
-  response=$(_post "$data" "$NIC_Api/dns-master/$ep" "" "$m")
+    _debug data "$data"
+    response=$(_post "$data" "$NIC_Api/dns-master/$ep" "" "$m")
   else
-  response=$(_get "$NIC_Api/dns-master/$ep")
+    response=$(_get "$NIC_Api/dns-master/$ep")
   fi
 
   if _contains "$response" "<errors>"; then
-  error=$(printf "%s" "$response" | grep "error code" | sed -r "s/.*<error code=.*>(.*)<\/error>/\1/g")
-  _err "Error: $error"
-  return 1
+    error=$(printf "%s" "$response" | grep "error code" | sed -r "s/.*<error code=.*>(.*)<\/error>/\1/g")
+    _err "Error: $error"
+    return 1
   fi
 
   if ! _contains "$response" "<status>success</status>"; then
-   return 1
+    return 1
   fi
   _debug2 response "$response"
   return 0

From 573c8f3b13e002cc948adfee840005cc18982098 Mon Sep 17 00:00:00 2001
From: David Robles <master-nevi@users.noreply.github.com>
Date: Wed, 23 Oct 2019 07:20:01 -0700
Subject: [PATCH 077/246] Use more widely supported options for the "tr"
 command line utility by removing the use of the character class
 representation option. [:space:] => "\t\r\n\v\f"

---
 dnsapi/dns_freedns.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 81b1de5b..6fac0c21 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -303,7 +303,7 @@ _freedns_domain_id() {
       return 1
     fi
 
-    domain_id="$(echo "$htmlpage" | tr -d "\r\n" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    domain_id="$(echo "$htmlpage" | tr -d "\t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
       | sed -n 's/.*\(edit\.php?edit_domain_id=[0-9a-zA-Z]*\).*/\1/p' \
       | cut -d = -f 2)"
@@ -349,7 +349,7 @@ _freedns_data_id() {
       return 1
     fi
 
-    data_id="$(echo "$htmlpage" | tr -d "\r\n" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    data_id="$(echo "$htmlpage" | tr -d "\t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
       | sed -n 's/.*\(edit\.php?data_id=[0-9a-zA-Z]*\).*/\1/p' \

From 18ad01533b3b5d0cf51f9e72464940e7a080d880 Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Thu, 24 Oct 2019 09:19:18 +0800
Subject: [PATCH 078/246] add space. fix
 https://github.com/Neilpang/acme.sh/pull/2553

---
 dnsapi/dns_freedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 6fac0c21..32d240fc 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -303,7 +303,7 @@ _freedns_domain_id() {
       return 1
     fi
 
-    domain_id="$(echo "$htmlpage" | tr -d "\t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    domain_id="$(echo "$htmlpage" | tr -d " \t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
       | sed -n 's/.*\(edit\.php?edit_domain_id=[0-9a-zA-Z]*\).*/\1/p' \
       | cut -d = -f 2)"

From c0449a3ed22e102cd68f959460619dd9ceff18cc Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:04:20 +0200
Subject: [PATCH 079/246] Only save Attributes if it is set

---
 dnsapi/dns_opnsense.sh | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ff6f8a54..ea9677b7 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -220,22 +220,32 @@ _opns_check_auth() {
   if [ -z "$OPNs_Host" ]; then
     OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
+    return 1
+  else
+    _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
   if [ -z "$OPNs_Port" ]; then
     OPNs_Port="443"
-    _err "You don't specify OPNsense Port."
+  else
+    _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
+  else
+  #save the api addr and key to the account conf file.
+    _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
     OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
@@ -243,15 +253,10 @@ _opns_check_auth() {
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-  #save the api addr and key to the account conf file.
-  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
-  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
-  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
-  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
-  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"

From 430956d3043d0a958fa696fe51a1d88f5c77d48d Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:13:35 +0200
Subject: [PATCH 080/246] Fix whitespaces

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ea9677b7..abd85abb 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -234,7 +234,7 @@ _opns_check_auth() {
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
   else
-  #save the api addr and key to the account conf file.
+    #save the api addr and key to the account conf file.
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"

From b85c1a88614b531698133565643e618482904f06 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:22:15 +0200
Subject: [PATCH 081/246] Fix additional line

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index abd85abb..0f7cdea6 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -257,7 +257,6 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1

From 1d1f61613c539eaa0eddf8b10e8a1dea47824b8a Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 09:25:29 +0200
Subject: [PATCH 082/246] Check for root domain via API

---
 dnsapi/dns_leaseweb.sh | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 976ad5ac..6a75ef33 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -88,14 +88,24 @@ _get_root() {
   i=$(_math "$i" - 1)
 
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f "$i"-100)
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
     if [ -z "$h" ]; then
-      return 1
+      return 1 #not valid domain
+    fi
+
+    #Check API if domain exists
+    if _lsw_api "GET" "$h"; then
+      if [ "$_code" = "200"]; then
+        _domain="$h"
+        return 0
+      fi
+    fi
+    i=$(_math "$i" - 1)
+    if (( $i < 1)); then
+      return 1 #not found
     fi
-    _domain="$h"
-    return 0
   done
-  _debug "$domain not found"
+
   return 1
 }
 
@@ -109,6 +119,14 @@ _lsw_api() {
   export _H2="Content-Type: application/json"
   export _H1="X-Lsw-Auth: ${LSW_Key}"
 
+  if [ "$cmd" = "GET" ]; then
+    response="$(_get "$LSW_API/$domain")"
+    _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+    _debug "http response code $_code"
+    _debug response "$response"
+    return 0
+  fi
+
   if [ "$cmd" = "POST" ]; then
     data="{\"name\": \"$fulldomain.\",\"type\": \"TXT\",\"content\": [\"$txtvalue\"],\"ttl\": 60}"
     response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"

From e10f447b5b6b56c8742136f1c288dce32c392f41 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 11:42:15 +0200
Subject: [PATCH 083/246] Fixed some bugs, tested and working

---
 dnsapi/dns_leaseweb.sh | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 6a75ef33..cb49ce7b 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -83,19 +83,20 @@ dns_leaseweb_rm() {
 # returns
 # _domain=domain.com
 _get_root() {
-  domain=$1
-  i="$(echo "$fulldomain" | tr '.' ' ' | wc -w)"
+  rdomain=$1
+  i="$(echo "$rdomain" | tr '.' ' ' | wc -w)"
   i=$(_math "$i" - 1)
 
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    h=$(printf "%s" "$rdomain" | cut -d . -f $i-100)
+    _debug h "$h"
     if [ -z "$h" ]; then
       return 1 #not valid domain
     fi
 
     #Check API if domain exists
     if _lsw_api "GET" "$h"; then
-      if [ "$_code" = "200"]; then
+      if [ "$_code" = "200" ]; then
         _domain="$h"
         return 0
       fi
@@ -111,16 +112,16 @@ _get_root() {
 
 _lsw_api() {
   cmd=$1
-  domain=$2
-  fulldomain=$3
-  txtvalue=$4
+  data=$2
+  fd=$3
+  tvalue=$4
 
   # Construct the HTTP Authorization header
   export _H2="Content-Type: application/json"
   export _H1="X-Lsw-Auth: ${LSW_Key}"
 
   if [ "$cmd" = "GET" ]; then
-    response="$(_get "$LSW_API/$domain")"
+    response="$(_get "$LSW_API/$d")"
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
     _debug "http response code $_code"
     _debug response "$response"
@@ -128,8 +129,8 @@ _lsw_api() {
   fi
 
   if [ "$cmd" = "POST" ]; then
-    data="{\"name\": \"$fulldomain.\",\"type\": \"TXT\",\"content\": [\"$txtvalue\"],\"ttl\": 60}"
-    response="$(_post "$data" "$LSW_API/$domain/resourceRecordSets" "$data" "POST")"
+    data="{\"name\": \"$fd.\",\"type\": \"TXT\",\"content\": [\"$tvalue\"],\"ttl\": 60}"
+    response="$(_post "$data" "$LSW_API/$d/resourceRecordSets" "$data" "POST")"
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
     _debug "http response code $_code"
     _debug response "$response"
@@ -137,7 +138,7 @@ _lsw_api() {
   fi
 
   if [ "$cmd" = "DELETE" ]; then
-    response="$(_post "" "$LSW_API/$domain/resourceRecordSets/$fulldomain/TXT" "" "DELETE")"
+    response="$(_post "" "$LSW_API/$d/resourceRecordSets/$fd/TXT" "" "DELETE")"
     _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
     _debug "http response code $_code"
     _debug response "$response"

From 14f6f9ec94a5d0e68f495fe485610db82b6eefc0 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 11:56:27 +0200
Subject: [PATCH 084/246] Fixed wrong assignement of var

---
 dnsapi/dns_leaseweb.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index cb49ce7b..31446bec 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -112,7 +112,7 @@ _get_root() {
 
 _lsw_api() {
   cmd=$1
-  data=$2
+  d=$2
   fd=$3
   tvalue=$4
 

From 6d62ae226a82c8c42129a1bae560495790e092d4 Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 12:14:53 +0200
Subject: [PATCH 085/246] Small fix

---
 dnsapi/dns_leaseweb.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 31446bec..72f53b23 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -102,8 +102,8 @@ _get_root() {
       fi
     fi
     i=$(_math "$i" - 1)
-    if (( $i < 1)); then
-      return 1 #not found
+    if (( i < 2 )); then
+      return 1 #not found, no need to check _acme-challenge.sub.domain in leaseweb api.
     fi
   done
 

From 58642286c95fa42d3e78754a9f0253fa70f529bb Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 13:22:19 +0200
Subject: [PATCH 086/246] Fix for SC2039/SC2086

---
 dnsapi/dns_leaseweb.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 72f53b23..0fd8dcc0 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -88,7 +88,7 @@ _get_root() {
   i=$(_math "$i" - 1)
 
   while true; do
-    h=$(printf "%s" "$rdomain" | cut -d . -f $i-100)
+    h=$(printf "%s" "$rdomain" | cut -d . -f "$i"-100)
     _debug h "$h"
     if [ -z "$h" ]; then
       return 1 #not valid domain
@@ -102,7 +102,7 @@ _get_root() {
       fi
     fi
     i=$(_math "$i" - 1)
-    if (( i < 2 )); then
+    if $(( i < 2 )); then
       return 1 #not found, no need to check _acme-challenge.sub.domain in leaseweb api.
     fi
   done

From e48daffad99af7cd09b0c5860b439de2895541ca Mon Sep 17 00:00:00 2001
From: Rolph Haspers <r.haspers@global.leaseweb.com>
Date: Fri, 25 Oct 2019 13:46:10 +0200
Subject: [PATCH 087/246] Fixed error

---
 dnsapi/dns_leaseweb.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_leaseweb.sh b/dnsapi/dns_leaseweb.sh
index 0fd8dcc0..a1d9e749 100644
--- a/dnsapi/dns_leaseweb.sh
+++ b/dnsapi/dns_leaseweb.sh
@@ -102,7 +102,7 @@ _get_root() {
       fi
     fi
     i=$(_math "$i" - 1)
-    if $(( i < 2 )); then
+    if [ "$i" -lt 2 ]; then
       return 1 #not found, no need to check _acme-challenge.sub.domain in leaseweb api.
     fi
   done

From d04c6dd3ac03ff6031cbb0d8a2d86645fe9adb20 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Fri, 25 Oct 2019 22:31:36 +0800
Subject: [PATCH 088/246] fix https://github.com/Neilpang/acme.sh/issues/2557
 and https://github.com/Neilpang/acme.sh/issues/2544

---
 acme.sh | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index e060e334..37ce15aa 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4047,7 +4047,18 @@ $_authorizations_map"
       fi
 
       if [ "$ACME_VERSION" = "2" ]; then
-        response="$(echo "$_authorizations_map" | grep "^$(_idn "$d")," | sed "s/$d,//")"
+        _idn_d="$(_idn "$d")"
+        _candindates="$(echo "$_authorizations_map" | grep "^$_idn_d,")"
+        _debug2 _candindates "$_candindates"
+        if [ "$(echo "$_candindates" | wc -l)" -gt 1 ]; then
+          for _can in $_candindates; do
+            if _startswith "$(echo "$_can" | tr '.' '|')" "$(echo "$_idn_d" | tr '.' '|'),"; then
+              _candindates="$_can"
+              break
+            fi
+          done
+        fi
+        response="$(echo "$_candindates" | sed "s/$_idn_d,//")"
         _debug2 "response" "$response"
         if [ -z "$response" ]; then
           _err "get to authz error."

From 2a2877231268cce11ccc624c007ecf3fc2c8dea6 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Fri, 25 Oct 2019 22:34:33 +0800
Subject: [PATCH 089/246] fix
 https://github.com/Neilpang/acme.sh/pull/2553#issuecomment-546173277

---
 dnsapi/dns_freedns.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 32d240fc..6a0b58ac 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -349,7 +349,7 @@ _freedns_data_id() {
       return 1
     fi
 
-    data_id="$(echo "$htmlpage" | tr -d "\t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+    data_id="$(echo "$htmlpage" | tr -d " \t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
       | grep "<td[a-zA-Z=#]*>$record_type</td>" \
       | grep "<ahref.*>$search_domain</a>" \
       | sed -n 's/.*\(edit\.php?data_id=[0-9a-zA-Z]*\).*/\1/p' \

From df3575217acc5c50d45145672a3008cdb5895cdc Mon Sep 17 00:00:00 2001
From: scottkof <sstroupe@kofile.net>
Date: Fri, 25 Oct 2019 12:05:15 -0700
Subject: [PATCH 090/246] Avoid API throttling errors in AWS DNS plugin

---
 dnsapi/dns_aws.sh | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 246f4774..54b1bb3a 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -6,6 +6,8 @@
 #AWS_SECRET_ACCESS_KEY="xxxxxxx"
 
 #This is the Amazon Route53 api wrapper for acme.sh
+#All `sleep` commands are included to avoid Route53 throttling, see
+#https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DNSLimitations.html#limits-api-requests
 
 AWS_HOST="route53.amazonaws.com"
 AWS_URL="https://$AWS_HOST"
@@ -43,6 +45,7 @@ dns_aws_add() {
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
+    sleep 1
     return 1
   fi
   _debug _domain_id "$_domain_id"
@@ -51,6 +54,7 @@ dns_aws_add() {
 
   _info "Getting existing records for $fulldomain"
   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
+    sleep 1
     return 1
   fi
 
@@ -63,6 +67,7 @@ dns_aws_add() {
 
   if [ "$_resource_record" ] && _contains "$response" "$txtvalue"; then
     _info "The TXT record already exists. Skipping."
+    sleep 1
     return 0
   fi
 
@@ -72,9 +77,10 @@ dns_aws_add() {
 
   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
     _info "TXT record updated successfully."
+    sleep 1
     return 0
   fi
-
+  sleep 1
   return 1
 }
 
@@ -93,6 +99,7 @@ dns_aws_rm() {
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
+    sleep 1
     return 1
   fi
   _debug _domain_id "$_domain_id"
@@ -101,6 +108,7 @@ dns_aws_rm() {
 
   _info "Getting existing records for $fulldomain"
   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
+    sleep 1
     return 1
   fi
 
@@ -109,6 +117,7 @@ dns_aws_rm() {
     _debug "_resource_record" "$_resource_record"
   else
     _debug "no records exist, skip"
+    sleep 1
     return 0
   fi
 
@@ -116,9 +125,10 @@ dns_aws_rm() {
 
   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
     _info "TXT record deleted successfully."
+    sleep 1
     return 0
   fi
-
+  sleep 1
   return 1
 
 }

From bba5376a3693dc19186edd6ffc42277d45dfa2fb Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john@sodarock.com>
Date: Tue, 15 Oct 2019 14:37:38 -0700
Subject: [PATCH 091/246] Improve debug capabilities when using bash

When calling the _debug3() function will print the filename, function
name, and line number when running under bash
---
 acme.sh | 40 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index 041b5b44..46df2ed5 100755
--- a/acme.sh
+++ b/acme.sh
@@ -265,6 +265,37 @@ _usage() {
   printf "\n" >&2
 }
 
+__debug_bash_helper() {
+  # At this point only do for --debug 3
+  if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -lt "$DEBUG_LEVEL_3" ]; then
+    echo ""
+    return
+  fi
+  # Return extra debug info when running with bash, otherwise return empty
+  # string.
+  if [ -z "${BASH_VERSION}" ]; then
+    echo ""
+    return
+  fi
+  # We are a bash shell at this point, return the filename, function name, and
+  # line number as a string
+  _dbh_saveIFS=$IFS
+  IFS=" "
+  # Must use eval or syntax error happens under dash
+  # Use 'caller 1' as we want one level up the stack as we should be called
+  # by one of the _debug* functions
+  eval "_dbh_called=($(caller 1))"
+  IFS=$_dbh_saveIFS
+  _dbh_file=${_dbh_called[2]}
+  if [ -n "${_script_home}" ]; then
+    # Trim off the _script_home directory name
+    _dbh_file=${_dbh_file#$_script_home/}
+  fi
+  _dbh_function=${_dbh_called[1]}
+  _dbh_lineno=${_dbh_called[0]}
+  printf "%-40s " "$_dbh_file:${_dbh_function}:${_dbh_lineno}"
+}
+
 _debug() {
   if [ "${LOG_LEVEL:-$DEFAULT_LOG_LEVEL}" -ge "$LOG_LEVEL_1" ]; then
     _log "$@"
@@ -273,7 +304,8 @@ _debug() {
     _syslog "$SYSLOG_DEBUG" "$@"
   fi
   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_1" ]; then
-    _printargs "$@" >&2
+    _bash_debug=$(__debug_bash_helper)
+    _printargs "${_bash_debug}$@" >&2
   fi
 }
 
@@ -306,7 +338,8 @@ _debug2() {
     _syslog "$SYSLOG_DEBUG" "$@"
   fi
   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_2" ]; then
-    _printargs "$@" >&2
+    _bash_debug=$(__debug_bash_helper)
+    _printargs "${_bash_debug}$@" >&2
   fi
 }
 
@@ -338,7 +371,8 @@ _debug3() {
     _syslog "$SYSLOG_DEBUG" "$@"
   fi
   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -ge "$DEBUG_LEVEL_3" ]; then
-    _printargs "$@" >&2
+    _bash_debug=$(__debug_bash_helper)
+    _printargs "${_bash_debug}$@" >&2
   fi
 }
 

From ed9e196bf68d9eb4494fbd33826eaa2e2a9366bf Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 00:58:33 +0100
Subject: [PATCH 092/246] Update list of DNS providers for Plesk XML API

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index c8bebc6f..32d30147 100644
--- a/README.md
+++ b/README.md
@@ -321,6 +321,7 @@ You don't have to do anything manually!
 1. acme-dns (https://github.com/joohoi/acme-dns)
 1. TELE3 (https://www.tele3.cz)
 1. EUSERV.EU (https://www.euserv.eu)
+1. Plesk XML API (https://www.plesk.com)
 
 And: 
 

From 1339b9422d0a7ad0f8c57b549ddb50eff7c18d05 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:04:08 +0100
Subject: [PATCH 093/246] Update for dns pleskxml

---
 dnsapi/README.md | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 1f394f92..568baba9 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -897,6 +897,26 @@ acme.sh --issue --dns dns_euserv -d example.com -d *.example.com --insecure
 The `EUSERV_Username` and `EUSERV_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
 Please report any issues to https://github.com/initit/acme.sh or to <github@initit.de>
+
+## 47. Use Plesk XML API to automatically issue cert
+
+The plesk plugin uses an XML API to add and remove dns records. 
+The Plesk API URI (URL), and the user name and password for logging in, must be configured.
+
+```
+export pleskxml_uri="https://YOUR_PLESK_URI_HERE:8443/enterprise/control/agent.php"
+           (or probably something similar)
+export pleskxml_user="plesk username"
+export pleskxml_pass="plesk password"
+```
+
+Ok, let's issue a cert now:
+```
+acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
+```
+
+The `pleskxml_user`, `pleskxml_pass` and `pleskxml_uri` will be saved in `~/.acme.sh/account.conf` and are reused when needed.
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
@@ -917,4 +937,4 @@ See:  https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 
 # Use lexicon DNS API
 
-https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
\ No newline at end of file
+https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api

From 274393ac64fbccf994fd240498cb863348388da3 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:09:50 +0100
Subject: [PATCH 094/246] Create DNS 01 module for Plesk XML API

---
 dnsapi/dns_pleskxml | 402 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 402 insertions(+)
 create mode 100644 dnsapi/dns_pleskxml

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
new file mode 100644
index 00000000..a8a74721
--- /dev/null
+++ b/dnsapi/dns_pleskxml
@@ -0,0 +1,402 @@
+#!/usr/bin/env sh
+
+##  Name: dns_pleskxml.sh
+##  Created by Stilez.
+##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
+
+##  This DNS01 method uses the Plesk XML API described at:
+##  https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
+##  and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
+
+##  Note: a DNS ID with host = empty string is OK for this API, see
+##  https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
+##  For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
+##  So this API module can handle such a request, if needed.
+
+##  The plesk plugin uses the xml api to add and remvoe the dns records. Therefore the url, username
+##  and password have to be configured by the user before this module is called.
+##
+##  ```
+##  export pleskxml_uri="https://YOUR_PLESK_URI_HERE:8443/enterprise/control/agent.php"
+##          (or probably something similar)
+##  export pleskxml_user="plesk username"
+##  export pleskxml_pass="plesk password"
+##  ```
+
+##  Ok, let's issue a cert now:
+##  ```
+##  acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
+##  ```
+##
+##  The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
+
+
+####################  INTERNAL VARIABLES + NEWLINE  ##################################
+
+pleskxml_init_checks_done=0
+
+# Variable containing bare newline - not a style issue
+# shellcheck disable=SC1004
+NEWLINE='\
+'
+
+
+####################  API Templates ##################################
+
+pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
+  # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
+  # Also used to test credentials and URI.
+  # No args.
+pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
+  # Get all DNS records for a Plesk domain ID.
+  # ARG = Plesk domain id to query
+pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
+  # Add a TXT record to a domain.
+  # ARGS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
+pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
+  # Add a TXT record to a domain.
+  # ARG = the Plesk internal ID for the dns record to be deleted
+
+
+####################  Public functions ##################################
+
+#Usage: add     _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_pleskxml_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Entering dns_pleskxml_add() to add TXT record '$2' to domain '$1'..."
+
+  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
+  if ! _credential_check; then
+    return 1
+  fi
+
+  # Get root and subdomain details, and Plesk domain ID
+  if ! _pleskxml_get_root_domain "$fulldomain"; then
+    return 1
+  fi
+
+  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
+
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$( printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue" )"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # OK, we should have added a TXT record. Let's check and return success if so.
+  # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
+
+  results="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>' )"
+
+  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+    # Error - doesn't contain expected string. Something's wrong.
+    _err 'Error when calling Plesk XML API.'
+    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
+    _err 'This is unexpected: something has gone wrong.'
+    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    return 1
+  fi
+
+  recid="$( _value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/' )"
+
+  _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
+
+  return 0
+}
+
+#Usage: rm      _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_pleskxml_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Entering dns_pleskxml_rm() to remove TXT record '$2' from domain '$1'..."
+
+  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
+  if ! _credential_check; then
+    return 1
+  fi
+
+  # Get root and subdomain details, and Plesk domain ID
+  if ! _pleskxml_get_root_domain "$fulldomain"; then
+    return 1
+  fi
+
+  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs'
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$( printf "$pleskxml_tplt_get_dns_records" "$root_domain_id" )"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
+  reclist="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | \
+    grep "<site-id>${root_domain_id}</site-id>" | \
+    grep -E '<id>[0-9]+</id>' | \
+    grep '<type>TXT</type>' \
+  )"
+
+  if [ -z "$reclist" ]; then
+    _err "No TXT records found for root domain ${root_domain_name} (Plesk domain ID ${root_domain_id}). Exiting."
+    return 1
+  fi
+
+  _debug "Got list of DNS TXT records for root domain '$root_domain_name'"':\n'"$reclist"
+
+  recid="$( _value "$reclist" | \
+    grep "<host>$1.</host>" | \
+    grep "<value>$txtvalue</value>" | \
+    sed -E 's/(^.*<id>|<\/id>.*$)//g' \
+  )"
+
+  _debug "List of DNS TXT records for host:"'\n'"$( _value "$reclist" | grep "<host>$1.</host>" )"
+
+
+  if ! _value "$recid" | grep -Eq '^[0-9]+$'; then
+    _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
+    _err "Cannot delete TXT record. Exiting."
+    return 1
+  fi
+
+  _debug "Found Plesk record ID for target text string '${txtvalue}': ID=${recid}"
+  _debug 'Calling Plesk XML API to remove TXT record'
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$( printf "$pleskxml_tplt_rmv_dns_record" "$recid" )"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # OK, we should have removed a TXT record. Let's check and return success if so.
+  # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
+
+  results="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>' )"
+
+  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+    # Error - doesn't contain expected string. Something's wrong.
+    _err 'Error when calling Plesk XML API.'
+    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
+    _err 'This is unexpected: something has gone wrong.'
+    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    return 1
+  fi
+
+  _info "Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()."
+  return 0
+}
+
+
+
+####################  Private functions below ##################################
+
+# Outputs value of a variable
+_value() {
+  printf '%s' "$1"
+}
+
+
+# Outputs value of a variable (FQDN) and cuts it at 2 delimiters
+# $1, $2 = where to cut
+# $3 = FQDN
+_valuecut() {
+  printf '%s' "$3" | cut -d . -f "${1}-${2}"
+}
+
+
+# Cleans up an API response, splits it "per item" and greps for a string to validate useful lines
+# $1 - result string from API
+# $2 - tag to resplit on (usually "result" or "domain")
+# $3 - regex to recognise useful return lines
+_api_response_split() {
+  printf '%s' "$1" | \
+  sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' | \
+  tr -d '\n\r'  | \
+  sed -E "s/<\/?$2>/${NEWLINE}/g" | \
+  grep -E "$3"
+}
+
+
+# Calls Plesk XML API, and checks results for obvious issues
+_call_api() {
+  request="$1"
+  errtext=''
+
+  _debug 'Entered _call_api(). Calling Plesk XML API with request:\n' "'${request}'"
+
+  export _H1="HTTP_AUTH_LOGIN: $pleskxml_user"
+  export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass"
+  export _H3="content-Type: text/xml"
+  export _H4="HTTP_PRETTY_PRINT: true"
+  pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
+  pleskxml_retcode="$?"
+  _debug "acme _post() returned retcode=$pleskxml_retcode. Literal response:" '\n' "'${pleskxml_prettyprint_result}'"
+
+  # Error handling
+
+  # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
+  # Also detect if there simply aren't any status lines (null result?) and report that, as well.
+
+  statuslines="$( echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$' )"
+
+  if _value "$statuslines" | grep -qv '<status>ok</status>'; then
+
+    # We have some status lines that aren't "ok". Get the details
+    errtext="$( \
+      _value "$pleskxml_prettyprint_result" | \
+      grep -iE "(<status>|<errcode>|<errtext>)" | \
+      sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' | \
+      sed -E 's/^<([a-z]+)>/\1: /' \
+    )"
+
+  elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
+
+    # We have no status lines at all. Results are empty
+    errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.'
+
+  fi
+
+  if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
+    _err "The Plesk XML API call failed."
+    _err "The return code for the POST request was $pleskxml_retcode (0=success)."
+    if [ "$errtext" != "" ]; then
+      _err 'Status and error messages received from the Plesk server:\n' "$errtext"
+    else
+      _err "No additional error messages were received back from the Plesk server"
+    fi
+    return 1
+  fi
+
+  _debug "Leaving _call_api(). Successful call."
+
+  return 0
+}
+
+
+_credential_check() {
+  # Startup checks (credentials, URI)
+
+  _debug "Checking Plesk XML API login credentials and URI..."
+
+  if [ "$pleskxml_init_checks_done" -eq 1 ]; then
+    _debug "Initial checks already done, no need to repeat. Skipped."
+    return 0
+  fi
+
+
+  pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
+  pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
+  pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
+
+  _debug "Credentials - User: '${pleskxml_user}'  Passwd: ******  URI: '${pleskxml_uri}'"
+
+  if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then
+    pleskxml_user=""
+    pleskxml_pass=""
+    pleskxml_uri=""
+    _err "You didn't specify one or more of the Plesk XML API username, password, or URI."
+    _err "Please create these and try again."
+    _err "Instructions are in the module source code."
+    return 1
+  fi
+
+  # Test the API is usable, by trying to read the list of managed domains...
+  _call_api "$pleskxml_tplt_get_domains"
+  if [ "$pleskxml_retcode" -ne 0 ]; then
+    _err '\nFailed to access Plesk XML API.'
+    _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
+    return 1
+  fi
+
+  _saveaccountconf_mutable pleskxml_uri "$pleskxml_uri"
+  _saveaccountconf_mutable pleskxml_user "$pleskxml_user"
+  _saveaccountconf_mutable pleskxml_pass "$pleskxml_pass"
+
+  _debug "Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use."
+
+  pleskxml_init_checks_done=1
+
+  return 0
+}
+
+
+# For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
+_pleskxml_get_root_domain() {
+  _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
+
+  # test if the domain is valid for splitting.
+
+   if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
+  ### COMMENTED OUT ALSO FOR SAME REASON
+  ###  _err "Invalid domain. The ACME domain must contain at least three parts (aa.bb.tld) to identify a host, domain, and tld for the TXT record."
+    _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
+    return 1
+  fi
+
+  _debug "Querying Plesk server for list of managed domains..."
+
+  _call_api "$pleskxml_tplt_get_domains"
+  if [ "$pleskxml_retcode" -ne 0 ]; then
+    return 1
+  fi
+
+  # Generate a hacked list of domains known to this Plesk account.
+  # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
+  # for non-Western character sets.
+  # Output will be one line per known domain, containing 1 or 2 <name> tages and an <id> tag
+  # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
+  output="$( _api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>' )"
+
+  _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
+
+  # loop and test if domain, or any parent domain, is managed by Plesk
+  # Loop until we don't have any '.' in the sring we're testing as a root domain
+
+  root_domain_name="$1"
+  doneloop=0
+
+  while _contains "$root_domain_name" '\.'; do
+
+    _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
+
+    root_domain_id="$( _value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 |  sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/' )"
+
+    if [ -n "$root_domain_id" ]; then
+      # Found a match
+      # Note that a result with host = empty string is OK for this API, see
+      # https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
+      # See notes at top of this file
+      sub_domain_name="$( _value "$1" | sed -E "s/\.?${root_domain_name}"'$//' )"
+      _info "Matched host '$1' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
+      return 0
+    fi
+
+    # No match, try next parent up (if any)...
+
+    if _contains "$root_domain_name" '\.[^.]+\.'; then
+       _debug "No match, trying next parent up..."
+    else
+      _debug "No match,and next parent would be a TLD..."
+    fi
+    root_domain_name="$( _valuecut 2 1000 "$root_domain_name" )"
+    doneloop=1
+
+  done
+
+  # if we get here, we failed to find a root domain match in the list of domains managed by Plesk.
+  # if we never ran the loop a first time, $1 wasn't at least a 2 level domain (domain.tld) and wasn't valid anyway
+
+  if [ -z $doneloop ]; then
+    _err "'$1' isn't a valid domain for ACME DNS. Exiting."
+  else
+    _err "Cannot find '$1' or any parent domain of it, in Plesk."
+    _err "Are you sure that this domain is managed by this Plesk server?"
+  fi
+
+  return 1
+}

From a00300f88a7e9d85883616e55819f51052e64b7e Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:23:14 +0100
Subject: [PATCH 095/246] revert changes to this file

---
 README.md | 646 ++++++++++++++++--------------------------------------
 1 file changed, 189 insertions(+), 457 deletions(-)

diff --git a/README.md b/README.md
index 32d30147..613fff7f 100644
--- a/README.md
+++ b/README.md
@@ -1,503 +1,235 @@
+
+Skip to content
+Pull requests
+Issues
+Marketplace
+Explore
+@stilez
+Learn Git and GitHub without any code!
+
+Using the Hello World guide, you’ll start a branch, write comments, and open a pull request.
+
+395
+14.7k
+
+    1.9k
+
+Neilpang/acme.sh
+Code
+Issues 415
+Pull requests 110
+Actions
+Projects 0
+Wiki
+Security
+Insights
+You’re editing a file in a project you don’t have write access to. Submitting a change to this file will write it to a new branch in your fork stilez/acme.sh, so you can send a pull request.
+acme.sh/
+
+1
+
 # An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
-[![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+2
+
+​
+
+3
+
+<a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
+
+4
+
 - An ACME protocol client written purely in Shell (Unix shell) language.
+
+5
+
 - Full ACME protocol implementation.
+
+6
+
 - Support ACME v1 and ACME v2
+
+7
+
 - Support ACME v2 wildcard certs
+
+8
+
 - Simple, powerful and very easy to use. You only need 3 minutes to learn it.
+
+9
+
 - Bash, dash and sh compatible.
+
+10
+
 - Simplest shell script for Let's Encrypt free certificate client.
+
+11
+
 - Purely written in Shell with no dependencies on python or the official Let's Encrypt client.
+
+12
+
 - Just one script to issue, renew and install your certificates automatically.
+
+13
+
 - DOES NOT require `root/sudoer` access.
+
+14
+
 - Docker friendly
+
+15
+
 - IPv6 support
 
+16
+
+- Cron job notifications for renewal or error etc.
+
+17
+
+​
+
+18
+
 It's probably the `easiest & smartest` shell script to automatically issue & renew the free certificates from Let's Encrypt.
 
+19
+
+​
+
+20
+
 Wiki: https://github.com/Neilpang/acme.sh/wiki
 
+21
+
+​
+
+22
+
 For Docker Fans: [acme.sh :two_hearts: Docker ](https://github.com/Neilpang/acme.sh/wiki/Run-acme.sh-in-docker)
 
+23
+
+​
+
+24
+
 Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 
+25
+
+​
+
+26
+
+​
+
+27
 
 # [中文说明](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
 
+28
+
+​
+
+29
+
 # Who:
+
+30
+
 - [FreeBSD.org](https://blog.crashed.org/letsencrypt-in-freebsd-org/)
+
+31
+
 - [ruby-china.org](https://ruby-china.org/topics/31983)
+
+32
+
 - [Proxmox](https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x_and_newer))
+
+33
+
 - [pfsense](https://github.com/pfsense/FreeBSD-ports/pull/89)
+
+34
+
 - [webfaction](https://community.webfaction.com/questions/19988/using-letsencrypt)
+
+35
+
 - [Loadbalancer.org](https://www.loadbalancer.org/blog/loadbalancer-org-with-lets-encrypt-quick-and-dirty)
+
+36
+
 - [discourse.org](https://meta.discourse.org/t/setting-up-lets-encrypt/40709)
+
+37
+
 - [Centminmod](https://centminmod.com/letsencrypt-acmetool-https.html)
+
+38
+
 - [splynx](https://forum.splynx.com/t/free-ssl-cert-for-splynx-lets-encrypt/297)
-- [archlinux](https://aur.archlinux.org/packages/acme.sh-git/)
+
+39
+
+- [archlinux](https://www.archlinux.org/packages/community/any/acme.sh)
+
+40
+
 - [opnsense.org](https://github.com/opnsense/plugins/tree/master/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient)
+
+41
+
 - [CentOS Web Panel](http://centos-webpanel.com/)
+
+42
+
 - [lnmp.org](https://lnmp.org/)
+
+43
+
 - [more...](https://github.com/Neilpang/acme.sh/wiki/Blogs-and-tutorials)
 
+44
+
+​
+
+45
+
 # Tested OS
 
+46
+
+​
+
+47
+
 | NO | Status| Platform|
-|----|-------|---------|
-|1|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/ubuntu-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Ubuntu
-|2|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/debian-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Debian
-|3|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/centos-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|CentOS
-|4|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/windows-cygwin.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
-|5|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/freebsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|FreeBSD
-|6|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/pfsense.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|pfsense
-|7|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/opensuse-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|openSUSE
-|8|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/alpine-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Alpine Linux (with curl)
-|9|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/base-archlinux.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Archlinux
-|10|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/fedora-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|fedora
-|11|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/kalilinux-kali-linux-docker.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Kali Linux
-|12|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/oraclelinux-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Oracle Linux
-|13|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/proxmox.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
-|14|-----| Cloud Linux  https://github.com/Neilpang/le/issues/111
-|15|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/openbsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|OpenBSD
-|16|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/mageia.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Mageia
-|17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/Neilpang/acme.sh/wiki/How-to-run-on-OpenWRT)
-|18|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/solaris.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|SunOS/Solaris
-|19|[![](https://cdn.rawgit.com/Neilpang/acmetest/master/status/gentoo-stage3-amd64.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Gentoo Linux
-|20|[![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)|Mac OSX
 
-For all build statuses, check our [weekly build project](https://github.com/Neilpang/acmetest):
+@stilez
+Propose file change
+Commit summary
+Optional extended description
+
+    © 2019 GitHub, Inc.
+    Terms
+    Privacy
+    Security
+    Status
+    Help
+
+    Contact GitHub
+    Pricing
+    API
+    Training
+    Blog
+    About
 
-https://github.com/Neilpang/acmetest
-
-
-# Supported modes
-
-- Webroot mode
-- Standalone mode
-- Apache mode
-- Nginx mode
-- DNS mode
-- [DNS alias mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode)
-- [Stateless mode](https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode)
-
-
-# 1. How to install
-
-### 1. Install online
-
-Check this project: https://github.com/Neilpang/get.acme.sh
-
-```bash
-curl https://get.acme.sh | sh
-```
-
-Or:
-
-```bash
-wget -O -  https://get.acme.sh | sh
-```
-
-
-### 2. Or, Install from git
-
-Clone this project and launch installation:
-
-```bash
-git clone https://github.com/Neilpang/acme.sh.git
-cd ./acme.sh
-./acme.sh --install
-```
-
-You `don't have to be root` then, although `it is recommended`.
-
-Advanced Installation: https://github.com/Neilpang/acme.sh/wiki/How-to-install
-
-The installer will perform 3 actions:
-
-1. Create and copy `acme.sh` to your home dir (`$HOME`): `~/.acme.sh/`.
-All certs will be placed in this folder too.
-2. Create alias for: `acme.sh=~/.acme.sh/acme.sh`.
-3. Create daily cron job to check and renew the certs if needed.
-
-Cron entry example:
-
-```bash
-0 0 * * * "/home/user/.acme.sh"/acme.sh --cron --home "/home/user/.acme.sh" > /dev/null
-```
-
-After the installation, you must close the current terminal and reopen it to make the alias take effect.
-
-Ok, you are ready to issue certs now.
-
-Show help message:
-
-```sh
-root@v1:~# acme.sh -h
-```
-
-# 2. Just issue a cert
-
-**Example 1:** Single domain.
-
-```bash
-acme.sh --issue -d example.com -w /home/wwwroot/example.com
-```
-
-or:
-
-```bash
-acme.sh --issue -d example.com -w /home/username/public_html
-```
-
-or:
-
-```bash
-acme.sh --issue -d example.com -w /var/www/html
-```
-
-**Example 2:** Multiple domains in the same cert.
-
-```bash
-acme.sh --issue -d example.com -d www.example.com -d cp.example.com -w /home/wwwroot/example.com
-```
-
-The parameter `/home/wwwroot/example.com` or `/home/username/public_html` or `/var/www/html` is the web root folder where you host your website files. You **MUST** have `write access` to this folder.
-
-Second argument **"example.com"** is the main domain you want to issue the cert for.
-You must have at least one domain there.
-
-You must point and bind all the domains to the same webroot dir: `/home/wwwroot/example.com`.
-
-The certs will be placed in `~/.acme.sh/example.com/`
-
-The certs will be renewed automatically every **60** days.
-
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
-
-
-# 3. Install the cert to Apache/Nginx etc.
-
-After the cert is generated, you probably want to install/copy the cert to your Apache/Nginx or other servers.
-You **MUST** use this command to copy the certs to the target files, **DO NOT** use the certs files in **~/.acme.sh/** folder, they are for internal use only, the folder structure may change in the future.
-
-**Apache** example:
-```bash
-acme.sh --install-cert -d example.com \
---cert-file      /path/to/certfile/in/apache/cert.pem  \
---key-file       /path/to/keyfile/in/apache/key.pem  \
---fullchain-file /path/to/fullchain/certfile/apache/fullchain.pem \
---reloadcmd     "service apache2 force-reload"
-```
-
-**Nginx** example:
-```bash
-acme.sh --install-cert -d example.com \
---key-file       /path/to/keyfile/in/nginx/key.pem  \
---fullchain-file /path/to/fullchain/nginx/cert.pem \
---reloadcmd     "service nginx force-reload"
-```
-
-Only the domain is required, all the other parameters are optional.
-
-The ownership and permission info of existing files are preserved. You can pre-create the files to define the ownership and permission.
-
-Install/copy the cert/key to the production Apache or Nginx path.
-
-The cert will be renewed every **60** days by default (which is configurable). Once the cert is renewed, the Apache/Nginx service will be reloaded automatically by the command: `service apache2 force-reload` or `service nginx force-reload`.
-
-
-**Please take care:  The reloadcmd is very important. The cert can be automatically renewed, but, without a correct 'reloadcmd' the cert may not be flushed to your server(like nginx or apache), then your website will not be able to show renewed cert in 60 days.**
-
-# 4. Use Standalone server to issue cert
-
-**(requires you to be root/sudoer or have permission to listen on port 80 (TCP))**
-
-Port `80` (TCP) **MUST** be free to listen on, otherwise you will be prompted to free it and try again.
-
-```bash
-acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
-```
-
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
-
-
-# 5. Use Apache mode
-
-**(requires you to be root/sudoer, since it is required to interact with Apache server)**
-
-If you are running a web server, Apache or Nginx, it is recommended to use the `Webroot mode`.
-
-Particularly, if you are running an Apache server, you can use Apache mode instead. This mode doesn't write any files to your web root folder.
-
-Just set string "apache" as the second argument and it will force use of apache plugin automatically.
-
-```sh
-acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
-```
-
-**This apache mode is only to issue the cert, it will not change your apache config files. 
-You will need to configure your website config files to use the cert by yourself.
-We don't want to mess your apache server, don't worry.**
-
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
-
-# 6. Use Nginx mode
-
-**(requires you to be root/sudoer, since it is required to interact with Nginx server)**
-
-If you are running a web server, Apache or Nginx, it is recommended to use the `Webroot mode`.
-
-Particularly, if you are running an nginx server, you can use nginx mode instead. This mode doesn't write any files to your web root folder.
-
-Just set string "nginx" as the second argument.
-
-It will configure nginx server automatically to verify the domain and then restore the nginx config to the original version.
-
-So, the config is not changed.
-
-```sh
-acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
-```
-
-**This nginx mode is only to issue the cert, it will not change your nginx config files. 
-You will need to configure your website config files to use the cert by yourself.
-We don't want to mess your nginx server, don't worry.**
-
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
-
-# 7. Automatic DNS API integration
-
-If your DNS provider supports API access, we can use that API to automatically issue the certs.
-
-You don't have to do anything manually!
-
-### Currently acme.sh supports:
-
-1. CloudFlare.com API
-1. DNSPod.cn API
-1. CloudXNS.com API
-1. GoDaddy.com API
-1. PowerDNS.com API
-1. OVH, kimsufi, soyoustart and runabove API
-1. nsupdate API
-1. LuaDNS.com API
-1. DNSMadeEasy.com API
-1. AWS Route 53
-1. aliyun.com(阿里云) API
-1. ISPConfig 3.1 API
-1. Alwaysdata.com API
-1. Linode.com API
-1. FreeDNS (https://freedns.afraid.org/)
-1. cyon.ch
-1. Domain-Offensive/Resellerinterface/Domainrobot API
-1. Gandi LiveDNS API
-1. Knot DNS API
-1. DigitalOcean API (native)
-1. ClouDNS.net API
-1. Infoblox NIOS API (https://www.infoblox.com/)
-1. VSCALE (https://vscale.io/)
-1. Dynu API (https://www.dynu.com)
-1. DNSimple API
-1. NS1.com API
-1. DuckDNS.org API
-1. Name.com API
-1. Dyn Managed DNS API
-1. Yandex PDD API (https://pdd.yandex.ru)
-1. Hurricane Electric DNS service (https://dns.he.net)
-1. UnoEuro API (https://www.unoeuro.com/)
-1. INWX (https://www.inwx.de/)
-1. Servercow (https://servercow.de)
-1. Namesilo (https://www.namesilo.com)
-1. InternetX autoDNS API (https://internetx.com)
-1. Azure DNS
-1. selectel.com(selectel.ru) DNS API
-1. zonomi.com DNS API
-1. DreamHost.com API
-1. DirectAdmin API
-1. KingHost (https://www.kinghost.com.br/)
-1. Zilore (https://zilore.com)
-1. Loopia.se API
-1. acme-dns (https://github.com/joohoi/acme-dns)
-1. TELE3 (https://www.tele3.cz)
-1. EUSERV.EU (https://www.euserv.eu)
-1. Plesk XML API (https://www.plesk.com)
-
-And: 
-
-**lexicon DNS API: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
-   (DigitalOcean, DNSimple, DNSMadeEasy, DNSPark, EasyDNS, Namesilo, NS1, PointHQ, Rage4 and Vultr etc.)**
-
-
-**More APIs coming soon...**
-
-If your DNS provider is not on the supported list above, you can write your own DNS API script easily. If you do, please consider submitting a [Pull Request](https://github.com/Neilpang/acme.sh/pulls) and contribute it to the project.
-
-For more details: [How to use DNS API](dnsapi)
-
-# 8. Use DNS manual mode:
-
-See: https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode first.
-
-If your dns provider doesn't support any api access, you can add the txt record by your hand.
-
-```bash
-acme.sh --issue --dns -d example.com -d www.example.com -d cp.example.com
-```
-
-You should get an output like below:
-
-```sh
-Add the following txt record:
-Domain:_acme-challenge.example.com
-Txt value:9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c
-
-Add the following txt record:
-Domain:_acme-challenge.www.example.com
-Txt value:9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
-
-Please add those txt records to the domains. Waiting for the dns to take effect.
-```
-
-Then just rerun with `renew` argument:
-
-```bash
-acme.sh --renew -d example.com
-```
-
-Ok, it's done.
-
-**Take care, this is dns manual mode, it can not be renewed automatically. you will have to add a new txt record to your domain by your hand when you renew your cert.**
-
-**Please use dns api mode instead.**
-
-# 9. Issue ECC certificates
-
-`Let's Encrypt` can now issue **ECDSA** certificates.
-
-And we support them too!
-
-Just set the `keylength` parameter with a prefix `ec-`.
-
-For example:
-
-### Single domain ECC certificate
-
-```bash
-acme.sh --issue -w /home/wwwroot/example.com -d example.com --keylength ec-256
-```
-
-### SAN multi domain ECC certificate
-
-```bash
-acme.sh --issue -w /home/wwwroot/example.com -d example.com -d www.example.com --keylength ec-256
-```
-
-Please look at the `keylength` parameter above.
-
-Valid values are:
-
-1. **ec-256 (prime256v1, "ECDSA P-256")**
-2. **ec-384 (secp384r1,  "ECDSA P-384")**
-3. **ec-521 (secp521r1,  "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
-
-
-
-# 10. Issue Wildcard certificates
-
-It's simple, just give a wildcard domain as the `-d` parameter.
-
-```sh
-acme.sh  --issue -d example.com  -d '*.example.com'  --dns dns_cf
-```
-
-
-
-# 11. How to renew the certs
-
-No, you don't need to renew the certs manually. All the certs will be renewed automatically every **60** days.
-
-However, you can also force to renew a cert:
-
-```sh
-acme.sh --renew -d example.com --force
-```
-
-or, for ECC cert:
-
-```sh
-acme.sh --renew -d example.com --force --ecc
-```
-
-
-# 12. How to stop cert renewal
-
-To stop renewal of a cert, you can execute the following to remove the cert from the renewal list:
-
-```sh
-acme.sh --remove -d example.com [--ecc]
-```
-
-The cert/key file is not removed from the disk.
-
-You can remove the respective directory (e.g. `~/.acme.sh/example.com`) by yourself.
-
-
-# 13. How to upgrade `acme.sh`
-
-acme.sh is in constant development, so it's strongly recommended to use the latest code.
-
-You can update acme.sh to the latest code:
-
-```sh
-acme.sh --upgrade
-```
-
-You can also enable auto upgrade:
-
-```sh
-acme.sh --upgrade --auto-upgrade
-```
-
-Then **acme.sh** will be kept up to date automatically.
-
-Disable auto upgrade:
-
-```sh
-acme.sh --upgrade --auto-upgrade 0
-```
-
-
-# 14. Issue a cert from an existing CSR
-
-https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
-
-
-# 15. Under the Hood
-
-Speak ACME language using shell, directly to "Let's Encrypt".
-
-TODO:
-
-
-# 16. Acknowledgments
-
-1. Acme-tiny: https://github.com/diafygi/acme-tiny
-2. ACME protocol: https://github.com/ietf-wg-acme/acme
-
-
-# 17. License & Others
-
-License is GPLv3
-
-Please Star and Fork me.
-
-[Issues](https://github.com/Neilpang/acme.sh/issues) and [pull requests](https://github.com/Neilpang/acme.sh/pulls) are welcome.
-
-
-# 18. Donate
-Your donation makes **acme.sh** better:
-
-1. PayPal/Alipay(支付宝)/Wechat(微信): [https://donate.acme.sh/](https://donate.acme.sh/)
-  
-[Donate List](https://github.com/Neilpang/acme.sh/wiki/Donate-list)

From 4c9d99040c822b35eefbcee46b88bdb766af32a5 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:31:17 +0100
Subject: [PATCH 096/246] Fix (revert) edited .md file

---
 README.md | 609 +++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 461 insertions(+), 148 deletions(-)

diff --git a/README.md b/README.md
index 6c692885..d5012d68 100644
--- a/README.md
+++ b/README.md
@@ -1,185 +1,498 @@
-
-Skip to content
-Pull requests
-Issues
-Marketplace
-Explore
-@stilez
-Learn Git and GitHub without any code!
-
-Using the Hello World guide, you’ll start a branch, write comments, and open a pull request.
-
-395
-14.7k
-
-    1.9k
-
-Neilpang/acme.sh
-Code
-Issues 415
-Pull requests 110
-Actions
-Projects 0
-Wiki
-Security
-Insights
-You’re editing a file in a project you don’t have write access to. Submitting a change to this file will write it to a new branch in your fork stilez/acme.sh, so you can send a pull request.
-acme.sh/
-
-1
-
-
-2
-
-
-3
+# An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
 
 <a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
-
-4
-
 - An ACME protocol client written purely in Shell (Unix shell) language.
-
-5
-
 - Full ACME protocol implementation.
-
-6
-
-
-7
-
-
-8
-
+- Support ACME v1 and ACME v2
+- Support ACME v2 wildcard certs
 - Simple, powerful and very easy to use. You only need 3 minutes to learn it.
-
+- Bash, dash and sh compatible.
+- Simplest shell script for Let's Encrypt free certificate client.
+- Purely written in Shell with no dependencies on python or the official Let's Encrypt client.
+- Just one script to issue, renew and install your certificates automatically.
 - DOES NOT require `root/sudoer` access.
-
-14
-
 - Docker friendly
-
-15
-
 - IPv6 support
-
-16
-
 - Cron job notifications for renewal or error etc.
 
-17
-
-​
-
-18
-
 It's probably the `easiest & smartest` shell script to automatically issue & renew the free certificates from Let's Encrypt.
 
-19
-
-
-20
-
 Wiki: https://github.com/Neilpang/acme.sh/wiki
 
-21
-
-​
-
-22
-
 For Docker Fans: [acme.sh :two_hearts: Docker ](https://github.com/Neilpang/acme.sh/wiki/Run-acme.sh-in-docker)
 
-23
-
-​
-
-24
-
 Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 
-25
-
-​
-
-26
-
-
-27
 
 # [中文说明](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
 
-28
-
-​
-
-
 # Who:
-
-30
-
 - [FreeBSD.org](https://blog.crashed.org/letsencrypt-in-freebsd-org/)
-
-31
-
 - [ruby-china.org](https://ruby-china.org/topics/31983)
-
-32
-
-
-33
-
+- [Proxmox](https://pve.proxmox.com/wiki/HTTPS_Certificate_Configuration_(Version_4.x_and_newer))
 - [pfsense](https://github.com/pfsense/FreeBSD-ports/pull/89)
-
-34
-
 - [webfaction](https://community.webfaction.com/questions/19988/using-letsencrypt)
-
-35
-
-
-36
-
+- [Loadbalancer.org](https://www.loadbalancer.org/blog/loadbalancer-org-with-lets-encrypt-quick-and-dirty)
 - [discourse.org](https://meta.discourse.org/t/setting-up-lets-encrypt/40709)
-
-37
-
 - [Centminmod](https://centminmod.com/letsencrypt-acmetool-https.html)
-
-38
-
 - [splynx](https://forum.splynx.com/t/free-ssl-cert-for-splynx-lets-encrypt/297)
-
-39
-
 - [archlinux](https://www.archlinux.org/packages/community/any/acme.sh)
-
-40
-
-
-41
-
+- [opnsense.org](https://github.com/opnsense/plugins/tree/master/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient)
 - [CentOS Web Panel](http://centos-webpanel.com/)
-
-
 - [lnmp.org](https://lnmp.org/)
-
-43
-
 - [more...](https://github.com/Neilpang/acme.sh/wiki/Blogs-and-tutorials)
 
-
-​
-
-45
-
-
-46
-
-​
-
-47
+# Tested OS
 
 | NO | Status| Platform|
+|----|-------|---------|
+|1|[![](https://neilpang.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Ubuntu
+|2|[![](https://neilpang.github.io/acmetest/status/debian-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Debian
+|3|[![](https://neilpang.github.io/acmetest/status/centos-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|CentOS
+|4|[![](https://neilpang.github.io/acmetest/status/windows-cygwin.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
+|5|[![](https://neilpang.github.io/acmetest/status/freebsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|FreeBSD
+|6|[![](https://neilpang.github.io/acmetest/status/pfsense.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|pfsense
+|7|[![](https://neilpang.github.io/acmetest/status/opensuse-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|openSUSE
+|8|[![](https://neilpang.github.io/acmetest/status/alpine-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Alpine Linux (with curl)
+|9|[![](https://neilpang.github.io/acmetest/status/base-archlinux.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Archlinux
+|10|[![](https://neilpang.github.io/acmetest/status/fedora-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|fedora
+|11|[![](https://neilpang.github.io/acmetest/status/kalilinux-kali-linux-docker.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Kali Linux
+|12|[![](https://neilpang.github.io/acmetest/status/oraclelinux-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Oracle Linux
+|13|[![](https://neilpang.github.io/acmetest/status/proxmox.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
+|14|-----| Cloud Linux  https://github.com/Neilpang/le/issues/111
+|15|[![](https://neilpang.github.io/acmetest/status/openbsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|OpenBSD
+|16|[![](https://neilpang.github.io/acmetest/status/mageia.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Mageia
+|17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/Neilpang/acme.sh/wiki/How-to-run-on-OpenWRT)
+|18|[![](https://neilpang.github.io/acmetest/status/solaris.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|SunOS/Solaris
+|19|[![](https://neilpang.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Gentoo Linux
+|20|[![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)|Mac OSX
 
+For all build statuses, check our [weekly build project](https://github.com/Neilpang/acmetest):
+
+https://github.com/Neilpang/acmetest
+
+# Supported CA
+
+- Letsencrypt.org CA(default)
+- [BuyPass.com CA](https://github.com/Neilpang/acme.sh/wiki/BuyPass.com-CA)
+- [Pebble strict Mode](https://github.com/letsencrypt/pebble)
+
+# Supported modes
+
+- Webroot mode
+- Standalone mode
+- Standalone tls-alpn mode
+- Apache mode
+- Nginx mode
+- DNS mode
+- [DNS alias mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode)
+- [Stateless mode](https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode)
+
+
+# 1. How to install
+
+### 1. Install online
+
+Check this project: https://github.com/Neilpang/get.acme.sh
+
+```bash
+curl https://get.acme.sh | sh
+```
+
+Or:
+
+```bash
+wget -O -  https://get.acme.sh | sh
+```
+
+
+### 2. Or, Install from git
+
+Clone this project and launch installation:
+
+```bash
+git clone https://github.com/Neilpang/acme.sh.git
+cd ./acme.sh
+./acme.sh --install
+```
+
+You `don't have to be root` then, although `it is recommended`.
+
+Advanced Installation: https://github.com/Neilpang/acme.sh/wiki/How-to-install
+
+The installer will perform 3 actions:
+
+1. Create and copy `acme.sh` to your home dir (`$HOME`): `~/.acme.sh/`.
+All certs will be placed in this folder too.
+2. Create alias for: `acme.sh=~/.acme.sh/acme.sh`.
+3. Create daily cron job to check and renew the certs if needed.
+
+Cron entry example:
+
+```bash
+0 0 * * * "/home/user/.acme.sh"/acme.sh --cron --home "/home/user/.acme.sh" > /dev/null
+```
+
+After the installation, you must close the current terminal and reopen it to make the alias take effect.
+
+Ok, you are ready to issue certs now.
+
+Show help message:
+
+```sh
+root@v1:~# acme.sh -h
+```
+
+# 2. Just issue a cert
+
+**Example 1:** Single domain.
+
+```bash
+acme.sh --issue -d example.com -w /home/wwwroot/example.com
+```
+
+or:
+
+```bash
+acme.sh --issue -d example.com -w /home/username/public_html
+```
+
+or:
+
+```bash
+acme.sh --issue -d example.com -w /var/www/html
+```
+
+**Example 2:** Multiple domains in the same cert.
+
+```bash
+acme.sh --issue -d example.com -d www.example.com -d cp.example.com -w /home/wwwroot/example.com
+```
+
+The parameter `/home/wwwroot/example.com` or `/home/username/public_html` or `/var/www/html` is the web root folder where you host your website files. You **MUST** have `write access` to this folder.
+
+Second argument **"example.com"** is the main domain you want to issue the cert for.
+You must have at least one domain there.
+
+You must point and bind all the domains to the same webroot dir: `/home/wwwroot/example.com`.
+
+The certs will be placed in `~/.acme.sh/example.com/`
+
+The certs will be renewed automatically every **60** days.
+
+More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+
+
+# 3. Install the cert to Apache/Nginx etc.
+
+After the cert is generated, you probably want to install/copy the cert to your Apache/Nginx or other servers.
+You **MUST** use this command to copy the certs to the target files, **DO NOT** use the certs files in **~/.acme.sh/** folder, they are for internal use only, the folder structure may change in the future.
+
+**Apache** example:
+```bash
+acme.sh --install-cert -d example.com \
+--cert-file      /path/to/certfile/in/apache/cert.pem  \
+--key-file       /path/to/keyfile/in/apache/key.pem  \
+--fullchain-file /path/to/fullchain/certfile/apache/fullchain.pem \
+--reloadcmd     "service apache2 force-reload"
+```
+
+**Nginx** example:
+```bash
+acme.sh --install-cert -d example.com \
+--key-file       /path/to/keyfile/in/nginx/key.pem  \
+--fullchain-file /path/to/fullchain/nginx/cert.pem \
+--reloadcmd     "service nginx force-reload"
+```
+
+Only the domain is required, all the other parameters are optional.
+
+The ownership and permission info of existing files are preserved. You can pre-create the files to define the ownership and permission.
+
+Install/copy the cert/key to the production Apache or Nginx path.
+
+The cert will be renewed every **60** days by default (which is configurable). Once the cert is renewed, the Apache/Nginx service will be reloaded automatically by the command: `service apache2 force-reload` or `service nginx force-reload`.
+
+
+**Please take care:  The reloadcmd is very important. The cert can be automatically renewed, but, without a correct 'reloadcmd' the cert may not be flushed to your server(like nginx or apache), then your website will not be able to show renewed cert in 60 days.**
+
+# 4. Use Standalone server to issue cert
+
+**(requires you to be root/sudoer or have permission to listen on port 80 (TCP))**
+
+Port `80` (TCP) **MUST** be free to listen on, otherwise you will be prompted to free it and try again.
+
+```bash
+acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
+```
+
+More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+
+# 5. Use Standalone ssl server to issue cert
+
+**(requires you to be root/sudoer or have permission to listen on port 443 (TCP))**
+
+Port `443` (TCP) **MUST** be free to listen on, otherwise you will be prompted to free it and try again.
+
+```bash
+acme.sh --issue --alpn -d example.com -d www.example.com -d cp.example.com
+```
+
+More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+
+
+# 6. Use Apache mode
+
+**(requires you to be root/sudoer, since it is required to interact with Apache server)**
+
+If you are running a web server, Apache or Nginx, it is recommended to use the `Webroot mode`.
+
+Particularly, if you are running an Apache server, you can use Apache mode instead. This mode doesn't write any files to your web root folder.
+
+Just set string "apache" as the second argument and it will force use of apache plugin automatically.
+
+```sh
+acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
+```
+
+**This apache mode is only to issue the cert, it will not change your apache config files.
+You will need to configure your website config files to use the cert by yourself.
+We don't want to mess your apache server, don't worry.**
+
+More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+
+# 7. Use Nginx mode
+
+**(requires you to be root/sudoer, since it is required to interact with Nginx server)**
+
+If you are running a web server, Apache or Nginx, it is recommended to use the `Webroot mode`.
+
+Particularly, if you are running an nginx server, you can use nginx mode instead. This mode doesn't write any files to your web root folder.
+
+Just set string "nginx" as the second argument.
+
+It will configure nginx server automatically to verify the domain and then restore the nginx config to the original version.
+
+So, the config is not changed.
+
+```sh
+acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
+```
+
+**This nginx mode is only to issue the cert, it will not change your nginx config files.
+You will need to configure your website config files to use the cert by yourself.
+We don't want to mess your nginx server, don't worry.**
+
+More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+
+# 8. Automatic DNS API integration
+
+If your DNS provider supports API access, we can use that API to automatically issue the certs.
+
+You don't have to do anything manually!
+
+### Currently acme.sh supports most of the dns providers:
+
+https://github.com/Neilpang/acme.sh/wiki/dnsapi
+
+# 9. Use DNS manual mode:
+
+See: https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode first.
+
+If your dns provider doesn't support any api access, you can add the txt record by your hand.
+
+```bash
+acme.sh --issue --dns -d example.com -d www.example.com -d cp.example.com
+```
+
+You should get an output like below:
+
+```sh
+Add the following txt record:
+Domain:_acme-challenge.example.com
+Txt value:9ihDbjYfTExAYeDs4DBUeuTo18KBzwvTEjUnSwd32-c
+
+Add the following txt record:
+Domain:_acme-challenge.www.example.com
+Txt value:9ihDbjxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+Please add those txt records to the domains. Waiting for the dns to take effect.
+```
+
+Then just rerun with `renew` argument:
+
+```bash
+acme.sh --renew -d example.com
+```
+
+Ok, it's done.
+
+**Take care, this is dns manual mode, it can not be renewed automatically. you will have to add a new txt record to your domain by your hand when you renew your cert.**
+
+**Please use dns api mode instead.**
+
+# 10. Issue ECC certificates
+
+`Let's Encrypt` can now issue **ECDSA** certificates.
+
+And we support them too!
+
+Just set the `keylength` parameter with a prefix `ec-`.
+
+For example:
+
+### Single domain ECC certificate
+
+```bash
+acme.sh --issue -w /home/wwwroot/example.com -d example.com --keylength ec-256
+```
+
+### SAN multi domain ECC certificate
+
+```bash
+acme.sh --issue -w /home/wwwroot/example.com -d example.com -d www.example.com --keylength ec-256
+```
+
+Please look at the `keylength` parameter above.
+
+Valid values are:
+
+1. **ec-256 (prime256v1, "ECDSA P-256")**
+2. **ec-384 (secp384r1,  "ECDSA P-384")**
+3. **ec-521 (secp521r1,  "ECDSA P-521", which is not supported by Let's Encrypt yet.)**
+
+
+
+# 11. Issue Wildcard certificates
+
+It's simple, just give a wildcard domain as the `-d` parameter.
+
+```sh
+acme.sh  --issue -d example.com  -d '*.example.com'  --dns dns_cf
+```
+
+
+
+# 12. How to renew the certs
+
+No, you don't need to renew the certs manually. All the certs will be renewed automatically every **60** days.
+
+However, you can also force to renew a cert:
+
+```sh
+acme.sh --renew -d example.com --force
+```
+
+or, for ECC cert:
+
+```sh
+acme.sh --renew -d example.com --force --ecc
+```
+
+
+# 13. How to stop cert renewal
+
+To stop renewal of a cert, you can execute the following to remove the cert from the renewal list:
+
+```sh
+acme.sh --remove -d example.com [--ecc]
+```
+
+The cert/key file is not removed from the disk.
+
+You can remove the respective directory (e.g. `~/.acme.sh/example.com`) by yourself.
+
+
+# 14. How to upgrade `acme.sh`
+
+acme.sh is in constant development, so it's strongly recommended to use the latest code.
+
+You can update acme.sh to the latest code:
+
+```sh
+acme.sh --upgrade
+```
+
+You can also enable auto upgrade:
+
+```sh
+acme.sh --upgrade --auto-upgrade
+```
+
+Then **acme.sh** will be kept up to date automatically.
+
+Disable auto upgrade:
+
+```sh
+acme.sh --upgrade --auto-upgrade 0
+```
+
+
+# 15. Issue a cert from an existing CSR
+
+https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
+
+
+# 16. Send notifications in cronjob
+
+https://github.com/Neilpang/acme.sh/wiki/notify
+
+
+# 17. Under the Hood
+
+Speak ACME language using shell, directly to "Let's Encrypt".
+
+TODO:
+
+
+# 18. Acknowledgments
+
+1. Acme-tiny: https://github.com/diafygi/acme-tiny
+2. ACME protocol: https://github.com/ietf-wg-acme/acme
+
+
+## Contributors
+
+### Code Contributors
+
+This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
+<a href="https://github.com/Neilpang/acme.sh/graphs/contributors"><img src="https://opencollective.com/acmesh/contributors.svg?width=890&button=false" /></a>
+
+### Financial Contributors
+
+Become a financial contributor and help us sustain our community. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+#### Individuals
+
+<a href="https://opencollective.com/acmesh"><img src="https://opencollective.com/acmesh/individuals.svg?width=890"></a>
+
+#### Organizations
+
+Support this project with your organization. Your logo will show up here with a link to your website. [[Contribute](https://opencollective.com/acmesh/contribute)]
+
+<a href="https://opencollective.com/acmesh/organization/0/website"><img src="https://opencollective.com/acmesh/organization/0/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/1/website"><img src="https://opencollective.com/acmesh/organization/1/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/2/website"><img src="https://opencollective.com/acmesh/organization/2/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/3/website"><img src="https://opencollective.com/acmesh/organization/3/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/4/website"><img src="https://opencollective.com/acmesh/organization/4/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/5/website"><img src="https://opencollective.com/acmesh/organization/5/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/6/website"><img src="https://opencollective.com/acmesh/organization/6/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/7/website"><img src="https://opencollective.com/acmesh/organization/7/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/8/website"><img src="https://opencollective.com/acmesh/organization/8/avatar.svg"></a>
+<a href="https://opencollective.com/acmesh/organization/9/website"><img src="https://opencollective.com/acmesh/organization/9/avatar.svg"></a>
+
+# 19. License & Others
+
+License is GPLv3
+
+Please Star and Fork me.
+
+[Issues](https://github.com/Neilpang/acme.sh/issues) and [pull requests](https://github.com/Neilpang/acme.sh/pulls) are welcome.
+
+
+# 20. Donate
+Your donation makes **acme.sh** better:
+
+1. PayPal/Alipay(支付宝)/Wechat(微信): [https://donate.acme.sh/](https://donate.acme.sh/)
+
+[Donate List](https://github.com/Neilpang/acme.sh/wiki/Donate-list)

From a6614abd24600618a23ee390470eea7af912b9f4 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:00:59 +0000
Subject: [PATCH 097/246] Formatting fixes for Travis

---
 dnsapi/dns_pleskxml | 102 +++++++++++++++++++++++---------------------
 1 file changed, 53 insertions(+), 49 deletions(-)

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
index a8a74721..bed1b26f 100644
--- a/dnsapi/dns_pleskxml
+++ b/dnsapi/dns_pleskxml
@@ -44,18 +44,21 @@ NEWLINE='\
 ####################  API Templates ##################################
 
 pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
-  # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
-  # Also used to test credentials and URI.
-  # No args.
+# Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
+# Also used to test credentials and URI.
+# No args.
+
 pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
-  # Get all DNS records for a Plesk domain ID.
-  # ARG = Plesk domain id to query
+# Get all DNS records for a Plesk domain ID.
+# ARG = Plesk domain id to query
+
 pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
-  # Add a TXT record to a domain.
-  # ARGS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
+# Add a TXT record to a domain.
+# ARGS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
+
 pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
-  # Add a TXT record to a domain.
-  # ARG = the Plesk internal ID for the dns record to be deleted
+# Add a TXT record to a domain.
+# ARG = the Plesk internal ID for the dns record to be deleted
 
 
 ####################  Public functions ##################################
@@ -82,7 +85,7 @@ dns_pleskxml_add() {
 
   # printf using template in a variable - not a style issue
   # shellcheck disable=SC2059
-  request="$( printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue" )"
+  request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"
   if ! _call_api "$request"; then
     return 1
   fi
@@ -90,7 +93,7 @@ dns_pleskxml_add() {
   # OK, we should have added a TXT record. Let's check and return success if so.
   # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
 
-  results="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>' )"
+  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
   if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
@@ -101,7 +104,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$( _value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/' )"
+  recid="$(_value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -129,16 +132,16 @@ dns_pleskxml_rm() {
 
   # printf using template in a variable - not a style issue
   # shellcheck disable=SC2059
-  request="$( printf "$pleskxml_tplt_get_dns_records" "$root_domain_id" )"
+  request="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")"
   if ! _call_api "$request"; then
     return 1
   fi
 
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
-  reclist="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' | \
-    grep "<site-id>${root_domain_id}</site-id>" | \
-    grep -E '<id>[0-9]+</id>' | \
-    grep '<type>TXT</type>' \
+  reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
+    | grep "<site-id>${root_domain_id}</site-id>" \
+    | grep -E '<id>[0-9]+</id>' \
+    | grep '<type>TXT</type>' \
   )"
 
   if [ -z "$reclist" ]; then
@@ -148,14 +151,13 @@ dns_pleskxml_rm() {
 
   _debug "Got list of DNS TXT records for root domain '$root_domain_name'"':\n'"$reclist"
 
-  recid="$( _value "$reclist" | \
-    grep "<host>$1.</host>" | \
-    grep "<value>$txtvalue</value>" | \
-    sed -E 's/(^.*<id>|<\/id>.*$)//g' \
-  )"
-
-  _debug "List of DNS TXT records for host:"'\n'"$( _value "$reclist" | grep "<host>$1.</host>" )"
+  recid="$(_value "$reclist" \
+    | grep "<host>$1.</host>" \
+    | grep "<value>$txtvalue</value>" \
+    | sed -E 's/(^.*<id>|<\/id>.*$)//g' \
+ )"
 
+  _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
   if ! _value "$recid" | grep -Eq '^[0-9]+$'; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
@@ -168,7 +170,7 @@ dns_pleskxml_rm() {
 
   # printf using template in a variable - not a style issue
   # shellcheck disable=SC2059
-  request="$( printf "$pleskxml_tplt_rmv_dns_record" "$recid" )"
+  request="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")"
   if ! _call_api "$request"; then
     return 1
   fi
@@ -176,7 +178,7 @@ dns_pleskxml_rm() {
   # OK, we should have removed a TXT record. Let's check and return success if so.
   # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
 
-  results="$( _api_response_split "$pleskxml_prettyprint_result" 'result' '<status>' )"
+  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
   if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
@@ -214,11 +216,11 @@ _valuecut() {
 # $2 - tag to resplit on (usually "result" or "domain")
 # $3 - regex to recognise useful return lines
 _api_response_split() {
-  printf '%s' "$1" | \
-  sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' | \
-  tr -d '\n\r'  | \
-  sed -E "s/<\/?$2>/${NEWLINE}/g" | \
-  grep -E "$3"
+  printf '%s' "$1" \
+  | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
+  | tr -d '\n\r' \
+  | sed -E "s/<\/?$2>/${NEWLINE}/g" \
+  | grep -E "$3"
 }
 
 
@@ -242,17 +244,16 @@ _call_api() {
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
-  statuslines="$( echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$' )"
+  statuslines="$(echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
 
   if _value "$statuslines" | grep -qv '<status>ok</status>'; then
 
     # We have some status lines that aren't "ok". Get the details
-    errtext="$( \
-      _value "$pleskxml_prettyprint_result" | \
-      grep -iE "(<status>|<errcode>|<errtext>)" | \
-      sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' | \
-      sed -E 's/^<([a-z]+)>/\1: /' \
-    )"
+    errtext="$( _value "$pleskxml_prettyprint_result" \
+      | grep -iE "(<status>|<errcode>|<errtext>)" \
+      | sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' \
+      | sed -E 's/^<([a-z]+)>/\1: /' \
+   )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
 
@@ -326,14 +327,17 @@ _credential_check() {
 
 
 # For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
+
+# IMPORTANT NOTE:  a result with host = empty string is OK for this API, see
+# https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
+# See notes at top of this file
+
 _pleskxml_get_root_domain() {
   _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
 
   # test if the domain is valid for splitting.
 
-   if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
-  ### COMMENTED OUT ALSO FOR SAME REASON
-  ###  _err "Invalid domain. The ACME domain must contain at least three parts (aa.bb.tld) to identify a host, domain, and tld for the TXT record."
+  if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
     _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
     return 1
   fi
@@ -350,7 +354,8 @@ _pleskxml_get_root_domain() {
   # for non-Western character sets.
   # Output will be one line per known domain, containing 1 or 2 <name> tages and an <id> tag
   # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
-  output="$( _api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>' )"
+
+  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
 
   _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
 
@@ -364,14 +369,13 @@ _pleskxml_get_root_domain() {
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
 
-    root_domain_id="$( _value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 |  sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/' )"
+    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 |  sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
     if [ -n "$root_domain_id" ]; then
       # Found a match
-      # Note that a result with host = empty string is OK for this API, see
-      # https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
-      # See notes at top of this file
-      sub_domain_name="$( _value "$1" | sed -E "s/\.?${root_domain_name}"'$//' )"
+      # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
+      # SO WE HANDLE IT AND DON'T PREVENT IT
+      sub_domain_name="$(_value "$1" | sed -E "s/\.?${root_domain_name}"'$//')"
       _info "Matched host '$1' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
       return 0
     fi
@@ -379,11 +383,11 @@ _pleskxml_get_root_domain() {
     # No match, try next parent up (if any)...
 
     if _contains "$root_domain_name" '\.[^.]+\.'; then
-       _debug "No match, trying next parent up..."
+      _debug "No match, trying next parent up..."
     else
       _debug "No match,and next parent would be a TLD..."
     fi
-    root_domain_name="$( _valuecut 2 1000 "$root_domain_name" )"
+    root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
     doneloop=1
 
   done

From 9299a83b175c77feec281a8f8754283e8c6333a0 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:10:03 +0000
Subject: [PATCH 098/246] Travis fixes

---
 dnsapi/dns_pleskxml | 40 +++++++++++++---------------------------
 1 file changed, 13 insertions(+), 27 deletions(-)

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
index bed1b26f..794127c7 100644
--- a/dnsapi/dns_pleskxml
+++ b/dnsapi/dns_pleskxml
@@ -30,8 +30,7 @@
 ##
 ##  The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
 
-
-####################  INTERNAL VARIABLES + NEWLINE  ##################################
+####################  INTERNAL VARIABLES + NEWLINE + API TEMPLATES ##################################
 
 pleskxml_init_checks_done=0
 
@@ -40,9 +39,6 @@ pleskxml_init_checks_done=0
 NEWLINE='\
 '
 
-
-####################  API Templates ##################################
-
 pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
 # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
 # Also used to test credentials and URI.
@@ -60,7 +56,6 @@ pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter>
 # Add a TXT record to a domain.
 # ARG = the Plesk internal ID for the dns record to be deleted
 
-
 ####################  Public functions ##################################
 
 #Usage: add     _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
@@ -141,7 +136,7 @@ dns_pleskxml_rm() {
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
     | grep "<site-id>${root_domain_id}</site-id>" \
     | grep -E '<id>[0-9]+</id>' \
-    | grep '<type>TXT</type>' \
+    | grep '<type>TXT</type>'
   )"
 
   if [ -z "$reclist" ]; then
@@ -154,8 +149,8 @@ dns_pleskxml_rm() {
   recid="$(_value "$reclist" \
     | grep "<host>$1.</host>" \
     | grep "<value>$txtvalue</value>" \
-    | sed -E 's/(^.*<id>|<\/id>.*$)//g' \
- )"
+    | sed -E 's/(^.*<id>|<\/id>.*$)//g'
+  )"
 
   _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
@@ -193,8 +188,6 @@ dns_pleskxml_rm() {
   return 0
 }
 
-
-
 ####################  Private functions below ##################################
 
 # Outputs value of a variable
@@ -202,7 +195,6 @@ _value() {
   printf '%s' "$1"
 }
 
-
 # Outputs value of a variable (FQDN) and cuts it at 2 delimiters
 # $1, $2 = where to cut
 # $3 = FQDN
@@ -210,20 +202,18 @@ _valuecut() {
   printf '%s' "$3" | cut -d . -f "${1}-${2}"
 }
 
-
 # Cleans up an API response, splits it "per item" and greps for a string to validate useful lines
 # $1 - result string from API
 # $2 - tag to resplit on (usually "result" or "domain")
 # $3 - regex to recognise useful return lines
 _api_response_split() {
   printf '%s' "$1" \
-  | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
-  | tr -d '\n\r' \
-  | sed -E "s/<\/?$2>/${NEWLINE}/g" \
-  | grep -E "$3"
+    | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
+    | tr -d '\n\r' \
+    | sed -E "s/<\/?$2>/${NEWLINE}/g" \
+    | grep -E "$3"
 }
 
-
 # Calls Plesk XML API, and checks results for obvious issues
 _call_api() {
   request="$1"
@@ -249,11 +239,11 @@ _call_api() {
   if _value "$statuslines" | grep -qv '<status>ok</status>'; then
 
     # We have some status lines that aren't "ok". Get the details
-    errtext="$( _value "$pleskxml_prettyprint_result" \
+    errtext="$(_value "$pleskxml_prettyprint_result" \
       | grep -iE "(<status>|<errcode>|<errtext>)" \
       | sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' \
-      | sed -E 's/^<([a-z]+)>/\1: /' \
-   )"
+      | sed -E 's/^<([a-z]+)>/\1: /'
+    )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
 
@@ -278,10 +268,8 @@ _call_api() {
   return 0
 }
 
-
+# Startup checks (credentials, URI)
 _credential_check() {
-  # Startup checks (credentials, URI)
-
   _debug "Checking Plesk XML API login credentials and URI..."
 
   if [ "$pleskxml_init_checks_done" -eq 1 ]; then
@@ -289,7 +277,6 @@ _credential_check() {
     return 0
   fi
 
-
   pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
   pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
   pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
@@ -325,7 +312,6 @@ _credential_check() {
   return 0
 }
 
-
 # For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
 
 # IMPORTANT NOTE:  a result with host = empty string is OK for this API, see
@@ -369,7 +355,7 @@ _pleskxml_get_root_domain() {
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
 
-    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 |  sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
     if [ -n "$root_domain_id" ]; then
       # Found a match

From 6df31eb7f58f32428de4a57971b882421d19b3f5 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:13:15 +0000
Subject: [PATCH 099/246] travis

---
 dnsapi/dns_pleskxml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
index 794127c7..83017c3b 100644
--- a/dnsapi/dns_pleskxml
+++ b/dnsapi/dns_pleskxml
@@ -77,7 +77,6 @@ dns_pleskxml_add() {
 
   _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
 
-
   # printf using template in a variable - not a style issue
   # shellcheck disable=SC2059
   request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"

From 1253357a39206dd43047bdbbbd341ffef1d735ab Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 01:48:02 +0000
Subject: [PATCH 100/246] edits to comments

---
 dnsapi/dns_pleskxml | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
index 83017c3b..e2ec5717 100644
--- a/dnsapi/dns_pleskxml
+++ b/dnsapi/dns_pleskxml
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-##  Name: dns_pleskxml.sh
+##  Name: dns_pleskxml
 ##  Created by Stilez.
 ##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
 
@@ -13,14 +13,16 @@
 ##  For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
 ##  So this API module can handle such a request, if needed.
 
+##  For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
+
 ##  The plesk plugin uses the xml api to add and remvoe the dns records. Therefore the url, username
 ##  and password have to be configured by the user before this module is called.
 ##
 ##  ```
-##  export pleskxml_uri="https://YOUR_PLESK_URI_HERE:8443/enterprise/control/agent.php"
+##  export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"
 ##          (or probably something similar)
-##  export pleskxml_user="plesk username"
-##  export pleskxml_pass="plesk password"
+##  export pleskxml_user="my plesk username"
+##  export pleskxml_pass="my plesk password"
 ##  ```
 
 ##  Ok, let's issue a cert now:
@@ -42,19 +44,19 @@ NEWLINE='\
 pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
 # Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
 # Also used to test credentials and URI.
-# No args.
+# No params.
 
 pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
 # Get all DNS records for a Plesk domain ID.
-# ARG = Plesk domain id to query
+# PARAM = Plesk domain id to query
 
 pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
 # Add a TXT record to a domain.
-# ARGS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
+# PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
 
 pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
-# Add a TXT record to a domain.
-# ARG = the Plesk internal ID for the dns record to be deleted
+# Delete a specific TXT record from a domain.
+# PARAM = the Plesk internal ID for the DNS record to be deleted
 
 ####################  Public functions ##################################
 
@@ -63,7 +65,7 @@ dns_pleskxml_add() {
   fulldomain=$1
   txtvalue=$2
 
-  _info "Entering dns_pleskxml_add() to add TXT record '$2' to domain '$1'..."
+  _info "Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..."
 
   # Get credentials if not already checked, and confirm we can log in to Plesk XML API
   if ! _credential_check; then
@@ -110,7 +112,7 @@ dns_pleskxml_rm() {
   fulldomain=$1
   txtvalue=$2
 
-  _info "Entering dns_pleskxml_rm() to remove TXT record '$2' from domain '$1'..."
+  _info "Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..."
 
   # Get credentials if not already checked, and confirm we can log in to Plesk XML API
   if ! _credential_check; then
@@ -189,19 +191,19 @@ dns_pleskxml_rm() {
 
 ####################  Private functions below ##################################
 
-# Outputs value of a variable
+# Outputs value of a variable without additional newlines etc
 _value() {
   printf '%s' "$1"
 }
 
-# Outputs value of a variable (FQDN) and cuts it at 2 delimiters
+# Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between
 # $1, $2 = where to cut
 # $3 = FQDN
 _valuecut() {
   printf '%s' "$3" | cut -d . -f "${1}-${2}"
 }
 
-# Cleans up an API response, splits it "per item" and greps for a string to validate useful lines
+# Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
 # $1 - result string from API
 # $2 - tag to resplit on (usually "result" or "domain")
 # $3 - regex to recognise useful return lines
@@ -228,8 +230,6 @@ _call_api() {
   pleskxml_retcode="$?"
   _debug "acme _post() returned retcode=$pleskxml_retcode. Literal response:" '\n' "'${pleskxml_prettyprint_result}'"
 
-  # Error handling
-
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
@@ -320,7 +320,7 @@ _credential_check() {
 _pleskxml_get_root_domain() {
   _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
 
-  # test if the domain is valid for splitting.
+  # test if the domain as provided is valid for splitting.
 
   if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
     _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
@@ -334,10 +334,10 @@ _pleskxml_get_root_domain() {
     return 1
   fi
 
-  # Generate a hacked list of domains known to this Plesk account.
+  # Generate a crude list of domains known to this Plesk account.
   # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
   # for non-Western character sets.
-  # Output will be one line per known domain, containing 1 or 2 <name> tages and an <id> tag
+  # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
   # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
 
   output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
@@ -345,7 +345,7 @@ _pleskxml_get_root_domain() {
   _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
 
   # loop and test if domain, or any parent domain, is managed by Plesk
-  # Loop until we don't have any '.' in the sring we're testing as a root domain
+  # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
 
   root_domain_name="$1"
   doneloop=0
@@ -378,7 +378,7 @@ _pleskxml_get_root_domain() {
   done
 
   # if we get here, we failed to find a root domain match in the list of domains managed by Plesk.
-  # if we never ran the loop a first time, $1 wasn't at least a 2 level domain (domain.tld) and wasn't valid anyway
+  # if we never ran the loop even once, $1 wasn't a 2nd level (or deeper) domain (e.g. domain.tld) and wasn't valid anyway
 
   if [ -z $doneloop ]; then
     _err "'$1' isn't a valid domain for ACME DNS. Exiting."

From 671edc33e173b0318972d7eb4fd50d03fbde85cd Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sun, 27 Oct 2019 11:43:40 +0800
Subject: [PATCH 101/246] fix background color

---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 37ce15aa..07dc63d2 100755
--- a/acme.sh
+++ b/acme.sh
@@ -153,7 +153,7 @@ fi
 
 __green() {
   if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
-    printf '\033[1;31;32m%b\033[0m' "$1"
+    printf '\33[1;32m%b\33[0m' "$1"
     return
   fi
   printf -- "%b" "$1"
@@ -161,7 +161,7 @@ __green() {
 
 __red() {
   if [ "${__INTERACTIVE}${ACME_NO_COLOR:-0}" = "10" -o "${ACME_FORCE_COLOR}" = "1" ]; then
-    printf '\033[1;31;40m%b\033[0m' "$1"
+    printf '\33[1;31m%b\33[0m' "$1"
     return
   fi
   printf -- "%b" "$1"

From 9eb5f65b8f272b71fdf2d69a33492e67b5b76836 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 07:38:22 +0000
Subject: [PATCH 102/246] edit comments

---
 dnsapi/dns_pleskxml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
index e2ec5717..d613f8e1 100644
--- a/dnsapi/dns_pleskxml
+++ b/dnsapi/dns_pleskxml
@@ -60,7 +60,7 @@ pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter>
 
 ####################  Public functions ##################################
 
-#Usage: add     _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+#Usage: dns_pleskxml_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_pleskxml_add() {
   fulldomain=$1
   txtvalue=$2
@@ -107,7 +107,7 @@ dns_pleskxml_add() {
   return 0
 }
 
-#Usage: rm      _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+#Usage: dns_pleskxml_rm   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_pleskxml_rm() {
   fulldomain=$1
   txtvalue=$2

From 582c77805c837962129ea5372a664658739a13e1 Mon Sep 17 00:00:00 2001
From: peterkelm <info@peterkelm.com>
Date: Sun, 27 Oct 2019 13:13:22 +0100
Subject: [PATCH 103/246] variomedia dns api

initial commit for the variomedia dns api implementation
---
 dnsapi/dns_variomedia.sh | 166 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 166 insertions(+)
 create mode 100644 dnsapi/dns_variomedia.sh

diff --git a/dnsapi/dns_variomedia.sh b/dnsapi/dns_variomedia.sh
new file mode 100644
index 00000000..56f1bf96
--- /dev/null
+++ b/dnsapi/dns_variomedia.sh
@@ -0,0 +1,166 @@
+#!/usr/bin/env sh
+
+#
+#VARIOMEDIA_API_TOKEN=000011112222333344445555666677778888
+
+VARIOMEDIA_API="https://api.variomedia.de"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_variomedia_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  VARIOMEDIA_API_TOKEN="${VARIOMEDIA_API_TOKEN:-$(_readaccountconf_mutable VARIOMEDIA_API_TOKEN)}"
+  if test -z "$VARIOMEDIA_API_TOKEN"; then
+    VARIOMEDIA_API_TOKEN=""
+    _err 'VARIOMEDIA_API_TOKEN was not exported'
+    return 1
+  fi
+
+  _saveaccountconf_mutable VARIOMEDIA_API_TOKEN "$VARIOMEDIA_API_TOKEN"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+# _debug 'Getting txt records'
+# _variomedia_rest GET "/dns-records?filter[domain]=$_domain"
+
+# if printf "%s\n" "$response" | grep "\"record_type\": \"A\", \"fqdn\": \"$fulldomain\"" >/dev/null; then
+#   _err 'Error'
+#   return 1
+# fi
+
+  if ! _variomedia_rest POST "dns-records" "{\"data\": {\"type\": \"dns-record\", \"attributes\": {\"record_type\": \"TXT\", \"name\": \"$_sub_domain\", \"domain\": \"$_domain\", \"data\": \"$txtvalue\", \"ttl\":300}}}"; then
+    _err "$response"
+    return 1
+  fi
+
+  _debug2 _response "$response"
+  return 0
+}
+
+#fulldomain txtvalue
+dns_variomedia_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  VARIOMEDIA_API_TOKEN="${VARIOMEDIA_API_TOKEN:-$(_readaccountconf_mutable VARIOMEDIA_API_TOKEN)}"
+  if test -z "$VARIOMEDIA_API_TOKEN"; then
+    VARIOMEDIA_API_TOKEN=""
+    _err 'VARIOMEDIA_API_TOKEN was not exported'
+    return 1
+  fi
+
+  _saveaccountconf_mutable VARIOMEDIA_API_TOKEN "$VARIOMEDIA_API_TOKEN"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug 'Getting txt records'
+
+  if ! _variomedia_rest GET "dns-records?filter[domain]=$_domain"; then
+    _err 'Error'
+    return 1
+  fi
+
+  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1  | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep $_sub_domain | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
+  _debug _record_id "$_record_id"
+  if [ "$_record_id" ]; then
+    _info "Successfully retrieved the record id for ACME challenge."
+  else
+    _info "Empty record id, it seems no such record."
+    return 0
+  fi
+
+  if ! _variomedia_rest DELETE "/dns-records/$_record_id"; then
+    _err "$response"
+    return 1
+  fi
+
+  _debug2 _response "$response"
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  fulldomain=$1
+  i=1
+  while true; do
+    h=$(printf "%s" "$fulldomain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if ! _variomedia_rest GET "domains/$h"; then
+      return 1
+    fi
+
+    if _startswith "$response" "\{\"data\":"; then
+      if _contains "$response" "\"id\": \"$h\""; then
+        _sub_domain="$(echo "$fulldomain" | sed "s/\\.$h\$//")"
+        _domain=$h
+        return 0
+#     else
+#       _err 'Invalid domain'
+#       return 1
+      fi
+#   else
+#     _err "$response"
+#     return 1
+    fi
+    i=$(_math "$i" + 1)
+  done
+
+  _debug "root domain not found"
+  
+  return 1
+}
+
+_variomedia_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+# api_key_trimmed=$(echo $VARIOMEDIA_API_TOKEN | tr -d '"')
+
+# export _H1="Api-Key: $api_key_trimmed"
+
+  export _H1="Authorization: token $VARIOMEDIA_API_TOKEN"
+  export _H2="Content-Type: application/vnd.api+json"
+  export _H3="Accept: application/vnd.variomedia.v1+json"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$VARIOMEDIA_API/$ep" "" "$m")"
+  else
+    response="$(_get "$VARIOMEDIA_API/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Error $ep"
+    return 1
+  fi
+
+  _debug2 response "$response"
+  return 0
+}

From 1271f97b669ee66727293beea3f2a39da2899e04 Mon Sep 17 00:00:00 2001
From: peterkelm <info@peterkelm.com>
Date: Sun, 27 Oct 2019 16:52:51 +0100
Subject: [PATCH 104/246] fixed dns_variomedia_rm for wildcard certs

fixed dns_variomedia_rm to respect the txtvalue supplied as function parameter
---
 dnsapi/dns_variomedia.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_variomedia.sh b/dnsapi/dns_variomedia.sh
index 56f1bf96..2e822a0d 100644
--- a/dnsapi/dns_variomedia.sh
+++ b/dnsapi/dns_variomedia.sh
@@ -77,7 +77,7 @@ dns_variomedia_rm() {
     return 1
   fi
 
-  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1  | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep $_sub_domain | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
+  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1  | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep $_sub_domain | grep $txtvalue | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
   _debug _record_id "$_record_id"
   if [ "$_record_id" ]; then
     _info "Successfully retrieved the record id for ACME challenge."

From c1b089d1c3adb314daf29a084c3bf13042e72c7f Mon Sep 17 00:00:00 2001
From: peterkelm <info@peterkelm.com>
Date: Sun, 27 Oct 2019 16:58:36 +0100
Subject: [PATCH 105/246] unused code removed

---
 dnsapi/dns_variomedia.sh | 18 ------------------
 1 file changed, 18 deletions(-)

diff --git a/dnsapi/dns_variomedia.sh b/dnsapi/dns_variomedia.sh
index 2e822a0d..8588d7c8 100644
--- a/dnsapi/dns_variomedia.sh
+++ b/dnsapi/dns_variomedia.sh
@@ -30,14 +30,6 @@ dns_variomedia_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-# _debug 'Getting txt records'
-# _variomedia_rest GET "/dns-records?filter[domain]=$_domain"
-
-# if printf "%s\n" "$response" | grep "\"record_type\": \"A\", \"fqdn\": \"$fulldomain\"" >/dev/null; then
-#   _err 'Error'
-#   return 1
-# fi
-
   if ! _variomedia_rest POST "dns-records" "{\"data\": {\"type\": \"dns-record\", \"attributes\": {\"record_type\": \"TXT\", \"name\": \"$_sub_domain\", \"domain\": \"$_domain\", \"data\": \"$txtvalue\", \"ttl\":300}}}"; then
     _err "$response"
     return 1
@@ -119,13 +111,7 @@ _get_root() {
         _sub_domain="$(echo "$fulldomain" | sed "s/\\.$h\$//")"
         _domain=$h
         return 0
-#     else
-#       _err 'Invalid domain'
-#       return 1
       fi
-#   else
-#     _err "$response"
-#     return 1
     fi
     i=$(_math "$i" + 1)
   done
@@ -141,10 +127,6 @@ _variomedia_rest() {
   data="$3"
   _debug "$ep"
 
-# api_key_trimmed=$(echo $VARIOMEDIA_API_TOKEN | tr -d '"')
-
-# export _H1="Api-Key: $api_key_trimmed"
-
   export _H1="Authorization: token $VARIOMEDIA_API_TOKEN"
   export _H2="Content-Type: application/vnd.api+json"
   export _H3="Accept: application/vnd.variomedia.v1+json"

From bc291141b13a802ac0190ba06946ef2fa9add768 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 16:58:22 +0000
Subject: [PATCH 106/246] fix filename

---
 dnsapi/dns_pleskxml.sh | 391 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 391 insertions(+)
 create mode 100644 dnsapi/dns_pleskxml.sh

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
new file mode 100644
index 00000000..25d1e6dc
--- /dev/null
+++ b/dnsapi/dns_pleskxml.sh
@@ -0,0 +1,391 @@
+#!/usr/bin/env sh
+
+##  Name: dns_pleskxml.sh
+##  Created by Stilez.
+##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
+
+##  This DNS01 method uses the Plesk XML API described at:
+##  https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
+##  and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
+
+##  Note: a DNS ID with host = empty string is OK for this API, see
+##  https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
+##  For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
+##  So this API module can handle such a request, if needed.
+
+##  For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
+
+##  The plesk plugin uses the xml api to add and remvoe the dns records. Therefore the url, username
+##  and password have to be configured by the user before this module is called.
+##
+##  ```
+##  export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"
+##          (or probably something similar)
+##  export pleskxml_user="my plesk username"
+##  export pleskxml_pass="my plesk password"
+##  ```
+
+##  Ok, let's issue a cert now:
+##  ```
+##  acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
+##  ```
+##
+##  The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
+
+####################  INTERNAL VARIABLES + NEWLINE + API TEMPLATES ##################################
+
+pleskxml_init_checks_done=0
+
+# Variable containing bare newline - not a style issue
+# shellcheck disable=SC1004
+NEWLINE='\
+'
+
+pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
+# Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
+# Also used to test credentials and URI.
+# No params.
+
+pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
+# Get all DNS records for a Plesk domain ID.
+# PARAM = Plesk domain id to query
+
+pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
+# Add a TXT record to a domain.
+# PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
+
+pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
+# Delete a specific TXT record from a domain.
+# PARAM = the Plesk internal ID for the DNS record to be deleted
+
+####################  Public functions ##################################
+
+#Usage: dns_pleskxml_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_pleskxml_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..."
+
+  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
+  if ! _credential_check; then
+    return 1
+  fi
+
+  # Get root and subdomain details, and Plesk domain ID
+  if ! _pleskxml_get_root_domain "$fulldomain"; then
+    return 1
+  fi
+
+  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # OK, we should have added a TXT record. Let's check and return success if so.
+  # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
+
+  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
+
+  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+    # Error - doesn't contain expected string. Something's wrong.
+    _err 'Error when calling Plesk XML API.'
+    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
+    _err 'This is unexpected: something has gone wrong.'
+    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    return 1
+  fi
+
+  recid="$(_value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+
+  _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
+
+  return 0
+}
+
+#Usage: dns_pleskxml_rm   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_pleskxml_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..."
+
+  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
+  if ! _credential_check; then
+    return 1
+  fi
+
+  # Get root and subdomain details, and Plesk domain ID
+  if ! _pleskxml_get_root_domain "$fulldomain"; then
+    return 1
+  fi
+
+  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs'
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
+  reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
+    | grep "<site-id>${root_domain_id}</site-id>" \
+    | grep -E '<id>[0-9]+</id>' \
+    | grep '<type>TXT</type>'
+  )"
+
+  if [ -z "$reclist" ]; then
+    _err "No TXT records found for root domain ${root_domain_name} (Plesk domain ID ${root_domain_id}). Exiting."
+    return 1
+  fi
+
+  _debug "Got list of DNS TXT records for root domain '$root_domain_name'"':\n'"$reclist"
+
+  recid="$(_value "$reclist" \
+    | grep "<host>$1.</host>" \
+    | grep "<value>$txtvalue</value>" \
+    | sed -E 's/(^.*<id>|<\/id>.*$)//g'
+  )"
+
+  _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
+
+  if ! _value "$recid" | grep -Eq '^[0-9]+$'; then
+    _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
+    _err "Cannot delete TXT record. Exiting."
+    return 1
+  fi
+
+  _debug "Found Plesk record ID for target text string '${txtvalue}': ID=${recid}"
+  _debug 'Calling Plesk XML API to remove TXT record'
+
+  # printf using template in a variable - not a style issue
+  # shellcheck disable=SC2059
+  request="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")"
+  if ! _call_api "$request"; then
+    return 1
+  fi
+
+  # OK, we should have removed a TXT record. Let's check and return success if so.
+  # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
+
+  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
+
+  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+    # Error - doesn't contain expected string. Something's wrong.
+    _err 'Error when calling Plesk XML API.'
+    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
+    _err 'This is unexpected: something has gone wrong.'
+    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    return 1
+  fi
+
+  _info "Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()."
+  return 0
+}
+
+####################  Private functions below ##################################
+
+# Outputs value of a variable without additional newlines etc
+_value() {
+  printf '%s' "$1"
+}
+
+# Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between
+# $1, $2 = where to cut
+# $3 = FQDN
+_valuecut() {
+  printf '%s' "$3" | cut -d . -f "${1}-${2}"
+}
+
+# Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
+# $1 - result string from API
+# $2 - tag to resplit on (usually "result" or "domain")
+# $3 - regex to recognise useful return lines
+_api_response_split() {
+  printf '%s' "$1" \
+    | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
+    | tr -d '\n\r' \
+    | sed -E "s/<\/?$2>/${NEWLINE}/g" \
+    | grep -E "$3"
+}
+
+# Calls Plesk XML API, and checks results for obvious issues
+_call_api() {
+  request="$1"
+  errtext=''
+
+  _debug 'Entered _call_api(). Calling Plesk XML API with request:\n' "'${request}'"
+
+  export _H1="HTTP_AUTH_LOGIN: $pleskxml_user"
+  export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass"
+  export _H3="content-Type: text/xml"
+  export _H4="HTTP_PRETTY_PRINT: true"
+  pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
+  pleskxml_retcode="$?"
+  _debug "acme _post() returned retcode=$pleskxml_retcode. Literal response:" '\n' "'${pleskxml_prettyprint_result}'"
+
+  # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
+  # Also detect if there simply aren't any status lines (null result?) and report that, as well.
+
+  statuslines="$(echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
+
+  if _value "$statuslines" | grep -qv '<status>ok</status>'; then
+
+    # We have some status lines that aren't "ok". Get the details
+    errtext="$(_value "$pleskxml_prettyprint_result" \
+      | grep -iE "(<status>|<errcode>|<errtext>)" \
+      | sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' \
+      | sed -E 's/^<([a-z]+)>/\1: /'
+    )"
+
+  elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
+
+    # We have no status lines at all. Results are empty
+    errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.'
+
+  fi
+
+  if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
+    _err "The Plesk XML API call failed."
+    _err "The return code for the POST request was $pleskxml_retcode (0=success)."
+    if [ "$errtext" != "" ]; then
+      _err 'Status and error messages received from the Plesk server:\n' "$errtext"
+    else
+      _err "No additional error messages were received back from the Plesk server"
+    fi
+    return 1
+  fi
+
+  _debug "Leaving _call_api(). Successful call."
+
+  return 0
+}
+
+# Startup checks (credentials, URI)
+_credential_check() {
+  _debug "Checking Plesk XML API login credentials and URI..."
+
+  if [ "$pleskxml_init_checks_done" -eq 1 ]; then
+    _debug "Initial checks already done, no need to repeat. Skipped."
+    return 0
+  fi
+
+  pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
+  pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
+  pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
+
+  _debug "Credentials - User: '${pleskxml_user}'  Passwd: ******  URI: '${pleskxml_uri}'"
+
+  if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then
+    pleskxml_user=""
+    pleskxml_pass=""
+    pleskxml_uri=""
+    _err "You didn't specify one or more of the Plesk XML API username, password, or URI."
+    _err "Please create these and try again."
+    _err "Instructions are in the module source code."
+    return 1
+  fi
+
+  # Test the API is usable, by trying to read the list of managed domains...
+  _call_api "$pleskxml_tplt_get_domains"
+  if [ "$pleskxml_retcode" -ne 0 ]; then
+    _err '\nFailed to access Plesk XML API.'
+    _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
+    return 1
+  fi
+
+  _saveaccountconf_mutable pleskxml_uri "$pleskxml_uri"
+  _saveaccountconf_mutable pleskxml_user "$pleskxml_user"
+  _saveaccountconf_mutable pleskxml_pass "$pleskxml_pass"
+
+  _debug "Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use."
+
+  pleskxml_init_checks_done=1
+
+  return 0
+}
+
+# For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
+
+# IMPORTANT NOTE:  a result with host = empty string is OK for this API, see
+# https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
+# See notes at top of this file
+
+_pleskxml_get_root_domain() {
+  _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
+
+  # test if the domain as provided is valid for splitting.
+
+  if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
+    _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
+    return 1
+  fi
+
+  _debug "Querying Plesk server for list of managed domains..."
+
+  _call_api "$pleskxml_tplt_get_domains"
+  if [ "$pleskxml_retcode" -ne 0 ]; then
+    return 1
+  fi
+
+  # Generate a crude list of domains known to this Plesk account.
+  # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
+  # for non-Western character sets.
+  # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
+  # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
+
+  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
+
+  _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
+
+  # loop and test if domain, or any parent domain, is managed by Plesk
+  # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
+
+  root_domain_name="$1"
+  doneloop=0
+
+  while _contains "$root_domain_name" '\.'; do
+
+    _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
+
+    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+
+    if [ -n "$root_domain_id" ]; then
+      # Found a match
+      # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
+      # SO WE HANDLE IT AND DON'T PREVENT IT
+      sub_domain_name="$(_value "$1" | sed -E "s/\.?${root_domain_name}"'$//')"
+      _info "Matched host '$1' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
+      return 0
+    fi
+
+    # No match, try next parent up (if any)...
+
+    if _contains "$root_domain_name" '\.[^.]+\.'; then
+      _debug "No match, trying next parent up..."
+    else
+      _debug "No match,and next parent would be a TLD..."
+    fi
+    root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
+    doneloop=1
+
+  done
+
+  # if we get here, we failed to find a root domain match in the list of domains managed by Plesk.
+  # if we never ran the loop even once, $1 wasn't a 2nd level (or deeper) domain (e.g. domain.tld) and wasn't valid anyway
+
+  if [ -z $doneloop ]; then
+    _err "'$1' isn't a valid domain for ACME DNS. Exiting."
+  else
+    _err "Cannot find '$1' or any parent domain of it, in Plesk."
+    _err "Are you sure that this domain is managed by this Plesk server?"
+  fi
+
+  return 1
+}

From 7c09bdc6e0dde113a241d1526ede4b9a01a7f864 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Sun, 27 Oct 2019 16:58:58 +0000
Subject: [PATCH 107/246] renamed

---
 dnsapi/dns_pleskxml | 391 --------------------------------------------
 1 file changed, 391 deletions(-)
 delete mode 100644 dnsapi/dns_pleskxml

diff --git a/dnsapi/dns_pleskxml b/dnsapi/dns_pleskxml
deleted file mode 100644
index d613f8e1..00000000
--- a/dnsapi/dns_pleskxml
+++ /dev/null
@@ -1,391 +0,0 @@
-#!/usr/bin/env sh
-
-##  Name: dns_pleskxml
-##  Created by Stilez.
-##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
-
-##  This DNS01 method uses the Plesk XML API described at:
-##  https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
-##  and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
-
-##  Note: a DNS ID with host = empty string is OK for this API, see
-##  https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
-##  For example, to add a TXT record to DNS alias domain "acme-alias.com" would be a valid Plesk action.
-##  So this API module can handle such a request, if needed.
-
-##  For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
-
-##  The plesk plugin uses the xml api to add and remvoe the dns records. Therefore the url, username
-##  and password have to be configured by the user before this module is called.
-##
-##  ```
-##  export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"
-##          (or probably something similar)
-##  export pleskxml_user="my plesk username"
-##  export pleskxml_pass="my plesk password"
-##  ```
-
-##  Ok, let's issue a cert now:
-##  ```
-##  acme.sh --issue --dns dns_pleskxml -d example.com -d www.example.com
-##  ```
-##
-##  The `pleskxml_uri`, `pleskxml_user` and `pleskxml_pass` will be saved in `~/.acme.sh/account.conf` and reused when needed.
-
-####################  INTERNAL VARIABLES + NEWLINE + API TEMPLATES ##################################
-
-pleskxml_init_checks_done=0
-
-# Variable containing bare newline - not a style issue
-# shellcheck disable=SC1004
-NEWLINE='\
-'
-
-pleskxml_tplt_get_domains="<packet><customer><get-domain-list><filter/></get-domain-list></customer></packet>"
-# Get a list of domains that PLESK can manage, so we can check root domain + host for acme.sh
-# Also used to test credentials and URI.
-# No params.
-
-pleskxml_tplt_get_dns_records="<packet><dns><get_rec><filter><site-id>%s</site-id></filter></get_rec></dns></packet>"
-# Get all DNS records for a Plesk domain ID.
-# PARAM = Plesk domain id to query
-
-pleskxml_tplt_add_txt_record="<packet><dns><add_rec><site-id>%s</site-id><type>TXT</type><host>%s</host><value>%s</value></add_rec></dns></packet>"
-# Add a TXT record to a domain.
-# PARAMS = (1) Plesk internal domain ID, (2) "hostname" for the new record, eg '_acme_challenge', (3) TXT record value
-
-pleskxml_tplt_rmv_dns_record="<packet><dns><del_rec><filter><id>%s</id></filter></del_rec></dns></packet>"
-# Delete a specific TXT record from a domain.
-# PARAM = the Plesk internal ID for the DNS record to be deleted
-
-####################  Public functions ##################################
-
-#Usage: dns_pleskxml_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
-dns_pleskxml_add() {
-  fulldomain=$1
-  txtvalue=$2
-
-  _info "Entering dns_pleskxml_add() to add TXT record '$txtvalue' to domain '$fulldomain'..."
-
-  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
-  if ! _credential_check; then
-    return 1
-  fi
-
-  # Get root and subdomain details, and Plesk domain ID
-  if ! _pleskxml_get_root_domain "$fulldomain"; then
-    return 1
-  fi
-
-  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to add TXT record'
-
-  # printf using template in a variable - not a style issue
-  # shellcheck disable=SC2059
-  request="$(printf "$pleskxml_tplt_add_txt_record" "$root_domain_id" "$sub_domain_name" "$txtvalue")"
-  if ! _call_api "$request"; then
-    return 1
-  fi
-
-  # OK, we should have added a TXT record. Let's check and return success if so.
-  # All that should be left in the result, is one section, containing <result><status>ok</status><id>NEW_DNS_RECORD_ID</id></result>
-
-  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
-
-  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
-    # Error - doesn't contain expected string. Something's wrong.
-    _err 'Error when calling Plesk XML API.'
-    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
-    _err 'This is unexpected: something has gone wrong.'
-    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
-    return 1
-  fi
-
-  recid="$(_value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
-
-  _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
-
-  return 0
-}
-
-#Usage: dns_pleskxml_rm   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
-dns_pleskxml_rm() {
-  fulldomain=$1
-  txtvalue=$2
-
-  _info "Entering dns_pleskxml_rm() to remove TXT record '$txtvalue' from domain '$fulldomain'..."
-
-  # Get credentials if not already checked, and confirm we can log in to Plesk XML API
-  if ! _credential_check; then
-    return 1
-  fi
-
-  # Get root and subdomain details, and Plesk domain ID
-  if ! _pleskxml_get_root_domain "$fulldomain"; then
-    return 1
-  fi
-
-  _debug 'Credentials OK, and domain identified. Calling Plesk XML API to get list of TXT records and their IDs'
-
-  # printf using template in a variable - not a style issue
-  # shellcheck disable=SC2059
-  request="$(printf "$pleskxml_tplt_get_dns_records" "$root_domain_id")"
-  if ! _call_api "$request"; then
-    return 1
-  fi
-
-  # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
-  reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
-    | grep "<site-id>${root_domain_id}</site-id>" \
-    | grep -E '<id>[0-9]+</id>' \
-    | grep '<type>TXT</type>'
-  )"
-
-  if [ -z "$reclist" ]; then
-    _err "No TXT records found for root domain ${root_domain_name} (Plesk domain ID ${root_domain_id}). Exiting."
-    return 1
-  fi
-
-  _debug "Got list of DNS TXT records for root domain '$root_domain_name'"':\n'"$reclist"
-
-  recid="$(_value "$reclist" \
-    | grep "<host>$1.</host>" \
-    | grep "<value>$txtvalue</value>" \
-    | sed -E 's/(^.*<id>|<\/id>.*$)//g'
-  )"
-
-  _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
-
-  if ! _value "$recid" | grep -Eq '^[0-9]+$'; then
-    _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
-    _err "Cannot delete TXT record. Exiting."
-    return 1
-  fi
-
-  _debug "Found Plesk record ID for target text string '${txtvalue}': ID=${recid}"
-  _debug 'Calling Plesk XML API to remove TXT record'
-
-  # printf using template in a variable - not a style issue
-  # shellcheck disable=SC2059
-  request="$(printf "$pleskxml_tplt_rmv_dns_record" "$recid")"
-  if ! _call_api "$request"; then
-    return 1
-  fi
-
-  # OK, we should have removed a TXT record. Let's check and return success if so.
-  # All that should be left in the result, is one section, containing <result><status>ok</status><id>PLESK_DELETED_DNS_RECORD_ID</id></result>
-
-  results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
-
-  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
-    # Error - doesn't contain expected string. Something's wrong.
-    _err 'Error when calling Plesk XML API.'
-    _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
-    _err 'This is unexpected: something has gone wrong.'
-    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
-    return 1
-  fi
-
-  _info "Success. TXT record appears to be correctly removed. Exiting dns_pleskxml_rm()."
-  return 0
-}
-
-####################  Private functions below ##################################
-
-# Outputs value of a variable without additional newlines etc
-_value() {
-  printf '%s' "$1"
-}
-
-# Outputs value of a variable (FQDN) and cuts it at 2 specified '.' delimiters, returning the text in between
-# $1, $2 = where to cut
-# $3 = FQDN
-_valuecut() {
-  printf '%s' "$3" | cut -d . -f "${1}-${2}"
-}
-
-# Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
-# $1 - result string from API
-# $2 - tag to resplit on (usually "result" or "domain")
-# $3 - regex to recognise useful return lines
-_api_response_split() {
-  printf '%s' "$1" \
-    | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
-    | tr -d '\n\r' \
-    | sed -E "s/<\/?$2>/${NEWLINE}/g" \
-    | grep -E "$3"
-}
-
-# Calls Plesk XML API, and checks results for obvious issues
-_call_api() {
-  request="$1"
-  errtext=''
-
-  _debug 'Entered _call_api(). Calling Plesk XML API with request:\n' "'${request}'"
-
-  export _H1="HTTP_AUTH_LOGIN: $pleskxml_user"
-  export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass"
-  export _H3="content-Type: text/xml"
-  export _H4="HTTP_PRETTY_PRINT: true"
-  pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
-  pleskxml_retcode="$?"
-  _debug "acme _post() returned retcode=$pleskxml_retcode. Literal response:" '\n' "'${pleskxml_prettyprint_result}'"
-
-  # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
-  # Also detect if there simply aren't any status lines (null result?) and report that, as well.
-
-  statuslines="$(echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
-
-  if _value "$statuslines" | grep -qv '<status>ok</status>'; then
-
-    # We have some status lines that aren't "ok". Get the details
-    errtext="$(_value "$pleskxml_prettyprint_result" \
-      | grep -iE "(<status>|<errcode>|<errtext>)" \
-      | sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' \
-      | sed -E 's/^<([a-z]+)>/\1: /'
-    )"
-
-  elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
-
-    # We have no status lines at all. Results are empty
-    errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.'
-
-  fi
-
-  if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
-    _err "The Plesk XML API call failed."
-    _err "The return code for the POST request was $pleskxml_retcode (0=success)."
-    if [ "$errtext" != "" ]; then
-      _err 'Status and error messages received from the Plesk server:\n' "$errtext"
-    else
-      _err "No additional error messages were received back from the Plesk server"
-    fi
-    return 1
-  fi
-
-  _debug "Leaving _call_api(). Successful call."
-
-  return 0
-}
-
-# Startup checks (credentials, URI)
-_credential_check() {
-  _debug "Checking Plesk XML API login credentials and URI..."
-
-  if [ "$pleskxml_init_checks_done" -eq 1 ]; then
-    _debug "Initial checks already done, no need to repeat. Skipped."
-    return 0
-  fi
-
-  pleskxml_user="${pleskxml_user:-$(_readaccountconf_mutable pleskxml_user)}"
-  pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
-  pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
-
-  _debug "Credentials - User: '${pleskxml_user}'  Passwd: ******  URI: '${pleskxml_uri}'"
-
-  if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then
-    pleskxml_user=""
-    pleskxml_pass=""
-    pleskxml_uri=""
-    _err "You didn't specify one or more of the Plesk XML API username, password, or URI."
-    _err "Please create these and try again."
-    _err "Instructions are in the module source code."
-    return 1
-  fi
-
-  # Test the API is usable, by trying to read the list of managed domains...
-  _call_api "$pleskxml_tplt_get_domains"
-  if [ "$pleskxml_retcode" -ne 0 ]; then
-    _err '\nFailed to access Plesk XML API.'
-    _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
-    return 1
-  fi
-
-  _saveaccountconf_mutable pleskxml_uri "$pleskxml_uri"
-  _saveaccountconf_mutable pleskxml_user "$pleskxml_user"
-  _saveaccountconf_mutable pleskxml_pass "$pleskxml_pass"
-
-  _debug "Test login to Plesk XML API successful. Login credentials and URI successfully saved to the acme.sh configuration file for future use."
-
-  pleskxml_init_checks_done=1
-
-  return 0
-}
-
-# For a FQDN, identify the root domain managed by Plesk, its domain ID in Plesk, and the host if any.
-
-# IMPORTANT NOTE:  a result with host = empty string is OK for this API, see
-# https://docs.plesk.com/en-US/obsidian/api-rpc/about-xml-api/reference/managing-dns/managing-dns-records/adding-dns-record.34798
-# See notes at top of this file
-
-_pleskxml_get_root_domain() {
-  _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
-
-  # test if the domain as provided is valid for splitting.
-
-  if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
-    _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
-    return 1
-  fi
-
-  _debug "Querying Plesk server for list of managed domains..."
-
-  _call_api "$pleskxml_tplt_get_domains"
-  if [ "$pleskxml_retcode" -ne 0 ]; then
-    return 1
-  fi
-
-  # Generate a crude list of domains known to this Plesk account.
-  # We convert <ascii-name> tags to <name> so it'll flag on a hit with either <name> or <ascii-name> fields,
-  # for non-Western character sets.
-  # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
-  # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
-
-  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
-
-  _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
-
-  # loop and test if domain, or any parent domain, is managed by Plesk
-  # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
-
-  root_domain_name="$1"
-  doneloop=0
-
-  while _contains "$root_domain_name" '\.'; do
-
-    _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
-
-    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
-
-    if [ -n "$root_domain_id" ]; then
-      # Found a match
-      # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
-      # SO WE HANDLE IT AND DON'T PREVENT IT
-      sub_domain_name="$(_value "$1" | sed -E "s/\.?${root_domain_name}"'$//')"
-      _info "Matched host '$1' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
-      return 0
-    fi
-
-    # No match, try next parent up (if any)...
-
-    if _contains "$root_domain_name" '\.[^.]+\.'; then
-      _debug "No match, trying next parent up..."
-    else
-      _debug "No match,and next parent would be a TLD..."
-    fi
-    root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
-    doneloop=1
-
-  done
-
-  # if we get here, we failed to find a root domain match in the list of domains managed by Plesk.
-  # if we never ran the loop even once, $1 wasn't a 2nd level (or deeper) domain (e.g. domain.tld) and wasn't valid anyway
-
-  if [ -z $doneloop ]; then
-    _err "'$1' isn't a valid domain for ACME DNS. Exiting."
-  else
-    _err "Cannot find '$1' or any parent domain of it, in Plesk."
-    _err "Are you sure that this domain is managed by this Plesk server?"
-  fi
-
-  return 1
-}

From a22d3b239070ddc573a283bf2a709e68a12d2085 Mon Sep 17 00:00:00 2001
From: scottkof <sstroupe@kofile.net>
Date: Mon, 28 Oct 2019 06:32:08 -0700
Subject: [PATCH 108/246] Switch from `sleep` to `_sleep`

---
 dnsapi/dns_aws.sh | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 54b1bb3a..6db87666 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -6,7 +6,7 @@
 #AWS_SECRET_ACCESS_KEY="xxxxxxx"
 
 #This is the Amazon Route53 api wrapper for acme.sh
-#All `sleep` commands are included to avoid Route53 throttling, see
+#All `_sleep` commands are included to avoid Route53 throttling, see
 #https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/DNSLimitations.html#limits-api-requests
 
 AWS_HOST="route53.amazonaws.com"
@@ -45,7 +45,7 @@ dns_aws_add() {
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
-    sleep 1
+    _sleep 1
     return 1
   fi
   _debug _domain_id "$_domain_id"
@@ -54,7 +54,7 @@ dns_aws_add() {
 
   _info "Getting existing records for $fulldomain"
   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
-    sleep 1
+    _sleep 1
     return 1
   fi
 
@@ -67,7 +67,7 @@ dns_aws_add() {
 
   if [ "$_resource_record" ] && _contains "$response" "$txtvalue"; then
     _info "The TXT record already exists. Skipping."
-    sleep 1
+    _sleep 1
     return 0
   fi
 
@@ -77,10 +77,10 @@ dns_aws_add() {
 
   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
     _info "TXT record updated successfully."
-    sleep 1
+    _sleep 1
     return 0
   fi
-  sleep 1
+  _sleep 1
   return 1
 }
 
@@ -99,7 +99,7 @@ dns_aws_rm() {
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
-    sleep 1
+    _sleep 1
     return 1
   fi
   _debug _domain_id "$_domain_id"
@@ -108,7 +108,7 @@ dns_aws_rm() {
 
   _info "Getting existing records for $fulldomain"
   if ! aws_rest GET "2013-04-01$_domain_id/rrset" "name=$fulldomain&type=TXT"; then
-    sleep 1
+    _sleep 1
     return 1
   fi
 
@@ -117,7 +117,7 @@ dns_aws_rm() {
     _debug "_resource_record" "$_resource_record"
   else
     _debug "no records exist, skip"
-    sleep 1
+    _sleep 1
     return 0
   fi
 
@@ -125,10 +125,10 @@ dns_aws_rm() {
 
   if aws_rest POST "2013-04-01$_domain_id/rrset/" "" "$_aws_tmpl_xml" && _contains "$response" "ChangeResourceRecordSetsResponse"; then
     _info "TXT record deleted successfully."
-    sleep 1
+    _sleep 1
     return 0
   fi
-  sleep 1
+  _sleep 1
   return 1
 
 }

From d7affad05981f3fdc59ecf1f30e4455f06cc9f5a Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 29 Oct 2019 10:30:00 +0000
Subject: [PATCH 109/246] various small improves

---
 dnsapi/dns_pleskxml.sh | 73 +++++++++++++++++++++++-------------------
 1 file changed, 40 insertions(+), 33 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 25d1e6dc..bd6eaa87 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -189,7 +189,7 @@ dns_pleskxml_rm() {
   return 0
 }
 
-####################  Private functions below ##################################
+####################  Private functions below (utility functions) ##################################
 
 # Outputs value of a variable without additional newlines etc
 _value() {
@@ -203,6 +203,12 @@ _valuecut() {
   printf '%s' "$3" | cut -d . -f "${1}-${2}"
 }
 
+# Counts '.' present in a domain name
+# $1 = domain name
+_countdots() {
+  _value "$1" | tr -dc '.' | wc -c
+}
+
 # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
 # $1 - result string from API
 # $2 - tag to resplit on (usually "result" or "domain")
@@ -215,6 +221,8 @@ _api_response_split() {
     | grep -E "$3"
 }
 
+####################  Private functions below (DNS functions) ##################################
+
 # Calls Plesk XML API, and checks results for obvious issues
 _call_api() {
   request="$1"
@@ -228,7 +236,7 @@ _call_api() {
   export _H4="HTTP_PRETTY_PRINT: true"
   pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
   pleskxml_retcode="$?"
-  _debug "acme _post() returned retcode=$pleskxml_retcode. Literal response:" '\n' "'${pleskxml_prettyprint_result}'"
+  _debug 'The responses from the Plesk XML server were:\n' "retcode=$pleskxml_retcode. Literal response:"'\n' "'$pleskxml_prettyprint_result'"
 
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
@@ -239,9 +247,9 @@ _call_api() {
 
     # We have some status lines that aren't "ok". Get the details
     errtext="$(_value "$pleskxml_prettyprint_result" \
-      | grep -iE "(<status>|<errcode>|<errtext>)" \
-      | sed -E 's/(^[[:space:]]+|<\/[a-z]+$)//g' \
-      | sed -E 's/^<([a-z]+)>/\1: /'
+      | grep -E "(<status>|<errcode>|<errtext>)" \
+      | sed -E 's/^<(status|errcode|errtext)>/\1: /' \
+      | sed -E 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g' \
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
@@ -252,14 +260,23 @@ _call_api() {
   fi
 
   if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
-    _err "The Plesk XML API call failed."
-    _err "The return code for the POST request was $pleskxml_retcode (0=success)."
+    # Call failed, for reasons either in the retcode or the response text...
+
+    if [ "$pleskxml_retcode" -eq 0 ]; then
+      _err "The POST request was successfully sent to the Plesk server."
+    else
+      _err "The return code for the POST request was $pleskxml_retcode (non-zero = could not submit request to server)."
+    fi
+
     if [ "$errtext" != "" ]; then
-      _err 'Status and error messages received from the Plesk server:\n' "$errtext"
+      _err 'The error responses received from the Plesk server were:\n' "$errtext"
     else
       _err "No additional error messages were received back from the Plesk server"
     fi
+
+    _err "The Plesk XML API call failed."
     return 1
+
   fi
 
   _debug "Leaving _call_api(). Successful call."
@@ -319,10 +336,12 @@ _credential_check() {
 
 _pleskxml_get_root_domain() {
   _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
+  original_full_domain_name="$1"
+  root_domain_name="$1"
 
   # test if the domain as provided is valid for splitting.
 
-  if _value "$root_domain_name" | grep -qvE '^[^.]+\.[^.]+\.[^.]'; then
+  if ! _countdots "$root_domain_name"; then
     _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
     return 1
   fi
@@ -347,10 +366,7 @@ _pleskxml_get_root_domain() {
   # loop and test if domain, or any parent domain, is managed by Plesk
   # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
 
-  root_domain_name="$1"
-  doneloop=0
-
-  while _contains "$root_domain_name" '\.'; do
+  while true; do
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
 
@@ -360,32 +376,23 @@ _pleskxml_get_root_domain() {
       # Found a match
       # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
       # SO WE HANDLE IT AND DON'T PREVENT IT
-      sub_domain_name="$(_value "$1" | sed -E "s/\.?${root_domain_name}"'$//')"
-      _info "Matched host '$1' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
+      sub_domain_name="$(_value "$original_full_domain_name" | sed -E "s/\.?${root_domain_name}"'$//')"
+      _info "Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
       return 0
     fi
 
     # No match, try next parent up (if any)...
 
-    if _contains "$root_domain_name" '\.[^.]+\.'; then
-      _debug "No match, trying next parent up..."
-    else
-      _debug "No match,and next parent would be a TLD..."
-    fi
     root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
-    doneloop=1
+
+    if ! _countdots "$root_domain_name"; then
+      _debug "No match, and next parent would be a TLD..."
+      _err "Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk."
+      _err "Are you sure that this domain is managed by this Plesk server?"
+      return 1
+    fi
+
+    _debug "No match, trying next parent up..."
 
   done
-
-  # if we get here, we failed to find a root domain match in the list of domains managed by Plesk.
-  # if we never ran the loop even once, $1 wasn't a 2nd level (or deeper) domain (e.g. domain.tld) and wasn't valid anyway
-
-  if [ -z $doneloop ]; then
-    _err "'$1' isn't a valid domain for ACME DNS. Exiting."
-  else
-    _err "Cannot find '$1' or any parent domain of it, in Plesk."
-    _err "Are you sure that this domain is managed by this Plesk server?"
-  fi
-
-  return 1
 }

From b7c3df455e275a6fa0556d178c48f944666410bf Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 09:38:03 +0000
Subject: [PATCH 110/246] travis fix

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index bd6eaa87..aa1da6f4 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -249,7 +249,7 @@ _call_api() {
     errtext="$(_value "$pleskxml_prettyprint_result" \
       | grep -E "(<status>|<errcode>|<errtext>)" \
       | sed -E 's/^<(status|errcode|errtext)>/\1: /' \
-      | sed -E 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g' \
+      | sed -E 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g'
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then

From 05ced9fbc4edf0c2d3bbe9913209e6c750702cad Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 09:53:40 +0000
Subject: [PATCH 111/246] edit a comment

---
 dnsapi/dns_pleskxml.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index aa1da6f4..24650d10 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -4,7 +4,7 @@
 ##  Created by Stilez.
 ##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
 
-##  This DNS01 method uses the Plesk XML API described at:
+##  This DNS-01 method uses the Plesk XML API described at:
 ##  https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
 ##  and more specifically: https://docs.plesk.com/en-US/12.5/api-rpc/reference.28784
 
@@ -15,8 +15,8 @@
 
 ##  For ACME v2 purposes, new TXT records are appended when added, and removing one TXT record will not affect any other TXT records.
 
-##  The plesk plugin uses the xml api to add and remvoe the dns records. Therefore the url, username
-##  and password have to be configured by the user before this module is called.
+##  The user credentials (username+password) and URL/URI for the Plesk XML API must be set by the user
+##  before this module is called (case sensitive):
 ##
 ##  ```
 ##  export pleskxml_uri="https://address-of-my-plesk-server.net:8443/enterprise/control/agent.php"

From 3441bd0e7c476a5add8dbfec730b5fa25b7a9f7e Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 10:22:04 +0000
Subject: [PATCH 112/246] improve _err message and remove a dubious _debug
 message.

---
 dnsapi/dns_pleskxml.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 24650d10..8a957e40 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -297,15 +297,13 @@ _credential_check() {
   pleskxml_pass="${pleskxml_pass:-$(_readaccountconf_mutable pleskxml_pass)}"
   pleskxml_uri="${pleskxml_uri:-$(_readaccountconf_mutable pleskxml_uri)}"
 
-  _debug "Credentials - User: '${pleskxml_user}'  Passwd: ******  URI: '${pleskxml_uri}'"
-
   if [ -z "$pleskxml_user" ] || [ -z "$pleskxml_pass" ] || [ -z "$pleskxml_uri" ]; then
     pleskxml_user=""
     pleskxml_pass=""
     pleskxml_uri=""
     _err "You didn't specify one or more of the Plesk XML API username, password, or URI."
     _err "Please create these and try again."
-    _err "Instructions are in the module source code."
+    _err "Instructions are in the 'dns_pleskxml' plugin source code or in the acme.sh documentation."
     return 1
   fi
 

From 2422e0b481b74e008fc995afd4e1994d6f0817e4 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 17:01:06 +0000
Subject: [PATCH 113/246] grep -E and sed -E

---
 dnsapi/dns_pleskxml.sh | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 8a957e40..03c58534 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -91,7 +91,7 @@ dns_pleskxml_add() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | egrep -q '<id>[0-9]+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -100,7 +100,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$(_value "$results" | grep -E '<id>[0-9]+</id>' | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+  recid="$(_value "$results" | egrep '<id>[0-9]+</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -136,7 +136,7 @@ dns_pleskxml_rm() {
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
     | grep "<site-id>${root_domain_id}</site-id>" \
-    | grep -E '<id>[0-9]+</id>' \
+    | egrep '<id>[0-9]+</id>' \
     | grep '<type>TXT</type>'
   )"
 
@@ -150,12 +150,12 @@ dns_pleskxml_rm() {
   recid="$(_value "$reclist" \
     | grep "<host>$1.</host>" \
     | grep "<value>$txtvalue</value>" \
-    | sed -E 's/(^.*<id>|<\/id>.*$)//g'
+    | sed -r 's/(^.*<id>|<\/id>.*$)//g'
   )"
 
   _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
-  if ! _value "$recid" | grep -Eq '^[0-9]+$'; then
+  if ! _value "$recid" | egrep -q '^[0-9]+$'; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
     _err "Cannot delete TXT record. Exiting."
     return 1
@@ -176,7 +176,7 @@ dns_pleskxml_rm() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -qE '<id>[0-9]+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | egrep -q '<id>[0-9]+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -215,10 +215,10 @@ _countdots() {
 # $3 - regex to recognise useful return lines
 _api_response_split() {
   printf '%s' "$1" \
-    | sed -E 's/(^[[:space:]]+|[[:space:]]+$)//g' \
+    | sed -r 's/(^[[:space:]]+|[[:space:]]+$)//g' \
     | tr -d '\n\r' \
-    | sed -E "s/<\/?$2>/${NEWLINE}/g" \
-    | grep -E "$3"
+    | sed -r "s/<\/?$2>/${NEWLINE}/g" \
+    | egrep "$3"
 }
 
 ####################  Private functions below (DNS functions) ##################################
@@ -241,15 +241,15 @@ _call_api() {
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
-  statuslines="$(echo "$pleskxml_prettyprint_result" | grep -E '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
+  statuslines="$(echo "$pleskxml_prettyprint_result" | egrep '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
 
   if _value "$statuslines" | grep -qv '<status>ok</status>'; then
 
     # We have some status lines that aren't "ok". Get the details
     errtext="$(_value "$pleskxml_prettyprint_result" \
-      | grep -E "(<status>|<errcode>|<errtext>)" \
-      | sed -E 's/^<(status|errcode|errtext)>/\1: /' \
-      | sed -E 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g'
+      | egrep "(<status>|<errcode>|<errtext>)" \
+      | sed -r 's/^<(status|errcode|errtext)>/\1: /' \
+      | sed -r 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g'
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
@@ -357,7 +357,7 @@ _pleskxml_get_root_domain() {
   # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
   # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
 
-  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -E 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
+  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -r 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
 
   _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
 
@@ -368,13 +368,13 @@ _pleskxml_get_root_domain() {
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
 
-    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -E 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
     if [ -n "$root_domain_id" ]; then
       # Found a match
       # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
       # SO WE HANDLE IT AND DON'T PREVENT IT
-      sub_domain_name="$(_value "$original_full_domain_name" | sed -E "s/\.?${root_domain_name}"'$//')"
+      sub_domain_name="$(_value "$original_full_domain_name" | sed -r "s/\.?${root_domain_name}"'$//')"
       _info "Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
       return 0
     fi

From a32b95544ba8aa385251f757940c93f3fef266c0 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 17:06:03 +0000
Subject: [PATCH 114/246] [[:space:]] -> " "

---
 dnsapi/dns_pleskxml.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 03c58534..12f56316 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -215,7 +215,7 @@ _countdots() {
 # $3 - regex to recognise useful return lines
 _api_response_split() {
   printf '%s' "$1" \
-    | sed -r 's/(^[[:space:]]+|[[:space:]]+$)//g' \
+    | sed -r 's/(^ +| +$)//g' \
     | tr -d '\n\r' \
     | sed -r "s/<\/?$2>/${NEWLINE}/g" \
     | egrep "$3"
@@ -241,15 +241,15 @@ _call_api() {
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
-  statuslines="$(echo "$pleskxml_prettyprint_result" | egrep '^[[:space:]]*<status>[^<]*</status>[[:space:]]*$')"
+  statuslines="$(echo "$pleskxml_prettyprint_result" | egrep '^ *<status>[^<]*</status> *$')"
 
   if _value "$statuslines" | grep -qv '<status>ok</status>'; then
 
     # We have some status lines that aren't "ok". Get the details
     errtext="$(_value "$pleskxml_prettyprint_result" \
       | egrep "(<status>|<errcode>|<errtext>)" \
-      | sed -r 's/^<(status|errcode|errtext)>/\1: /' \
-      | sed -r 's/(^[[:space:]]+|<\/(status|errcode|errtext)>$)//g'
+      | sed -r 's/^ *<(status|errcode|errtext)>/\1: /' \
+      | sed -r 's/<\/(status|errcode|errtext)>$//g'
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then

From dca6a4bbd57eed4b87f24cb7f1644fb5a51c2327 Mon Sep 17 00:00:00 2001
From: peterkelm <info@peterkelm.com>
Date: Wed, 30 Oct 2019 20:51:16 +0100
Subject: [PATCH 115/246] minor formatting changes

---
 dnsapi/dns_variomedia.sh | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_variomedia.sh b/dnsapi/dns_variomedia.sh
index 8588d7c8..ecc9ea4c 100644
--- a/dnsapi/dns_variomedia.sh
+++ b/dnsapi/dns_variomedia.sh
@@ -5,9 +5,9 @@
 
 VARIOMEDIA_API="https://api.variomedia.de"
 
-########  Public functions #####################
+######## Public functions #####################
 
-#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+#Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_variomedia_add() {
   fulldomain=$1
   txtvalue=$2
@@ -69,7 +69,7 @@ dns_variomedia_rm() {
     return 1
   fi
 
-  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1  | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep $_sub_domain | grep $txtvalue | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
+  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1 | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep "$_sub_domain" | grep "$txtvalue" | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
   _debug _record_id "$_record_id"
   if [ "$_record_id" ]; then
     _info "Successfully retrieved the record id for ACME challenge."
@@ -87,7 +87,7 @@ dns_variomedia_rm() {
   return 0
 }
 
-####################  Private functions below ##################################
+#################### Private functions below ##################################
 #_acme-challenge.www.domain.com
 #returns
 # _sub_domain=_acme-challenge.www
@@ -117,7 +117,6 @@ _get_root() {
   done
 
   _debug "root domain not found"
-  
   return 1
 }
 

From 343d7df57c366fe594edf8f4a523611a18cb0ac2 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Wed, 30 Oct 2019 22:11:16 +0000
Subject: [PATCH 116/246] shellcheck directive

---
 dnsapi/dns_pleskxml.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 12f56316..c12b2eeb 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -1,5 +1,9 @@
 #!/usr/bin/env sh
 
+# Globally disable this shellcheck error. 
+# Shellcheck errors on egrep ("deprecated"), but acme.sh uses egrep for compatibility.
+# shellcheck disable=SC2196
+
 ##  Name: dns_pleskxml.sh
 ##  Created by Stilez.
 ##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)

From bec26ce754fb575a6969c917cd8fd5fa212a800e Mon Sep 17 00:00:00 2001
From: peterkelm <info@peterkelm.com>
Date: Thu, 31 Oct 2019 09:03:35 +0100
Subject: [PATCH 117/246] Shellcheck'd

---
 dnsapi/dns_variomedia.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_variomedia.sh b/dnsapi/dns_variomedia.sh
index ecc9ea4c..729cda5e 100644
--- a/dnsapi/dns_variomedia.sh
+++ b/dnsapi/dns_variomedia.sh
@@ -69,7 +69,7 @@ dns_variomedia_rm() {
     return 1
   fi
 
-  _record_id="$(echo $response | cut -d '[' -f2 | cut -d']' -f1 | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep "$_sub_domain" | grep "$txtvalue" | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
+  _record_id="$(echo "$response" | cut -d '[' -f2 | cut -d']' -f1 | sed 's/},[ \t]*{/\},§\{/g' | tr § '\n' | grep "$_sub_domain" | grep "$txtvalue" | sed 's/^{//;s/}[,]?$//' | tr , '\n' | tr -d '\"' | grep ^id | cut -d : -f2 | tr -d ' ')"
   _debug _record_id "$_record_id"
   if [ "$_record_id" ]; then
     _info "Successfully retrieved the record id for ACME challenge."

From fee9baca895cecf5cb7a6d94791b655f09c73684 Mon Sep 17 00:00:00 2001
From: Johann Richard <189003+johannrichard@users.noreply.github.com>
Date: Fri, 1 Nov 2019 17:59:40 +0100
Subject: [PATCH 118/246] Add openssh package

* `acme.sh`'s `ssh.sh` is probably one of the hooks that's most versatile
* By default, it's not installed on `alpine` docker images and therefore is lacking in the `acme.sh` docker image
* This change adds the `openssh` package and therefore the `ssh` and associated commands
---
 Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/Dockerfile b/Dockerfile
index a6e37999..02dd5030 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,6 +3,7 @@ FROM alpine:3.10
 RUN apk update -f \
   && apk --no-cache add -f \
   openssl \
+  openssh \
   coreutils \
   bind-tools \
   curl \

From 5698bec6213d8c1ffa8c3c30b1587c8f982638c8 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 2 Nov 2019 09:48:41 +0800
Subject: [PATCH 119/246] fix https://github.com/Neilpang/acme.sh/issues/2566

---
 acme.sh            |  2 +-
 notify/dingtalk.sh | 69 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 70 insertions(+), 1 deletion(-)
 create mode 100644 notify/dingtalk.sh

diff --git a/acme.sh b/acme.sh
index 07dc63d2..78604337 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6070,7 +6070,7 @@ _send_notify() {
 _set_notify_hook() {
   _nhooks="$1"
 
-  _test_subject="Hello, this is notification from $PROJECT_NAME"
+  _test_subject="Hello, this is a notification from $PROJECT_NAME"
   _test_content="If you receive this message, your notification works."
 
   _send_notify "$_test_subject" "$_test_content" "$_nhooks" 0
diff --git a/notify/dingtalk.sh b/notify/dingtalk.sh
new file mode 100644
index 00000000..7d354da2
--- /dev/null
+++ b/notify/dingtalk.sh
@@ -0,0 +1,69 @@
+#!/usr/bin/env sh
+
+#Support dingtalk webhooks api
+
+#DINGTALK_WEBHOOK="xxxx"
+
+#optional
+#DINGTALK_KEYWORD="yyyy"
+
+#DINGTALK_SIGNING_KEY="SEC08ffdbd403cbc3fc8a65xxxxxxxxxxxxxxxxxxxx"
+
+# subject  content statusCode
+dingtalk_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_subject" "$_subject"
+  _debug "_content" "$_content"
+  _debug "_statusCode" "$_statusCode"
+
+  DINGTALK_WEBHOOK="${DINGTALK_WEBHOOK:-$(_readaccountconf_mutable DINGTALK_WEBHOOK)}"
+  if [ -z "$DINGTALK_WEBHOOK" ]; then
+    DINGTALK_WEBHOOK=""
+    _err "You didn't specify a dingtalk webhooks DINGTALK_WEBHOOK yet."
+    _err "You can get yours from https://dingtalk.com"
+    return 1
+  fi
+  _saveaccountconf_mutable DINGTALK_WEBHOOK "$DINGTALK_WEBHOOK"
+
+  DINGTALK_KEYWORD="${DINGTALK_KEYWORD:-$(_readaccountconf_mutable DINGTALK_KEYWORD)}"
+  if [ "$DINGTALK_KEYWORD" ]; then
+    _saveaccountconf_mutable DINGTALK_KEYWORD "$DINGTALK_KEYWORD"
+  fi
+
+#  DINGTALK_SIGNING_KEY="${DINGTALK_SIGNING_KEY:-$(_readaccountconf_mutable DINGTALK_SIGNING_KEY)}"
+#  if [ -z "$DINGTALK_SIGNING_KEY" ]; then
+#    DINGTALK_SIGNING_KEY="value1"
+#    _info "The DINGTALK_SIGNING_KEY is not set, so use the default value1 as key."
+#  elif ! _hasfield "$_IFTTT_AVAIL_MSG_KEYS" "$DINGTALK_SIGNING_KEY"; then
+#    _err "The DINGTALK_SIGNING_KEY \"$DINGTALK_SIGNING_KEY\" is not available, should be one of $_IFTTT_AVAIL_MSG_KEYS"
+#    DINGTALK_SIGNING_KEY=""
+#    return 1
+#  else
+#    _saveaccountconf_mutable DINGTALK_SIGNING_KEY "$DINGTALK_SIGNING_KEY"
+#  fi
+
+#  if [ "$DINGTALK_SIGNING_KEY" = "$IFTTT_CONTENT_KEY" ]; then
+#    DINGTALK_SIGNING_KEY=""
+#    IFTTT_CONTENT_KEY=""
+#    _err "The DINGTALK_SIGNING_KEY must not be same as IFTTT_CONTENT_KEY."
+#    return 1
+#  fi
+
+  _content=$(echo "$_content" | _json_encode)
+  _subject=$(echo "$_subject" | _json_encode)
+  _data="{\"msgtype\": \"text\", \"text\": {\"content\": \"[$DINGTALK_KEYWORD]\n$_subject\n$_content\"}}"
+
+  response="$(_post "$_data" "$DINGTALK_WEBHOOK" "" "POST" "application/json")"
+
+  if [ "$?" = "0" ] && _contains "$response" "errmsg\":\"ok"; then
+    _info "dingtalk webhooks event fired success."
+    return 0
+  fi
+
+  _err "dingtalk webhooks event fired error."
+  _err "$response"
+  return 1
+}
+

From 05acf28e0ddb47b5eab3a3c32ed69f7813237736 Mon Sep 17 00:00:00 2001
From: Johann Richard <189003+johannrichard@users.noreply.github.com>
Date: Sat, 2 Nov 2019 07:10:50 +0100
Subject: [PATCH 120/246] Update Dockerfile

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 02dd5030..5112bf07 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,7 +3,7 @@ FROM alpine:3.10
 RUN apk update -f \
   && apk --no-cache add -f \
   openssl \
-  openssh \
+  openssh-client \
   coreutils \
   bind-tools \
   curl \

From 35b34c43ed26ec2ad08ff004823f5b408e6a3401 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 2 Nov 2019 19:44:43 +0800
Subject: [PATCH 121/246] fix format

---
 notify/dingtalk.sh | 35 +++++++++++++++++------------------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/notify/dingtalk.sh b/notify/dingtalk.sh
index 7d354da2..c547da6e 100644
--- a/notify/dingtalk.sh
+++ b/notify/dingtalk.sh
@@ -32,24 +32,24 @@ dingtalk_send() {
     _saveaccountconf_mutable DINGTALK_KEYWORD "$DINGTALK_KEYWORD"
   fi
 
-#  DINGTALK_SIGNING_KEY="${DINGTALK_SIGNING_KEY:-$(_readaccountconf_mutable DINGTALK_SIGNING_KEY)}"
-#  if [ -z "$DINGTALK_SIGNING_KEY" ]; then
-#    DINGTALK_SIGNING_KEY="value1"
-#    _info "The DINGTALK_SIGNING_KEY is not set, so use the default value1 as key."
-#  elif ! _hasfield "$_IFTTT_AVAIL_MSG_KEYS" "$DINGTALK_SIGNING_KEY"; then
-#    _err "The DINGTALK_SIGNING_KEY \"$DINGTALK_SIGNING_KEY\" is not available, should be one of $_IFTTT_AVAIL_MSG_KEYS"
-#    DINGTALK_SIGNING_KEY=""
-#    return 1
-#  else
-#    _saveaccountconf_mutable DINGTALK_SIGNING_KEY "$DINGTALK_SIGNING_KEY"
-#  fi
+  #  DINGTALK_SIGNING_KEY="${DINGTALK_SIGNING_KEY:-$(_readaccountconf_mutable DINGTALK_SIGNING_KEY)}"
+  #  if [ -z "$DINGTALK_SIGNING_KEY" ]; then
+  #    DINGTALK_SIGNING_KEY="value1"
+  #    _info "The DINGTALK_SIGNING_KEY is not set, so use the default value1 as key."
+  #  elif ! _hasfield "$_IFTTT_AVAIL_MSG_KEYS" "$DINGTALK_SIGNING_KEY"; then
+  #    _err "The DINGTALK_SIGNING_KEY \"$DINGTALK_SIGNING_KEY\" is not available, should be one of $_IFTTT_AVAIL_MSG_KEYS"
+  #    DINGTALK_SIGNING_KEY=""
+  #    return 1
+  #  else
+  #    _saveaccountconf_mutable DINGTALK_SIGNING_KEY "$DINGTALK_SIGNING_KEY"
+  #  fi
 
-#  if [ "$DINGTALK_SIGNING_KEY" = "$IFTTT_CONTENT_KEY" ]; then
-#    DINGTALK_SIGNING_KEY=""
-#    IFTTT_CONTENT_KEY=""
-#    _err "The DINGTALK_SIGNING_KEY must not be same as IFTTT_CONTENT_KEY."
-#    return 1
-#  fi
+  #  if [ "$DINGTALK_SIGNING_KEY" = "$IFTTT_CONTENT_KEY" ]; then
+  #    DINGTALK_SIGNING_KEY=""
+  #    IFTTT_CONTENT_KEY=""
+  #    _err "The DINGTALK_SIGNING_KEY must not be same as IFTTT_CONTENT_KEY."
+  #    return 1
+  #  fi
 
   _content=$(echo "$_content" | _json_encode)
   _subject=$(echo "$_subject" | _json_encode)
@@ -66,4 +66,3 @@ dingtalk_send() {
   _err "$response"
   return 1
 }
-

From 6eaf2d67b7588f23f1870c8813d3d6d391820b89 Mon Sep 17 00:00:00 2001
From: Kukushkin Alexander <alex@alexkuk.ru>
Date: Fri, 16 Nov 2018 08:30:44 +0300
Subject: [PATCH 122/246] Fix Vscale

---
 dnsapi/dns_vscale.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_vscale.sh b/dnsapi/dns_vscale.sh
index e50b7d8b..d717d6e2 100755
--- a/dnsapi/dns_vscale.sh
+++ b/dnsapi/dns_vscale.sh
@@ -102,7 +102,7 @@ _get_root() {
         return 1
       fi
 
-      hostedzone="$(echo "$response" | _egrep_o "{.*\"name\":\s*\"$h\".*}")"
+      hostedzone="$(echo "$response" | tr "{" "\n" | _egrep_o "\"name\":\s*\"$h\".*}")"
       if [ "$hostedzone" ]; then
         _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
         if [ "$_domain_id" ]; then

From 2d1a776db792e475dfdedc3a3bfde7b649d8fa7e Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Mon, 4 Nov 2019 18:40:12 +0000
Subject: [PATCH 123/246] Replace egrep -> basic regex grep

(( ... isn't it annoying that basic regex has * but not + ..... ))
---
 dnsapi/dns_pleskxml.sh | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index c12b2eeb..f3d6a1de 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -1,9 +1,5 @@
 #!/usr/bin/env sh
 
-# Globally disable this shellcheck error. 
-# Shellcheck errors on egrep ("deprecated"), but acme.sh uses egrep for compatibility.
-# shellcheck disable=SC2196
-
 ##  Name: dns_pleskxml.sh
 ##  Created by Stilez.
 ##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
@@ -95,7 +91,7 @@ dns_pleskxml_add() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | egrep -q '<id>[0-9]+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9][0-9]*</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -104,7 +100,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$(_value "$results" | egrep '<id>[0-9]+</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+  recid="$(_value "$results" | grep '<id>[0-9][0-9]*</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -140,7 +136,7 @@ dns_pleskxml_rm() {
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
     | grep "<site-id>${root_domain_id}</site-id>" \
-    | egrep '<id>[0-9]+</id>' \
+    | grep '<id>[0-9][0-9]*</id>' \
     | grep '<type>TXT</type>'
   )"
 
@@ -159,7 +155,7 @@ dns_pleskxml_rm() {
 
   _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
-  if ! _value "$recid" | egrep -q '^[0-9]+$'; then
+  if ! _value "$recid" | grep -q '^[0-9][0-9]*$'; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
     _err "Cannot delete TXT record. Exiting."
     return 1
@@ -180,7 +176,7 @@ dns_pleskxml_rm() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | egrep -q '<id>[0-9]+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9][0-9]*</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -216,13 +212,16 @@ _countdots() {
 # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
 # $1 - result string from API
 # $2 - tag to resplit on (usually "result" or "domain")
-# $3 - regex to recognise useful return lines
+# $3 - basic regex to recognise useful return lines
+# note: $3 matches via basic NOT extended regex (BRE), as extended regex capabilities not needed at the moment.
+#       Last line could change to <sed -rn '/.../p'> instead, with suitablew ewscaping of ['"/$],
+#       if future Plesk XML API changes ever require extended regex
 _api_response_split() {
   printf '%s' "$1" \
     | sed -r 's/(^ +| +$)//g' \
     | tr -d '\n\r' \
     | sed -r "s/<\/?$2>/${NEWLINE}/g" \
-    | egrep "$3"
+    | grep "$3"
 }
 
 ####################  Private functions below (DNS functions) ##################################
@@ -245,15 +244,13 @@ _call_api() {
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
-  statuslines="$(echo "$pleskxml_prettyprint_result" | egrep '^ *<status>[^<]*</status> *$')"
+  statuslines="$(echo "$pleskxml_prettyprint_result" | grep '^ *<status>[^<]*</status> *$')"
 
   if _value "$statuslines" | grep -qv '<status>ok</status>'; then
 
     # We have some status lines that aren't "ok". Get the details
     errtext="$(_value "$pleskxml_prettyprint_result" \
-      | egrep "(<status>|<errcode>|<errtext>)" \
-      | sed -r 's/^ *<(status|errcode|errtext)>/\1: /' \
-      | sed -r 's/<\/(status|errcode|errtext)>$//g'
+      | sed -rn 's/^ *<(status|errcode|errtext)>([^<]+)<\/(status|errcode|errtext)> *$/\1: \2/p' \
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then

From 63a779baa86ed8609c7030fa8aa37deb11341752 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Mon, 4 Nov 2019 18:44:14 +0000
Subject: [PATCH 124/246] remove unnecessary \

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index f3d6a1de..c673744f 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -250,7 +250,7 @@ _call_api() {
 
     # We have some status lines that aren't "ok". Get the details
     errtext="$(_value "$pleskxml_prettyprint_result" \
-      | sed -rn 's/^ *<(status|errcode|errtext)>([^<]+)<\/(status|errcode|errtext)> *$/\1: \2/p' \
+      | sed -rn 's/^ *<(status|errcode|errtext)>([^<]+)<\/(status|errcode|errtext)> *$/\1: \2/p'
     )"
 
   elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then

From 04b0c62bf959c800c36f9b19da599741caacd1c8 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Mon, 4 Nov 2019 19:05:44 +0000
Subject: [PATCH 125/246] basic regex's to use \+

Maybe BRE aren't as basic as they sound. But I'm sure `man grep` didn't list the extra syntax of "preceded by backslash" :)  So let's use it
---
 dnsapi/dns_pleskxml.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index c673744f..dca0d246 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -91,7 +91,7 @@ dns_pleskxml_add() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9][0-9]*</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9]\+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -100,7 +100,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$(_value "$results" | grep '<id>[0-9][0-9]*</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+  recid="$(_value "$results" | grep '<id>[0-9]\+</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -136,7 +136,7 @@ dns_pleskxml_rm() {
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
     | grep "<site-id>${root_domain_id}</site-id>" \
-    | grep '<id>[0-9][0-9]*</id>' \
+    | grep '<id>[0-9]\+</id>' \
     | grep '<type>TXT</type>'
   )"
 
@@ -155,7 +155,7 @@ dns_pleskxml_rm() {
 
   _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
-  if ! _value "$recid" | grep -q '^[0-9][0-9]*$'; then
+  if ! _value "$recid" | grep -q '^[0-9]\+$'; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
     _err "Cannot delete TXT record. Exiting."
     return 1
@@ -176,7 +176,7 @@ dns_pleskxml_rm() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9][0-9]*</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9]\+</id>'; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'

From 896778cead810f88ffd8e5efa61d97cbd78dfe6d Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 17:56:20 +0000
Subject: [PATCH 126/246] Grep fixes and minor improvements

---
 dnsapi/dns_pleskxml.sh | 37 ++++++++++++++++++++++---------------
 1 file changed, 22 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index dca0d246..551e42fe 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -91,7 +91,7 @@ dns_pleskxml_add() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9]\+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -100,7 +100,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$(_value "$results" | grep '<id>[0-9]\+</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+  recid="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -136,7 +136,7 @@ dns_pleskxml_rm() {
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
     | grep "<site-id>${root_domain_id}</site-id>" \
-    | grep '<id>[0-9]\+</id>' \
+    | grep '<id>[0-9]\{1,\}</id>' \
     | grep '<type>TXT</type>'
   )"
 
@@ -155,7 +155,7 @@ dns_pleskxml_rm() {
 
   _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
 
-  if ! _value "$recid" | grep -q '^[0-9]\+$'; then
+  if ! _value "$recid" | grep '^[0-9]\{1,\}$' >/dev/null; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
     _err "Cannot delete TXT record. Exiting."
     return 1
@@ -176,7 +176,7 @@ dns_pleskxml_rm() {
 
   results="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>')"
 
-  if ! _value "$results" | grep '<status>ok</status>' | grep -q '<id>[0-9]\+</id>'; then
+  if ! _value "$results" | grep '<status>ok</status>' | grep '<id>[0-9]\{1,\}</id>' >/dev/null; then
     # Error - doesn't contain expected string. Something's wrong.
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
@@ -244,20 +244,27 @@ _call_api() {
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
 
-  statuslines="$(echo "$pleskxml_prettyprint_result" | grep '^ *<status>[^<]*</status> *$')"
+  statuslines_count_total="$(echo "$pleskxml_prettyprint_result" | grep -c '^ *<status>[^<]*</status> *$')"
+  statuslines_count_okay="$(echo "$pleskxml_prettyprint_result" | grep -c '^ *<status>ok</status> *$')"
 
-  if _value "$statuslines" | grep -qv '<status>ok</status>'; then
-
-    # We have some status lines that aren't "ok". Get the details
-    errtext="$(_value "$pleskxml_prettyprint_result" \
-      | sed -rn 's/^ *<(status|errcode|errtext)>([^<]+)<\/(status|errcode|errtext)> *$/\1: \2/p'
-    )"
-
-  elif ! _value "$statuslines" | grep -q '<status>ok</status>'; then
+  if [ -z "$statuslines_count_total" ]; then
 
     # We have no status lines at all. Results are empty
     errtext='The Plesk XML API unexpectedly returned an empty set of results for this call.'
 
+  elif [ "$statuslines_count_okay" -ne "$statuslines_count_total" ]; then
+
+    # We have some status lines that aren't "ok". Any available details are in API response fields "status" "errcode" and "errtext"
+    # Workaround for basic regex: 
+    #   - filter output to keep only lines like this: "SPACES<TAG>text</TAG>SPACES" (shouldn't be necessary with prettyprint but guarantees subsequent code is ok)
+    #   - then edit the 3 "useful" error tokens individually and remove closing tags on all lines
+    #   - then filter again to remove all lines not edited (which will be the lines not starting A-Z)
+    errtext="$(_value "$pleskxml_prettyprint_result" \
+      | grep '^ *<[a-z]\{1,\}>[^<]*<\/[a-z]\{1,\}> *$' \
+      | sed 's/^ *<status>/Status:     /;s/^ *<errcode>/Error code: /;s/^ *<errtext>/Error text: /;s/<\/.*$//' \
+      | grep '^[A-Z]'
+    )"
+
   fi
 
   if [ "$pleskxml_retcode" -ne 0 ] || [ "$errtext" != "" ]; then
@@ -266,7 +273,7 @@ _call_api() {
     if [ "$pleskxml_retcode" -eq 0 ]; then
       _err "The POST request was successfully sent to the Plesk server."
     else
-      _err "The return code for the POST request was $pleskxml_retcode (non-zero = could not submit request to server)."
+      _err "The return code for the POST request was $pleskxml_retcode (non-zero = failure in submitting request to server)."
     fi
 
     if [ "$errtext" != "" ]; then

From cbacc779fcc3dc9bf3b5924d5691c12f9d74ebe3 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 18:50:39 +0000
Subject: [PATCH 127/246] Fix some sed -r, and clean up some variable
 references ("$1" -> "$varname")

---
 dnsapi/dns_pleskxml.sh | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 551e42fe..2c9a4d56 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -100,7 +100,7 @@ dns_pleskxml_add() {
     return 1
   fi
 
-  recid="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+  recid="$(_value "$results" | grep '<id>[0-9]\{1,\}</id>' | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
 
   _info "Success. TXT record appears to be correctly added (Plesk record ID=$recid). Exiting dns_pleskxml_add()."
 
@@ -145,16 +145,16 @@ dns_pleskxml_rm() {
     return 1
   fi
 
-  _debug "Got list of DNS TXT records for root domain '$root_domain_name'"':\n'"$reclist"
+  _debug "Got list of DNS TXT records for root domain '$root_domain_name'. Full list is:"'\n'"$reclist"
+  
+  _debug "DNS TXT records for host '$fulldomain':"'\n'"$(_value "$reclist" | grep "<host>${fulldomain}.</host>")"
 
   recid="$(_value "$reclist" \
-    | grep "<host>$1.</host>" \
-    | grep "<value>$txtvalue</value>" \
-    | sed -r 's/(^.*<id>|<\/id>.*$)//g'
+    | grep "<host>${fulldomain}.</host>" \
+    | grep "<value>${txtvalue}</value>" \
+    | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/'
   )"
 
-  _debug "List of DNS TXT records for host:"'\n'"$(_value "$reclist" | grep "<host>$1.</host>")"
-
   if ! _value "$recid" | grep '^[0-9]\{1,\}$' >/dev/null; then
     _err "DNS records for root domain '${root_domain_name}' (Plesk ID ${root_domain_id}) + host '${sub_domain_name}' do not contain the TXT record '${txtvalue}'"
     _err "Cannot delete TXT record. Exiting."
@@ -341,13 +341,13 @@ _credential_check() {
 # See notes at top of this file
 
 _pleskxml_get_root_domain() {
-  _debug "Identifying DNS root domain for '$1' that is managed by the Plesk account."
   original_full_domain_name="$1"
-  root_domain_name="$1"
+
+  _debug "Identifying DNS root domain for '$original_full_domain_name' that is managed by the Plesk account."
 
   # test if the domain as provided is valid for splitting.
 
-  if ! _countdots "$root_domain_name"; then
+  if ! _countdots "$original_full_domain_name"; then
     _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
     return 1
   fi
@@ -372,6 +372,8 @@ _pleskxml_get_root_domain() {
   # loop and test if domain, or any parent domain, is managed by Plesk
   # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain
 
+  root_domain_name="$original_full_domain_name"
+
   while true; do
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."

From a8d670fc0d7abb2efa3cbcc411c79f37ad8c737d Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 19:01:32 +0000
Subject: [PATCH 128/246] Rest of sed -r

---
 dnsapi/dns_pleskxml.sh | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 2c9a4d56..c2de2184 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -211,16 +211,16 @@ _countdots() {
 
 # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines
 # $1 - result string from API
-# $2 - tag to resplit on (usually "result" or "domain")
+# $2 - plain text tag to resplit on (usually "result" or "domain"). NOT REGEX
 # $3 - basic regex to recognise useful return lines
 # note: $3 matches via basic NOT extended regex (BRE), as extended regex capabilities not needed at the moment.
-#       Last line could change to <sed -rn '/.../p'> instead, with suitablew ewscaping of ['"/$],
+#       Last line could change to <sed -n '/.../p'> instead, with suitable escaping of ['"/$],
 #       if future Plesk XML API changes ever require extended regex
 _api_response_split() {
   printf '%s' "$1" \
-    | sed -r 's/(^ +| +$)//g' \
+    | sed 's/^ +//;s/ +$//' \
     | tr -d '\n\r' \
-    | sed -r "s/<\/?$2>/${NEWLINE}/g" \
+    | sed "s/<\/\{0,1\}$2>/${NEWLINE}/g" \
     | grep "$3"
 }
 
@@ -365,7 +365,7 @@ _pleskxml_get_root_domain() {
   # Output will be one line per known domain, containing 2 <name> tages and a single <id> tag
   # We don't actually need to check for type, name, *and* id, but it guarantees only usable lines are returned.
 
-  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed -r 's/<(\/?)ascii-name>/<\1name>/g' | grep '<name>' | grep '<id>')"
+  output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')"
 
   _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
 
@@ -378,13 +378,13 @@ _pleskxml_get_root_domain() {
 
     _debug "Checking if '$root_domain_name' is managed by the Plesk server..."
 
-    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed -r 's/^.*<id>([0-9]+)<\/id>.*$/\1/')"
+    root_domain_id="$(_value "$output" | grep "<name>$root_domain_name</name>" | _head_n 1 | sed 's/^.*<id>\([0-9]\{1,\}\)<\/id>.*$/\1/')"
 
     if [ -n "$root_domain_id" ]; then
       # Found a match
       # SEE IMPORTANT NOTE ABOVE - THIS FUNCTION CAN RETURN HOST='', AND THAT'S OK FOR PLESK XML API WHICH ALLOWS IT.
       # SO WE HANDLE IT AND DON'T PREVENT IT
-      sub_domain_name="$(_value "$original_full_domain_name" | sed -r "s/\.?${root_domain_name}"'$//')"
+      sub_domain_name="$(_value "$original_full_domain_name" | sed "s/\.\{0,1\}${root_domain_name}"'$//')"
       _info "Success. Matched host '$original_full_domain_name' to: DOMAIN '${root_domain_name}' (Plesk ID '${root_domain_id}'), HOST '${sub_domain_name}'. Returning."
       return 0
     fi

From 4216c9e8f745d76588c8dc8592ade0e020f82d62 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 19:19:08 +0000
Subject: [PATCH 129/246] rmv spaces

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index c2de2184..d2a2684a 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -146,7 +146,7 @@ dns_pleskxml_rm() {
   fi
 
   _debug "Got list of DNS TXT records for root domain '$root_domain_name'. Full list is:"'\n'"$reclist"
-  
+
   _debug "DNS TXT records for host '$fulldomain':"'\n'"$(_value "$reclist" | grep "<host>${fulldomain}.</host>")"
 
   recid="$(_value "$reclist" \

From a9726bd52f764f519332783f8002ef8e2c742b5b Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 20:58:51 +0000
Subject: [PATCH 130/246] bugfix

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index d2a2684a..ad8d5cfd 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -393,7 +393,7 @@ _pleskxml_get_root_domain() {
 
     root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
 
-    if ! _countdots "$root_domain_name"; then
+    if [ _countdots "$root_domain_name" -eq 0 ]; then
       _debug "No match, and next parent would be a TLD..."
       _err "Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk."
       _err "Are you sure that this domain is managed by this Plesk server?"

From 38854bd876d11c4bf0f696e23c694a61d2b640ec Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 21:00:34 +0000
Subject: [PATCH 131/246] bugfix

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index ad8d5cfd..ca64325b 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -393,7 +393,7 @@ _pleskxml_get_root_domain() {
 
     root_domain_name="$(_valuecut 2 1000 "$root_domain_name")"
 
-    if [ _countdots "$root_domain_name" -eq 0 ]; then
+    if [ "$(_countdots "$root_domain_name")" -eq 0 ]; then
       _debug "No match, and next parent would be a TLD..."
       _err "Cannot find '$original_full_domain_name' or any parent domain of it, in Plesk."
       _err "Are you sure that this domain is managed by this Plesk server?"

From 43011f3bfa2e08807b3e7450d123aabcbd6905a8 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 21:04:10 +0000
Subject: [PATCH 132/246] enhance

---
 dnsapi/dns_pleskxml.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index ca64325b..5abe9dd1 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -203,10 +203,10 @@ _valuecut() {
   printf '%s' "$3" | cut -d . -f "${1}-${2}"
 }
 
-# Counts '.' present in a domain name
+# Counts '.' present in a domain name or other string
 # $1 = domain name
 _countdots() {
-  _value "$1" | tr -dc '.' | wc -c
+  _value "$1" | tr -dc '.' | wc -c | sed 's/ //g'
 }
 
 # Cleans up an API response, splits it "one line per item in the response" and greps for a string that in the context, identifies "useful" lines

From 05247dc4a4dca564a8d38e223da89556e2e68493 Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 21:09:14 +0000
Subject: [PATCH 133/246] fix

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index 5abe9dd1..b6781c2e 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -347,7 +347,7 @@ _pleskxml_get_root_domain() {
 
   # test if the domain as provided is valid for splitting.
 
-  if ! _countdots "$original_full_domain_name"; then
+  if [ "$(_countdots "$original_full_domain_name")" -eq 0 ]; then
     _err "Invalid domain. The ACME domain must contain at least two parts (aa.bb) to identify a domain and tld for the TXT record."
     return 1
   fi

From 6d0e4bed4b9d9bcb31e445ecadc7c4f741abc6fc Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 23:26:05 +0000
Subject: [PATCH 134/246] remove \n in output messages

---
 dnsapi/dns_pleskxml.sh | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index b6781c2e..ca07bc4e 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -96,7 +96,8 @@ dns_pleskxml_add() {
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
     _err 'This is unexpected: something has gone wrong.'
-    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    _err 'The full response was:' 
+    _err "$pleskxml_prettyprint_result"
     return 1
   fi
 
@@ -134,7 +135,9 @@ dns_pleskxml_rm() {
   fi
 
   # Reduce output to one line per DNS record, filtered for TXT records with a record ID only (which they should all have)
+  # Also strip out spaces between tags, redundant <data> and </data> group tags and any <self-closing/> tags
   reclist="$(_api_response_split "$pleskxml_prettyprint_result" 'result' '<status>ok</status>' \
+    | sed 's# \{1,\}<\([a-zA-Z]\)#<\1#g;s#</\{0,1\}data>##g;s#<[a-z][^/<>]*/>##g' \
     | grep "<site-id>${root_domain_id}</site-id>" \
     | grep '<id>[0-9]\{1,\}</id>' \
     | grep '<type>TXT</type>'
@@ -145,9 +148,8 @@ dns_pleskxml_rm() {
     return 1
   fi
 
-  _debug "Got list of DNS TXT records for root domain '$root_domain_name'. Full list is:"'\n'"$reclist"
-
-  _debug "DNS TXT records for host '$fulldomain':"'\n'"$(_value "$reclist" | grep "<host>${fulldomain}.</host>")"
+  _debug "Got list of DNS TXT records for root domain '$root_domain_name':"
+  _debug "$reclist"
 
   recid="$(_value "$reclist" \
     | grep "<host>${fulldomain}.</host>" \
@@ -181,7 +183,8 @@ dns_pleskxml_rm() {
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
     _err 'This is unexpected: something has gone wrong.'
-    _err 'The full response was:\n' "$pleskxml_prettyprint_result"
+    _err 'The full response was:'
+    _err "$pleskxml_prettyprint_result"
     return 1
   fi
 
@@ -231,7 +234,8 @@ _call_api() {
   request="$1"
   errtext=''
 
-  _debug 'Entered _call_api(). Calling Plesk XML API with request:\n' "'${request}'"
+  _debug 'Entered _call_api(). Calling Plesk XML API with request:'
+  _debug "'$request'"
 
   export _H1="HTTP_AUTH_LOGIN: $pleskxml_user"
   export _H2="HTTP_AUTH_PASSWD: $pleskxml_pass"
@@ -239,7 +243,9 @@ _call_api() {
   export _H4="HTTP_PRETTY_PRINT: true"
   pleskxml_prettyprint_result="$(_post "${request}" "$pleskxml_uri" "" "POST")"
   pleskxml_retcode="$?"
-  _debug 'The responses from the Plesk XML server were:\n' "retcode=$pleskxml_retcode. Literal response:"'\n' "'$pleskxml_prettyprint_result'"
+  _debug 'The responses from the Plesk XML server were:'
+  _debug "retcode=$pleskxml_retcode. Literal response:"
+  _debug "'$pleskxml_prettyprint_result'"
 
   # Detect any <status> that isn't "ok". None of the used calls should fail if the API is working correctly.
   # Also detect if there simply aren't any status lines (null result?) and report that, as well.
@@ -277,7 +283,8 @@ _call_api() {
     fi
 
     if [ "$errtext" != "" ]; then
-      _err 'The error responses received from the Plesk server were:\n' "$errtext"
+      _err 'The error responses received from the Plesk server were:'
+      _err "$errtext"
     else
       _err "No additional error messages were received back from the Plesk server"
     fi
@@ -318,7 +325,7 @@ _credential_check() {
   # Test the API is usable, by trying to read the list of managed domains...
   _call_api "$pleskxml_tplt_get_domains"
   if [ "$pleskxml_retcode" -ne 0 ]; then
-    _err '\nFailed to access Plesk XML API.'
+    _err 'Failed to access Plesk XML API.'
     _err "Please check your login credentials and Plesk URI, and that the URI is reachable, and try again."
     return 1
   fi
@@ -367,7 +374,8 @@ _pleskxml_get_root_domain() {
 
   output="$(_api_response_split "$pleskxml_prettyprint_result" 'domain' '<type>domain</type>' | sed 's/<ascii-name>/<name>/g;s/<\/ascii-name>/<\/name>/g' | grep '<name>' | grep '<id>')"
 
-  _debug 'Domains managed by Plesk server are (ignore the hacked output):\n' "$output"
+  _debug 'Domains managed by Plesk server are (ignore the hacked output):'
+  _debug "$output"
 
   # loop and test if domain, or any parent domain, is managed by Plesk
   # Loop until we don't have any '.' in the string we're testing as a candidate Plesk-managed domain

From 51cfd996eb8aaa142c9cbe61270bf1c5751f7d1e Mon Sep 17 00:00:00 2001
From: stilez <stilez@users.noreply.github.com>
Date: Tue, 5 Nov 2019 23:29:51 +0000
Subject: [PATCH 135/246] rmv space

---
 dnsapi/dns_pleskxml.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index ca07bc4e..c5d9e544 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -96,7 +96,7 @@ dns_pleskxml_add() {
     _err 'Error when calling Plesk XML API.'
     _err 'The result did not contain the expected <id>XXXXX</id> section, or contained other values as well.'
     _err 'This is unexpected: something has gone wrong.'
-    _err 'The full response was:' 
+    _err 'The full response was:'
     _err "$pleskxml_prettyprint_result"
     return 1
   fi

From 0b3ae1f9727787f46eec66ce796e030a5474a845 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:10:30 +0100
Subject: [PATCH 136/246] Add suggestions

---
 dnsapi/dns_opnsense.sh | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 0f7cdea6..97f18d1a 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,15 +4,19 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443"
+#OPNs_Port="443" (optional, defaults to 443 if unset)
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
 #fulldomain
 #txtvalue
+OPNs_DefaultPort=443
+OPNs_DefaultApi_Insecure=0
+
+
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2
@@ -168,7 +172,7 @@ _opns_rest() {
   key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
   token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
-  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
@@ -218,29 +222,30 @@ _opns_check_auth() {
   OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
 
   if [ -z "$OPNs_Host" ]; then
-    OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
     return 1
   else
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if [ -z "$OPNs_Port" ]; then
-    OPNs_Port="443"
+  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+    _err 'OPNs_Port specified but not numeric value'
+    return 1
+  elif [ -z "$OPNs_Port" ]; then
+    _info "OPNSense port not specified. Defaulting to using port $OPNs_DefaultPort"
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-
-  if [ -z "$OPNs_Api_Insecure" ]; then
-    OPNs_Api_Insecure="0"
-  else
-    #save the api addr and key to the account conf file.
+  
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+    _err 'OPNs_Api_Insecure specified but not 0/1 value'
+    return 1
+  elif [ -n "$OPNs_Api_Insecure" ]; then
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
@@ -249,7 +254,6 @@ _opns_check_auth() {
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    OPNs_Token=""
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1

From afdf8a78c0a42e22265309c522ee3cda4993e227 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:18:09 +0100
Subject: [PATCH 137/246] fix space

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 97f18d1a..afd96c3e 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -236,7 +236,7 @@ _opns_check_auth() {
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-  
+
   if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1

From fc8d9df5162bdec5e401edc4e8d6faba80e92d89 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:33:38 +0100
Subject: [PATCH 138/246] fix newline

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index afd96c3e..6dde12a5 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -16,7 +16,6 @@
 OPNs_DefaultPort=443
 OPNs_DefaultApi_Insecure=0
 
-
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2

From 18fc42e63b5f4491502b8a2203036c93b1c4eaba Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <langenbachs@gmail.com>
Date: Thu, 7 Nov 2019 22:06:32 +0100
Subject: [PATCH 139/246] typos and integrate suggestions from stilez

---
 dnsapi/dns_opnsense.sh | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 6dde12a5..4fbe9447 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,10 +4,13 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443" (optional, defaults to 443 if unset)
+#OPNs_Port="443"
+# optional, defaults to 443 if unset
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0
+# optional, defaults to 0 if unset
+# Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -44,15 +47,16 @@ dns_opnsense_rm() {
 }
 
 set_record() {
-  _info "Adding record"
   fulldomain=$1
   new_challenge=$2
+  _info "Adding record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
     return 1
   fi
+
   _debug _domain "$_domain"
   _debug _host "$_host"
   _debug _domainid "$_domainid"
@@ -81,7 +85,7 @@ set_record() {
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
-    _err "Error createing record $_record_string"
+    _err "Error creating record $_record_string"
     return 1
   fi
 
@@ -89,9 +93,9 @@ set_record() {
 }
 
 rm_record() {
-  _info "Remove record"
   fulldomain=$1
   new_challenge="$2"
+  _info "Remove record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
@@ -110,18 +114,18 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error delteting record $fulldomain"
+        _err "Error deleting record $host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error delteting record $fulldomain"
+      _err "Error deleting record $host from domain $fulldomain"
       return 1
     fi
   else
     _info "Record not found, nothing to remove"
   fi
 
-  return 0
+  return 0  
 }
 
 ####################  Private functions below ##################################
@@ -173,6 +177,7 @@ _opns_rest() {
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
+  _debug2 "Try to call api: https://${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
     export _H1="Content-Type: application/json"
@@ -227,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -236,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then
@@ -245,23 +250,23 @@ _opns_check_auth() {
   export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    _err "You don't specify OPNsense api key id."
-    _err "Please set you OPNs_Key and try again."
+    _err "you have not specified your OPNsense api key id."
+    _err "Please set OPNs_Key and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    _err "You don't specify OPNsense token."
-    _err "Please create you OPNs_Token and try again."
+    _err "you have not specified your OPNsense token."
+    _err "Please create OPNs_Token and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
   if ! _opns_rest "GET" "/general/get"; then
-    _err "Can't Access OPNsense"
+    _err "Call to OPNsense API interface failed. Unable to access OPNsense API."
     return 1
   fi
   return 0

From 0c76890572932edc06bf3fb39c9e329b2ceec326 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:52:10 +0100
Subject: [PATCH 140/246] whitespace fix

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 4fbe9447..9e4af15f 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -125,7 +125,7 @@ rm_record() {
     _info "Record not found, nothing to remove"
   fi
 
-  return 0  
+  return 0
 }
 
 ####################  Private functions below ##################################
@@ -232,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -241,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then

From 9cb328966c63d86565276e3ccc7d7e53d5101514 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:58:51 +0100
Subject: [PATCH 141/246] typo

---
 dnsapi/dns_opnsense.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 9e4af15f..b2a3746f 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -114,11 +114,11 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error deleting record $host from domain $fulldomain"
+        _err "Error deleting record $_host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error deleting record $host from domain $fulldomain"
+      _err "Error deleting record $_host from domain $fulldomain"
       return 1
     fi
   else

From f1f14040b85cb05330552d644c94890f6b82f2c3 Mon Sep 17 00:00:00 2001
From: Vitalii Tverdokhlib <v@nitra.ai>
Date: Sat, 9 Nov 2019 12:12:30 +0200
Subject: [PATCH 142/246] DOCS: typo

---
 notify/mailgun.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/notify/mailgun.sh b/notify/mailgun.sh
index 4b6ee3ba..93cdf793 100644
--- a/notify/mailgun.sh
+++ b/notify/mailgun.sh
@@ -7,7 +7,7 @@
 
 #MAILGUN_REGION="us|eu"          #optional, use "us" as default
 #MAILGUN_API_DOMAIN="xxxxxx.com"  #optional, use the default sandbox domain
-#MAILGUN_FROM="xxx@xxxxx.com"    #optional, use the default sendbox account
+#MAILGUN_FROM="xxx@xxxxx.com"    #optional, use the default sandbox account
 
 _MAILGUN_BASE_US="https://api.mailgun.net/v3"
 _MAILGUN_BASE_EU="https://api.eu.mailgun.net/v3"

From 867ec010abe4aa4af349895a1d1ac93c3d0fba66 Mon Sep 17 00:00:00 2001
From: arlecchino <kolbma@users.noreply.github.com>
Date: Tue, 12 Nov 2019 19:58:36 +0100
Subject: [PATCH 143/246] Fix callhook error in manual mode

Fixes #1586
Check force manual switch before causing error about it.
---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 81a20b0b..0164d54e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3365,7 +3365,7 @@ _on_issue_success() {
     fi
   fi
 
-  if _hasfield "$Le_Webroot" "$W_DNS"; then
+  if _hasfield "$Le_Webroot" "$W_DNS" && [ -z "$FORCE_DNS_MANUAL" ]; then
     _err "$_DNS_MANUAL_WARN"
   fi
 

From adce8f52e8b71da504541bec2a10a607b9b3fac4 Mon Sep 17 00:00:00 2001
From: "John L. Villalovos" <john@sodarock.com>
Date: Tue, 12 Nov 2019 08:48:41 -0800
Subject: [PATCH 144/246] debug_bash_helper: Use eval as busybox systems have
 problems

In _debug_bash_helper use eval as we are seeing issues with busybox
systems having issues with array access. Even though they aren't
actually running the code they appear to be parsing it and failing.

Also older versions of busybox have a bug with eval and double quotes,
so make sure to use single quotes when using eval.

Resolves: #2579
---
 acme.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/acme.sh b/acme.sh
index 81a20b0b..0c8ab903 100755
--- a/acme.sh
+++ b/acme.sh
@@ -268,31 +268,31 @@ _usage() {
 __debug_bash_helper() {
   # At this point only do for --debug 3
   if [ "${DEBUG:-$DEBUG_LEVEL_NONE}" -lt "$DEBUG_LEVEL_3" ]; then
-    echo ""
     return
   fi
   # Return extra debug info when running with bash, otherwise return empty
   # string.
   if [ -z "${BASH_VERSION}" ]; then
-    echo ""
     return
   fi
   # We are a bash shell at this point, return the filename, function name, and
   # line number as a string
   _dbh_saveIFS=$IFS
   IFS=" "
-  # Must use eval or syntax error happens under dash
+  # Must use eval or syntax error happens under dash. The eval should use
+  # single quotes as older versions of busybox had a bug with double quotes and
+  # eval.
   # Use 'caller 1' as we want one level up the stack as we should be called
   # by one of the _debug* functions
-  eval "_dbh_called=($(caller 1))"
+  eval '_dbh_called=($(caller 1))'
   IFS=$_dbh_saveIFS
-  _dbh_file=${_dbh_called[2]}
+  eval '_dbh_file=${_dbh_called[2]}'
   if [ -n "${_script_home}" ]; then
     # Trim off the _script_home directory name
-    _dbh_file=${_dbh_file#$_script_home/}
+    eval '_dbh_file=${_dbh_file#$_script_home/}'
   fi
-  _dbh_function=${_dbh_called[1]}
-  _dbh_lineno=${_dbh_called[0]}
+  eval '_dbh_function=${_dbh_called[1]}'
+  eval '_dbh_lineno=${_dbh_called[0]}'
   printf "%-40s " "$_dbh_file:${_dbh_function}:${_dbh_lineno}"
 }
 

From c282dd086fe0fc2152f7d47fb4ee1885f26aec09 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Nov 2019 08:06:21 +0800
Subject: [PATCH 145/246] minor

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 493b05bc..e3b39b0c 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -89,7 +89,7 @@ dns_nic_rm() {
     return 1
   fi
 
-  _domain_id=$(printf "%s" "$response" | grep "$_sub_domain" | grep "$txtvalue" | sed -r "s/.*<rr id=\"(.*)\".*/\1/g")
+  _domain_id=$(printf "%s" "$response" | grep "$_sub_domain" | grep -- "$txtvalue" | sed -r "s/.*<rr id=\"(.*)\".*/\1/g")
 
   if ! _nic_rest DELETE "services/$_service/zones/$_domain/records/$_domain_id"; then
     _err "Delete record error"

From b23e05dbc5bfe99a36b48448af2d13bc18c95d6e Mon Sep 17 00:00:00 2001
From: Charlie Garrison <cng@garrison.com.au>
Date: Tue, 26 Nov 2019 20:39:08 +1100
Subject: [PATCH 146/246] Added trailing slash to end of each line of
 DEPLOY_SCRIPT_CMD

---
 deploy/routeros.sh | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index 21c9196f..2f349999 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -85,19 +85,19 @@ routeros_deploy() {
   scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
   _info "Trying to push cert '$_cfullchain' to router"
   scp "$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer"
-  DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive 
-source=\"## generated by routeros deploy script in acme.sh
-\n/certificate remove [ find name=$_cdomain.cer_0 ]
-\n/certificate remove [ find name=$_cdomain.cer_1 ]
-\ndelay 1
-\n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\"
-\n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\"
-\ndelay 1
-\n/file remove $_cdomain.cer
-\n/file remove $_cdomain.key
-\ndelay 2
-\n/ip service set www-ssl certificate=$_cdomain.cer_0
-\n$ROUTER_OS_ADDITIONAL_SERVICES
+  DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=admin policy=ftp,read,write,password,sensitive \
+source=\"## generated by routeros deploy script in acme.sh;\
+\n/certificate remove [ find name=$_cdomain.cer_0 ];\
+\n/certificate remove [ find name=$_cdomain.cer_1 ];\
+\ndelay 1;\
+\n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\";\
+\n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\";\
+\ndelay 1;\
+\n/file remove $_cdomain.cer;\
+\n/file remove $_cdomain.key;\
+\ndelay 2;\
+\n/ip service set www-ssl certificate=$_cdomain.cer_0;\
+\n$ROUTER_OS_ADDITIONAL_SERVICES;\
 \n\"
 "
   # shellcheck disable=SC2029

From ec1f9841b21cd9aa7ca96aac4589472f3624f4eb Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:22:26 +0100
Subject: [PATCH 147/246] Replace grep -A.

---
 dnsapi/dns_kas.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 14c0b378..bf01fef3 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -69,13 +69,13 @@ dns_kas_rm() {
   _get_record_name "$_fulldomain"
   _get_record_id
 
-  # If there is a record_id, delete the entry   
+  # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
     params="$params&kas_auth_type=$KAS_Authtype"
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
-    
+
     # split it into a seperated list, if there where multiples entries made
     records=($_record_id)
     for i in "${records[@]}"
@@ -150,7 +150,7 @@ _get_record_id() {
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
-  _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  _record_id="$(echo "$response"  | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
-}
\ No newline at end of file
+}

From c641b61b26f20771b044bf838ce5943fc163d8f7 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:46:44 +0100
Subject: [PATCH 148/246] Fix a few snytax issues

---
 dnsapi/dns_kas.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index bf01fef3..759b3aaa 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -78,8 +78,7 @@ dns_kas_rm() {
 
     # split it into a seperated list, if there where multiples entries made
     records=($_record_id)
-    for i in "${records[@]}"
-    do
+    for i in "${records[@]}"; do
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."
@@ -95,7 +94,7 @@ dns_kas_rm() {
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
-return 0
+  return 0
 }
 
 ########################## PRIVATE FUNCTIONS ###########################

From 953a9b17681a456ed4538f82e071eca3f713199d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:51:23 +0100
Subject: [PATCH 149/246] Remove obsolete blank.

---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 759b3aaa..4f2b1d5a 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -149,7 +149,7 @@ _get_record_id() {
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
-  _record_id="$(echo "$response"  | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 5014f83b86cf456869063043a526476dd9937d46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbyszek=20=C5=BB=C3=B3=C5=82kiewski?=
 <zbyszek@onefellow.com>
Date: Fri, 6 Dec 2019 09:59:35 +0100
Subject: [PATCH 150/246] Fix case sensitive detection of domain in the
 response request

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 4d4957f5..07838b29 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4082,7 +4082,7 @@ $_authorizations_map"
 
       if [ "$ACME_VERSION" = "2" ]; then
         _idn_d="$(_idn "$d")"
-        _candindates="$(echo "$_authorizations_map" | grep "^$_idn_d,")"
+        _candindates="$(echo "$_authorizations_map" | grep -i "^$_idn_d,")"
         _debug2 _candindates "$_candindates"
         if [ "$(echo "$_candindates" | wc -l)" -gt 1 ]; then
           for _can in $_candindates; do

From 0ffd5de6fc4a414f207f532e0501929b009935ee Mon Sep 17 00:00:00 2001
From: Gustav Genberg <gurra.genberg@gmail.com>
Date: Sun, 8 Dec 2019 00:13:30 +0100
Subject: [PATCH 151/246] Fix add record error

---
 dnsapi/dns_unoeuro.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_unoeuro.sh b/dnsapi/dns_unoeuro.sh
index 9132f136..c4593a63 100644
--- a/dnsapi/dns_unoeuro.sh
+++ b/dnsapi/dns_unoeuro.sh
@@ -52,7 +52,7 @@ dns_unoeuro_add() {
   fi
   _info "Adding record"
 
-  if _uno_rest POST "my/products/$h/dns/records" "{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"data\":\"$txtvalue\",\"ttl\":120}"; then
+  if _uno_rest POST "my/products/$h/dns/records" "{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"data\":\"$txtvalue\",\"ttl\":120,\"priority\":0}"; then
     if _contains "$response" "\"status\": 200" >/dev/null; then
       _info "Added, OK"
       return 0

From c22705a59392f11007bdd18b086520399794b6e6 Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Wed, 11 Dec 2019 17:13:11 +0100
Subject: [PATCH 152/246] Add DNS API support for Constellix.

---
 dnsapi/dns_constellix.sh | 137 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)
 create mode 100644 dnsapi/dns_constellix.sh

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
new file mode 100644
index 00000000..bc552316
--- /dev/null
+++ b/dnsapi/dns_constellix.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env sh
+
+# Author: Wout Decre <wout@rambla.be>
+
+CONSTELLIX_API="https://api.dns.constellix.com/v1"
+#CONSTELLIX_KEY="XXX"
+#CONSTELLIX_SECRET="XXX"
+
+########  Public functions #####################
+
+dns_constellix_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
+  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+
+  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+    _err "You did not specify the Contellix API key and secret yet."
+    return 1
+  fi
+
+  _saveaccountconf_mutable CONSTELLIX_KEY "$CONSTELLIX_KEY"
+  _saveaccountconf_mutable CONSTELLIX_SECRET "$CONSTELLIX_SECRET"
+
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _info "Adding TXT record"
+  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"add\":true,\"set\":{\"name\":\"${_sub_domain}\",\"ttl\":120,\"roundRobin\":[{\"value\":\"${txtvalue}\"}]}}]"; then
+    if printf -- "%s" "$response" | grep "{\"success\":\"1 record(s) added, 0 record(s) updated, 0 record(s) deleted\"}" >/dev/null; then
+      _info "Added"
+      return 0
+    else
+      _err "Error adding TXT record"
+      return 1
+    fi
+  fi
+}
+
+dns_constellix_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
+  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+
+  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+    _err "You did not specify the Contellix API key and secret yet."
+    return 1
+  fi
+
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _info "Removing TXT record"
+  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"delete\":true,\"filter\":{\"field\":\"name\",\"op\":\"eq\",\"value\":\"${_sub_domain}\"}}]"; then
+    if printf -- "%s" "$response" | grep "{\"success\":\"0 record(s) added, 0 record(s) updated, 1 record(s) deleted\"}" >/dev/null; then
+      _info "Removed"
+      return 0
+    else
+      _err "Error removing TXT record"
+      return 1
+    fi
+  fi
+}
+
+####################  Private functions below ##################################
+
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  _debug "Detecting root zone"
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if ! _constellix_rest GET "domains"; then
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*" | head -n 1 | cut -d ':' -f 2 | tr -d '}')
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d '.' -f 1-$p)
+        _domain="$h"
+
+        _debug _domain_id "$_domain_id"
+        _debug _sub_domain "$_sub_domain"
+        _debug _domain "$_domain"
+        return 0
+      fi
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_constellix_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  rdate=$(date +"%s")"000"
+  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_SECRET" | _hex_dump | tr -d ' ')" | _base64)
+
+  export _H1="x-cnsdns-apiKey: $CONSTELLIX_KEY"
+  export _H2="x-cnsdns-requestDate: $rdate"
+  export _H3="x-cnsdns-hmac: $hmac"
+  export _H4="Accept: application/json"
+  export _H5="Content-Type: application/json"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$CONSTELLIX_API/$ep" "" "$m")"
+  else
+    response="$(_get "$CONSTELLIX_API/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Error $ep"
+    return 1
+  fi
+
+  _debug response "$response"
+  return 0
+}

From e8e6feeb0ffd273c20328bfa11a36f3f916c997a Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Wed, 11 Dec 2019 17:15:35 +0100
Subject: [PATCH 153/246] Use different e-mail.

---
 dnsapi/dns_constellix.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index bc552316..55f4a71b 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-# Author: Wout Decre <wout@rambla.be>
+# Author: Wout Decre <wout@canodus.be>
 
 CONSTELLIX_API="https://api.dns.constellix.com/v1"
 #CONSTELLIX_KEY="XXX"

From 3ccac629bcbb9f94602a7338891ec56ad9a1501d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Thu, 12 Dec 2019 16:23:42 +0100
Subject: [PATCH 154/246] Change the loop for sh.

---
 dnsapi/dns_kas.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 4f2b1d5a..a2dc0d5f 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -76,9 +76,7 @@ dns_kas_rm() {
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
 
-    # split it into a seperated list, if there where multiples entries made
-    records=($_record_id)
-    for i in "${records[@]}"; do
+    for i in $_record_id; do
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."

From f37546e173e41827a7aab169de32124d4fdfd5e9 Mon Sep 17 00:00:00 2001
From: Siyuan Miao <i@xswan.net>
Date: Fri, 13 Dec 2019 18:46:09 +0800
Subject: [PATCH 155/246] add acme.sh support for misaka.io dns service

---
 dnsapi/dns_misaka.sh | 160 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)
 create mode 100755 dnsapi/dns_misaka.sh

diff --git a/dnsapi/dns_misaka.sh b/dnsapi/dns_misaka.sh
new file mode 100755
index 00000000..7d83bf51
--- /dev/null
+++ b/dnsapi/dns_misaka.sh
@@ -0,0 +1,160 @@
+#!/usr/bin/env sh
+
+# bug reports to support+acmesh@misaka.io
+# based on dns_nsone.sh by dev@1e.ca
+
+#
+#Misaka_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
+#
+
+Misaka_Api="https://dnsapi.misaka.io/dns"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_misaka_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  if [ -z "$Misaka_Key" ]; then
+    Misaka_Key=""
+    _err "You didn't specify misaka.io dns api key yet."
+    _err "Please create you key and try again."
+    return 1
+  fi
+
+  #save the api key and email to the account conf file.
+  _saveaccountconf Misaka_Key "$Misaka_Key"
+
+  _debug "checking root zone [$fulldomain]"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _misaka_rest GET "zones/${_domain}/recordsets?search=${_sub_domain}"
+
+  if ! _contains "$response" "\"results\":"; then
+    _err "Error"
+    return 1
+  fi
+
+  count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$_sub_domain\",[^{]*\"type\":\"TXT\"" | wc -l | tr -d " ")
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Adding record"
+
+    if _misaka_rest PUT "zones/${_domain}/recordsets/${_sub_domain}/TXT" "{\"records\":[{\"value\":\"\\\"$txtvalue\\\"\"}],\"filters\":[],\"ttl\":1}"; then
+      _debug response "$response"
+      if _contains "$response" "$_sub_domain"; then
+        _info "Added"
+        return 0
+      else
+        _err "Add txt record error."
+        return 1
+      fi
+    fi
+    _err "Add txt record error."
+  else
+    _info "Updating record"
+
+    # todo: add existing challenges
+    _misaka_rest POST "zones/${_domain}/recordsets/${_sub_domain}/TXT" "{\"records\": [{\"value\": \"\\\"$txtvalue\\\"\"}],\"ttl\":1}"
+    if [ "$?" = "0" ] && _contains "$response" "$_sub_domain"; then
+      _info "Updated!"
+      #todo: check if the record takes effect
+      return 0
+    fi
+    _err "Update error"
+    return 1
+  fi
+
+}
+
+#fulldomain
+dns_misaka_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _misaka_rest GET "zones/${_domain}/recordsets?search=${_sub_domain}"
+
+  count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$_sub_domain\",[^{]*\"type\":\"TXT\"" | wc -l | tr -d " ")
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Don't need to remove."
+  else
+    if ! _misaka_rest DELETE "zones/${_domain}/recordsets/${_sub_domain}/TXT"; then
+      _err "Delete record error."
+      return 1
+    fi
+    _contains "$response" ""
+  fi
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  if ! _misaka_rest GET "zones?limit=1000"; then
+    return 1
+  fi
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain="$h"
+      return 0
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_misaka_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Content-Type: application/json"
+  export _H2="User-Agent: acme.sh/$VER misaka-dns-acmesh/20191213"
+  export _H3="Authorization: Token $Misaka_Key"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$Misaka_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$Misaka_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From 375b8dceb70ab9fc32e4da4aa62fcb2cb3654284 Mon Sep 17 00:00:00 2001
From: Siyuan Miao <i@xswan.net>
Date: Sat, 14 Dec 2019 10:44:57 +0800
Subject: [PATCH 156/246] use append mode to update recordsets

---
 dnsapi/dns_misaka.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_misaka.sh b/dnsapi/dns_misaka.sh
index 7d83bf51..eed4170e 100755
--- a/dnsapi/dns_misaka.sh
+++ b/dnsapi/dns_misaka.sh
@@ -61,8 +61,7 @@ dns_misaka_add() {
   else
     _info "Updating record"
 
-    # todo: add existing challenges
-    _misaka_rest POST "zones/${_domain}/recordsets/${_sub_domain}/TXT" "{\"records\": [{\"value\": \"\\\"$txtvalue\\\"\"}],\"ttl\":1}"
+    _misaka_rest POST "zones/${_domain}/recordsets/${_sub_domain}/TXT?append=true" "{\"records\": [{\"value\": \"\\\"$txtvalue\\\"\"}],\"ttl\":1}"
     if [ "$?" = "0" ] && _contains "$response" "$_sub_domain"; then
       _info "Updated!"
       #todo: check if the record takes effect

From 549ebbb462caa0ad49f9936f28c51dd8191f1fd4 Mon Sep 17 00:00:00 2001
From: wurzelpanzer <32928046+wurzelpanzer@users.noreply.github.com>
Date: Sat, 21 Dec 2019 20:19:02 +0100
Subject: [PATCH 157/246] Add easyDNS support

---
 dnsapi/dns_easydns.sh | 172 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 172 insertions(+)
 create mode 100644 dnsapi/dns_easydns.sh

diff --git a/dnsapi/dns_easydns.sh b/dnsapi/dns_easydns.sh
new file mode 100644
index 00000000..1d905841
--- /dev/null
+++ b/dnsapi/dns_easydns.sh
@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+#######################################################
+#
+# easyDNS REST API for acme.sh by Neilpang based on dns_cf.sh
+# 
+# Please note: # API is currently beta and subject to constant change
+# http://sandbox.rest.easydns.net:3000/
+#
+# Author: wurzelpanzer [wurzelpanzer@maximolider.net]
+# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2647
+#
+####################  Public functions #################
+
+#EASYDNS_Key="xxxxxxxxxxxxxxxxxxxxxxxx"
+#EASYDNS_Token="xxxxxxxxxxxxxxxxxxxxxxxx"
+EASYDNS_Api="https://rest.easydns.net"
+
+#Usage: add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_easydns_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  EASYDNS_Token="${EASYDNS_Token:-$(_readaccountconf_mutable EASYDNS_Token)}"
+  EASYDNS_Key="${EASYDNS_Key:-$(_readaccountconf_mutable EASYDNS_Key)}"
+
+  if [ -z "$EASYDNS_Token" ] || [ -z "$EASYDNS_Key" ]; then
+    _err "You didn't specify an easydns.net token or api key. Please sign up at http://docs.sandbox.rest.easydns.net/beta_signup.php"
+    return 1
+  else
+    _saveaccountconf_mutable EASYDNS_Token "$EASYDNS_Token"
+    _saveaccountconf_mutable EASYDNS_Key "$EASYDNS_Key"
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _EASYDNS_rest GET "zones/records/all/${_domain}/search/${_sub_domain}"
+
+  if ! printf "%s" "$response" | grep \"status\":200 >/dev/null; then
+    _err "Error"
+    return 1
+  fi
+
+  _info "Adding record"
+  if _EASYDNS_rest PUT "zones/records/add/$_domain/TXT" "{\"host\":\"$_sub_domain\",\"rdata\":\"$txtvalue\"}"; then
+    if _contains "$response" "\"status\":201"; then
+      _info "Added, OK"
+      return 0
+    elif _contains "$response" "Record already exists"; then
+      _info "Already exists, OK"
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+  return 1
+
+}
+
+dns_easydns_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  EASYDNS_Token="${EASYDNS_Token:-$(_readaccountconf_mutable EASYDNS_Token)}"
+  EASYDNS_Key="${EASYDNS_Key:-$(_readaccountconf_mutable EASYDNS_Key)}"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _EASYDNS_rest GET "zones/records/all/${_domain}/search/${_sub_domain}"
+
+  if ! printf "%s" "$response" | grep \"status\":200 >/dev/null; then
+    _err "Error"
+    return 1
+  fi
+
+  count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Don't need to remove."
+  else
+    record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | head -n 1)
+    _debug "record_id" "$record_id"
+    if [ -z "$record_id" ]; then
+      _err "Can not get record id to remove."
+      return 1
+    fi
+    if ! _EASYDNS_rest DELETE "zones/records/$_domain/$record_id"; then
+      _err "Delete record error."
+      return 1
+    fi
+    _contains "$response" "\"status\":200"
+  fi
+
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if ! _EASYDNS_rest GET "zones/records/all/$h"; then
+      return 1
+    fi
+
+    if _contains "$response" "\"status\":200"; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_EASYDNS_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  basicauth=$(printf "%s" "$EASYDNS_Token":"$EASYDNS_Key" | _base64)
+
+  export _H1="accept: application/json"
+  if [ "$basicauth" ]; then
+    export _H2="Authorization: Basic $basicauth"
+  fi
+
+  if [ "$m" != "GET" ]; then
+    export _H3="Content-Type: application/json"
+    _debug data "$data"
+    response="$(_post "$data" "$EASYDNS_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$EASYDNS_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From 594b83e7a646e6d5a8176e50712c688da31a8d6a Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 11:58:21 +0100
Subject: [PATCH 158/246] Update dns_kas.sh

remove "rev" command
fix "Error removing txt for domain:_acme-challenge.foo"
---
 dnsapi/dns_kas.sh | 44 ++++++++++++++++++++++++--------------------
 1 file changed, 24 insertions(+), 20 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index a2dc0d5f..19bfd6bb 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -12,8 +12,7 @@
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
-# TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
-#       => Get all root zones and compare once the provider offers that.
+########################################################################
 
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
 
@@ -26,8 +25,7 @@ dns_kas_add() {
   _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_fulldomain"
-  _get_record_name "$_fulldomain"
+  _get_zone_and_record_name "$_fulldomain"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -65,8 +63,7 @@ dns_kas_rm() {
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_fulldomain"
-  _get_record_name "$_fulldomain"
+  _get_zone_and_record_name "$_fulldomain"
   _get_record_id
 
   # If there is a record_id, delete the entry
@@ -116,20 +113,28 @@ _check_and_save() {
   return 0
 }
 
-# Gets back the base domain/zone.
-# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_zone() {
-  _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
-  return 0
-}
+_get_zone_and_record_name()() {
+  _zonen="$( cat testfile.txt  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+  _domain="$1"
+  if _endswith "$_domain" "."; then
+    _domain="$(echo "$_domain" | sed 's/.$//')"
+  fi
+  _rootzone="$_domain"
+  for i in $_zonen; do
+    l1=${#_rootzone}
+    l2=${#i}
+    if _endswith "$_domain" "$i" && [ "$l1" -ge "$l2" ]; then
+      _rootzone="$i"
+    fi
+  done
+  _zone="$_rootzone"
+  _debug2 "zone:" "$_zone"
 
-# Removes the domain/subdomain from the entry since kasserver
-# cannot handle _fulldomain
-# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
-# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_record_name() {
-  _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+  l3=$((${#_domain}-l1-1))
+  _record_name="$(echo "$_domain" | cut -c -"$l3")"
+  _debug2 "record_name:" "$_record_name"
   return 0
 }
 
@@ -146,8 +151,7 @@ _get_record_id() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-
-  _record_id="$(echo "$response" | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 99c47dd50a7a41fa8ef519c23ee5fc94644135bf Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 22:42:51 +0100
Subject: [PATCH 159/246] Update dns_kas.sh

only bash needed
---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 19bfd6bb..a39f8c9e 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/bin/bash
 ########################################################################
 # All-inkl Kasserver hook script for acme.sh
 #

From a138425417fe76deb6eade981a6e4c240f9afc41 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 23:42:46 +0100
Subject: [PATCH 160/246] Update dns_kas.sh

sorry for this commit.  ;)
Fix NewBeMistakes
---
 dnsapi/dns_kas.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index a39f8c9e..437422bd 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -115,8 +115,8 @@ _check_and_save() {
 
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_zone_and_record_name()() {
-  _zonen="$( cat testfile.txt  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+_get_zone_and_record_name() {
+  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
   _domain="$1"
   if _endswith "$_domain" "."; then
     _domain="$(echo "$_domain" | sed 's/.$//')"

From 2214507db01f547520fbed05afb3ecc1035c6fd3 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sun, 29 Dec 2019 10:59:28 +0100
Subject: [PATCH 161/246] Revert "Update dns_kas.sh"

This reverts commit 99c47dd50a7a41fa8ef519c23ee5fc94644135bf.
---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 437422bd..5c7cd9ef 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env sh
 ########################################################################
 # All-inkl Kasserver hook script for acme.sh
 #

From a44ea0ddf0ea5ee46e2cf8a6dc54d79e0584639e Mon Sep 17 00:00:00 2001
From: gildea <gildea@google.com>
Date: Tue, 31 Dec 2019 20:22:08 -0800
Subject: [PATCH 162/246] Return failure when falling through limiting loop

In _send_signed_request and _check_dns_entries, return 1 when the
timeout (or number of retries) has been exhausted.  This allows
the calling function to correctly handle the error.
---
 acme.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 4d4957f5..902b39d4 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2040,8 +2040,10 @@ _send_signed_request() {
         continue
       fi
     fi
-    break
+    return 0
   done
+  _info "Giving up sending to CA server after $MAX_REQUEST_RETRY_TIMES retries."
+  return 1
 
 }
 
@@ -3819,9 +3821,11 @@ _check_dns_entries() {
       _sleep 10
     else
       _info "All success, let's return"
-      break
+      return 0
     fi
   done
+  _info "Timed out waiting for DNS."
+  return 1
 
 }
 

From b59b0f0386fd1b0a35dd68dce0d5d18054973e34 Mon Sep 17 00:00:00 2001
From: Tambet Liiv <tambet@liiv.eu>
Date: Thu, 2 Jan 2020 14:55:36 +0200
Subject: [PATCH 163/246] use different method to get root

---
 dnsapi/dns_zone.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_zone.sh b/dnsapi/dns_zone.sh
index 847e32cd..176fc494 100755
--- a/dnsapi/dns_zone.sh
+++ b/dnsapi/dns_zone.sh
@@ -136,10 +136,10 @@ _get_root() {
     if [ -z "$h" ]; then
       return 1
     fi
-    if ! _zone_rest GET "dns/$h/a"; then
+    if ! _zone_rest GET "dns/$h"; then
       return 1
     fi
-    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
+    if _contains "$response" "\"identificator\":\"$h\"" >/dev/null; then
       _domain=$h
       return 0
     fi

From 8dd1df71cc6cf59eaedbe9b2fd0a40279cb98f60 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Thu, 2 Jan 2020 17:10:36 +0100
Subject: [PATCH 164/246] Update dns_kas.sh

tested and works now
---
 dnsapi/dns_kas.sh | 46 ++++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 5c7cd9ef..b17eeee4 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -13,19 +13,18 @@
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 ########################################################################
-
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
-
 ########  Public functions #####################
-
-dns_kas_add() {
+dns_kas_add(){
   _fulldomain=$1
   _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-
+  _info "Check and Save Props"
   _check_and_save
+  _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
+  _info "Getting Record ID"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -61,11 +60,14 @@ dns_kas_rm() {
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-
+   
+  _info "Check and Save Props"
   _check_and_save
+  _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
+  _info "Getting Record ID"
   _get_record_id
-
+  
   # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
@@ -116,11 +118,19 @@ _check_and_save() {
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone_and_record_name() {
-  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+ 
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&kas_action=get_domains"
+
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
   _domain="$1"
-  if _endswith "$_domain" "."; then
-    _domain="$(echo "$_domain" | sed 's/.$//')"
-  fi
+  _temp_domain="$(echo "$1" |  sed 's/\.$//')"
   _rootzone="$_domain"
   for i in $_zonen; do
     l1=${#_rootzone}
@@ -129,12 +139,12 @@ _get_zone_and_record_name() {
       _rootzone="$i"
     fi
   done
-  _zone="$_rootzone"
-  _debug2 "zone:" "$_zone"
-
-  l3=$((${#_domain}-l1-1))
-  _record_name="$(echo "$_domain" | cut -c -"$l3")"
-  _debug2 "record_name:" "$_record_name"
+  _zone="${_rootzone}."
+  _temp_record_name="$(echo "$_temp_domain" | sed "s/"$_rootzone"//g")"
+  _record_name="$(echo "$_temp_record_name" |  sed 's/\.$//')"
+  _debug2 "Zone:" "$_zone"
+  _debug2 "Domain:" "$_domain"
+  _debug2 "Record_Name:" "$_record_name"
   return 0
 }
 
@@ -151,7 +161,7 @@ _get_record_id() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | sed "s/record_id>=>//g")"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 7a3c61b7449dfe57e079eb124fbe2e934139e132 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Fri, 3 Jan 2020 21:38:47 +0800
Subject: [PATCH 165/246] check upgrade hash
 https://github.com/Neilpang/acme.sh/issues/2667

---
 acme.sh | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/acme.sh b/acme.sh
index fcebab7f..570e2836 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6303,6 +6303,7 @@ _installOnline() {
     chmod +x $PROJECT_ENTRY
     if ./$PROJECT_ENTRY install "$_nocron" "" "$_noprofile"; then
       _info "Install success!"
+      _saveaccountconf "UPGRADE_HASH" "$(_getMasterHash)"
     fi
 
     cd ..
@@ -6312,9 +6313,15 @@ _installOnline() {
   )
 }
 
+_getMasterHash() {
+  _hash_url="https://api.github.com/repos/Neilpang/acme.sh/git/refs/heads/master"
+  _get $_hash_url | tr -d "\r\n" | tr '{},' '\n' | grep '"sha":' | cut -d '"' -f 4
+}
+
 upgrade() {
   if (
     _initpath
+    [ -z "$FORCE" ] && [ "$(_getMasterHash)" = "$(_readaccountconf "UPGRADE_HASH")" ] && _info "Already uptodate!" && exit 0
     export LE_WORKING_DIR
     cd "$LE_WORKING_DIR"
     _installOnline "nocron" "noprofile"

From 8aedf26a87fff9aadf33df74fafa4615ea1106ef Mon Sep 17 00:00:00 2001
From: Ryan Meyers <ryanmeyersweb@gmail.com>
Date: Sat, 4 Jan 2020 10:51:32 -0600
Subject: [PATCH 166/246] Replace \s with hard space

---
 dnsapi/dns_linode_v4.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index ee7ee892..fc49bb6f 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -36,7 +36,7 @@ dns_linode_v4_add() {
             }"
 
   if _rest POST "/$_domain_id/records" "$_payload" && [ -n "$response" ]; then
-    _resource_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":\s*[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1)
+    _resource_id=$(printf "%s\n" "$response" | _egrep_o "\"id\": *[0-9]+" | cut -d : -f 2 | tr -d " " | _head_n 1)
     _debug _resource_id "$_resource_id"
 
     if [ -z "$_resource_id" ]; then
@@ -74,9 +74,9 @@ dns_linode_v4_rm() {
   if _rest GET "/$_domain_id/records" && [ -n "$response" ]; then
     response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
 
-    resource="$(echo "$response" | _egrep_o "{.*\"name\":\s*\"$_sub_domain\".*}")"
+    resource="$(echo "$response" | _egrep_o "{.*\"name\": *\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
-      _resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"id\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
+      _resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
       if [ "$_resource_id" ]; then
         _debug _resource_id "$_resource_id"
 
@@ -139,9 +139,9 @@ _get_root() {
         return 1
       fi
 
-      hostedzone="$(echo "$response" | _egrep_o "{.*\"domain\":\s*\"$h\".*}")"
+      hostedzone="$(echo "$response" | _egrep_o "{.*\"domain\": *\"$h\".*}")"
       if [ "$hostedzone" ]; then
-        _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\":\s*[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
+        _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
         if [ "$_domain_id" ]; then
           _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
           _domain=$h

From 38a8721a91be420a5ce83b6b18558c79ee0eb48a Mon Sep 17 00:00:00 2001
From: Ryan Meyers <ryanmeyersweb@gmail.com>
Date: Sat, 4 Jan 2020 10:52:52 -0600
Subject: [PATCH 167/246] Escape opening brackets

---
 dnsapi/dns_linode_v4.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_linode_v4.sh b/dnsapi/dns_linode_v4.sh
index fc49bb6f..c2bebc57 100755
--- a/dnsapi/dns_linode_v4.sh
+++ b/dnsapi/dns_linode_v4.sh
@@ -74,7 +74,7 @@ dns_linode_v4_rm() {
   if _rest GET "/$_domain_id/records" && [ -n "$response" ]; then
     response="$(echo "$response" | tr -d "\n" | tr '{' "|" | sed 's/|/&{/g' | tr "|" "\n")"
 
-    resource="$(echo "$response" | _egrep_o "{.*\"name\": *\"$_sub_domain\".*}")"
+    resource="$(echo "$response" | _egrep_o "\{.*\"name\": *\"$_sub_domain\".*}")"
     if [ "$resource" ]; then
       _resource_id=$(printf "%s\n" "$resource" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
       if [ "$_resource_id" ]; then
@@ -139,7 +139,7 @@ _get_root() {
         return 1
       fi
 
-      hostedzone="$(echo "$response" | _egrep_o "{.*\"domain\": *\"$h\".*}")"
+      hostedzone="$(echo "$response" | _egrep_o "\{.*\"domain\": *\"$h\".*}")"
       if [ "$hostedzone" ]; then
         _domain_id=$(printf "%s\n" "$hostedzone" | _egrep_o "\"id\": *[0-9]+" | _head_n 1 | cut -d : -f 2 | tr -d \ )
         if [ "$_domain_id" ]; then

From f174d7dd39ac0bc39f12e537e7c987afcaf950aa Mon Sep 17 00:00:00 2001
From: Silvan Raijer <github@rayzilt.nl>
Date: Sun, 5 Jan 2020 15:27:04 +0100
Subject: [PATCH 168/246] dns_lexicon.sh: Add extra variable _API_KEY

---
 dnsapi/dns_lexicon.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/dnsapi/dns_lexicon.sh b/dnsapi/dns_lexicon.sh
index f6f54464..bb9f7efc 100755
--- a/dnsapi/dns_lexicon.sh
+++ b/dnsapi/dns_lexicon.sh
@@ -63,6 +63,16 @@ _lexicon_init() {
     _saveaccountconf_mutable "$Lx_domaintoken" "$Lx_domaintoken_v"
     eval export "$Lx_domaintoken"
   fi
+
+  # shellcheck disable=SC2018,SC2019
+  Lx_api_key=$(echo LEXICON_"${PROVIDER}"_API_KEY | tr 'a-z' 'A-Z')
+  eval "$Lx_api_key=\${$Lx_api_key:-$(_readaccountconf_mutable "$Lx_api_key")}"
+  Lx_api_key_v=$(eval echo \$"$Lx_api_key")
+  _secure_debug "$Lx_api_key" "$Lx_api_key_v"
+  if [ "$Lx_api_key_v" ]; then
+    _saveaccountconf_mutable "$Lx_api_key" "$Lx_api_key_v"
+    eval export "$Lx_api_key"
+  fi
 }
 
 ########  Public functions #####################

From c3fbc36ce7142e7013aa4bad3e2d2d4e8596bbca Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 6 Jan 2020 20:57:12 +0800
Subject: [PATCH 169/246] fix
 https://github.com/Neilpang/acme.sh/issues/2547#issuecomment-570963981

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index e3b39b0c..76e30a87 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -24,7 +24,7 @@ dns_nic_add() {
     return 1
   fi
 
-  _saveaccountconf_mutable NIC_Customer "$NIC_Token"
+  _saveaccountconf_mutable NIC_Token "$NIC_Token"
   _saveaccountconf_mutable NIC_Username "$NIC_Username"
   _saveaccountconf_mutable NIC_Password "$NIC_Password"
 

From a88622c1be477dead8175334c08aa450b8e75b1c Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Mon, 6 Jan 2020 23:39:15 +0300
Subject: [PATCH 170/246] #2547 replace NIC_Token to
 NIC_ClientID&NIC_ClientSecret with backward compatibility

---
 dnsapi/dns_nic.sh | 86 +++++++++++++++++++++++++++++------------------
 1 file changed, 54 insertions(+), 32 deletions(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 76e30a87..4c3b280f 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -13,22 +13,8 @@ dns_nic_add() {
   fulldomain="${1}"
   txtvalue="${2}"
 
-  NIC_Token="${NIC_Token:-$(_readaccountconf_mutable NIC_Token)}"
-  NIC_Username="${NIC_Username:-$(_readaccountconf_mutable NIC_Username)}"
-  NIC_Password="${NIC_Password:-$(_readaccountconf_mutable NIC_Password)}"
-  if [ -z "$NIC_Token" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
-    NIC_Token=""
-    NIC_Username=""
-    NIC_Password=""
-    _err "You must export variables: NIC_Token, NIC_Username and NIC_Password"
-    return 1
-  fi
 
-  _saveaccountconf_mutable NIC_Token "$NIC_Token"
-  _saveaccountconf_mutable NIC_Username "$NIC_Username"
-  _saveaccountconf_mutable NIC_Password "$NIC_Password"
-
-  if ! _nic_get_authtoken "$NIC_Username" "$NIC_Password" "$NIC_Token"; then
+  if ! _nic_get_authtoken save; then
     _err "get NIC auth token failed"
     return 1
   fi
@@ -59,18 +45,7 @@ dns_nic_rm() {
   fulldomain="${1}"
   txtvalue="${2}"
 
-  NIC_Token="${NIC_Token:-$(_readaccountconf_mutable NIC_Token)}"
-  NIC_Username="${NIC_Username:-$(_readaccountconf_mutable NIC_Username)}"
-  NIC_Password="${NIC_Password:-$(_readaccountconf_mutable NIC_Password)}"
-  if [ -z "$NIC_Token" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
-    NIC_Token=""
-    NIC_Username=""
-    NIC_Password=""
-    _err "You must export variables: NIC_Token, NIC_Username and NIC_Password"
-    return 1
-  fi
-
-  if ! _nic_get_authtoken "$NIC_Username" "$NIC_Password" "$NIC_Token"; then
+  if ! _nic_get_authtoken; then
     _err "get NIC auth token failed"
     return 1
   fi
@@ -103,17 +78,64 @@ dns_nic_rm() {
 
 ####################  Private functions below ##################################
 
+#_nic_get_auth_elements [need2save]
+_nic_get_auth_elements() {
+  _need2save=$1
+
+  NIC_ClientID="${NIC_ClientID:-$(_readaccountconf_mutable NIC_ClientID)}"
+  NIC_ClientSecret="${NIC_ClientSecret:-$(_readaccountconf_mutable NIC_ClientSecret)}"
+  NIC_Username="${NIC_Username:-$(_readaccountconf_mutable NIC_Username)}"
+  NIC_Password="${NIC_Password:-$(_readaccountconf_mutable NIC_Password)}"
+
+  ## for backward compatibility
+  if [ -z "$NIC_ClientID" ] || [ -z "$NIC_ClientSecret" ]; then
+    NIC_Token="${NIC_Token:-$(_readaccountconf_mutable NIC_Token)}"
+    _debug NIC_Token "$NIC_Token"
+    if [ -n "$NIC_Token" ]; then
+      _two_values="$(echo "${NIC_Token}" | _dbase64)"
+      _debug _two_values "$_two_values"
+      IFS=":" read -r NIC_ClientID NIC_ClientSecret <<< $_two_values
+      _debug restored_NIC_ClientID "$NIC_ClientID"
+      _debug restored_NIC_ClientSecret "$NIC_ClientSecret"
+    fi
+  fi
+
+
+  if [ -z "$NIC_ClientID" ] || [ -z "$NIC_ClientSecret" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
+    NIC_ClientID=""
+    NIC_ClientSecret=""
+    NIC_Username=""
+    NIC_Password=""
+    _err "You must export variables: NIC_ClientID, NIC_ClientSecret, NIC_Username and NIC_Password"
+    return 1
+  fi
+
+  if [ "$_need2save" ]; then
+    _saveaccountconf_mutable NIC_ClientID "$NIC_ClientID"
+    _saveaccountconf_mutable NIC_ClientSecret "$NIC_ClientSecret"
+    _saveaccountconf_mutable NIC_Username "$NIC_Username"
+    _saveaccountconf_mutable NIC_Password "$NIC_Password"
+  fi
+
+  NIC_BasicAuth=$(printf "%s:%s" "${NIC_ClientID}" "${NIC_ClientSecret}" | _base64)
+ _debug NIC_BasicAuth "$NIC_BasicAuth"
+
+}
+
+#_nic_get_authtoken [need2save]
 _nic_get_authtoken() {
-  username="$1"
-  password="$2"
-  token="$3"
+  _need2save=$1
+
+  if ! _nic_get_auth_elements $_need2save; then
+    return 1
+  fi
 
   _info "Getting NIC auth token"
 
-  export _H1="Authorization: Basic $token"
+  export _H1="Authorization: Basic ${NIC_BasicAuth}"
   export _H2="Content-Type: application/x-www-form-urlencoded"
 
-  res=$(_post "grant_type=password&username=$username&password=$password&scope=%28GET%7CPUT%7CPOST%7CDELETE%29%3A%2Fdns-master%2F.%2B" "$NIC_Api/oauth/token" "" "POST")
+  res=$(_post "grant_type=password&username=${NIC_Username}&password=${NIC_Password}&scope=%28GET%7CPUT%7CPOST%7CDELETE%29%3A%2Fdns-master%2F.%2B" "$NIC_Api/oauth/token" "" "POST")
   if _contains "$res" "access_token"; then
     _auth_token=$(printf "%s" "$res" | cut -d , -f2 | tr -d "\"" | sed "s/access_token://")
     _info "Token received"

From 9666cf680e87df90238480ca960d2a7ff83692b3 Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Mon, 6 Jan 2020 23:42:08 +0300
Subject: [PATCH 171/246] #2547 fix multiply _service selection

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 4c3b280f..9dba92c2 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -168,7 +168,7 @@ _get_root() {
     if _contains "$_all_domains" "^$h$"; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain=$h
-      _service=$(printf "%s" "$response" | grep "$_domain" | sed -r "s/.*service=\"(.*)\".*$/\1/")
+      _service=$(printf "%s" "$response" | grep -F "idn-name=\"$_domain\"" | sed -r "s/.*service=\"(.*)\".*$/\1/")
       return 0
     fi
     p="$i"

From c822870cf850936db13d2fb5a30be230c75209d5 Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Mon, 6 Jan 2020 23:52:11 +0300
Subject: [PATCH 172/246] comment cleaning

---
 dnsapi/dns_nic.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 9dba92c2..5629b3be 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -1,10 +1,9 @@
 #!/usr/bin/env sh
 
 #
-#NIC_Token="sdfsdfsdfljlbjkljlkjsdfoiwjedfglgkdlfgkfgldfkg"
-#
+#NIC_ClientID='0dc0xxxxxxxxxxxxxxxxxxxxxxxxce88'
+#NIC_ClientSecret='3LTtxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxnuW8'
 #NIC_Username="000000/NIC-D"
-
 #NIC_Password="xxxxxxx"
 
 NIC_Api="https://api.nic.ru"

From 346454c21bdee14074001f6e2aa6e1b7686a0d5d Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Tue, 7 Jan 2020 00:26:44 +0300
Subject: [PATCH 173/246] fix CI warnings

---
 dnsapi/dns_nic.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 5629b3be..d0d6e546 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -12,7 +12,6 @@ dns_nic_add() {
   fulldomain="${1}"
   txtvalue="${2}"
 
-
   if ! _nic_get_authtoken save; then
     _err "get NIC auth token failed"
     return 1
@@ -93,7 +92,7 @@ _nic_get_auth_elements() {
     if [ -n "$NIC_Token" ]; then
       _two_values="$(echo "${NIC_Token}" | _dbase64)"
       _debug _two_values "$_two_values"
-      IFS=":" read -r NIC_ClientID NIC_ClientSecret <<< $_two_values
+      IFS=":" read -r NIC_ClientID NIC_ClientSecret <<<"$_two_values"
       _debug restored_NIC_ClientID "$NIC_ClientID"
       _debug restored_NIC_ClientSecret "$NIC_ClientSecret"
     fi
@@ -117,7 +116,7 @@ _nic_get_auth_elements() {
   fi
 
   NIC_BasicAuth=$(printf "%s:%s" "${NIC_ClientID}" "${NIC_ClientSecret}" | _base64)
- _debug NIC_BasicAuth "$NIC_BasicAuth"
+  _debug NIC_BasicAuth "$NIC_BasicAuth"
 
 }
 
@@ -125,7 +124,7 @@ _nic_get_auth_elements() {
 _nic_get_authtoken() {
   _need2save=$1
 
-  if ! _nic_get_auth_elements $_need2save; then
+  if ! _nic_get_auth_elements "$_need2save"; then
     return 1
   fi
 

From 8e2f11389d7b17c90a04ef97b2bd1ddb28176960 Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Tue, 7 Jan 2020 00:49:13 +0300
Subject: [PATCH 174/246] fix CI warnings SC2039

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index d0d6e546..34429fe4 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -92,7 +92,7 @@ _nic_get_auth_elements() {
     if [ -n "$NIC_Token" ]; then
       _two_values="$(echo "${NIC_Token}" | _dbase64)"
       _debug _two_values "$_two_values"
-      IFS=":" read -r NIC_ClientID NIC_ClientSecret <<<"$_two_values"
+      IFS=":" read -r NIC_ClientID NIC_ClientSecret < <(echo "$_two_values")
       _debug restored_NIC_ClientID "$NIC_ClientID"
       _debug restored_NIC_ClientSecret "$NIC_ClientSecret"
     fi

From be7688a4dfae5dac8d95707e985aefbfbccfd50d Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Tue, 7 Jan 2020 01:05:50 +0300
Subject: [PATCH 175/246] fix CI warnings SC2039 v2

---
 dnsapi/dns_nic.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 34429fe4..190d4d1f 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -92,7 +92,8 @@ _nic_get_auth_elements() {
     if [ -n "$NIC_Token" ]; then
       _two_values="$(echo "${NIC_Token}" | _dbase64)"
       _debug _two_values "$_two_values"
-      IFS=":" read -r NIC_ClientID NIC_ClientSecret < <(echo "$_two_values")
+      NIC_ClientID=$(echo "$_two_values" | cut -d':' -f1)
+      NIC_ClientSecret=$(echo "$_two_values" | cut -d':' -f2-)
       _debug restored_NIC_ClientID "$NIC_ClientID"
       _debug restored_NIC_ClientSecret "$NIC_ClientSecret"
     fi

From f3dd1603db9f998f2496e2baee89bac0b9ac7615 Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Tue, 7 Jan 2020 01:11:43 +0300
Subject: [PATCH 176/246] fix CI warnings v3

---
 dnsapi/dns_nic.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 190d4d1f..1ad18d5b 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -99,7 +99,6 @@ _nic_get_auth_elements() {
     fi
   fi
 
-
   if [ -z "$NIC_ClientID" ] || [ -z "$NIC_ClientSecret" ] || [ -z "$NIC_Username" ] || [ -z "$NIC_Password" ]; then
     NIC_ClientID=""
     NIC_ClientSecret=""

From efd3e8067b28c269517ec89e08d77284a8907931 Mon Sep 17 00:00:00 2001
From: Sergey Zorin <sergey@zorin.ru>
Date: Thu, 9 Jan 2020 17:05:18 +0300
Subject: [PATCH 177/246] remove -F option

---
 dnsapi/dns_nic.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nic.sh b/dnsapi/dns_nic.sh
index 1ad18d5b..5052ee10 100644
--- a/dnsapi/dns_nic.sh
+++ b/dnsapi/dns_nic.sh
@@ -166,7 +166,7 @@ _get_root() {
     if _contains "$_all_domains" "^$h$"; then
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain=$h
-      _service=$(printf "%s" "$response" | grep -F "idn-name=\"$_domain\"" | sed -r "s/.*service=\"(.*)\".*$/\1/")
+      _service=$(printf "%s" "$response" | grep "idn-name=\"$_domain\"" | sed -r "s/.*service=\"(.*)\".*$/\1/")
       return 0
     fi
     p="$i"

From 0712e98904448fd16fc5aeaece54685d099f730d Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Sun, 12 Jan 2020 13:36:24 +0800
Subject: [PATCH 178/246] fix https://github.com/Neilpang/acme.sh/pull/2559

---
 acme.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/acme.sh b/acme.sh
index 570e2836..539e843d 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2019,7 +2019,7 @@ _send_signed_request() {
     _debug code "$code"
 
     _debug2 original "$response"
-    if echo "$responseHeaders" | grep -i "Content-Type: application/json" >/dev/null 2>&1; then
+    if echo "$responseHeaders" | grep -i "Content-Type: *application/json" >/dev/null 2>&1; then
       response="$(echo "$response" | _normalizeJson)"
     fi
     _debug2 response "$response"
@@ -3447,7 +3447,7 @@ _regAccount() {
   fi
 
   _debug2 responseHeaders "$responseHeaders"
-  _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
+  _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n ")"
   _debug "_accUri" "$_accUri"
   if [ -z "$_accUri" ]; then
     _err "Can not find account id url."
@@ -4006,7 +4006,7 @@ issue() {
         _on_issue_err "$_post_hook"
         return 1
       fi
-      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d ":" -f 2-)"
       _debug Le_LinkOrder "$Le_LinkOrder"
       Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
       _debug Le_OrderFinalize "$Le_OrderFinalize"
@@ -4521,7 +4521,7 @@ $_authorizations_map"
       return 1
     fi
     if [ -z "$Le_LinkOrder" ]; then
-      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d ":" -f 2-)"
     fi
 
     _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
@@ -5572,7 +5572,7 @@ _deactivate() {
       return 1
     fi
 
-    authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
+    authzUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n")"
     _debug "authzUri" "$authzUri"
     if [ "$code" ] && [ ! "$code" = '201' ]; then
       _err "new-authz error: $response"

From 8494ac8f3dbe88123db60ab4441f27574d13f46e Mon Sep 17 00:00:00 2001
From: Nick Stepa <hired777@gmail.com>
Date: Sun, 12 Jan 2020 13:29:09 +0100
Subject: [PATCH 179/246] Fix dns records removing after usage.

---
 dnsapi/dns_yandex.sh | 128 ++++++++++++++++++++++++-------------------
 1 file changed, 71 insertions(+), 57 deletions(-)

diff --git a/dnsapi/dns_yandex.sh b/dnsapi/dns_yandex.sh
index a4f39784..90bbf74e 100755
--- a/dnsapi/dns_yandex.sh
+++ b/dnsapi/dns_yandex.sh
@@ -6,83 +6,91 @@
 # Values to export:
 # export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 
+# Sometimes cloudflare / google doesn't pick new dns recods fast enough.
+# You can add --dnssleep XX to params as workaround.
+
 ########  Public functions #####################
 
 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_yandex_add() {
-  fulldomain="${1}"
-  txtvalue="${2}"
-  _debug "Calling: dns_yandex_add() '${fulldomain}' '${txtvalue}'"
+  local fulldomain="${1}"
+  local txtvalue="${2}"
+  _debug "Calling: dns_yandex_add() '${fulldomain}' '$txtvalue'"
+
   _PDD_credentials || return 1
-  export _H1="PddToken: $PDD_Token"
 
   _PDD_get_domain "$fulldomain" || return 1
-  _debug "Found suitable domain in pdd: $curDomain"
-  curData="domain=${curDomain}&type=TXT&subdomain=${curSubdomain}&ttl=360&content=${txtvalue}"
-  curUri="https://pddimp.yandex.ru/api2/admin/dns/add"
-  curResult="$(_post "${curData}" "${curUri}")"
-  _debug "Result: $curResult"
+  _debug "Found suitable domain: $domain"
+
+  _PDD_get_record_ids "${domain}" "${subdomain}" || return 1
+  _debug "Record_ids: $record_ids"
+
+  if [ ! -z "$record_ids" ]; then
+      _err "Remove all existing $subdomain records from $domain"
+      return 1
+  fi
+
+  local data="domain=${domain}&type=TXT&subdomain=${subdomain}&ttl=300&content=${txtvalue}"
+  local uri="https://pddimp.yandex.ru/api2/admin/dns/add"
+  local result="$(_post "${data}" "${uri}" | _normalizeJson)"
+  _debug "Result: $result"
+
+  if ! _contains "$result" '"success":"ok"'; then
+      _err "Can't add $subdomain to $domain"
+      return 1
+  fi
 }
 
 #Usage: dns_myapi_rm   _acme-challenge.www.domain.com
 dns_yandex_rm() {
-  fulldomain="${1}"
+  local fulldomain="${1}"
   _debug "Calling: dns_yandex_rm() '${fulldomain}'"
+
   _PDD_credentials || return 1
-  export _H1="PddToken: $PDD_Token"
 
   _PDD_get_domain "$fulldomain" || return 1
-  _debug "Found suitable domain in pdd: $curDomain"
+  _debug "Found suitable domain: $domain"
 
-  record_id=$(pdd_get_record_id "${fulldomain}")
-  _debug "Result: $record_id"
+  _PDD_get_record_ids "${domain}" "${subdomain}" || return 1
+  _debug "Record_ids: $record_ids"
 
-  for rec_i in $record_id; do
-    curUri="https://pddimp.yandex.ru/api2/admin/dns/del"
-    curData="domain=${curDomain}&record_id=${rec_i}"
-    curResult="$(_post "${curData}" "${curUri}")"
-    _debug "Result: $curResult"
+  for record_id in $record_ids; do
+    local data="domain=${domain}&record_id=${record_id}"
+    local uri="https://pddimp.yandex.ru/api2/admin/dns/del"
+    local result="$(_post "${data}" "${uri}" | _normalizeJson)"
+    _debug "Result: $result"
+
+    if ! _contains "$result" '"success":"ok"'; then
+      _info "Can't remove $subdomain from $domain"
+    fi
   done
 }
 
 ####################  Private functions below ##################################
 
 _PDD_get_domain() {
-  fulldomain="${1}"
-  __page=1
-  __last=0
-  while [ $__last -eq 0 ]; do
-    uri1="https://pddimp.yandex.ru/api2/admin/domain/domains?page=${__page}&on_page=20"
-    res1="$(_get "$uri1" | _normalizeJson)"
-    _debug2 "res1" "$res1"
-    __found="$(echo "$res1" | sed -n -e 's#.* "found": \([^,]*\),.*#\1#p')"
-    _debug "found: $__found results on page"
-    if [ "0$__found" -lt 20 ]; then
-      _debug "last page: $__page"
-      __last=1
+  local fulldomain=${1}
+
+  local subdomain_start=1
+  while true; do
+    local domain_start=$(_math $subdomain_start + 1)
+    domain=$(echo "$fulldomain" | cut -d . -f $domain_start-)
+    subdomain=$(echo "$fulldomain" | cut -d . -f -$subdomain_start)
+
+    _debug "Checking domain $domain"
+    if [ -z "$domain" ]; then
+      return 1
     fi
 
-    __all_domains="$__all_domains $(echo "$res1" | tr "," "\n" | grep '"name"' | cut -d: -f2 | sed -e 's@"@@g')"
+    local uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=$domain"
+    local result="$(_get "${uri}" | _normalizeJson)"
+    _debug "Result: $result"
 
-    __page=$(_math $__page + 1)
-  done
-
-  k=2
-  while [ $k -lt 10 ]; do
-    __t=$(echo "$fulldomain" | cut -d . -f $k-100)
-    _debug "finding zone for domain $__t"
-    for d in $__all_domains; do
-      if [ "$d" = "$__t" ]; then
-        p=$(_math $k - 1)
-        curSubdomain="$(echo "$fulldomain" | cut -d . -f "1-$p")"
-        curDomain="$__t"
+    if _contains "$result" '"success":"ok"'; then
         return 0
-      fi
-    done
-    k=$(_math $k + 1)
+    fi
+    subdomain_start=$(_math $subdomain_start + 1)
   done
-  _err "No suitable domain found in your account"
-  return 1
 }
 
 _PDD_credentials() {
@@ -94,16 +102,22 @@ _PDD_credentials() {
   else
     _saveaccountconf PDD_Token "${PDD_Token}"
   fi
+  export _H1="PddToken: $PDD_Token"
 }
 
-pdd_get_record_id() {
-  fulldomain="${1}"
+_PDD_get_record_ids() {
+  local domain="${1}"
+  local subdomain="${2}"
 
-  _PDD_get_domain "$fulldomain"
-  _debug "Found suitable domain in pdd: $curDomain"
+  _debug "Check existing records for $subdomain"
 
-  curUri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=${curDomain}"
-  curResult="$(_get "${curUri}" | _normalizeJson)"
-  _debug "Result: $curResult"
-  echo "$curResult" | _egrep_o "{[^{]*\"content\":[^{]*\"subdomain\":\"${curSubdomain}\"" | sed -n -e 's#.* "record_id": \(.*\),[^,]*#\1#p'
+  local uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=${domain}"
+  local result="$(_get "${uri}" | _normalizeJson)"
+  _debug "Result: $result"
+
+  if ! _contains "$result" '"success":"ok"'; then
+      return 1
+  fi
+
+  record_ids=$(echo "$result" | _egrep_o "{[^{]*\"subdomain\":\"${subdomain}\"[^}]*}" | sed -n -e 's#.*"record_id": \([0-9]*\).*#\1#p')
 }

From ef7b51beb7d7c0e6607efca377e1089531aeb435 Mon Sep 17 00:00:00 2001
From: Nick Stepa <hired777@gmail.com>
Date: Sun, 12 Jan 2020 13:54:18 +0100
Subject: [PATCH 180/246] Remove local keyword.

---
 dnsapi/dns_yandex.sh | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/dnsapi/dns_yandex.sh b/dnsapi/dns_yandex.sh
index 90bbf74e..fc693d6e 100755
--- a/dnsapi/dns_yandex.sh
+++ b/dnsapi/dns_yandex.sh
@@ -6,15 +6,15 @@
 # Values to export:
 # export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
 
-# Sometimes cloudflare / google doesn't pick new dns recods fast enough.
+# Sometimes cloudflare / google doesn't pick new dns records fast enough.
 # You can add --dnssleep XX to params as workaround.
 
 ########  Public functions #####################
 
 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_yandex_add() {
-  local fulldomain="${1}"
-  local txtvalue="${2}"
+  fulldomain="${1}"
+  txtvalue="${2}"
   _debug "Calling: dns_yandex_add() '${fulldomain}' '$txtvalue'"
 
   _PDD_credentials || return 1
@@ -30,9 +30,9 @@ dns_yandex_add() {
       return 1
   fi
 
-  local data="domain=${domain}&type=TXT&subdomain=${subdomain}&ttl=300&content=${txtvalue}"
-  local uri="https://pddimp.yandex.ru/api2/admin/dns/add"
-  local result="$(_post "${data}" "${uri}" | _normalizeJson)"
+  data="domain=${domain}&type=TXT&subdomain=${subdomain}&ttl=300&content=${txtvalue}"
+  uri="https://pddimp.yandex.ru/api2/admin/dns/add"
+  result="$(_post "${data}" "${uri}" | _normalizeJson)"
   _debug "Result: $result"
 
   if ! _contains "$result" '"success":"ok"'; then
@@ -43,7 +43,7 @@ dns_yandex_add() {
 
 #Usage: dns_myapi_rm   _acme-challenge.www.domain.com
 dns_yandex_rm() {
-  local fulldomain="${1}"
+  fulldomain="${1}"
   _debug "Calling: dns_yandex_rm() '${fulldomain}'"
 
   _PDD_credentials || return 1
@@ -55,9 +55,9 @@ dns_yandex_rm() {
   _debug "Record_ids: $record_ids"
 
   for record_id in $record_ids; do
-    local data="domain=${domain}&record_id=${record_id}"
-    local uri="https://pddimp.yandex.ru/api2/admin/dns/del"
-    local result="$(_post "${data}" "${uri}" | _normalizeJson)"
+    data="domain=${domain}&record_id=${record_id}"
+    uri="https://pddimp.yandex.ru/api2/admin/dns/del"
+    result="$(_post "${data}" "${uri}" | _normalizeJson)"
     _debug "Result: $result"
 
     if ! _contains "$result" '"success":"ok"'; then
@@ -69,21 +69,21 @@ dns_yandex_rm() {
 ####################  Private functions below ##################################
 
 _PDD_get_domain() {
-  local fulldomain=${1}
+  fulldomain=${1}
 
-  local subdomain_start=1
+  subdomain_start=1
   while true; do
-    local domain_start=$(_math $subdomain_start + 1)
-    domain=$(echo "$fulldomain" | cut -d . -f $domain_start-)
-    subdomain=$(echo "$fulldomain" | cut -d . -f -$subdomain_start)
+    domain_start=$(_math $subdomain_start + 1)
+    domain=$(echo "$fulldomain" | cut -d . -f "$domain_start"-)
+    subdomain=$(echo "$fulldomain" | cut -d . -f -"$subdomain_start")
 
     _debug "Checking domain $domain"
     if [ -z "$domain" ]; then
       return 1
     fi
 
-    local uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=$domain"
-    local result="$(_get "${uri}" | _normalizeJson)"
+    uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=$domain"
+    result="$(_get "${uri}" | _normalizeJson)"
     _debug "Result: $result"
 
     if _contains "$result" '"success":"ok"'; then
@@ -106,13 +106,13 @@ _PDD_credentials() {
 }
 
 _PDD_get_record_ids() {
-  local domain="${1}"
-  local subdomain="${2}"
+  domain="${1}"
+  subdomain="${2}"
 
   _debug "Check existing records for $subdomain"
 
-  local uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=${domain}"
-  local result="$(_get "${uri}" | _normalizeJson)"
+  uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=${domain}"
+  result="$(_get "${uri}" | _normalizeJson)"
   _debug "Result: $result"
 
   if ! _contains "$result" '"success":"ok"'; then

From e5f69f0815b39d37e49188e659f3b0b6f4d9b58f Mon Sep 17 00:00:00 2001
From: Nick Stepa <hired777@gmail.com>
Date: Sun, 12 Jan 2020 14:07:49 +0100
Subject: [PATCH 181/246] Fix indentation.

---
 dnsapi/dns_yandex.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_yandex.sh b/dnsapi/dns_yandex.sh
index fc693d6e..cf702ba8 100755
--- a/dnsapi/dns_yandex.sh
+++ b/dnsapi/dns_yandex.sh
@@ -26,8 +26,8 @@ dns_yandex_add() {
   _debug "Record_ids: $record_ids"
 
   if [ ! -z "$record_ids" ]; then
-      _err "Remove all existing $subdomain records from $domain"
-      return 1
+    _err "Remove all existing $subdomain records from $domain"
+    return 1
   fi
 
   data="domain=${domain}&type=TXT&subdomain=${subdomain}&ttl=300&content=${txtvalue}"
@@ -36,8 +36,8 @@ dns_yandex_add() {
   _debug "Result: $result"
 
   if ! _contains "$result" '"success":"ok"'; then
-      _err "Can't add $subdomain to $domain"
-      return 1
+    _err "Can't add $subdomain to $domain"
+    return 1
   fi
 }
 
@@ -87,7 +87,7 @@ _PDD_get_domain() {
     _debug "Result: $result"
 
     if _contains "$result" '"success":"ok"'; then
-        return 0
+      return 0
     fi
     subdomain_start=$(_math $subdomain_start + 1)
   done
@@ -116,7 +116,7 @@ _PDD_get_record_ids() {
   _debug "Result: $result"
 
   if ! _contains "$result" '"success":"ok"'; then
-      return 1
+    return 1
   fi
 
   record_ids=$(echo "$result" | _egrep_o "{[^{]*\"subdomain\":\"${subdomain}\"[^}]*}" | sed -n -e 's#.*"record_id": \([0-9]*\).*#\1#p')

From 4eff3b6a24efd9cae60183cbbde4b89eef8f391c Mon Sep 17 00:00:00 2001
From: Nick Stepa <hired777@gmail.com>
Date: Sun, 12 Jan 2020 15:16:48 +0100
Subject: [PATCH 182/246] Change error to info in case record already exists.

---
 dnsapi/dns_yandex.sh | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_yandex.sh b/dnsapi/dns_yandex.sh
index cf702ba8..5721f994 100755
--- a/dnsapi/dns_yandex.sh
+++ b/dnsapi/dns_yandex.sh
@@ -15,19 +15,18 @@
 dns_yandex_add() {
   fulldomain="${1}"
   txtvalue="${2}"
-  _debug "Calling: dns_yandex_add() '${fulldomain}' '$txtvalue'"
+  _debug "Calling: dns_yandex_add() '${fulldomain}' '${txtvalue}'"
 
   _PDD_credentials || return 1
 
-  _PDD_get_domain "$fulldomain" || return 1
+  _PDD_get_domain || return 1
   _debug "Found suitable domain: $domain"
 
-  _PDD_get_record_ids "${domain}" "${subdomain}" || return 1
+  _PDD_get_record_ids || return 1
   _debug "Record_ids: $record_ids"
 
   if [ ! -z "$record_ids" ]; then
-    _err "Remove all existing $subdomain records from $domain"
-    return 1
+    _info "All existing $subdomain records from $domain will be removed at the very end."
   fi
 
   data="domain=${domain}&type=TXT&subdomain=${subdomain}&ttl=300&content=${txtvalue}"
@@ -36,8 +35,12 @@ dns_yandex_add() {
   _debug "Result: $result"
 
   if ! _contains "$result" '"success":"ok"'; then
-    _err "Can't add $subdomain to $domain"
-    return 1
+    if _contains "$result" '"success":"error"' && _contains "$result" '"error":"record_exists"'; then
+      _info "Record already exists."
+    else
+      _err "Can't add $subdomain to $domain."
+      return 1
+    fi
   fi
 }
 
@@ -61,7 +64,7 @@ dns_yandex_rm() {
     _debug "Result: $result"
 
     if ! _contains "$result" '"success":"ok"'; then
-      _info "Can't remove $subdomain from $domain"
+      _info "Can't remove $subdomain from $domain."
     fi
   done
 }
@@ -69,8 +72,6 @@ dns_yandex_rm() {
 ####################  Private functions below ##################################
 
 _PDD_get_domain() {
-  fulldomain=${1}
-
   subdomain_start=1
   while true; do
     domain_start=$(_math $subdomain_start + 1)
@@ -96,8 +97,8 @@ _PDD_get_domain() {
 _PDD_credentials() {
   if [ -z "${PDD_Token}" ]; then
     PDD_Token=""
-    _err "You need to export PDD_Token=xxxxxxxxxxxxxxxxx"
-    _err "You can get it at https://pddimp.yandex.ru/api2/admin/get_token"
+    _err "You need to export PDD_Token=xxxxxxxxxxxxxxxxx."
+    _err "You can get it at https://pddimp.yandex.ru/api2/admin/get_token."
     return 1
   else
     _saveaccountconf PDD_Token "${PDD_Token}"
@@ -106,9 +107,6 @@ _PDD_credentials() {
 }
 
 _PDD_get_record_ids() {
-  domain="${1}"
-  subdomain="${2}"
-
   _debug "Check existing records for $subdomain"
 
   uri="https://pddimp.yandex.ru/api2/admin/dns/list?domain=${domain}"

From 70fdb1042fd194e6e107e57d5ce1a670f3df0070 Mon Sep 17 00:00:00 2001
From: Andrey Tuzhilin <andrey@3adigital.ru>
Date: Tue, 14 Jan 2020 15:55:44 +0300
Subject: [PATCH 183/246] fix: added public dns zones filter

---
 dnsapi/dns_gcloud.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_gcloud.sh b/dnsapi/dns_gcloud.sh
index ebbeecf2..6365b338 100755
--- a/dnsapi/dns_gcloud.sh
+++ b/dnsapi/dns_gcloud.sh
@@ -131,7 +131,7 @@ _dns_gcloud_find_zone() {
     filter="$filter$part. "
     part="$(echo "$part" | sed 's/[^.]*\.*//')"
   done
-  filter="$filter)"
+  filter="$filter) AND visibility=public"
   _debug filter "$filter"
 
   # List domains and find the zone with the deepest sub-domain (in case of some levels of delegation)

From f01936ca4fac5499d90787098c2eec3a6359ab56 Mon Sep 17 00:00:00 2001
From: helbgd <helmut.angerer@googlemail.com>
Date: Tue, 14 Jan 2020 15:19:37 +0100
Subject: [PATCH 184/246] Server Name not correct

the servername of the server that has the upd.php file was not correct
---
 dnsapi/dns_ddnss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ddnss.sh b/dnsapi/dns_ddnss.sh
index 903b9619..1bf258f5 100644
--- a/dnsapi/dns_ddnss.sh
+++ b/dnsapi/dns_ddnss.sh
@@ -12,7 +12,7 @@
 # --
 #
 
-DDNSS_DNS_API="https://ddnss.de/upd.php"
+DDNSS_DNS_API="https://www.ddnss.de/upd.php"
 
 ########  Public functions #####################
 

From b1ce6ffcc79da2d0b458a4195c10d1fd45a59182 Mon Sep 17 00:00:00 2001
From: helbgd <helmut.angerer@googlemail.com>
Date: Tue, 14 Jan 2020 15:27:35 +0100
Subject: [PATCH 185/246] www is incorrect as well

use ip4 and not www, if you use www it deletes the ip4 address of the host and updates only the ip6 address
---
 dnsapi/dns_ddnss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ddnss.sh b/dnsapi/dns_ddnss.sh
index 1bf258f5..53781d0d 100644
--- a/dnsapi/dns_ddnss.sh
+++ b/dnsapi/dns_ddnss.sh
@@ -12,7 +12,7 @@
 # --
 #
 
-DDNSS_DNS_API="https://www.ddnss.de/upd.php"
+DDNSS_DNS_API="https://ip4.ddnss.de/upd.php"
 
 ########  Public functions #####################
 

From 024619676b73e2cf20527471c6209c924d63c0e4 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Wed, 15 Jan 2020 13:56:01 +0100
Subject: [PATCH 186/246] Update dns_kas.sh

fixing 4 Travis style
---
 dnsapi/dns_kas.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index b17eeee4..31d68e62 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -9,17 +9,18 @@
 #  - $KAS_Authdata (Kasserver API auth data.)
 #
 # Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
+# Updated by: Marc-Oliver Lange <git@die-lang.es>
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 ########################################################################
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
-########  Public functions #####################
-dns_kas_add(){
+########  Public functions  #####################
+dns_kas_add() {
   _fulldomain=$1
   _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
-  _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
+  _info "Adding $_fulldomain DNS TXT entry on All-inkl/Kasserver"
   _info "Check and Save Props"
   _check_and_save
   _info "Checking Zone and Record_Name"
@@ -128,9 +129,9 @@ _get_zone_and_record_name() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
+  _zonen="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
   _domain="$1"
-  _temp_domain="$(echo "$1" |  sed 's/\.$//')"
+  _temp_domain="$(echo "$1" | sed 's/\.$//')"
   _rootzone="$_domain"
   for i in $_zonen; do
     l1=${#_rootzone}
@@ -140,8 +141,8 @@ _get_zone_and_record_name() {
     fi
   done
   _zone="${_rootzone}."
-  _temp_record_name="$(echo "$_temp_domain" | sed "s/"$_rootzone"//g")"
-  _record_name="$(echo "$_temp_record_name" |  sed 's/\.$//')"
+  _temp_record_name="$(echo "$_temp_domain" | sed "s/$_rootzone//g")"
+  _record_name="$(echo "$_temp_record_name" | sed 's/\.$//')"
   _debug2 "Zone:" "$_zone"
   _debug2 "Domain:" "$_domain"
   _debug2 "Record_Name:" "$_record_name"

From ac3667c7652a6338aba1528de4a4dd7b0d77e8cd Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 15 Jan 2020 21:43:49 +0800
Subject: [PATCH 187/246] fix https://github.com/Neilpang/acme.sh/issues/2693

---
 acme.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/acme.sh b/acme.sh
index 539e843d..f461c575 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6303,6 +6303,7 @@ _installOnline() {
     chmod +x $PROJECT_ENTRY
     if ./$PROJECT_ENTRY install "$_nocron" "" "$_noprofile"; then
       _info "Install success!"
+      _initpath
       _saveaccountconf "UPGRADE_HASH" "$(_getMasterHash)"
     fi
 

From f8f53a6bd99d50293bc775fb74fcee9bde8a1280 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 15 Jan 2020 22:01:34 +0800
Subject: [PATCH 188/246] debug

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index f461c575..cae7c30e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2415,7 +2415,7 @@ __initHome() {
   if [ -z "$ACCOUNT_CONF_PATH" ]; then
     ACCOUNT_CONF_PATH="$_DEFAULT_ACCOUNT_CONF_PATH"
   fi
-
+  _debug3 ACCOUNT_CONF_PATH "$ACCOUNT_CONF_PATH"
   DEFAULT_LOG_FILE="$LE_CONFIG_HOME/$PROJECT_NAME.log"
 
   DEFAULT_CA_HOME="$LE_CONFIG_HOME/ca"

From 26309f51e380c0c60798a62ba1842b1263cc6fcf Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 15 Jan 2020 22:04:49 +0800
Subject: [PATCH 189/246] start 2.8.5

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 539e843d..547d4a1d 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-VER=2.8.4
+VER=2.8.5
 
 PROJECT_NAME="acme.sh"
 

From 431c53efcf6f8ee4ae011b572729b624c9c86ace Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Wed, 15 Jan 2020 17:48:30 +0100
Subject: [PATCH 190/246] Update dns_kas.sh

Removing spaces in empty lines
---
 dnsapi/dns_kas.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 31d68e62..95401684 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -61,14 +61,14 @@ dns_kas_rm() {
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-   
+
   _info "Check and Save Props"
   _check_and_save
   _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
   _info "Getting Record ID"
   _get_record_id
-  
+
   # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
@@ -119,7 +119,7 @@ _check_and_save() {
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone_and_record_name() {
- 
+  params="?kas_login=$KAS_Login"
   params="?kas_login=$KAS_Login"
   params="$params&kas_auth_type=$KAS_Authtype"
   params="$params&kas_auth_data=$KAS_Authdata"

From 0f54cf83f4f24f037e1adf52be37c9e809df4825 Mon Sep 17 00:00:00 2001
From: StefanAbl <thorn.st57@gmail.com>
Date: Sat, 18 Jan 2020 13:48:29 +0100
Subject: [PATCH 191/246] fixed dynv6 dns validation

---
 dnsapi/dns_dynv6.sh | 125 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 dnsapi/dns_dynv6.sh

diff --git a/dnsapi/dns_dynv6.sh b/dnsapi/dns_dynv6.sh
new file mode 100644
index 00000000..b1fa7650
--- /dev/null
+++ b/dnsapi/dns_dynv6.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env sh
+#Author StefanAbl
+#Usage specify a private keyfile to use with dynv6 'export KEY="path/to/keyfile"'
+#if no keyfile is specified, you will be asked if you want to create one in /home/$USER/.ssh/dynv6 and /home/$USER/.ssh/dynv6.pub
+########  Public functions #####################
+# Please Read this guide first: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+#Usage: dns_myapi_add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_dynv6_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using dynv6 api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  _get_keyfile
+  
+  _info "using keyfile $dynv6_keyfile"
+  _get_domain "$fulldomain"
+  _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
+  if ! _contains "$_your_hosts" "$_host"; then
+    _debug "The host is $_host and the record $_record"
+    _debug "Dynv6 returned $_your_hosts"
+    _err "The host $_host does not exists on your dynv6 account"
+    return 1
+  fi
+  _debug "found host on your account"
+  returnval="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts \""$_host"\" records set \""$_record"\" txt data \""$txtvalue"\")"
+  _debug "Dynv6 returend this after record was added: $returnval"
+  if _contains "$returnval" "created"; then
+    return 0
+  elif _contains "$returnval" "updated"; then
+    return 0
+  else
+    _err "Something went wrong! it does not seem like the record was added succesfully"
+    return 1
+  fi
+  return 1
+}
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_dynv6_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using dynv6 api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  _get_keyfile
+  _info "using keyfile $dynv6_keyfile"
+  _get_domain "$fulldomain"
+  _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
+  if ! _contains "$_your_hosts" "$_host"; then
+    _debug "The host is $_host and the record $_record"
+    _debug "Dynv6 returned $_your_hosts"
+    _err "The host $_host does not exists on your dynv6 account"
+    return 1
+  fi
+  _debug "found host on your account"
+  _info "$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts "\"$_host\"" records del "\"$_record\"" txt)"
+  return 0
+
+}
+#################### Private functions below ##################################
+#Usage: No Input required
+#returns
+#dynv6_keyfile the path to the new keyfile that has been generated
+_generate_new_key() {
+  dynv6_keyfile="$(eval echo ~"$USER")/.ssh/dynv6"
+  _info "Path to key file used: $dynv6_keyfile"
+  if [ ! -f "$dynv6_keyfile" ] && [ ! -f "$dynv6_keyfile.pub" ]; then
+    _debug "generating key in $dynv6_keyfile and $dynv6_keyfile.pub"
+    ssh-keygen -f "$dynv6_keyfile" -t ssh-ed25519 -N ''
+  else
+    _err "There is already a file in $dynv6_keyfile or $dynv6_keyfile.pub"
+    return 1
+  fi
+
+}
+#Usage: _acme-challenge.www.example.dynv6.net
+#returns
+#_host= example.dynv6.net
+#_record=_acme-challenge.www
+#aborts if not a valid domain
+_get_domain() {
+  _full_domain="$1"
+  _debug "getting domain for $_full_domain"
+  if ! _contains "$_full_domain" 'dynv6.net' && ! _contains "$_full_domain" 'dns.army' && ! _contains "$_full_domain" 'dns.navy'; then
+    _err "The hosts does not seem to be a dynv6 host"
+    return 1
+  fi
+  _record="${_full_domain%.*}"
+  _record="${_record%.*}"
+  _record="${_record%.*}"
+  _debug "The record we are ging to use is $_record"
+  _host="$_full_domain"
+  while [ "$(echo "$_host" | grep -o '\.' | wc -l)" != "2" ]; do
+    _host="${_host#*.}"
+  done
+  _debug "And the host is $_host"
+  return 0
+
+}
+
+# Usage: No input required
+#returns
+#dynv6_keyfile path to the key that will be used
+_get_keyfile() {
+	_debug "get keyfile method called"
+  dynv6_keyfile="${dynv6_keyfile:-$(_readaccountconf_mutable dynv6_keyfile)}"
+  _debug Your key is "$dynv6_keyfile"
+  if [ -z "$dynv6_keyfile" ]; then
+    if [ -z "$KEY" ]; then
+      _err "You did not specify a key to use with dynv6"
+      _info "Creating new dynv6 api key to add to dynv6.com"
+      _generate_new_key
+      _info "Please add this key to dynv6.com $(cat "$dynv6_keyfile.pub")"
+      _info "Hit Enter to contiue"
+      read _
+      #save the credentials to the account conf file.
+    else
+      dynv6_keyfile="$KEY"
+    fi
+    _saveaccountconf_mutable dynv6_keyfile "$dynv6_keyfile"
+  fi
+
+
+}

From 6e3ba3ca45daaa47f2afe901647585bb6d5c2010 Mon Sep 17 00:00:00 2001
From: StefanAbl <thorn.st57@gmail.com>
Date: Sat, 18 Jan 2020 13:53:26 +0100
Subject: [PATCH 192/246] travis

---
 dnsapi/dns_dynv6.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_dynv6.sh b/dnsapi/dns_dynv6.sh
index b1fa7650..cf39282b 100644
--- a/dnsapi/dns_dynv6.sh
+++ b/dnsapi/dns_dynv6.sh
@@ -12,7 +12,6 @@ dns_dynv6_add() {
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
   _get_keyfile
-  
   _info "using keyfile $dynv6_keyfile"
   _get_domain "$fulldomain"
   _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
@@ -72,7 +71,6 @@ _generate_new_key() {
     _err "There is already a file in $dynv6_keyfile or $dynv6_keyfile.pub"
     return 1
   fi
-
 }
 #Usage: _acme-challenge.www.example.dynv6.net
 #returns
@@ -103,7 +101,7 @@ _get_domain() {
 #returns
 #dynv6_keyfile path to the key that will be used
 _get_keyfile() {
-	_debug "get keyfile method called"
+  _debug "get keyfile method called"
   dynv6_keyfile="${dynv6_keyfile:-$(_readaccountconf_mutable dynv6_keyfile)}"
   _debug Your key is "$dynv6_keyfile"
   if [ -z "$dynv6_keyfile" ]; then
@@ -113,13 +111,11 @@ _get_keyfile() {
       _generate_new_key
       _info "Please add this key to dynv6.com $(cat "$dynv6_keyfile.pub")"
       _info "Hit Enter to contiue"
-      read _
+      read -r _
       #save the credentials to the account conf file.
     else
       dynv6_keyfile="$KEY"
     fi
     _saveaccountconf_mutable dynv6_keyfile "$dynv6_keyfile"
   fi
-
-
 }

From e7d130cc11e4a52695e84fd1ea86d7c27a090b18 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Tue, 21 Jan 2020 06:36:31 +0100
Subject: [PATCH 193/246] Add support for CloudDNS API

---
 dnsapi/dns_clouddns.sh | 186 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 186 insertions(+)
 create mode 100755 dnsapi/dns_clouddns.sh

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
new file mode 100755
index 00000000..2678c66b
--- /dev/null
+++ b/dnsapi/dns_clouddns.sh
@@ -0,0 +1,186 @@
+#!/usr/bin/env sh
+
+# Author: Radek Sprta <sprta@vshosting.cz>
+
+#CLOUDDNS_EMAIL=XXXXX
+#CLOUDDNS_PASSWORD="YYYYYYYYY"
+#CLOUDDNS_CLIENT_ID=XXXXX
+
+CLOUDDNS_API='https://admin.vshosting.cloud/clouddns'
+CLOUDDNS_LOGIN_API='https://admin.vshosting.cloud/api/public/auth/login'
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_clouddns_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CLOUDDNS_CLIENT_ID="${CLOUDDNS_CLIENT_ID:-$(_readaccountconf_mutable CLOUDDNS_CLIENT_ID)}"
+  CLOUDDNS_EMAIL="${CLOUDDNS_EMAIL:-$(_readaccountconf_mutable CLOUDDNS_EMAIL)}"
+  CLOUDDNS_PASSWORD="${CLOUDDNS_PASSWORD:-$(_readaccountconf_mutable CLOUDDNS_PASSWORD)}"
+
+  if [ -z "$CLOUDDNS_PASSWORD" ] || [ -z "$CLOUDDNS_EMAIL" ] || [ -z "$CLOUDDNS_CLIENT_ID" ]; then
+    CLOUDDNS_CLIENT_ID=""
+    CLOUDDNS_EMAIL=""
+    CLOUDDNS_PASSWORD=""
+    _err "You didn't specify a CloudDNS password, email and client id yet."
+    return 1
+  fi
+  if ! _contains "$CLOUDDNS_EMAIL" "@"; then
+    _err "It seems that the CLOUDDNS_EMAIL=$CLOUDDNS_EMAIL is not a valid email address."
+    _err "Please check and retry."
+    return 1
+  fi
+  # Save CloudDNS client id, email and password to config file
+  _saveaccountconf_mutable CLOUDDNS_CLIENT_ID "$CLOUDDNS_CLIENT_ID"
+  _saveaccountconf_mutable CLOUDDNS_EMAIL "$CLOUDDNS_EMAIL"
+  _saveaccountconf_mutable CLOUDDNS_PASSWORD "$CLOUDDNS_PASSWORD"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  # For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
+  # we can not use updating anymore.
+  _info "Adding record"
+  if _clouddns_api POST "record-txt" "{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"domainId\":\"$_domain_id\"}"; then
+    if _contains "$response" "$txtvalue"; then
+      _info "Added, OK"
+    elif _contains "$response" '"code":4136'; then
+      _info "Already exists, OK"
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+
+  # Publish challenge record
+  _debug "Publishing record changes"
+  _clouddns_api PUT "domain/$_domain_id/publish" "{\"soaTtl\":300}"
+}
+
+#fulldomain txtvalue
+dns_clouddns_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CLOUDDNS_CLIENT_ID="${CLOUDDNS_CLIENT_ID:-$(_readaccountconf_mutable CLOUDDNS_CLIENT_ID)}"
+  CLOUDDNS_EMAIL="${CLOUDDNS_EMAIL:-$(_readaccountconf_mutable CLOUDDNS_EMAIL)}"
+  CLOUDDNS_PASSWORD="${CLOUDDNS_PASSWORD:-$(_readaccountconf_mutable CLOUDDNS_PASSWORD)}"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  # Get record Id
+  response="$(_clouddns_api GET "domain/$_domain_id" | tr -d '\t\r\n ')"
+  _debug response "$response"
+  if _contains "$response" "lastDomainRecordList"; then
+    re="\"lastDomainRecordList\".*\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\"," 
+    _last_domains=$(echo "$response" | _egrep_o "$re")
+    re2="\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\","
+    _record_id=$(echo "$_last_domains" | _egrep_o "$re2" | _head_n 1 | cut -d : -f 2 | cut -d , -f 1 | tr -d "\"")
+    _debug _record_id "$_record_id"
+  else
+    _err "Could not retrieve record id"
+    return 1
+  fi
+  
+  _info "Removing record"
+  if _clouddns_api DELETE "record/$_record_id"; then
+    if _contains "$response" "\"error\":"; then
+      _err "Could not remove record"
+      return 1
+    fi
+  fi
+
+  # Publish challenge record
+  _debug "Publishing record changes"
+  _clouddns_api PUT "domain/$_domain_id/publish" "{\"soaTtl\":300}"
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  domain_root=$(echo "$fulldomain" | _egrep_o '\.([^\.]*\.[^\.]*)$' | cut -c 2-)
+  _debug domain_root "$domain_root"
+
+  # Get domain id
+  data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}, \
+      {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
+  response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
+  _debug "Domain id $response"
+
+  if _contains "$response" "\"id\":\""; then
+    re='domainType\":\"[^\"]*\",\"id\":\"([^\"]*)\",' # Match domain id
+    _domain_id=$(echo "$response" | _egrep_o "$re" | _head_n 1 | cut -d : -f 3 | tr -d "\",")
+    if [ "$_domain_id" ]; then
+      _sub_domain=$(printf "%s" "$domain" | sed "s/.$domain_root//")
+      _domain="$domain_root"
+      return 0
+    fi
+    _err 'Domain name not found on your CloudDNS account'
+    return 1
+  fi
+  return 1
+}
+
+_clouddns_api() {
+  method=$1
+  endpoint="$2"
+  data="$3"
+  _debug endpoint "$endpoint"
+
+  if [ -z "$CLOUDDNS_TOKEN" ]; then
+    _clouddns_login
+  fi
+  _debug CLOUDDNS_TOKEN "$CLOUDDNS_TOKEN"
+
+  export _H1="Content-Type: application/json"
+  export _H2="Authorization: Bearer $CLOUDDNS_TOKEN"
+
+  if [ "$method" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$CLOUDDNS_API/$endpoint" "" "$method")"
+  else
+    response="$(_get "$CLOUDDNS_API/$endpoint")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $endpoint"
+    return 1
+  fi
+  printf "%s" "$response"
+  return 0
+}
+
+_clouddns_login() {
+  login_data="{\"email\": \"$CLOUDDNS_EMAIL\", \"password\": \"$CLOUDDNS_PASSWORD\"}"
+  response="$(_post "$login_data" "$CLOUDDNS_LOGIN_API" "" "POST" "Content-Type: application/json")"
+  _debug2 response "$response"
+
+  if _contains "$response" "\"accessToken\":\""; then
+    CLOUDDNS_TOKEN=$(echo "$response" | _egrep_o "\"accessToken\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \")
+    export CLOUDDNS_TOKEN
+  else
+    echo 'Could not get CloudDNS access token; check your credentials'
+    return 1
+  fi
+  return 0
+}

From 69392f67e8c49bfaaa447bd7f1dd14a428cf357c Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 01:33:15 +0100
Subject: [PATCH 194/246] Correctly handle .co.uk type domains

---
 dnsapi/dns_clouddns.sh | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
index 2678c66b..174d740f 100755
--- a/dnsapi/dns_clouddns.sh
+++ b/dnsapi/dns_clouddns.sh
@@ -118,15 +118,24 @@ dns_clouddns_rm() {
 # _domain_id=sdjkglgdfewsdfg
 _get_root() {
   domain=$1
-  domain_root=$(echo "$fulldomain" | _egrep_o '\.([^\.]*\.[^\.]*)$' | cut -c 2-)
-  _debug domain_root "$domain_root"
+
+  # Get domain root
+  data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}]}"
+  response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
+  _debug2 "response" "$response"
+  domain_slice="$domain"
+  while [ -z "$domain_root" ]; do
+    if _contains "$response" "\"domainName\":\"$domain_slice\.\""; then
+      domain_root="$domain_slice"
+      _debug domain_root "$domain_root"
+    fi
+    domain_slice="$(echo "$domain_slice" | cut -d . -f 2-)"
+  done
 
   # Get domain id
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}, \
-      {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
+    {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
   response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
-  _debug "Domain id $response"
-
   if _contains "$response" "\"id\":\""; then
     re='domainType\":\"[^\"]*\",\"id\":\"([^\"]*)\",' # Match domain id
     _domain_id=$(echo "$response" | _egrep_o "$re" | _head_n 1 | cut -d : -f 3 | tr -d "\",")

From 36e0feea430a008d63b818a4dc3cc8b46ddf459f Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 01:59:40 +0100
Subject: [PATCH 195/246] Clean up comments

---
 dnsapi/dns_clouddns.sh | 39 +++++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 18 deletions(-)

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
index 174d740f..75d9ca6c 100755
--- a/dnsapi/dns_clouddns.sh
+++ b/dnsapi/dns_clouddns.sh
@@ -11,10 +11,11 @@ CLOUDDNS_LOGIN_API='https://admin.vshosting.cloud/api/public/auth/login'
 
 ########  Public functions #####################
 
-#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Usage: add _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_clouddns_add() {
   fulldomain=$1
   txtvalue=$2
+  _debug "fulldomain" "$fulldomain"
 
   CLOUDDNS_CLIENT_ID="${CLOUDDNS_CLIENT_ID:-$(_readaccountconf_mutable CLOUDDNS_CLIENT_ID)}"
   CLOUDDNS_EMAIL="${CLOUDDNS_EMAIL:-$(_readaccountconf_mutable CLOUDDNS_EMAIL)}"
@@ -24,7 +25,7 @@ dns_clouddns_add() {
     CLOUDDNS_CLIENT_ID=""
     CLOUDDNS_EMAIL=""
     CLOUDDNS_PASSWORD=""
-    _err "You didn't specify a CloudDNS password, email and client id yet."
+    _err "You didn't specify a CloudDNS password, email and client ID yet."
     return 1
   fi
   if ! _contains "$CLOUDDNS_EMAIL" "@"; then
@@ -46,8 +47,6 @@ dns_clouddns_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  # For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
-  # we can not use updating anymore.
   _info "Adding record"
   if _clouddns_api POST "record-txt" "{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"domainId\":\"$_domain_id\"}"; then
     if _contains "$response" "$txtvalue"; then
@@ -55,20 +54,19 @@ dns_clouddns_add() {
     elif _contains "$response" '"code":4136'; then
       _info "Already exists, OK"
     else
-      _err "Add txt record error."
+      _err "Add TXT record error."
       return 1
     fi
   fi
 
-  # Publish challenge record
   _debug "Publishing record changes"
   _clouddns_api PUT "domain/$_domain_id/publish" "{\"soaTtl\":300}"
 }
 
-#fulldomain txtvalue
+# Usage: rm _acme-challenge.www.domain.com
 dns_clouddns_rm() {
   fulldomain=$1
-  txtvalue=$2
+  _debug "fulldomain" "$fulldomain"
 
   CLOUDDNS_CLIENT_ID="${CLOUDDNS_CLIENT_ID:-$(_readaccountconf_mutable CLOUDDNS_CLIENT_ID)}"
   CLOUDDNS_EMAIL="${CLOUDDNS_EMAIL:-$(_readaccountconf_mutable CLOUDDNS_EMAIL)}"
@@ -76,16 +74,16 @@ dns_clouddns_rm() {
 
   _debug "First detect the root zone"
   if ! _get_root "$fulldomain"; then
-    _err "invalid domain"
+    _err "Invalid domain"
     return 1
   fi
   _debug _domain_id "$_domain_id"
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  # Get record Id
+  # Get record ID
   response="$(_clouddns_api GET "domain/$_domain_id" | tr -d '\t\r\n ')"
-  _debug response "$response"
+  _debug2 response "$response"
   if _contains "$response" "lastDomainRecordList"; then
     re="\"lastDomainRecordList\".*\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\"," 
     _last_domains=$(echo "$response" | _egrep_o "$re")
@@ -93,7 +91,7 @@ dns_clouddns_rm() {
     _record_id=$(echo "$_last_domains" | _egrep_o "$re2" | _head_n 1 | cut -d : -f 2 | cut -d , -f 1 | tr -d "\"")
     _debug _record_id "$_record_id"
   else
-    _err "Could not retrieve record id"
+    _err "Could not retrieve record ID"
     return 1
   fi
   
@@ -105,14 +103,14 @@ dns_clouddns_rm() {
     fi
   fi
 
-  # Publish challenge record
   _debug "Publishing record changes"
   _clouddns_api PUT "domain/$_domain_id/publish" "{\"soaTtl\":300}"
 }
 
 ####################  Private functions below ##################################
-#_acme-challenge.www.domain.com
-#returns
+
+# Usage: _get_root _acme-challenge.www.domain.com
+# Returns:
 # _sub_domain=_acme-challenge.www
 # _domain=domain.com
 # _domain_id=sdjkglgdfewsdfg
@@ -122,7 +120,7 @@ _get_root() {
   # Get domain root
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}]}"
   response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
-  _debug2 "response" "$response"
+  _debug2 response "$response"
   domain_slice="$domain"
   while [ -z "$domain_root" ]; do
     if _contains "$response" "\"domainName\":\"$domain_slice\.\""; then
@@ -134,7 +132,7 @@ _get_root() {
 
   # Get domain id
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}, \
-    {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
+      {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
   response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
   if _contains "$response" "\"id\":\""; then
     re='domainType\":\"[^\"]*\",\"id\":\"([^\"]*)\",' # Match domain id
@@ -150,6 +148,9 @@ _get_root() {
   return 1
 }
 
+# Usage: _clouddns_api GET domain/search '{"data": "value"}'
+# Returns:
+#  response='{"message": "api response"}'
 _clouddns_api() {
   method=$1
   endpoint="$2"
@@ -172,13 +173,15 @@ _clouddns_api() {
   fi
 
   if [ "$?" != "0" ]; then
-    _err "error $endpoint"
+    _err "Error $endpoint"
     return 1
   fi
   printf "%s" "$response"
   return 0
 }
 
+# Returns:
+#  CLOUDDNS_TOKEN=dslfje2rj23l
 _clouddns_login() {
   login_data="{\"email\": \"$CLOUDDNS_EMAIL\", \"password\": \"$CLOUDDNS_PASSWORD\"}"
   response="$(_post "$login_data" "$CLOUDDNS_LOGIN_API" "" "POST" "Content-Type: application/json")"

From 6b675117481153bd8067737969f089bd24ada53e Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 02:03:11 +0100
Subject: [PATCH 196/246] Disable check

---
 dnsapi/dns_clouddns.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
index 75d9ca6c..1e9987db 100755
--- a/dnsapi/dns_clouddns.sh
+++ b/dnsapi/dns_clouddns.sh
@@ -172,6 +172,7 @@ _clouddns_api() {
     response="$(_get "$CLOUDDNS_API/$endpoint")"
   fi
 
+  # shellcheck disable=SC2181
   if [ "$?" != "0" ]; then
     _err "Error $endpoint"
     return 1

From 23f26770523807630df8d87cd38016a8359c57a9 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 02:53:50 +0100
Subject: [PATCH 197/246] Do not print HTTP responses to stdout

---
 dnsapi/dns_clouddns.sh | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
index 1e9987db..cfbb1cbb 100755
--- a/dnsapi/dns_clouddns.sh
+++ b/dnsapi/dns_clouddns.sh
@@ -47,8 +47,9 @@ dns_clouddns_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  _info "Adding record"
-  if _clouddns_api POST "record-txt" "{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"domainId\":\"$_domain_id\"}"; then
+  # Add TXT record
+  data="{\"type\":\"TXT\",\"name\":\"$fulldomain.\",\"value\":\"$txtvalue\",\"domainId\":\"$_domain_id\"}"
+  if _clouddns_api POST "record-txt" "$data"; then
     if _contains "$response" "$txtvalue"; then
       _info "Added, OK"
     elif _contains "$response" '"code":4136'; then
@@ -82,8 +83,7 @@ dns_clouddns_rm() {
   _debug _domain "$_domain"
 
   # Get record ID
-  response="$(_clouddns_api GET "domain/$_domain_id" | tr -d '\t\r\n ')"
-  _debug2 response "$response"
+  _clouddns_api GET "domain/$_domain_id"
   if _contains "$response" "lastDomainRecordList"; then
     re="\"lastDomainRecordList\".*\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\"," 
     _last_domains=$(echo "$response" | _egrep_o "$re")
@@ -119,8 +119,7 @@ _get_root() {
 
   # Get domain root
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}]}"
-  response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
-  _debug2 response "$response"
+  _clouddns_api "POST" "domain/search" "$data" 
   domain_slice="$domain"
   while [ -z "$domain_root" ]; do
     if _contains "$response" "\"domainName\":\"$domain_slice\.\""; then
@@ -133,7 +132,7 @@ _get_root() {
   # Get domain id
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}, \
       {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
-  response="$(_clouddns_api "POST" "domain/search" "$data" | tr -d '\t\r\n ')"
+  _clouddns_api "POST" "domain/search" "$data"
   if _contains "$response" "\"id\":\""; then
     re='domainType\":\"[^\"]*\",\"id\":\"([^\"]*)\",' # Match domain id
     _domain_id=$(echo "$response" | _egrep_o "$re" | _head_n 1 | cut -d : -f 3 | tr -d "\",")
@@ -167,9 +166,9 @@ _clouddns_api() {
 
   if [ "$method" != "GET" ]; then
     _debug data "$data"
-    response="$(_post "$data" "$CLOUDDNS_API/$endpoint" "" "$method")"
+    response="$(_post "$data" "$CLOUDDNS_API/$endpoint" "" "$method" | tr -d '\t\r\n ')"
   else
-    response="$(_get "$CLOUDDNS_API/$endpoint")"
+    response="$(_get "$CLOUDDNS_API/$endpoint" | tr -d '\t\r\n ')"
   fi
 
   # shellcheck disable=SC2181
@@ -177,7 +176,7 @@ _clouddns_api() {
     _err "Error $endpoint"
     return 1
   fi
-  printf "%s" "$response"
+  _debug2 response "$response"
   return 0
 }
 
@@ -186,7 +185,6 @@ _clouddns_api() {
 _clouddns_login() {
   login_data="{\"email\": \"$CLOUDDNS_EMAIL\", \"password\": \"$CLOUDDNS_PASSWORD\"}"
   response="$(_post "$login_data" "$CLOUDDNS_LOGIN_API" "" "POST" "Content-Type: application/json")"
-  _debug2 response "$response"
 
   if _contains "$response" "\"accessToken\":\""; then
     CLOUDDNS_TOKEN=$(echo "$response" | _egrep_o "\"accessToken\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \")

From 5c7feba77bd4a0b6f8ba1edaca2c1118a26cfa17 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 05:33:46 +0100
Subject: [PATCH 198/246] Format with shfmt

---
 dnsapi/dns_clouddns.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_clouddns.sh b/dnsapi/dns_clouddns.sh
index cfbb1cbb..31ae4ee9 100755
--- a/dnsapi/dns_clouddns.sh
+++ b/dnsapi/dns_clouddns.sh
@@ -85,7 +85,7 @@ dns_clouddns_rm() {
   # Get record ID
   _clouddns_api GET "domain/$_domain_id"
   if _contains "$response" "lastDomainRecordList"; then
-    re="\"lastDomainRecordList\".*\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\"," 
+    re="\"lastDomainRecordList\".*\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\","
     _last_domains=$(echo "$response" | _egrep_o "$re")
     re2="\"id\":\"([^\"}]*)\"[^}]*\"name\":\"$fulldomain.\","
     _record_id=$(echo "$_last_domains" | _egrep_o "$re2" | _head_n 1 | cut -d : -f 2 | cut -d , -f 1 | tr -d "\"")
@@ -94,7 +94,7 @@ dns_clouddns_rm() {
     _err "Could not retrieve record ID"
     return 1
   fi
-  
+
   _info "Removing record"
   if _clouddns_api DELETE "record/$_record_id"; then
     if _contains "$response" "\"error\":"; then
@@ -119,7 +119,7 @@ _get_root() {
 
   # Get domain root
   data="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$CLOUDDNS_CLIENT_ID\"}]}"
-  _clouddns_api "POST" "domain/search" "$data" 
+  _clouddns_api "POST" "domain/search" "$data"
   domain_slice="$domain"
   while [ -z "$domain_root" ]; do
     if _contains "$response" "\"domainName\":\"$domain_slice\.\""; then

From 3c98fae4f286f0ed1f68ae86ec8781b471be23d6 Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Wed, 22 Jan 2020 20:00:04 +0100
Subject: [PATCH 199/246] Updated/fixed some entries in --help output

---
 acme.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index b5f80b35..9b33fc74 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6202,7 +6202,7 @@ Parameters:
   --force, -f                       Used to force to install or force to renew a cert immediately.
   --staging, --test                 Use staging server, just for test.
   --debug                           Output debug info.
-  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
+  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for security.
   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
   --standalone                      Use standalone mode.
   --alpn                            Use standalone alpn mode.
@@ -6211,7 +6211,7 @@ Parameters:
   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
 
-  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
+  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
   --accountkeylength, -ak [2048]    Specifies the account key length.
   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
   --log-level 1|2                   Specifies the log level, default is 1.
@@ -6226,7 +6226,7 @@ Parameters:
 
   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
 
-  --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
+  --server SERVER                   ACME Directory Resource URI. (default: $DEFAULT_CA)
   --accountconf                     Specifies a customized account config file.
   --home                            Specifies the home dir for $PROJECT_NAME.
   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.

From b6552aff7502c5ef183fdee8a91cd7cb143eea2e Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Wed, 22 Jan 2020 21:21:38 +0100
Subject: [PATCH 200/246] Added maximum account key length to --help output

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 9b33fc74..dae42714 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6212,7 +6212,7 @@ Parameters:
   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
 
   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
-  --accountkeylength, -ak [2048]    Specifies the account key length.
+  --accountkeylength, -ak [2048]    Specifies the account key length: 2048, 3072, 4096
   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
   --log-level 1|2                   Specifies the log level, default is 1.
   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.

From 6613ae57b0a08dbae9e1f089d948c832a6b00074 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Thu, 23 Jan 2020 19:20:44 +0100
Subject: [PATCH 201/246] Update dns_kas.sh

sleep 10 to _sleep 10
---
 dnsapi/dns_kas.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 95401684..2cb0b439 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -44,7 +44,7 @@ dns_kas_add() {
   params="$params&var5=zone_host"
   params="$params&wert5=$_zone"
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
@@ -80,7 +80,7 @@ dns_kas_rm() {
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."
-      sleep 10
+      _sleep 10
       response="$(_get "$KAS_Api$params2")"
       _debug2 "response" "$response"
       if ! _contains "$response" "TRUE"; then
@@ -126,7 +126,7 @@ _get_zone_and_record_name() {
   params="$params&kas_action=get_domains"
 
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
   _zonen="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
@@ -159,7 +159,7 @@ _get_record_id() {
   params="$params&wert1=$_zone"
 
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
   _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | sed "s/record_id>=>//g")"

From 05aa26e6197241231bf968d23c03e1af4d6ad3b4 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 21:22:42 +0800
Subject: [PATCH 202/246] minor, remove space key

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index b5f80b35..786d929a 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4006,7 +4006,7 @@ issue() {
         _on_issue_err "$_post_hook"
         return 1
       fi
-      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d ":" -f 2-)"
+      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n " | cut -d ":" -f 2-)"
       _debug Le_LinkOrder "$Le_LinkOrder"
       Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
       _debug Le_OrderFinalize "$Le_OrderFinalize"

From 4f303de00c8d640351db5fb065bf0861786fab18 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 22:12:21 +0800
Subject: [PATCH 203/246] fix bug
 https://github.com/Neilpang/acme.sh/issues/2695 If a domain was already
 verified by http-01 method,  when we try to issue a cert for them same domain
 with dns-01 method, we just get only one challenge object of type http-01
 with "valid" status, from the authz-v3 url. So, we report error that we are
 not able the validate the domain, because of that we don't find dns-01
 challenge. This behavior is not the same as before. I believe it was changed
 by the letsencrypt CA.

---
 acme.sh | 80 +++++++++++++++++++++++++++++++++------------------------
 1 file changed, 47 insertions(+), 33 deletions(-)

diff --git a/acme.sh b/acme.sh
index 786d929a..0de32794 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4119,45 +4119,59 @@ $_authorizations_map"
 
       entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
       _debug entry "$entry"
+      keyauthorization=""
       if [ -z "$entry" ]; then
-        _err "Error, can not get domain token entry $d"
-        _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
-        if [ "$_supported_vtypes" ]; then
-          _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
+        _err "Error, can not get domain token entry $d for $vtype"
+        if ! _startswith "$d" '*.'; then
+          _debug "Not a wildcard domain, lets check whether the validation is already valid."
+          if echo "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
+            _debug "$d is already valid."
+            keyauthorization="$STATE_VERIFIED"
+            _debug keyauthorization "$keyauthorization"
+          fi
+        fi
+        if [ -z "$keyauthorization" ]; then
+          _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
+          if [ "$_supported_vtypes" ]; then
+            _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
+          fi
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
         fi
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
       fi
-      token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
-      _debug token "$token"
+      
+      if [ -z "$keyauthorization" ]; then
+        token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
+        _debug token "$token"
 
-      if [ -z "$token" ]; then
-        _err "Error, can not get domain token $entry"
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
-      fi
-      if [ "$ACME_VERSION" = "2" ]; then
-        uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
-      else
-        uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
-      fi
-      _debug uri "$uri"
+        if [ -z "$token" ]; then
+          _err "Error, can not get domain token $entry"
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        if [ "$ACME_VERSION" = "2" ]; then
+          uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
+        else
+          uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
+        fi
+        _debug uri "$uri"
 
-      if [ -z "$uri" ]; then
-        _err "Error, can not get domain uri. $entry"
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
-      fi
-      keyauthorization="$token.$thumbprint"
-      _debug keyauthorization "$keyauthorization"
-
-      if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
-        _debug "$d is already verified."
-        keyauthorization="$STATE_VERIFIED"
+        if [ -z "$uri" ]; then
+          _err "Error, can not get domain uri. $entry"
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        keyauthorization="$token.$thumbprint"
         _debug keyauthorization "$keyauthorization"
+
+        if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
+          _debug "$d is already verified."
+          keyauthorization="$STATE_VERIFIED"
+          _debug keyauthorization "$keyauthorization"
+        fi
       fi
 
       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"

From dc0cca8c8371e0040fea4db3c0f19bd2740776b7 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 22:22:25 +0800
Subject: [PATCH 204/246] move the error message

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 0de32794..c8b5bf95 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4121,7 +4121,6 @@ $_authorizations_map"
       _debug entry "$entry"
       keyauthorization=""
       if [ -z "$entry" ]; then
-        _err "Error, can not get domain token entry $d for $vtype"
         if ! _startswith "$d" '*.'; then
           _debug "Not a wildcard domain, lets check whether the validation is already valid."
           if echo "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
@@ -4131,6 +4130,7 @@ $_authorizations_map"
           fi
         fi
         if [ -z "$keyauthorization" ]; then
+          _err "Error, can not get domain token entry $d for $vtype"
           _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
           if [ "$_supported_vtypes" ]; then
             _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"

From f716f6060e7ee99704055dc57f603da3668e7da6 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 23:02:09 +0800
Subject: [PATCH 205/246] minor check update hash for branch name

---
 acme.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 786d929a..b4974fe3 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6315,7 +6315,11 @@ _installOnline() {
 }
 
 _getMasterHash() {
-  _hash_url="https://api.github.com/repos/Neilpang/acme.sh/git/refs/heads/master"
+  _b="$BRANCH"
+  if [ -z "$_b" ]; then
+    _b="master"
+  fi
+  _hash_url="https://api.github.com/repos/Neilpang/acme.sh/git/refs/heads/$_b"
   _get $_hash_url | tr -d "\r\n" | tr '{},' '\n' | grep '"sha":' | cut -d '"' -f 4
 }
 

From 9541ea6a9fee42567a194fbec82b6c80bd2a04bb Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 22:12:21 +0800
Subject: [PATCH 206/246] fix bug
 https://github.com/Neilpang/acme.sh/issues/2695 If a domain was already
 verified by http-01 method,  when we try to issue a cert for them same domain
 with dns-01 method, we just get only one challenge object of type http-01
 with "valid" status, from the authz-v3 url. So, we report error that we are
 not able the validate the domain, because of that we don't find dns-01
 challenge. This behavior is not the same as before. I believe it was changed
 by the letsencrypt CA.

---
 acme.sh | 80 +++++++++++++++++++++++++++++++++------------------------
 1 file changed, 47 insertions(+), 33 deletions(-)

diff --git a/acme.sh b/acme.sh
index b4974fe3..3c21c75b 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4119,45 +4119,59 @@ $_authorizations_map"
 
       entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
       _debug entry "$entry"
+      keyauthorization=""
       if [ -z "$entry" ]; then
-        _err "Error, can not get domain token entry $d"
-        _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
-        if [ "$_supported_vtypes" ]; then
-          _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
+        _err "Error, can not get domain token entry $d for $vtype"
+        if ! _startswith "$d" '*.'; then
+          _debug "Not a wildcard domain, lets check whether the validation is already valid."
+          if echo "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
+            _debug "$d is already valid."
+            keyauthorization="$STATE_VERIFIED"
+            _debug keyauthorization "$keyauthorization"
+          fi
+        fi
+        if [ -z "$keyauthorization" ]; then
+          _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
+          if [ "$_supported_vtypes" ]; then
+            _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"
+          fi
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
         fi
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
       fi
-      token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
-      _debug token "$token"
+      
+      if [ -z "$keyauthorization" ]; then
+        token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
+        _debug token "$token"
 
-      if [ -z "$token" ]; then
-        _err "Error, can not get domain token $entry"
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
-      fi
-      if [ "$ACME_VERSION" = "2" ]; then
-        uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
-      else
-        uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
-      fi
-      _debug uri "$uri"
+        if [ -z "$token" ]; then
+          _err "Error, can not get domain token $entry"
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        if [ "$ACME_VERSION" = "2" ]; then
+          uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
+        else
+          uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
+        fi
+        _debug uri "$uri"
 
-      if [ -z "$uri" ]; then
-        _err "Error, can not get domain uri. $entry"
-        _clearup
-        _on_issue_err "$_post_hook"
-        return 1
-      fi
-      keyauthorization="$token.$thumbprint"
-      _debug keyauthorization "$keyauthorization"
-
-      if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
-        _debug "$d is already verified."
-        keyauthorization="$STATE_VERIFIED"
+        if [ -z "$uri" ]; then
+          _err "Error, can not get domain uri. $entry"
+          _clearup
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        keyauthorization="$token.$thumbprint"
         _debug keyauthorization "$keyauthorization"
+
+        if printf "%s" "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
+          _debug "$d is already verified."
+          keyauthorization="$STATE_VERIFIED"
+          _debug keyauthorization "$keyauthorization"
+        fi
       fi
 
       dvlist="$d$sep$keyauthorization$sep$uri$sep$vtype$sep$_currentRoot"

From fc3a181779e8c4dbc3dd65a727df656619a100df Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 22:22:25 +0800
Subject: [PATCH 207/246] move the error message

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 3c21c75b..5ae2e312 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4121,7 +4121,6 @@ $_authorizations_map"
       _debug entry "$entry"
       keyauthorization=""
       if [ -z "$entry" ]; then
-        _err "Error, can not get domain token entry $d for $vtype"
         if ! _startswith "$d" '*.'; then
           _debug "Not a wildcard domain, lets check whether the validation is already valid."
           if echo "$response" | grep '"status":"valid"' >/dev/null 2>&1; then
@@ -4131,6 +4130,7 @@ $_authorizations_map"
           fi
         fi
         if [ -z "$keyauthorization" ]; then
+          _err "Error, can not get domain token entry $d for $vtype"
           _supported_vtypes="$(echo "$response" | _egrep_o "\"challenges\":\[[^]]*]" | tr '{' "\n" | grep type | cut -d '"' -f 4 | tr "\n" ' ')"
           if [ "$_supported_vtypes" ]; then
             _err "The supported validation types are: $_supported_vtypes, but you specified: $vtype"

From f8b225e70e2286622e01134d4e5ba5e69d1ab00e Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 27 Jan 2020 23:30:36 +0800
Subject: [PATCH 208/246] fix format

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 5ae2e312..200c95c0 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4140,7 +4140,7 @@ $_authorizations_map"
           return 1
         fi
       fi
-      
+
       if [ -z "$keyauthorization" ]; then
         token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
         _debug token "$token"

From 09f74a9af8f1de082f605e1f4338fb5ca7cb148e Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 30 Jan 2020 10:50:39 +0800
Subject: [PATCH 209/246] start v2.8.6, change the repo name

---
 acme.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/acme.sh b/acme.sh
index 200c95c0..b05c341b 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1,12 +1,12 @@
 #!/usr/bin/env sh
 
-VER=2.8.5
+VER=2.8.6
 
 PROJECT_NAME="acme.sh"
 
 PROJECT_ENTRY="acme.sh"
 
-PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
+PROJECT="https://github.com/acmesh-official/$PROJECT_NAME"
 
 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
 
@@ -126,19 +126,19 @@ NOTIFY_MODE_CERT=1
 
 NOTIFY_MODE_DEFAULT=$NOTIFY_MODE_BULK
 
-_DEBUG_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh"
+_DEBUG_WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh"
 
-_PREPARE_LINK="https://github.com/Neilpang/acme.sh/wiki/Install-preparations"
+_PREPARE_LINK="https://github.com/acmesh-official/acme.sh/wiki/Install-preparations"
 
-_STATELESS_WIKI="https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode"
+_STATELESS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode"
 
-_DNS_ALIAS_WIKI="https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode"
+_DNS_ALIAS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode"
 
-_DNS_MANUAL_WIKI="https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode"
+_DNS_MANUAL_WIKI="https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode"
 
-_NOTIFY_WIKI="https://github.com/Neilpang/acme.sh/wiki/notify"
+_NOTIFY_WIKI="https://github.com/acmesh-official/acme.sh/wiki/notify"
 
-_SUDO_WIKI="https://github.com/Neilpang/acme.sh/wiki/sudo"
+_SUDO_WIKI="https://github.com/acmesh-official/acme.sh/wiki/sudo"
 
 _DNS_MANUAL_ERR="The dns manual mode can not renew automatically, you must issue it again manually. You'd better use the other modes instead."
 
@@ -6333,7 +6333,7 @@ _getMasterHash() {
   if [ -z "$_b" ]; then
     _b="master"
   fi
-  _hash_url="https://api.github.com/repos/Neilpang/acme.sh/git/refs/heads/$_b"
+  _hash_url="https://api.github.com/repos/acmesh-official/$PROJECT_NAME/git/refs/heads/$_b"
   _get $_hash_url | tr -d "\r\n" | tr '{},' '\n' | grep '"sha":' | cut -d '"' -f 4
 }
 

From d795fac37a3ea23b3e3fa1babf685f1e2c079ad3 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 30 Jan 2020 12:06:39 +0800
Subject: [PATCH 210/246] update repo name

---
 .github/ISSUE_TEMPLATE.md        |  4 +-
 .github/PULL_REQUEST_TEMPLATE.md |  2 +-
 .travis.yml                      |  2 +-
 README.md                        | 86 ++++++++++++++++----------------
 deploy/README.md                 |  2 +-
 deploy/docker.sh                 |  2 +-
 dnsapi/README.md                 |  2 +-
 dnsapi/dns_aws.sh                |  2 +-
 dnsapi/dns_azure.sh              |  2 +-
 dnsapi/dns_cyon.sh               |  2 +-
 dnsapi/dns_easydns.sh            |  2 +-
 dnsapi/dns_freedns.sh            |  2 +-
 dnsapi/dns_lexicon.sh            |  2 +-
 dnsapi/dns_miab.sh               |  2 +-
 dnsapi/dns_myapi.sh              |  4 +-
 dnsapi/dns_openprovider.sh       |  2 +-
 dnsapi/dns_ovh.sh                |  4 +-
 dnsapi/dns_pleskxml.sh           |  2 +-
 dnsapi/dns_rackspace.sh          |  2 +-
 dnsapi/dns_servercow.sh          |  2 +-
 20 files changed, 65 insertions(+), 65 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md
index 53112c6f..c9c1b555 100644
--- a/.github/ISSUE_TEMPLATE.md
+++ b/.github/ISSUE_TEMPLATE.md
@@ -2,7 +2,7 @@
 我很忙, 每天可能只有 几秒钟 时间看你的 issue, 如果不按照我的要求写 issue, 你可能不会得到任何回复, 石沉大海.
 
 请确保已经更新到最新的代码, 然后贴上来 `--debug 2` 的调试输出. 没有调试信息. 我做不了什么.
-如何调试 https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh
+如何调试 https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
 
 If it is a bug report:
 - make sure you are able to repro it on the latest released version.
@@ -10,7 +10,7 @@ You can install the latest version by: `acme.sh --upgrade`
 
 - Search the existing issues.
 - Refer to the [WIKI](https://wiki.acme.sh).
-- Debug info [Debug](https://github.com/Neilpang/acme.sh/wiki/How-to-debug-acme.sh).
+- Debug info [Debug](https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh).
 
 -->
 
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 3bd170b7..4f7ceb47 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -3,7 +3,7 @@
 Please send to `dev` branch instead.
 Any PR to `master` branch will NOT be merged.
 
-2. For dns api support, read this guide first: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+2. For dns api support, read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
 You will NOT get any review without passing this guide.  You also need to fix the CI errors.
 
 -->
\ No newline at end of file
diff --git a/.travis.yml b/.travis.yml
index 1264803e..155ec64b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -28,7 +28,7 @@ script:
   - if [ "$TRAVIS_OS_NAME" = "linux" ]; then shellcheck -V ; fi
   - if [ "$TRAVIS_OS_NAME" = "linux" ]; then shellcheck -e SC2181 **/*.sh && echo "shellcheck OK" ; fi
   - cd ..
-  - git clone --depth 1 https://github.com/Neilpang/acmetest.git && cp -r acme.sh acmetest/ && cd acmetest
+  - git clone --depth 1 https://github.com/acmesh-official/acmetest.git && cp -r acme.sh acmetest/ && cd acmetest
   - if [ "$TRAVIS_OS_NAME" = "linux" -a "$NGROK_TOKEN" ]; then sudo TEST_LOCAL="$TEST_LOCAL" NGROK_TOKEN="$NGROK_TOKEN" ./rundocker.sh testplat ubuntu:latest ; fi
   - if [ "$TRAVIS_OS_NAME" = "osx" -a "$NGROK_TOKEN" ]; then sudo TEST_LOCAL="$TEST_LOCAL" NGROK_TOKEN="$NGROK_TOKEN" ACME_OPENSSL_BIN="$ACME_OPENSSL_BIN" ./letest.sh ; fi
 
diff --git a/README.md b/README.md
index d5012d68..d71c3c57 100644
--- a/README.md
+++ b/README.md
@@ -17,14 +17,14 @@
 
 It's probably the `easiest & smartest` shell script to automatically issue & renew the free certificates from Let's Encrypt.
 
-Wiki: https://github.com/Neilpang/acme.sh/wiki
+Wiki: https://github.com/acmesh-official/acme.sh/wiki
 
-For Docker Fans: [acme.sh :two_hearts: Docker ](https://github.com/Neilpang/acme.sh/wiki/Run-acme.sh-in-docker)
+For Docker Fans: [acme.sh :two_hearts: Docker ](https://github.com/acmesh-official/acme.sh/wiki/Run-acme.sh-in-docker)
 
 Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 
 
-# [中文说明](https://github.com/Neilpang/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
+# [中文说明](https://github.com/acmesh-official/acme.sh/wiki/%E8%AF%B4%E6%98%8E)
 
 # Who:
 - [FreeBSD.org](https://blog.crashed.org/letsencrypt-in-freebsd-org/)
@@ -40,41 +40,41 @@ Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 - [opnsense.org](https://github.com/opnsense/plugins/tree/master/security/acme-client/src/opnsense/scripts/OPNsense/AcmeClient)
 - [CentOS Web Panel](http://centos-webpanel.com/)
 - [lnmp.org](https://lnmp.org/)
-- [more...](https://github.com/Neilpang/acme.sh/wiki/Blogs-and-tutorials)
+- [more...](https://github.com/acmesh-official/acme.sh/wiki/Blogs-and-tutorials)
 
 # Tested OS
 
 | NO | Status| Platform|
 |----|-------|---------|
-|1|[![](https://neilpang.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Ubuntu
-|2|[![](https://neilpang.github.io/acmetest/status/debian-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Debian
-|3|[![](https://neilpang.github.io/acmetest/status/centos-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|CentOS
-|4|[![](https://neilpang.github.io/acmetest/status/windows-cygwin.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
-|5|[![](https://neilpang.github.io/acmetest/status/freebsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|FreeBSD
-|6|[![](https://neilpang.github.io/acmetest/status/pfsense.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|pfsense
-|7|[![](https://neilpang.github.io/acmetest/status/opensuse-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|openSUSE
-|8|[![](https://neilpang.github.io/acmetest/status/alpine-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Alpine Linux (with curl)
-|9|[![](https://neilpang.github.io/acmetest/status/base-archlinux.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Archlinux
-|10|[![](https://neilpang.github.io/acmetest/status/fedora-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|fedora
-|11|[![](https://neilpang.github.io/acmetest/status/kalilinux-kali-linux-docker.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Kali Linux
-|12|[![](https://neilpang.github.io/acmetest/status/oraclelinux-latest.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Oracle Linux
-|13|[![](https://neilpang.github.io/acmetest/status/proxmox.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
-|14|-----| Cloud Linux  https://github.com/Neilpang/le/issues/111
-|15|[![](https://neilpang.github.io/acmetest/status/openbsd.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|OpenBSD
-|16|[![](https://neilpang.github.io/acmetest/status/mageia.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Mageia
-|17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/Neilpang/acme.sh/wiki/How-to-run-on-OpenWRT)
-|18|[![](https://neilpang.github.io/acmetest/status/solaris.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|SunOS/Solaris
-|19|[![](https://neilpang.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/Neilpang/letest#here-are-the-latest-status)|Gentoo Linux
+|1|[![](https://acmesh-official.github.io/acmetest/status/ubuntu-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)| Ubuntu
+|2|[![](https://acmesh-official.github.io/acmetest/status/debian-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)| Debian
+|3|[![](https://acmesh-official.github.io/acmetest/status/centos-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|CentOS
+|4|[![](https://acmesh-official.github.io/acmetest/status/windows-cygwin.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Windows (cygwin with curl, openssl and crontab included)
+|5|[![](https://acmesh-official.github.io/acmetest/status/freebsd.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|FreeBSD
+|6|[![](https://acmesh-official.github.io/acmetest/status/pfsense.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|pfsense
+|7|[![](https://acmesh-official.github.io/acmetest/status/opensuse-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|openSUSE
+|8|[![](https://acmesh-official.github.io/acmetest/status/alpine-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Alpine Linux (with curl)
+|9|[![](https://acmesh-official.github.io/acmetest/status/base-archlinux.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Archlinux
+|10|[![](https://acmesh-official.github.io/acmetest/status/fedora-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|fedora
+|11|[![](https://acmesh-official.github.io/acmetest/status/kalilinux-kali-linux-docker.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Kali Linux
+|12|[![](https://acmesh-official.github.io/acmetest/status/oraclelinux-latest.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Oracle Linux
+|13|[![](https://acmesh-official.github.io/acmetest/status/proxmox.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)| Proxmox https://pve.proxmox.com/wiki/HTTPSCertificateConfiguration#Let.27s_Encrypt_using_acme.sh
+|14|-----| Cloud Linux  https://github.com/acmesh-official/acme.sh/issues/111
+|15|[![](https://acmesh-official.github.io/acmetest/status/openbsd.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|OpenBSD
+|16|[![](https://acmesh-official.github.io/acmetest/status/mageia.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Mageia
+|17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/acmesh-official/acme.sh/wiki/How-to-run-on-OpenWRT)
+|18|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|SunOS/Solaris
+|19|[![](https://acmesh-official.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Gentoo Linux
 |20|[![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)|Mac OSX
 
-For all build statuses, check our [weekly build project](https://github.com/Neilpang/acmetest):
+For all build statuses, check our [weekly build project](https://github.com/acmesh-official/acmetest):
 
-https://github.com/Neilpang/acmetest
+https://github.com/acmesh-official/acmetest
 
 # Supported CA
 
 - Letsencrypt.org CA(default)
-- [BuyPass.com CA](https://github.com/Neilpang/acme.sh/wiki/BuyPass.com-CA)
+- [BuyPass.com CA](https://github.com/acmesh-official/acme.sh/wiki/BuyPass.com-CA)
 - [Pebble strict Mode](https://github.com/letsencrypt/pebble)
 
 # Supported modes
@@ -85,15 +85,15 @@ https://github.com/Neilpang/acmetest
 - Apache mode
 - Nginx mode
 - DNS mode
-- [DNS alias mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode)
-- [Stateless mode](https://github.com/Neilpang/acme.sh/wiki/Stateless-Mode)
+- [DNS alias mode](https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode)
+- [Stateless mode](https://github.com/acmesh-official/acme.sh/wiki/Stateless-Mode)
 
 
 # 1. How to install
 
 ### 1. Install online
 
-Check this project: https://github.com/Neilpang/get.acme.sh
+Check this project: https://github.com/acmesh-official/get.acme.sh
 
 ```bash
 curl https://get.acme.sh | sh
@@ -111,14 +111,14 @@ wget -O -  https://get.acme.sh | sh
 Clone this project and launch installation:
 
 ```bash
-git clone https://github.com/Neilpang/acme.sh.git
+git clone https://github.com/acmesh-official/acme.sh.git
 cd ./acme.sh
 ./acme.sh --install
 ```
 
 You `don't have to be root` then, although `it is recommended`.
 
-Advanced Installation: https://github.com/Neilpang/acme.sh/wiki/How-to-install
+Advanced Installation: https://github.com/acmesh-official/acme.sh/wiki/How-to-install
 
 The installer will perform 3 actions:
 
@@ -180,7 +180,7 @@ The certs will be placed in `~/.acme.sh/example.com/`
 
 The certs will be renewed automatically every **60** days.
 
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
 
 # 3. Install the cert to Apache/Nginx etc.
@@ -226,7 +226,7 @@ Port `80` (TCP) **MUST** be free to listen on, otherwise you will be prompted to
 acme.sh --issue --standalone -d example.com -d www.example.com -d cp.example.com
 ```
 
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
 # 5. Use Standalone ssl server to issue cert
 
@@ -238,7 +238,7 @@ Port `443` (TCP) **MUST** be free to listen on, otherwise you will be prompted t
 acme.sh --issue --alpn -d example.com -d www.example.com -d cp.example.com
 ```
 
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
 
 # 6. Use Apache mode
@@ -259,7 +259,7 @@ acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
 You will need to configure your website config files to use the cert by yourself.
 We don't want to mess your apache server, don't worry.**
 
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
 # 7. Use Nginx mode
 
@@ -283,7 +283,7 @@ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
 You will need to configure your website config files to use the cert by yourself.
 We don't want to mess your nginx server, don't worry.**
 
-More examples: https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert
+More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
 # 8. Automatic DNS API integration
 
@@ -293,11 +293,11 @@ You don't have to do anything manually!
 
 ### Currently acme.sh supports most of the dns providers:
 
-https://github.com/Neilpang/acme.sh/wiki/dnsapi
+https://github.com/acmesh-official/acme.sh/wiki/dnsapi
 
 # 9. Use DNS manual mode:
 
-See: https://github.com/Neilpang/acme.sh/wiki/dns-manual-mode first.
+See: https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode first.
 
 If your dns provider doesn't support any api access, you can add the txt record by your hand.
 
@@ -430,12 +430,12 @@ acme.sh --upgrade --auto-upgrade 0
 
 # 15. Issue a cert from an existing CSR
 
-https://github.com/Neilpang/acme.sh/wiki/Issue-a-cert-from-existing-CSR
+https://github.com/acmesh-official/acme.sh/wiki/Issue-a-cert-from-existing-CSR
 
 
 # 16. Send notifications in cronjob
 
-https://github.com/Neilpang/acme.sh/wiki/notify
+https://github.com/acmesh-official/acme.sh/wiki/notify
 
 
 # 17. Under the Hood
@@ -456,7 +456,7 @@ TODO:
 ### Code Contributors
 
 This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
-<a href="https://github.com/Neilpang/acme.sh/graphs/contributors"><img src="https://opencollective.com/acmesh/contributors.svg?width=890&button=false" /></a>
+<a href="https://github.com/acmesh-official/acme.sh/graphs/contributors"><img src="https://opencollective.com/acmesh/contributors.svg?width=890&button=false" /></a>
 
 ### Financial Contributors
 
@@ -487,7 +487,7 @@ License is GPLv3
 
 Please Star and Fork me.
 
-[Issues](https://github.com/Neilpang/acme.sh/issues) and [pull requests](https://github.com/Neilpang/acme.sh/pulls) are welcome.
+[Issues](https://github.com/acmesh-official/acme.sh/issues) and [pull requests](https://github.com/acmesh-official/acme.sh/pulls) are welcome.
 
 
 # 20. Donate
@@ -495,4 +495,4 @@ Your donation makes **acme.sh** better:
 
 1. PayPal/Alipay(支付宝)/Wechat(微信): [https://donate.acme.sh/](https://donate.acme.sh/)
 
-[Donate List](https://github.com/Neilpang/acme.sh/wiki/Donate-list)
+[Donate List](https://github.com/acmesh-official/acme.sh/wiki/Donate-list)
diff --git a/deploy/README.md b/deploy/README.md
index fc633ad7..e3f239fa 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -2,5 +2,5 @@
 
 deploy hook usage:
 
-https://github.com/Neilpang/acme.sh/wiki/deployhooks
+https://github.com/acmesh-official/acme.sh/wiki/deployhooks
 
diff --git a/deploy/docker.sh b/deploy/docker.sh
index 05333b3f..06d79855 100755
--- a/deploy/docker.sh
+++ b/deploy/docker.sh
@@ -8,7 +8,7 @@
 #DEPLOY_DOCKER_CONTAINER_FULLCHAIN_FILE="/path/to/fullchain.pem"
 #DEPLOY_DOCKER_CONTAINER_RELOAD_CMD="service nginx force-reload"
 
-_DEPLOY_DOCKER_WIKI="https://github.com/Neilpang/acme.sh/wiki/deploy-to-docker-containers"
+_DEPLOY_DOCKER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/deploy-to-docker-containers"
 
 _DOCKER_HOST_DEFAULT="/var/run/docker.sock"
 
diff --git a/dnsapi/README.md b/dnsapi/README.md
index 4fa59cf2..e81f7916 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -2,5 +2,5 @@
 DNS api usage:
 
 
-https://github.com/Neilpang/acme.sh/wiki/dnsapi
+https://github.com/acmesh-official/acme.sh/wiki/dnsapi
 
diff --git a/dnsapi/dns_aws.sh b/dnsapi/dns_aws.sh
index 6db87666..0503d0f2 100755
--- a/dnsapi/dns_aws.sh
+++ b/dnsapi/dns_aws.sh
@@ -12,7 +12,7 @@
 AWS_HOST="route53.amazonaws.com"
 AWS_URL="https://$AWS_HOST"
 
-AWS_WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API"
+AWS_WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Amazon-Route53-API"
 
 ########  Public functions #####################
 
diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index 8b52dee7..bf7cf2bf 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-WIKI="https://github.com/Neilpang/acme.sh/wiki/How-to-use-Azure-DNS"
+WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS"
 
 ########  Public functions #####################
 
diff --git a/dnsapi/dns_cyon.sh b/dnsapi/dns_cyon.sh
index d7ad712c..8db3011d 100644
--- a/dnsapi/dns_cyon.sh
+++ b/dnsapi/dns_cyon.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
 ########
-# Custom cyon.ch DNS API for use with [acme.sh](https://github.com/Neilpang/acme.sh)
+# Custom cyon.ch DNS API for use with [acme.sh](https://github.com/acmesh-official/acme.sh)
 #
 # Usage: acme.sh --issue --dns dns_cyon -d www.domain.com
 #
diff --git a/dnsapi/dns_easydns.sh b/dnsapi/dns_easydns.sh
index 1d905841..ca8faab2 100644
--- a/dnsapi/dns_easydns.sh
+++ b/dnsapi/dns_easydns.sh
@@ -8,7 +8,7 @@
 # http://sandbox.rest.easydns.net:3000/
 #
 # Author: wurzelpanzer [wurzelpanzer@maximolider.net]
-# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2647
+# Report Bugs here: https://github.com/acmesh-official/acme.sh/issues/2647
 #
 ####################  Public functions #################
 
diff --git a/dnsapi/dns_freedns.sh b/dnsapi/dns_freedns.sh
index 6a0b58ac..4a58931f 100755
--- a/dnsapi/dns_freedns.sh
+++ b/dnsapi/dns_freedns.sh
@@ -7,7 +7,7 @@
 #
 #Author: David Kerr
 #Report Bugs here: https://github.com/dkerr64/acme.sh
-#or here... https://github.com/Neilpang/acme.sh/issues/2305
+#or here... https://github.com/acmesh-official/acme.sh/issues/2305
 #
 ########  Public functions #####################
 
diff --git a/dnsapi/dns_lexicon.sh b/dnsapi/dns_lexicon.sh
index bb9f7efc..516b6eff 100755
--- a/dnsapi/dns_lexicon.sh
+++ b/dnsapi/dns_lexicon.sh
@@ -5,7 +5,7 @@
 # https://github.com/AnalogJ/lexicon
 lexicon_cmd="lexicon"
 
-wiki="https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api"
+wiki="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-lexicon-dns-api"
 
 _lexicon_init() {
   if ! _exists "$lexicon_cmd"; then
diff --git a/dnsapi/dns_miab.sh b/dnsapi/dns_miab.sh
index 23ff6cee..7e697704 100644
--- a/dnsapi/dns_miab.sh
+++ b/dnsapi/dns_miab.sh
@@ -10,7 +10,7 @@
 #     used to communicate with the MailinaBox Custom DNS API
 # Report Bugs here:
 #    https://github.com/billgertz/MIAB_dns_api (for dns_miab.sh)
-#    https://github.com/Neilpang/acme.sh       (for acme.sh)
+#    https://github.com/acmesh-official/acme.sh       (for acme.sh)
 #
 ########  Public functions #####################
 
diff --git a/dnsapi/dns_myapi.sh b/dnsapi/dns_myapi.sh
index 2451d193..7f3c5a86 100755
--- a/dnsapi/dns_myapi.sh
+++ b/dnsapi/dns_myapi.sh
@@ -7,11 +7,11 @@
 #returns 0 means success, otherwise error.
 #
 #Author: Neilpang
-#Report Bugs here: https://github.com/Neilpang/acme.sh
+#Report Bugs here: https://github.com/acmesh-official/acme.sh
 #
 ########  Public functions #####################
 
-# Please Read this guide first: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+# Please Read this guide first: https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Dev-Guide
 
 #Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_myapi_add() {
diff --git a/dnsapi/dns_openprovider.sh b/dnsapi/dns_openprovider.sh
index 1b1b760e..ad1e5838 100755
--- a/dnsapi/dns_openprovider.sh
+++ b/dnsapi/dns_openprovider.sh
@@ -3,7 +3,7 @@
 # This is the OpenProvider API wrapper for acme.sh
 #
 # Author: Sylvia van Os
-# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2104
+# Report Bugs here: https://github.com/acmesh-official/acme.sh/issues/2104
 #
 #     export OPENPROVIDER_USER="username"
 #     export OPENPROVIDER_PASSWORDHASH="hashed_password"
diff --git a/dnsapi/dns_ovh.sh b/dnsapi/dns_ovh.sh
index 65567efd..7c18d009 100755
--- a/dnsapi/dns_ovh.sh
+++ b/dnsapi/dns_ovh.sh
@@ -32,9 +32,9 @@ SYS_CA='https://ca.api.soyoustart.com/1.0'
 #'runabove-ca'
 RAV_CA='https://api.runabove.com/1.0'
 
-wiki="https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api"
+wiki="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-OVH-domain-api"
 
-ovh_success="https://github.com/Neilpang/acme.sh/wiki/OVH-Success"
+ovh_success="https://github.com/acmesh-official/acme.sh/wiki/OVH-Success"
 
 _ovh_get_api() {
   _ogaep="$1"
diff --git a/dnsapi/dns_pleskxml.sh b/dnsapi/dns_pleskxml.sh
index c5d9e544..fe18bef4 100644
--- a/dnsapi/dns_pleskxml.sh
+++ b/dnsapi/dns_pleskxml.sh
@@ -2,7 +2,7 @@
 
 ##  Name: dns_pleskxml.sh
 ##  Created by Stilez.
-##  Also uses some code from PR#1832 by @romanlum (https://github.com/Neilpang/acme.sh/pull/1832/files)
+##  Also uses some code from PR#1832 by @romanlum (https://github.com/acmesh-official/acme.sh/pull/1832/files)
 
 ##  This DNS-01 method uses the Plesk XML API described at:
 ##  https://docs.plesk.com/en-US/12.5/api-rpc/about-xml-api.28709
diff --git a/dnsapi/dns_rackspace.sh b/dnsapi/dns_rackspace.sh
index 3939fd81..159671f9 100644
--- a/dnsapi/dns_rackspace.sh
+++ b/dnsapi/dns_rackspace.sh
@@ -9,7 +9,7 @@ RACKSPACE_Endpoint="https://dns.api.rackspacecloud.com/v1.0"
 
 # 20190213 - The name & id fields swapped in the API response; fix sed
 # 20190101 - Duplicating file for new pull request to dev branch
-# Original - tcocca:rackspace_dnsapi https://github.com/Neilpang/acme.sh/pull/1297
+# Original - tcocca:rackspace_dnsapi https://github.com/acmesh-official/acme.sh/pull/1297
 
 ########  Public functions #####################
 #Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
diff --git a/dnsapi/dns_servercow.sh b/dnsapi/dns_servercow.sh
index be4e59da..e73d85b0 100755
--- a/dnsapi/dns_servercow.sh
+++ b/dnsapi/dns_servercow.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
 ##########
-# Custom servercow.de DNS API v1 for use with [acme.sh](https://github.com/Neilpang/acme.sh)
+# Custom servercow.de DNS API v1 for use with [acme.sh](https://github.com/acmesh-official/acme.sh)
 #
 # Usage:
 # export SERVERCOW_API_Username=username

From d610eb15d8b8f7ea4f9a407ee230d4822e510b65 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Thu, 30 Jan 2020 12:44:02 +0800
Subject: [PATCH 211/246] update repo name

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index d71c3c57..d1c793d4 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)
+# An ACME Shell script: acme.sh [![Build Status](https://travis-ci.org/acmesh-official/acme.sh.svg?branch=master)](https://travis-ci.org/acmesh-official/acme.sh)
 
 <a href="https://opencollective.com/acmesh" alt="Financial Contributors on Open Collective"><img src="https://opencollective.com/acmesh/all/badge.svg?label=financial+contributors" /></a> [![Join the chat at https://gitter.im/acme-sh/Lobby](https://badges.gitter.im/acme-sh/Lobby.svg)](https://gitter.im/acme-sh/Lobby?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge)
 - An ACME protocol client written purely in Shell (Unix shell) language.
@@ -65,7 +65,7 @@ Twitter: [@neilpangxa](https://twitter.com/neilpangxa)
 |17|-----| OpenWRT: Tested and working. See [wiki page](https://github.com/acmesh-official/acme.sh/wiki/How-to-run-on-OpenWRT)
 |18|[![](https://acmesh-official.github.io/acmetest/status/solaris.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|SunOS/Solaris
 |19|[![](https://acmesh-official.github.io/acmetest/status/gentoo-stage3-amd64.svg)](https://github.com/acmesh-official/letest#here-are-the-latest-status)|Gentoo Linux
-|20|[![Build Status](https://travis-ci.org/Neilpang/acme.sh.svg?branch=master)](https://travis-ci.org/Neilpang/acme.sh)|Mac OSX
+|20|[![Build Status](https://travis-ci.org/acmesh-official/acme.sh.svg?branch=master)](https://travis-ci.org/acmesh-official/acme.sh)|Mac OSX
 
 For all build statuses, check our [weekly build project](https://github.com/acmesh-official/acmetest):
 

From d9a9695fe089f07e81199fcfb9ebb75fe6def7be Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 5 Feb 2020 14:29:01 -0800
Subject: [PATCH 212/246] Deploy certificates to Palo Alto Network Firewalls

---
 deploy/panos.sh | 144 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 144 insertions(+)
 create mode 100644 deploy/panos.sh

diff --git a/deploy/panos.sh b/deploy/panos.sh
new file mode 100644
index 00000000..8a288e7b
--- /dev/null
+++ b/deploy/panos.sh
@@ -0,0 +1,144 @@
+#!/usr/bin/env sh
+
+# Script to deploy certificates to Palo Alto Networks PANOS via API
+# Note PANOS API KEY and IP address needs to be set prior to running.
+# The following variables exported from environment will be used.
+# If not set then values previously saved in domain.conf file are used.
+#
+# Firewall admin with superuser and IP address is required.
+#
+# export PANOS_USER=""  # required
+# export PANOS_PASS=""  # required
+# export PANOS_HOST=""  # required
+
+# This function is to parse the XML
+parse_response() {
+  status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
+  message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  return 0
+}
+
+deployer() {
+  type=$1 # Types are cert, key, commit
+  _debug "**** Deploying $type *****"
+
+  #Generate DEIM
+  delim="-----MultipartDelimiter$(date "+%s%N")"
+  nl="\015\012"
+  #Set Header
+  _H1="Content-Type: multipart/form-data; boundary=$delim"
+  if [ $type = 'cert' ]; then
+    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
+  fi
+  if [ $type = 'key' ]; then
+    #Add key
+    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
+  fi
+  #Close multipart
+  content="$content${nl}--$delim--${nl}"
+  #Convert CRLF
+  content=$(printf %b "$content")
+
+  if [ $type = 'cert' ]; then
+    panos_url="https://$_panos_host/api/?type=import&category=certificate&certificate-name=$_cdomain&format=pem&key=$_panos_key"
+  fi
+  
+  if [ $type = 'key' ]; then
+    panos_url="https://$_panos_host/api/?type=import&category=private-key&certificate-name=$_cdomain&format=pem&passphrase=none&key=$_panos_key"
+  fi
+  if [ $type = 'commit' ]; then
+    cmd=$(_url_encode "<commit><partial><$_panos_user></$_panos_user></partial></commit>")
+    panos_url="https://$_panos_host/api/?type=commit&cmd=$cmd&key=$_panos_key"
+  fi
+
+  if [ $type = 'key' ] || [ $type = 'cert' ]; then
+    response=$(_post "$content" "$panos_url" "" "POST")
+  else
+    response=$(_get $panos_url)
+  fi
+  _debug panos_url $panos_url 
+  _debug "RESPONSE $response"
+  parse_response "$response"
+  _debug "STATUS IS $status"
+  _debug "MESSAGE IS $message"
+  # Saving response to variables
+  response_status=$status
+  # Check for cert upload error and handle gracefully.
+
+  #DEBUG
+  _debug header "$_H1"
+  # _debug content "$content"
+  _debug response_status "$response_status"
+  if [ "$response_status" = "success" ]; then
+    _debug "Successfully deployed $type"
+    return 0
+  else
+    _err "Deploy of type $type failed. Try deploying with --debug to troubleshoot."
+    _debug "$message"
+    return 1
+  fi
+}
+
+# This is the main function that will call the other functions to deploy everything.
+panos_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _cfullchain="$5"
+  # PANOS HOST is required to make API calls to the PANOS/Panorama
+  if [ -z "$PANOS_HOST" ]; then
+    if [ -z "$_panos_host" ]; then
+      _err "PANOS_HOST not defined."
+      return 1
+    fi
+  else
+    _debug "PANOS HOST is set. Save to domain conf."
+    _panos_host="$PANOS_HOST"
+    _savedomainconf _panos_host "$_panos_host"
+  fi
+  # Retrieve stored variables
+  _panos_user="$(_readaccountconf_mutable PANOS_USER)"
+  _panos_pass="$(_readaccountconf_mutable PANOS_PASS)"
+  # PANOS Credentials check
+  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ]; then
+    _debug "PANOS_USER, PANOS_PASS is not defined"
+    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ]; then
+      _err "No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables."
+      return 1
+    else
+      _debug "ok"
+    fi
+  else
+    _debug "Saving environment variables"
+    # Encrypt and save user
+    _saveaccountconf_mutable PANOS_USER "$PANOS_USER"
+    _saveaccountconf_mutable PANOS_PASS "$PANOS_PASS"
+    _panos_user="$PANOS_USER"
+    _panos_pass="$PANOS_PASS"
+  fi
+  _debug "Let's use username and pass to generate token."
+  if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then
+    _err "Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST"
+    return 1
+  else
+    _debug "Getting PANOS KEY"
+    panos_key_response=$(_get "https://$_panos_host/api/?type=keygen&user=$_panos_user&password=$_panos_pass")
+    _debug "PANOS KEY FULL RESPONSE $panos_key_response"
+    status=$(echo "$panos_key_response" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
+    _debug "STATUS IS $status"
+    if [ "$status" = "success" ]; then
+      panos_key=$(echo "$panos_key_response" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
+      _panos_key=$panos_key
+    else
+      _err "PANOS Key could not be set. Deploy with --debug to troubleshoot"
+      return 1
+    fi
+    if [ -z "$_panos_host" ] && [ -z "$_panos_key" ] && [ -z "$_panos_user" ]; then
+      _err "Missing host, apikey, user."
+      return 1
+    else
+      deployer cert
+      deployer key
+      deployer commit
+    fi
+  fi
+}
\ No newline at end of file

From 64f8a222cb1ef1a036957ba613afe30d2a2dd770 Mon Sep 17 00:00:00 2001
From: Victor Huang <i@qwq.ren>
Date: Thu, 6 Feb 2020 11:12:14 +0800
Subject: [PATCH 213/246] Add support for CQHTTP QQ bot API

---
 notify/cqhttp.sh | 75 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 notify/cqhttp.sh

diff --git a/notify/cqhttp.sh b/notify/cqhttp.sh
new file mode 100644
index 00000000..a47f4c92
--- /dev/null
+++ b/notify/cqhttp.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+#Support for CQHTTP api. Push notification on CoolQ
+#CQHTTP_TOKEN="" Required, QQ application token
+#CQHTTP_USER="" Required, QQ reciever ID
+#CQHTTP_APIROOT="" Required, CQHTTP Server URL (without slash suffix)
+#CQHTTP_CUSTOM_MSGHEAD="" Optional, custom message header
+
+CQHTTP_APIPATH="/send_private_msg"
+
+cqhttp_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_statusCode" "$_statusCode"
+
+  CQHTTP_TOKEN="${CQHTTP_TOKEN:-$(_readaccountconf_mutable CQHTTP_TOKEN)}"
+  if [ -z "$CQHTTP_TOKEN" ]; then
+    CQHTTP_TOKEN=""
+    _err "You didn't specify a CQHTTP application token yet. If it's empty please pass \"__ACME_SH_TOKEN_EMPTY__\" (without quote)."
+    return 1
+  fi
+  _saveaccountconf_mutable CQHTTP_TOKEN "$CQHTTP_TOKEN"
+  if [ "$CQHTTP_TOKEN" = "__ACME_SH_TOKEN_EMPTY__" ]; then
+    CQHTTP_TOKEN=""
+  fi
+
+  CQHTTP_USER="${CQHTTP_USER:-$(_readaccountconf_mutable CQHTTP_USER)}"
+  if [ -z "$CQHTTP_USER" ]; then
+    CQHTTP_USER=""
+    _err "You didn't specify a QQ user yet."
+    return 1
+  fi
+  _saveaccountconf_mutable CQHTTP_USER "$CQHTTP_USER"
+
+  CQHTTP_APIROOT="${CQHTTP_APIROOT:-$(_readaccountconf_mutable CQHTTP_APIROOT)}"
+  if [ -z "$CQHTTP_APIROOT" ]; then
+    CQHTTP_APIROOT=""
+    _err "You didn't specify a QQ user yet."
+    return 1
+  fi
+  _saveaccountconf_mutable CQHTTP_APIROOT "$CQHTTP_APIROOT"
+
+  CQHTTP_APIROOT="${CQHTTP_APIROOT:-$(_readaccountconf_mutable CQHTTP_APIROOT)}"
+  if [ -z "$CQHTTP_APIROOT" ]; then
+    CQHTTP_APIROOT=""
+    _err "You didn't specify a QQ user yet."
+    return 1
+  fi
+  _saveaccountconf_mutable CQHTTP_APIROOT "$CQHTTP_APIROOT"
+
+  CQHTTP_CUSTOM_MSGHEAD="${CQHTTP_CUSTOM_MSGHEAD:-$(_readaccountconf_mutable CQHTTP_CUSTOM_MSGHEAD)}"
+  if [ -z "$CQHTTP_CUSTOM_MSGHEAD" ]; then
+    CQHTTP_CUSTOM_MSGHEAD="A message from acme.sh:"
+  else
+    _saveaccountconf_mutable CQHTTP_CUSTOM_MSGHEAD "$CQHTTP_CUSTOM_MSGHEAD"
+  fi
+
+  _access_token="$(printf "%s" "$CQHTTP_TOKEN" | _url_encode)"
+  _user_id="$(printf "%s" "$CQHTTP_USER" | _url_encode)"
+  _message="$(printf "$CQHTTP_CUSTOM_MSGHEAD %s\\n%s" "$_subject" "$_content" | _url_encode)"
+
+  _finalUrl="$CQHTTP_APIROOT$CQHTTP_APIPATH?access_token=$_access_token&user_id=$_user_id&message=$_message"
+  response="$(_get "$_finalUrl")"
+
+  if [ "$?" = "0" ] && _contains "$response" "\"retcode\":0,\"status\":\"ok\""; then
+    _info "QQ send success."
+    return 0
+  fi
+
+  _err "QQ send error."
+  _err "URL: $_finalUrl"
+  _err "Response: $response"
+  return 1
+}

From 33670a5bd0788ffc403f6e6b32feef179382413a Mon Sep 17 00:00:00 2001
From: Victor Huang <i@qwq.ren>
Date: Thu, 6 Feb 2020 11:26:56 +0800
Subject: [PATCH 214/246] CQHTTP: Change shebang to "/usr/bin/env sh"

---
 notify/cqhttp.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/notify/cqhttp.sh b/notify/cqhttp.sh
index a47f4c92..fe78a0fd 100644
--- a/notify/cqhttp.sh
+++ b/notify/cqhttp.sh
@@ -1,8 +1,8 @@
-#!/bin/bash
+#!/usr/bin/env sh
 
 #Support for CQHTTP api. Push notification on CoolQ
 #CQHTTP_TOKEN="" Required, QQ application token
-#CQHTTP_USER="" Required, QQ reciever ID
+#CQHTTP_USER="" Required, QQ receiver ID
 #CQHTTP_APIROOT="" Required, CQHTTP Server URL (without slash suffix)
 #CQHTTP_CUSTOM_MSGHEAD="" Optional, custom message header
 

From 2cc50a2b65d4e443d7469675c5639999a27f8f19 Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Sat, 8 Feb 2020 12:27:19 +0100
Subject: [PATCH 215/246] Cosmetic fixes.

---
 dnsapi/dns_constellix.sh | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 55f4a71b..c47ede44 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -2,26 +2,28 @@
 
 # Author: Wout Decre <wout@canodus.be>
 
-CONSTELLIX_API="https://api.dns.constellix.com/v1"
-#CONSTELLIX_KEY="XXX"
-#CONSTELLIX_SECRET="XXX"
+CONSTELLIX_Api="https://api.dns.constellix.com/v1"
+#CONSTELLIX_Key="XXX"
+#CONSTELLIX_Secret="XXX"
 
 ########  Public functions #####################
 
+# Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
 dns_constellix_add() {
   fulldomain=$1
   txtvalue=$2
 
-  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
-  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+  CONSTELLIX_Key="${CONSTELLIX_Key:-$(_readaccountconf_mutable CONSTELLIX_Key)}"
+  CONSTELLIX_Secret="${CONSTELLIX_Secret:-$(_readaccountconf_mutable CONSTELLIX_Secret)}"
 
-  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+  if [ -z "$CONSTELLIX_Key" ] || [ -z "$CONSTELLIX_Secret" ]; then
     _err "You did not specify the Contellix API key and secret yet."
     return 1
   fi
 
-  _saveaccountconf_mutable CONSTELLIX_KEY "$CONSTELLIX_KEY"
-  _saveaccountconf_mutable CONSTELLIX_SECRET "$CONSTELLIX_SECRET"
+  _saveaccountconf_mutable CONSTELLIX_Key "$CONSTELLIX_Key"
+  _saveaccountconf_mutable CONSTELLIX_Secret "$CONSTELLIX_Secret"
 
   if ! _get_root "$fulldomain"; then
     _err "Invalid domain"
@@ -40,14 +42,16 @@ dns_constellix_add() {
   fi
 }
 
+# Usage: fulldomain txtvalue
+# Used to remove the txt record after validation
 dns_constellix_rm() {
   fulldomain=$1
   txtvalue=$2
 
-  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
-  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+  CONSTELLIX_Key="${CONSTELLIX_Key:-$(_readaccountconf_mutable CONSTELLIX_Key)}"
+  CONSTELLIX_Secret="${CONSTELLIX_Secret:-$(_readaccountconf_mutable CONSTELLIX_Secret)}"
 
-  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+  if [ -z "$CONSTELLIX_Key" ] || [ -z "$CONSTELLIX_Secret" ]; then
     _err "You did not specify the Contellix API key and secret yet."
     return 1
   fi
@@ -112,9 +116,9 @@ _constellix_rest() {
   _debug "$ep"
 
   rdate=$(date +"%s")"000"
-  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_SECRET" | _hex_dump | tr -d ' ')" | _base64)
+  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_Secret" | _hex_dump | tr -d ' ')" | _base64)
 
-  export _H1="x-cnsdns-apiKey: $CONSTELLIX_KEY"
+  export _H1="x-cnsdns-apiKey: $CONSTELLIX_Key"
   export _H2="x-cnsdns-requestDate: $rdate"
   export _H3="x-cnsdns-hmac: $hmac"
   export _H4="Accept: application/json"
@@ -122,9 +126,9 @@ _constellix_rest() {
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"
-    response="$(_post "$data" "$CONSTELLIX_API/$ep" "" "$m")"
+    response="$(_post "$data" "$CONSTELLIX_Api/$ep" "" "$m")"
   else
-    response="$(_get "$CONSTELLIX_API/$ep")"
+    response="$(_get "$CONSTELLIX_Api/$ep")"
   fi
 
   if [ "$?" != "0" ]; then

From 5d88ad554feb1f7b676ecb75c89e2f1543261fbf Mon Sep 17 00:00:00 2001
From: Victor Huang <i@qwq.ren>
Date: Sat, 8 Feb 2020 23:24:45 +0800
Subject: [PATCH 216/246] Improved token processing method and misc bugfixes

Replace '_err' to '_debug' in the final error report.
Removed redundancy code.
---
 notify/cqhttp.sh | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/notify/cqhttp.sh b/notify/cqhttp.sh
index fe78a0fd..ac76f5b8 100644
--- a/notify/cqhttp.sh
+++ b/notify/cqhttp.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 
 #Support for CQHTTP api. Push notification on CoolQ
-#CQHTTP_TOKEN="" Required, QQ application token
+#CQHTTP_TOKEN="" Recommended to be not empty, QQ application token
 #CQHTTP_USER="" Required, QQ receiver ID
 #CQHTTP_APIROOT="" Required, CQHTTP Server URL (without slash suffix)
 #CQHTTP_CUSTOM_MSGHEAD="" Optional, custom message header
@@ -17,12 +17,9 @@ cqhttp_send() {
   CQHTTP_TOKEN="${CQHTTP_TOKEN:-$(_readaccountconf_mutable CQHTTP_TOKEN)}"
   if [ -z "$CQHTTP_TOKEN" ]; then
     CQHTTP_TOKEN=""
-    _err "You didn't specify a CQHTTP application token yet. If it's empty please pass \"__ACME_SH_TOKEN_EMPTY__\" (without quote)."
-    return 1
-  fi
-  _saveaccountconf_mutable CQHTTP_TOKEN "$CQHTTP_TOKEN"
-  if [ "$CQHTTP_TOKEN" = "__ACME_SH_TOKEN_EMPTY__" ]; then
-    CQHTTP_TOKEN=""
+    _info "You didn't specify a CQHTTP application token yet, which is unsafe. Assuming it to be empty."
+  else
+    _saveaccountconf_mutable CQHTTP_TOKEN "$CQHTTP_TOKEN"
   fi
 
   CQHTTP_USER="${CQHTTP_USER:-$(_readaccountconf_mutable CQHTTP_USER)}"
@@ -36,15 +33,7 @@ cqhttp_send() {
   CQHTTP_APIROOT="${CQHTTP_APIROOT:-$(_readaccountconf_mutable CQHTTP_APIROOT)}"
   if [ -z "$CQHTTP_APIROOT" ]; then
     CQHTTP_APIROOT=""
-    _err "You didn't specify a QQ user yet."
-    return 1
-  fi
-  _saveaccountconf_mutable CQHTTP_APIROOT "$CQHTTP_APIROOT"
-
-  CQHTTP_APIROOT="${CQHTTP_APIROOT:-$(_readaccountconf_mutable CQHTTP_APIROOT)}"
-  if [ -z "$CQHTTP_APIROOT" ]; then
-    CQHTTP_APIROOT=""
-    _err "You didn't specify a QQ user yet."
+    _err "You didn't specify the API root yet."
     return 1
   fi
   _saveaccountconf_mutable CQHTTP_APIROOT "$CQHTTP_APIROOT"
@@ -69,7 +58,7 @@ cqhttp_send() {
   fi
 
   _err "QQ send error."
-  _err "URL: $_finalUrl"
-  _err "Response: $response"
+  _debug "URL" "$_finalUrl"
+  _debug "Response" "$response"
   return 1
 }

From 8189a34d145050a3ffb5598d330e6bcdd4cadf02 Mon Sep 17 00:00:00 2001
From: Blfrg <i3lfrg@gmail.com>
Date: Sat, 8 Feb 2020 16:43:23 -0600
Subject: [PATCH 217/246] fix dns_me id parse

The API seems to have changed and the ID is no longer in the same location.
---
 dnsapi/dns_me.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_me.sh b/dnsapi/dns_me.sh
index 98a58411..302603ea 100644
--- a/dnsapi/dns_me.sh
+++ b/dnsapi/dns_me.sh
@@ -114,7 +114,7 @@ _get_root() {
     fi
 
     if _contains "$response" "\"name\":\"$h\""; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*" | head -n 1 | cut -d : -f 2 | tr -d '}')
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+}$" | head -n 1 | cut -d : -f 2 | tr -d '}')
       if [ "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
         _domain="$h"

From 555e0de9e45f36ddd2507975a0368eaab9141074 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sat, 29 Jun 2019 21:47:24 -0600
Subject: [PATCH 218/246] Initial support for Synology DSM

This allows you to update a key on a Synology DSM using the existing API.
Handles restarting the necessary services the certificate is attached to and all other internal stuff (copying the certificate around, etc.)

This is way less error prone than most articles I've found on how to update a Synology DSM certificate.
---
 deploy/synology_dsm.sh | 145 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 deploy/synology_dsm.sh

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
new file mode 100644
index 00000000..45eab335
--- /dev/null
+++ b/deploy/synology_dsm.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env sh
+
+# Here is a script to deploy cert to Synology DSM vault
+# (https://www.vaultproject.io/)
+#
+# it requires the jq and curl are in the $PATH and the following
+# environment variables must be set:
+#
+# SYNO_Username - Synology Username to login (must be an administrator)
+# SYNO_Password - Synology Password to login
+# SYNO_Certificate - Certificate description to target for replacement
+#
+# The following environmental variables may be set if you don't like their
+# default values:
+#
+# SYNO_Scheme - defaults to http
+# SYNO_Hostname - defaults to localhost
+# SYNO_Port - defaults to 5000
+#
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+synology_dsm_deploy() {
+
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+
+  _debug _cdomain "$_cdomain"
+
+  # Get Username and Password, but don't save until we successfully authenticate
+  SYNO_Username="${SYNO_Username:-$(_readaccountconf_mutable SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_readaccountconf_mutable SYNO_Password)}"
+  if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
+    SYNO_Username=""
+    SYNO_Password=""
+    _err "SYNO_Username & SYNO_Password must be set"
+    return 1
+  fi
+  _debug2 SYNO_Username "$SYNO_Username"
+  _secure_debug2 SYNO_Password "$SYNO_Password"
+
+  # Optional scheme, hostname, and port for Synology DSM
+  SYNO_Scheme="${SYNO_Scheme:-$(_readaccountconf_mutable SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_readaccountconf_mutable SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_readaccountconf_mutable SYNO_Port)}"
+  _saveaccountconf_mutable SYNO_Scheme "$SYNO_Scheme"
+  _saveaccountconf_mutable SYNO_Hostname "$SYNO_Hostname"
+  _saveaccountconf_mutable SYNO_Port "$SYNO_Port"
+
+  # default vaules for scheme, hostname, and port
+  # defaulting to localhost and http because it's localhost...
+  [ -n "${SYNO_Scheme}" ] || SYNO_Scheme="http"
+  [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost"
+  [ -n "${SYNO_Port}" ] || SYNO_Port="5000"
+
+  _debug2 SYNO_Scheme "$SYNO_Scheme"
+  _debug2 SYNO_Hostname "$SYNO_Hostname"
+  _debug2 SYNO_Port "$SYNO_Port"
+
+  # Get the certificate description, but don't save it until we verfiy it's real
+  _getdeployconf SYNO_Certificate
+  if [ -z "${SYNO_Certificate}" ]; then
+    _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
+    return 1
+  fi
+  _debug SYNO_Certificate "$SYNO_Certificate"
+
+  # We can't use _get or _post because they lack support for cookies
+  # use jq because I'm too lazy to figure out what is required to parse json
+  # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
+  for x in curl jq; do
+      if ! _exists "$x"; then
+        _err "Please install $x first."
+        _err "We need $x to work."
+        return 1
+      fi
+  done
+
+  _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
+  _debug _base_url "$_base_url"
+
+  _cookie_jar="$(_mktemp)"
+  _debug _cookie_jar "$_cookie_jar"
+
+  # Login, get the token from JSON and session id from cookie
+  _debug "Logging into $SYNO_Hostname:$SYNO_Port"
+  token=$(curl -sk -c $_cookie_jar "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
+  if [ $token = "null" ]; then
+    _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
+    _err "Check your username and password."
+    rm "$_cookie_jar"
+    return 1
+  fi
+
+  # Now that we know the username and password are good, save them
+  _saveaccountconf_mutable SYNO_Username "$SYNO_Username"
+  _saveaccountconf_mutable SYNO_Password "$SYNO_Password"
+  _secure_debug2 token "$token"
+
+  # Use token and session id to get the list of certificates
+  response=$(curl -sk -b $_cookie_jar $_base_url/webapi/entry.cgi -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  _debug3 response "$response"
+  # select the first certificate matching our description
+  cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
+  _debug3 cert "$cert"
+
+  if [ "$cert" = "null" ]; then
+    _err "Unable to find certificate: $SYNO_Certificate"
+    rm "$_cookie_jar"
+    return 1
+  fi
+
+  # we've verified this certificate description is a thing, so save it
+  _savedeployconf SYNO_Certificate "$SYNO_Certificate"
+
+  id=$(echo $cert | jq -r ".id")
+  default=$(echo "$cert" | jq -r ".is_default")
+  _debug2 id "$id"
+  _debug2 default "$default"
+
+  # This is the heavy lifting, make the API call to update a certificate in place
+  response=$(curl -sk -b $_cookie_jar "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F key=@$_ckey -F cert=@$_ccert -F inter_cert=@$_cca -F id=$id -F desc=$SYNO_Certificate -F as_default=$default)
+  _debug3 response "$response"
+  success=$(echo "$response" | jq -r ".success")
+  _debug2 success "$success"
+  rm "$_cookie_jar"
+
+  if [ "$success" = "true" ]; then
+    restarted=$(echo "$response" | jq -r ".data.restart_httpd")
+    if [ "$restarted" = "true" ]; then
+        _info "http services were restarted"
+    else
+        _info "http services were NOT restarted"
+    fi
+    return 0;
+  else
+    code=$(echo "$response" | jq -r ".error.code")
+    _err "Unable to update certificate, error code $code"
+    return 1
+  fi
+}

From 548f83c3adf4533140980774892cc484937960ac Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:13:07 -0600
Subject: [PATCH 219/246] Cleanup shellcheck errors

---
 deploy/synology_dsm.sh | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 45eab335..d131e9cd 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -63,6 +63,7 @@ synology_dsm_deploy() {
 
   # Get the certificate description, but don't save it until we verfiy it's real
   _getdeployconf SYNO_Certificate
+  # shellcheck disable=SC2154
   if [ -z "${SYNO_Certificate}" ]; then
     _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
     return 1
@@ -88,8 +89,8 @@ synology_dsm_deploy() {
 
   # Login, get the token from JSON and session id from cookie
   _debug "Logging into $SYNO_Hostname:$SYNO_Port"
-  token=$(curl -sk -c $_cookie_jar "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
-  if [ $token = "null" ]; then
+  token=$(curl -sk -c "$_cookie_jar" "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
+  if [ "$token" = "null" ]; then
     _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
     _err "Check your username and password."
     rm "$_cookie_jar"
@@ -102,7 +103,7 @@ synology_dsm_deploy() {
   _secure_debug2 token "$token"
 
   # Use token and session id to get the list of certificates
-  response=$(curl -sk -b $_cookie_jar $_base_url/webapi/entry.cgi -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi" -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
   _debug3 response "$response"
   # select the first certificate matching our description
   cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
@@ -117,13 +118,13 @@ synology_dsm_deploy() {
   # we've verified this certificate description is a thing, so save it
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
-  id=$(echo $cert | jq -r ".id")
+  id=$(echo "$cert" | jq -r ".id")
   default=$(echo "$cert" | jq -r ".is_default")
   _debug2 id "$id"
   _debug2 default "$default"
 
   # This is the heavy lifting, make the API call to update a certificate in place
-  response=$(curl -sk -b $_cookie_jar "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F key=@$_ckey -F cert=@$_ccert -F inter_cert=@$_cca -F id=$id -F desc=$SYNO_Certificate -F as_default=$default)
+  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F "key=@$_ckey" -F "cert=@$_ccert" -F "inter_cert=@$_cca" -F "id=$id" -F "desc=$SYNO_Certificate" -F "as_default=$default")
   _debug3 response "$response"
   success=$(echo "$response" | jq -r ".success")
   _debug2 success "$success"

From 6459ccb18517c3f9f6c87410df8d76a0082020e3 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:13:45 -0600
Subject: [PATCH 220/246] Cleanup shfmt warnings

---
 deploy/synology_dsm.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index d131e9cd..7fab47d8 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -74,11 +74,11 @@ synology_dsm_deploy() {
   # use jq because I'm too lazy to figure out what is required to parse json
   # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
   for x in curl jq; do
-      if ! _exists "$x"; then
-        _err "Please install $x first."
-        _err "We need $x to work."
-        return 1
-      fi
+    if ! _exists "$x"; then
+      _err "Please install $x first."
+      _err "We need $x to work."
+      return 1
+    fi
   done
 
   _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
@@ -133,11 +133,11 @@ synology_dsm_deploy() {
   if [ "$success" = "true" ]; then
     restarted=$(echo "$response" | jq -r ".data.restart_httpd")
     if [ "$restarted" = "true" ]; then
-        _info "http services were restarted"
+      _info "http services were restarted"
     else
-        _info "http services were NOT restarted"
+      _info "http services were NOT restarted"
     fi
-    return 0;
+    return 0
   else
     code=$(echo "$response" | jq -r ".error.code")
     _err "Unable to update certificate, error code $code"

From 8e8cda132c0ab64548122478ab59f6eea7262dba Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:30:35 -0600
Subject: [PATCH 221/246] Remove boilerplate from what I used for template

---
 deploy/synology_dsm.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 7fab47d8..e37d7d44 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env sh
 
-# Here is a script to deploy cert to Synology DSM vault
-# (https://www.vaultproject.io/)
+# Here is a script to deploy cert to Synology DSM
 #
 # it requires the jq and curl are in the $PATH and the following
 # environment variables must be set:

From b3b00b6700e7bc960d96ddd0f2abf1315cab0e03 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Mon, 30 Sep 2019 14:06:04 -0600
Subject: [PATCH 222/246] Using domainconf instead of account

---
 deploy/synology_dsm.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index e37d7d44..25b63767 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -31,8 +31,8 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_readaccountconf_mutable SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_readaccountconf_mutable SYNO_Password)}"
+  SYNO_Username="${SYNO_Username:-$(_readdomainconf SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_readdomainconf SYNO_Password)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -43,12 +43,12 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_readaccountconf_mutable SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_readaccountconf_mutable SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_readaccountconf_mutable SYNO_Port)}"
-  _saveaccountconf_mutable SYNO_Scheme "$SYNO_Scheme"
-  _saveaccountconf_mutable SYNO_Hostname "$SYNO_Hostname"
-  _saveaccountconf_mutable SYNO_Port "$SYNO_Port"
+  SYNO_Scheme="${SYNO_Scheme:-$(_readdomainconf SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_readdomainconf SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_readdomainconf SYNO_Port)}"
+  _savedomainconf SYNO_Scheme "$SYNO_Scheme"
+  _savedomainconf SYNO_Hostname "$SYNO_Hostname"
+  _savedomainconf SYNO_Port "$SYNO_Port"
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -97,8 +97,8 @@ synology_dsm_deploy() {
   fi
 
   # Now that we know the username and password are good, save them
-  _saveaccountconf_mutable SYNO_Username "$SYNO_Username"
-  _saveaccountconf_mutable SYNO_Password "$SYNO_Password"
+  _savedomainconf SYNO_Username "$SYNO_Username"
+  _savedomainconf SYNO_Password "$SYNO_Password"
   _secure_debug2 token "$token"
 
   # Use token and session id to get the list of certificates

From 52a168b96160d5c407e54067181bedebe2c9aad9 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sat, 8 Feb 2020 16:27:18 -0800
Subject: [PATCH 223/246] Stop using jq/curl directly

This is a lot more fragile then the previous code due to treating JSON as just a string
---
 deploy/synology_dsm.sh | 105 ++++++++++++++++++++++-------------------
 1 file changed, 56 insertions(+), 49 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 25b63767..82645829 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -20,6 +20,12 @@
 
 ########  Public functions #####################
 
+_syno_get_cookie_data() {
+  _debug2 Cookie "$1"
+  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';' )"
+  grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
+}
+
 #domain keyfile certfile cafile fullchain
 synology_dsm_deploy() {
 
@@ -31,8 +37,8 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_readdomainconf SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_readdomainconf SYNO_Password)}"
+  SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -43,12 +49,12 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_readdomainconf SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_readdomainconf SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_readdomainconf SYNO_Port)}"
-  _savedomainconf SYNO_Scheme "$SYNO_Scheme"
-  _savedomainconf SYNO_Hostname "$SYNO_Hostname"
-  _savedomainconf SYNO_Port "$SYNO_Port"
+  SYNO_Scheme="${SYNO_Scheme:-$(_getdeployconf SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_getdeployconf SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_getdeployconf SYNO_Port)}"
+  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
+  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
+  _savedeployconf SYNO_Port "$SYNO_Port"
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -69,77 +75,78 @@ synology_dsm_deploy() {
   fi
   _debug SYNO_Certificate "$SYNO_Certificate"
 
-  # We can't use _get or _post because they lack support for cookies
-  # use jq because I'm too lazy to figure out what is required to parse json
-  # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
-  for x in curl jq; do
-    if ! _exists "$x"; then
-      _err "Please install $x first."
-      _err "We need $x to work."
-      return 1
-    fi
-  done
-
   _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
   _debug _base_url "$_base_url"
 
-  _cookie_jar="$(_mktemp)"
-  _debug _cookie_jar "$_cookie_jar"
-
   # Login, get the token from JSON and session id from cookie
-  _debug "Logging into $SYNO_Hostname:$SYNO_Port"
-  token=$(curl -sk -c "$_cookie_jar" "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
-  if [ "$token" = "null" ]; then
+  _info "Logging into $SYNO_Hostname:$SYNO_Port"
+  response=$(_get "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes")
+  token=$(echo "$response" | grep "SynoToken" | sed -n 's/.*"SynoToken" *: *"\([^"]*\).*/\1/p')
+  _debug3 response "$response"
+
+  if [ -z "$token" ]; then
     _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
     _err "Check your username and password."
-    rm "$_cookie_jar"
     return 1
   fi
 
+  _H1="Cookie: $(_syno_get_cookie_data "id"); $(_syno_get_cookie_data "smid")"
+  _H2="X-SYNO-TOKEN: $token"
+  export _H1
+  export _H2
+  _debug3 H1 "${_H1}"
+  _debug3 H2 "${_H2}"
+
   # Now that we know the username and password are good, save them
-  _savedomainconf SYNO_Username "$SYNO_Username"
-  _savedomainconf SYNO_Password "$SYNO_Password"
+  _savedeployconf SYNO_Username "$SYNO_Username"
+  _savedeployconf SYNO_Password "$SYNO_Password"
   _secure_debug2 token "$token"
 
-  # Use token and session id to get the list of certificates
-  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi" -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  _info "Getting certificates in Synology DSM"
+  response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")
   _debug3 response "$response"
-  # select the first certificate matching our description
-  cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
-  _debug3 cert "$cert"
+  id=$(printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
+  _debug2 id "$id"
 
-  if [ "$cert" = "null" ]; then
+  if [ -z "$id" ]; then
     _err "Unable to find certificate: $SYNO_Certificate"
-    rm "$_cookie_jar"
     return 1
   fi
 
   # we've verified this certificate description is a thing, so save it
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
-  id=$(echo "$cert" | jq -r ".id")
-  default=$(echo "$cert" | jq -r ".is_default")
-  _debug2 id "$id"
+  default=false
+  if printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+      default=true
+  fi
   _debug2 default "$default"
 
-  # This is the heavy lifting, make the API call to update a certificate in place
-  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F "key=@$_ckey" -F "cert=@$_ccert" -F "inter_cert=@$_cca" -F "id=$id" -F "desc=$SYNO_Certificate" -F "as_default=$default")
-  _debug3 response "$response"
-  success=$(echo "$response" | jq -r ".success")
-  _debug2 success "$success"
-  rm "$_cookie_jar"
+  _info "Generate form POST request"
+  nl="\015\012"
+  delim="--------------------------$(date +%Y%m%d%H%M%S)"
+  content="--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"cert\"; filename=\"$(basename "$_ccert")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ccert")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"inter_cert\"; filename=\"$(basename "$_cca")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cca")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"id\"${nl}${nl}$id"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"desc\"${nl}${nl}${SYNO_Certificate}"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}${default}"
+  content="$content${nl}--$delim--${nl}"
+  content="$(printf "%b_" "$content")";content="${content%_}" # protect trailing \n
 
-  if [ "$success" = "true" ]; then
-    restarted=$(echo "$response" | jq -r ".data.restart_httpd")
-    if [ "$restarted" = "true" ]; then
+  _info "Upload certificate to the Synology DSM"
+  response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
+  _debug3 response "$response"
+
+  if ! printf "$response" | grep -q '"error":'; then
+    if printf "$response" | grep -q '"restart_httpd":true'; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"
     fi
     return 0
   else
-    code=$(echo "$response" | jq -r ".error.code")
-    _err "Unable to update certificate, error code $code"
+    _err "Unable to update certificate, error code $response"
     return 1
   fi
 }

From 95769de464b6e21a3b31c644febd262738d0f63c Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:01:26 -0800
Subject: [PATCH 224/246] Fix shfmt/shellcheck issues

---
 deploy/synology_dsm.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 82645829..7d713930 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -22,7 +22,7 @@
 
 _syno_get_cookie_data() {
   _debug2 Cookie "$1"
-  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';' )"
+  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';')"
   grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
 }
 
@@ -105,7 +105,7 @@ synology_dsm_deploy() {
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")
   _debug3 response "$response"
-  id=$(printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
+  id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
   if [ -z "$id" ]; then
@@ -117,8 +117,8 @@ synology_dsm_deploy() {
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
   default=false
-  if printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
-      default=true
+  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+    default=true
   fi
   _debug2 default "$default"
 
@@ -132,14 +132,15 @@ synology_dsm_deploy() {
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"desc\"${nl}${nl}${SYNO_Certificate}"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}${default}"
   content="$content${nl}--$delim--${nl}"
-  content="$(printf "%b_" "$content")";content="${content%_}" # protect trailing \n
+  content="$(printf "%b_" "$content")"
+  content="${content%_}" # protect trailing \n
 
   _info "Upload certificate to the Synology DSM"
   response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
   _debug3 response "$response"
 
-  if ! printf "$response" | grep -q '"error":'; then
-    if printf "$response" | grep -q '"restart_httpd":true'; then
+  if ! echo "$response" | grep -q '"error":'; then
+    if echo "$response" | grep -q '"restart_httpd":true'; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"

From de25232a7345d8dfe221d1d1a131419182989ca6 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:26:55 -0800
Subject: [PATCH 225/246] Allow creating new certificates when certificate is
 not found

---
 deploy/synology_dsm.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 7d713930..71d9e7dc 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -39,6 +39,7 @@ synology_dsm_deploy() {
   # Get Username and Password, but don't save until we successfully authenticate
   SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
   SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
+  SYNO_Create="${SYNO_Create:-$(_getdeployconf SYNO_Create)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -108,8 +109,8 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
-  if [ -z "$id" ]; then
-    _err "Unable to find certificate: $SYNO_Certificate"
+  if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
+    _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1
   fi
 

From 5d3bc95ac529550077505189b4e2cc07ca4b5155 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:50:29 -0800
Subject: [PATCH 226/246] Fix some debug output

---
 deploy/synology_dsm.sh | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 71d9e7dc..bb49f279 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -21,8 +21,6 @@
 ########  Public functions #####################
 
 _syno_get_cookie_data() {
-  _debug2 Cookie "$1"
-  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';')"
   grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
 }
 
@@ -95,13 +93,13 @@ synology_dsm_deploy() {
   _H2="X-SYNO-TOKEN: $token"
   export _H1
   export _H2
-  _debug3 H1 "${_H1}"
-  _debug3 H2 "${_H2}"
+  _debug2 H1 "${_H1}"
+  _debug2 H2 "${_H2}"
 
   # Now that we know the username and password are good, save them
   _savedeployconf SYNO_Username "$SYNO_Username"
   _savedeployconf SYNO_Password "$SYNO_Password"
-  _secure_debug2 token "$token"
+  _debug token "$token"
 
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")

From 1259341095f2b15946f0db39ce53f821b194c00f Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 03:10:11 -0800
Subject: [PATCH 227/246] Use deployconf properly

---
 deploy/synology_dsm.sh | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index bb49f279..13728d66 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -35,9 +35,9 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
-  SYNO_Create="${SYNO_Create:-$(_getdeployconf SYNO_Create)}"
+  _getdeployconf SYNO_Username
+  _getdeployconf SYNO_Password
+  _getdeployconf SYNO_Create
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -48,12 +48,9 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_getdeployconf SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_getdeployconf SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_getdeployconf SYNO_Port)}"
-  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
-  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
-  _savedeployconf SYNO_Port "$SYNO_Port"
+  _getdeployconf SYNO_Scheme
+  _getdeployconf SYNO_Hostname
+  _getdeployconf SYNO_Port
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -61,6 +58,10 @@ synology_dsm_deploy() {
   [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost"
   [ -n "${SYNO_Port}" ] || SYNO_Port="5000"
 
+  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
+  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
+  _savedeployconf SYNO_Port "$SYNO_Port"
+
   _debug2 SYNO_Scheme "$SYNO_Scheme"
   _debug2 SYNO_Hostname "$SYNO_Hostname"
   _debug2 SYNO_Port "$SYNO_Port"
@@ -107,6 +108,7 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
+  # shellcheck disable=SC2154
   if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
     _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1

From 79637097bada83f251c68159df4baa657f16d7ad Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 11:50:50 -0800
Subject: [PATCH 228/246] Use _utc_date

---
 deploy/synology_dsm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 13728d66..dd26e3d8 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -125,7 +125,7 @@ synology_dsm_deploy() {
 
   _info "Generate form POST request"
   nl="\015\012"
-  delim="--------------------------$(date +%Y%m%d%H%M%S)"
+  delim="--------------------------$(_utc_date | tr -d -- '-: ')"
   content="--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")\012"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"cert\"; filename=\"$(basename "$_ccert")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ccert")\012"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"inter_cert\"; filename=\"$(basename "$_cca")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cca")\012"

From d07172a52843b8eeb412e85f2cdfc9a527c646c6 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 12:06:13 -0800
Subject: [PATCH 229/246] Replace disabled linter with variable substituion

---
 deploy/synology_dsm.sh | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index dd26e3d8..f1c08c36 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -68,8 +68,7 @@ synology_dsm_deploy() {
 
   # Get the certificate description, but don't save it until we verfiy it's real
   _getdeployconf SYNO_Certificate
-  # shellcheck disable=SC2154
-  if [ -z "${SYNO_Certificate}" ]; then
+  if [ -z "${SYNO_Certificate:?}" ]; then
     _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
     return 1
   fi
@@ -108,8 +107,7 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
-  # shellcheck disable=SC2154
-  if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
+  if [ -z "$id" ] && [ -z "${SYNO_Create:?}" ]; then
     _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1
   fi

From eb49127b9ec75472c663eaaebb6370ab95a3f357 Mon Sep 17 00:00:00 2001
From: Blfrg <i3lfrg@gmail.com>
Date: Sun, 9 Feb 2020 14:50:29 -0600
Subject: [PATCH 230/246] improve id parse

Locate only the outer most "id" property
---
 dnsapi/dns_me.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_me.sh b/dnsapi/dns_me.sh
index 302603ea..db51cc7c 100644
--- a/dnsapi/dns_me.sh
+++ b/dnsapi/dns_me.sh
@@ -114,7 +114,7 @@ _get_root() {
     fi
 
     if _contains "$response" "\"name\":\"$h\""; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+}$" | head -n 1 | cut -d : -f 2 | tr -d '}')
+      _domain_id=$(printf "%s\n" "$response" | cut -c 2- | head -c -2 | sed 's/{.*}//' | sed -r 's/^.*"id":([0-9]+).*$/\1/')
       if [ "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
         _domain="$h"

From 719b690451c9ec28f42bb7889fb1658f9efc0591 Mon Sep 17 00:00:00 2001
From: Arthur Wiebe <arthur@adamnet.works>
Date: Mon, 10 Feb 2020 10:22:55 -0500
Subject: [PATCH 231/246] add support for using a Zone ID

---
 dnsapi/dns_cf.sh | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/dnsapi/dns_cf.sh b/dnsapi/dns_cf.sh
index 62e40caf..f29f0f51 100755
--- a/dnsapi/dns_cf.sh
+++ b/dnsapi/dns_cf.sh
@@ -7,6 +7,7 @@
 
 #CF_Token="xxxx"
 #CF_Account_ID="xxxx"
+#CF_Zone_ID="xxxx"
 
 CF_Api="https://api.cloudflare.com/client/v4"
 
@@ -19,12 +20,14 @@ dns_cf_add() {
 
   CF_Token="${CF_Token:-$(_readaccountconf_mutable CF_Token)}"
   CF_Account_ID="${CF_Account_ID:-$(_readaccountconf_mutable CF_Account_ID)}"
+  CF_Zone_ID="${CF_Zone_ID:-$(_readaccountconf_mutable CF_Zone_ID)}"
   CF_Key="${CF_Key:-$(_readaccountconf_mutable CF_Key)}"
   CF_Email="${CF_Email:-$(_readaccountconf_mutable CF_Email)}"
 
   if [ "$CF_Token" ]; then
     _saveaccountconf_mutable CF_Token "$CF_Token"
     _saveaccountconf_mutable CF_Account_ID "$CF_Account_ID"
+    _saveaccountconf_mutable CF_Zone_ID "$CF_Zone_ID"
   else
     if [ -z "$CF_Key" ] || [ -z "$CF_Email" ]; then
       CF_Key=""
@@ -141,6 +144,28 @@ _get_root() {
   domain=$1
   i=1
   p=1
+
+  # Use Zone ID directly if provided
+  if [ "$CF_Zone_ID" ]; then
+    if ! _cf_rest GET "zones/$CF_Zone_ID"; then
+      return 1
+    else
+      if _contains "$response" '"success":true'; then
+        _domain=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | head -n 1)
+        if [ "$_domain" ]; then
+          _cutlength=$(expr ${#domain} - ${#_domain} - 1)
+          _sub_domain=$(printf "%s" "$domain" | cut -c 1-$_cutlength)
+          _domain_id=$CF_Zone_ID
+          return 0
+        else
+          return 1
+        fi
+      else
+        return 1
+      fi
+    fi
+  fi
+
   while true; do
     h=$(printf "%s" "$domain" | cut -d . -f $i-100)
     _debug h "$h"

From 1b475cf9f3997c27aae49ab578dd7070d9169b3d Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Mon, 10 Feb 2020 21:02:27 -0700
Subject: [PATCH 232/246] Remove -q from greps

---
 deploy/synology_dsm.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index f1c08c36..0c2b1185 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -116,7 +116,7 @@ synology_dsm_deploy() {
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
   default=false
-  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -- 'is_default":true' >/dev/null; then
     default=true
   fi
   _debug2 default "$default"
@@ -138,8 +138,8 @@ synology_dsm_deploy() {
   response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
   _debug3 response "$response"
 
-  if ! echo "$response" | grep -q '"error":'; then
-    if echo "$response" | grep -q '"restart_httpd":true'; then
+  if ! echo "$response" | grep '"error":' >/dev/null; then
+    if echo "$response" | grep '"restart_httpd":true' >/dev/null; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"

From d43227ede4fdc47f22abe971e647b3686678b607 Mon Sep 17 00:00:00 2001
From: Arthur Wiebe <arthur@adamnet.works>
Date: Tue, 11 Feb 2020 13:07:10 -0500
Subject: [PATCH 233/246] fix shellcheck issues

---
 dnsapi/dns_cf.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_cf.sh b/dnsapi/dns_cf.sh
index f29f0f51..2927ab4b 100755
--- a/dnsapi/dns_cf.sh
+++ b/dnsapi/dns_cf.sh
@@ -153,8 +153,8 @@ _get_root() {
       if _contains "$response" '"success":true'; then
         _domain=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | head -n 1)
         if [ "$_domain" ]; then
-          _cutlength=$(expr ${#domain} - ${#_domain} - 1)
-          _sub_domain=$(printf "%s" "$domain" | cut -c 1-$_cutlength)
+          _cutlength=$((${#domain} - ${#_domain} - 1))
+          _sub_domain=$(printf "%s" "$domain" | cut -c "1-$_cutlength")
           _domain_id=$CF_Zone_ID
           return 0
         else

From c2812896f8947c29117fe3a8b0832965aabdabeb Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 18:15:10 -0800
Subject: [PATCH 234/246] Update deployer

---
 deploy/panos.sh | 114 +++++++++++++++++++++++++-----------------------
 1 file changed, 59 insertions(+), 55 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 8a288e7b..ca03706f 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -13,61 +13,75 @@
 
 # This function is to parse the XML
 parse_response() {
-  status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
-  message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  type=$2
+  if [ $type = 'keygen' ]; then
+    status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
+    if [ "$status" = "success" ]; then
+      panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
+      _panos_key=$panos_key
+      message='PAN-OS key is set.' 
+    else
+      message="PAN-OS Key could not be set."
+    fi
+  else
+    status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
+    message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  fi
   return 0
 }
 
 deployer() {
-  type=$1 # Types are cert, key, commit
+  type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
-
-  #Generate DEIM
-  delim="-----MultipartDelimiter$(date "+%s%N")"
-  nl="\015\012"
-  #Set Header
-  _H1="Content-Type: multipart/form-data; boundary=$delim"
-  if [ $type = 'cert' ]; then
-    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
+  panos_url="https://$_panos_host/api/"
+  
+  if [ $type = 'keygen' ]; then
+    _H1="Content-Type: application/x-www-form-urlencoded"
+    content="type=keygen&user=$_panos_user&password=$_panos_pass"
+    # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
-  if [ $type = 'key' ]; then
-    #Add key
-    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
-  fi
-  #Close multipart
-  content="$content${nl}--$delim--${nl}"
-  #Convert CRLF
-  content=$(printf %b "$content")
 
-  if [ $type = 'cert' ]; then
-    panos_url="https://$_panos_host/api/?type=import&category=certificate&certificate-name=$_cdomain&format=pem&key=$_panos_key"
+  if [ $type = 'cert' ] || [ $type = 'key' ]; then
+      #Generate DEIM
+      delim="-----MultipartDelimiter$(date "+%s%N")"
+      nl="\015\012"
+        #Set Header
+      _H1="Content-Type: multipart/form-data; boundary=$delim"
+      
+    if [ $type = 'cert' ]; then
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
+    fi
+    if [ $type = 'key' ]; then
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\nnone"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
+    fi
+    #Close multipart
+    content="$content${nl}--$delim--${nl}"
+    #Convert CRLF
+    content=$(printf %b "$content")
+  fi
+
+  if [ $type = 'commit' ]; then
+   _H1="Content-Type: application/x-www-form-urlencoded"
+    cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
+    content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
   
-  if [ $type = 'key' ]; then
-    panos_url="https://$_panos_host/api/?type=import&category=private-key&certificate-name=$_cdomain&format=pem&passphrase=none&key=$_panos_key"
-  fi
-  if [ $type = 'commit' ]; then
-    cmd=$(_url_encode "<commit><partial><$_panos_user></$_panos_user></partial></commit>")
-    panos_url="https://$_panos_host/api/?type=commit&cmd=$cmd&key=$_panos_key"
-  fi
-
-  if [ $type = 'key' ] || [ $type = 'cert' ]; then
-    response=$(_post "$content" "$panos_url" "" "POST")
-  else
-    response=$(_get $panos_url)
-  fi
-  _debug panos_url $panos_url 
-  _debug "RESPONSE $response"
-  parse_response "$response"
-  _debug "STATUS IS $status"
-  _debug "MESSAGE IS $message"
+  response=$(_post "$content" "$panos_url" "" "POST")
+  parse_response "$response" $type
   # Saving response to variables
   response_status=$status
-  # Check for cert upload error and handle gracefully.
-
   #DEBUG
-  _debug header "$_H1"
-  # _debug content "$content"
   _debug response_status "$response_status"
   if [ "$response_status" = "success" ]; then
     _debug "Successfully deployed $type"
@@ -121,18 +135,8 @@ panos_deploy() {
     return 1
   else
     _debug "Getting PANOS KEY"
-    panos_key_response=$(_get "https://$_panos_host/api/?type=keygen&user=$_panos_user&password=$_panos_pass")
-    _debug "PANOS KEY FULL RESPONSE $panos_key_response"
-    status=$(echo "$panos_key_response" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
-    _debug "STATUS IS $status"
-    if [ "$status" = "success" ]; then
-      panos_key=$(echo "$panos_key_response" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
-      _panos_key=$panos_key
-    else
-      _err "PANOS Key could not be set. Deploy with --debug to troubleshoot"
-      return 1
-    fi
-    if [ -z "$_panos_host" ] && [ -z "$_panos_key" ] && [ -z "$_panos_user" ]; then
+    deployer keygen
+    if [ -z "$_panos_key" ]; then
       _err "Missing host, apikey, user."
       return 1
     else

From 71bc993e3ddf72d497b16a2a9ee598bcc0f92847 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:23:10 -0800
Subject: [PATCH 235/246] Fixed Shellchecks

---
 deploy/panos.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index ca03706f..b2c3b1d9 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -14,7 +14,7 @@
 # This function is to parse the XML
 parse_response() {
   type=$2
-  if [ $type = 'keygen' ]; then
+  if [ $type = "keygen" ]; then
     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
@@ -35,20 +35,20 @@ deployer() {
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
   
-  if [ $type = 'keygen' ]; then
+  if [ $type = "keygen" ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
 
-  if [ $type = 'cert' ] || [ $type = 'key' ]; then
+  if [ $type = "cert" ] || [ $type = "key" ]; then
       #Generate DEIM
       delim="-----MultipartDelimiter$(date "+%s%N")"
       nl="\015\012"
         #Set Header
-      _H1="Content-Type: multipart/form-data; boundary=$delim"
+      export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
-    if [ $type = 'cert' ]; then
+    if [ $type = "cert" ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -56,7 +56,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
     fi
-    if [ $type = 'key' ]; then
+    if [ $type = "key" ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -71,14 +71,14 @@ deployer() {
     content=$(printf %b "$content")
   fi
 
-  if [ $type = 'commit' ]; then
-   _H1="Content-Type: application/x-www-form-urlencoded"
+  if [ $type = "commit" ]; then
+    export _H1="Content-Type: application/x-www-form-urlencoded"
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
   
   response=$(_post "$content" "$panos_url" "" "POST")
-  parse_response "$response" $type
+  parse_response "$response" "$type"
   # Saving response to variables
   response_status=$status
   #DEBUG

From 5dcb4176769321555f953f44a046258dc1096294 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:26:48 -0800
Subject: [PATCH 236/246] ShellCheck fixes

---
 deploy/panos.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index b2c3b1d9..8e00fd6c 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -14,7 +14,7 @@
 # This function is to parse the XML
 parse_response() {
   type=$2
-  if [ $type = "keygen" ]; then
+  if [ "$type" = 'keygen' ]; then
     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
@@ -35,20 +35,20 @@ deployer() {
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
   
-  if [ $type = "keygen" ]; then
+  if [ "$type" = 'keygen' ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
 
-  if [ $type = "cert" ] || [ $type = "key" ]; then
+  if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
       #Generate DEIM
       delim="-----MultipartDelimiter$(date "+%s%N")"
       nl="\015\012"
         #Set Header
       export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
-    if [ $type = "cert" ]; then
+    if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -56,7 +56,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
     fi
-    if [ $type = "key" ]; then
+    if [ "$type" = 'key' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -71,7 +71,7 @@ deployer() {
     content=$(printf %b "$content")
   fi
 
-  if [ $type = "commit" ]; then
+  if [ "$type" = 'commit' ]; then
     export _H1="Content-Type: application/x-www-form-urlencoded"
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"

From cbdb8bd9b96a8370051f952806fa24dc13d80f9b Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:34:55 -0800
Subject: [PATCH 237/246] Fixing gitdiff

---
 deploy/panos.sh | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 8e00fd6c..c199caf4 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -42,11 +42,11 @@ deployer() {
   fi
 
   if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
-      #Generate DEIM
-      delim="-----MultipartDelimiter$(date "+%s%N")"
-      nl="\015\012"
-        #Set Header
-      export _H1="Content-Type: multipart/form-data; boundary=$delim"
+    #Generate DEIM
+    delim="-----MultipartDelimiter$(date "+%s%N")"
+    nl="\015\012"
+    #Set Header
+    export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
     if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
@@ -76,7 +76,6 @@ deployer() {
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
-  
   response=$(_post "$content" "$panos_url" "" "POST")
   parse_response "$response" "$type"
   # Saving response to variables
@@ -145,4 +144,4 @@ panos_deploy() {
       deployer commit
     fi
   fi
-}
\ No newline at end of file
+}

From 2077a70d03a548dfbb5501a5b4388948b93db9f7 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:44:51 -0800
Subject: [PATCH 238/246] Fixing gitdiff

---
 deploy/panos.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index c199caf4..3806f14f 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -34,7 +34,6 @@ deployer() {
   type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
-  
   if [ "$type" = 'keygen' ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
@@ -47,7 +46,6 @@ deployer() {
     nl="\015\012"
     #Set Header
     export _H1="Content-Type: multipart/form-data; boundary=$delim"
-      
     if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"

From 930e16b64a25e60fbb6998d3f27749a257111939 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:50:05 -0800
Subject: [PATCH 239/246] fix gitdiff

---
 deploy/panos.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 3806f14f..eaa19c89 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -19,7 +19,6 @@ parse_response() {
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
       _panos_key=$panos_key
-      message='PAN-OS key is set.' 
     else
       message="PAN-OS Key could not be set."
     fi

From 1fe3d80838d2aab564ad15aca7c2342b29e04f97 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 12 Feb 2020 14:57:31 -0800
Subject: [PATCH 240/246] Updated to use saveconf function and base64encode.

---
 deploy/panos.sh | 43 +++++++++++++++++++------------------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index eaa19c89..627a59de 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -94,36 +94,31 @@ panos_deploy() {
   _cdomain="$1"
   _ckey="$2"
   _cfullchain="$5"
-  # PANOS HOST is required to make API calls to the PANOS/Panorama
-  if [ -z "$PANOS_HOST" ]; then
-    if [ -z "$_panos_host" ]; then
-      _err "PANOS_HOST not defined."
-      return 1
-    fi
-  else
-    _debug "PANOS HOST is set. Save to domain conf."
-    _panos_host="$PANOS_HOST"
-    _savedomainconf _panos_host "$_panos_host"
-  fi
-  # Retrieve stored variables
-  _panos_user="$(_readaccountconf_mutable PANOS_USER)"
-  _panos_pass="$(_readaccountconf_mutable PANOS_PASS)"
-  # PANOS Credentials check
-  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ]; then
-    _debug "PANOS_USER, PANOS_PASS is not defined"
-    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ]; then
-      _err "No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables."
+  
+  # PANOS ENV VAR check
+  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ] || [ -z "$PANOS_HOST" ]; then
+    _debug "No ENV variables found lets check for saved variables"
+    _getdeployconf PANOS_USER
+    _getdeployconf PANOS_PASS
+    _getdeployconf PANOS_HOST
+    _panos_user=$PANOS_USER
+    _panos_pass=$PANOS_PASS
+    _panos_host=$PANOS_HOST
+    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ] && [ -z "$_panos_host" ]; then
+      _err "No host, user and pass found.. If this is the first time deploying please set PANOS_HOST, PANOS_USER and PANOS_PASS in environment variables. Delete them after you have succesfully deployed certs."
       return 1
     else
-      _debug "ok"
+      _debug "Using saved env variables."
     fi
   else
-    _debug "Saving environment variables"
+    _debug "Detected ENV variables to be saved to the deploy conf."
     # Encrypt and save user
-    _saveaccountconf_mutable PANOS_USER "$PANOS_USER"
-    _saveaccountconf_mutable PANOS_PASS "$PANOS_PASS"
+    _savedeployconf PANOS_USER "$PANOS_USER" 1
+    _savedeployconf PANOS_PASS "$PANOS_PASS" 1
+    _savedeployconf PANOS_HOST "$PANOS_HOST" 1
     _panos_user="$PANOS_USER"
     _panos_pass="$PANOS_PASS"
+    _panos_host="$PANOS_HOST"
   fi
   _debug "Let's use username and pass to generate token."
   if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then
@@ -133,7 +128,7 @@ panos_deploy() {
     _debug "Getting PANOS KEY"
     deployer keygen
     if [ -z "$_panos_key" ]; then
-      _err "Missing host, apikey, user."
+      _err "Missing apikey."
       return 1
     else
       deployer cert

From c355b25bb1eea5fbf1b5d08185bc52032b60cabd Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 12 Feb 2020 15:00:23 -0800
Subject: [PATCH 241/246] Fixed line formatting

---
 deploy/panos.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 627a59de..a550d877 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -94,7 +94,6 @@ panos_deploy() {
   _cdomain="$1"
   _ckey="$2"
   _cfullchain="$5"
-  
   # PANOS ENV VAR check
   if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ] || [ -z "$PANOS_HOST" ]; then
     _debug "No ENV variables found lets check for saved variables"

From 21450a08c27af39e3788526464c249a41c3db61f Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Thu, 13 Feb 2020 18:01:27 -0800
Subject: [PATCH 242/246] Fixed 6 character requirement.

---
 deploy/panos.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index a550d877..6316784a 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -30,6 +30,7 @@ parse_response() {
 }
 
 deployer() {
+  content=""
   type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
@@ -59,7 +60,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
-      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\nnone"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\n123456"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
     fi
     #Close multipart

From 463df9e4ba25273cc9a9fe82d12c47ad412518af Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Tue, 18 Feb 2020 16:26:15 +0100
Subject: [PATCH 243/246] Make socat debug output show version + features
 instead of help text

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index c9cd0d1c..3a01c13d 100755
--- a/acme.sh
+++ b/acme.sh
@@ -207,7 +207,7 @@ _dlg_versions() {
 
   echo "socat:"
   if _exists "socat"; then
-    socat -h 2>&1
+    socat -V 2>&1
   else
     _debug "socat doesn't exists."
   fi

From f8662c9bc21329fc4f0481e50a27df81cb57c249 Mon Sep 17 00:00:00 2001
From: adrian5 <adrian5@users.noreply.github.com>
Date: Thu, 20 Feb 2020 18:43:08 +0100
Subject: [PATCH 244/246] Fix phrasing in README

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index d1c793d4..de674cbf 100644
--- a/README.md
+++ b/README.md
@@ -257,7 +257,7 @@ acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com
 
 **This apache mode is only to issue the cert, it will not change your apache config files.
 You will need to configure your website config files to use the cert by yourself.
-We don't want to mess your apache server, don't worry.**
+We don't want to mess with your apache server, don't worry.**
 
 More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 
@@ -281,7 +281,7 @@ acme.sh --issue --nginx -d example.com -d www.example.com -d cp.example.com
 
 **This nginx mode is only to issue the cert, it will not change your nginx config files.
 You will need to configure your website config files to use the cert by yourself.
-We don't want to mess your nginx server, don't worry.**
+We don't want to mess with your nginx server, don't worry.**
 
 More examples: https://github.com/acmesh-official/acme.sh/wiki/How-to-issue-a-cert
 

From e184a1b9e64f9985387cc402449f459a2b1e6649 Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Thu, 20 Feb 2020 23:28:55 +0100
Subject: [PATCH 245/246] haproxy deploy script now compatible with OpenSSL
 v1.1+

haproxy deploy script now compatible with OpenSSL v1.1+

The OpenSSL OCSP request for haproxy deployment breaks from OpenSSL v1.1.0 on.
The format of the `-header` option has been changed and does now contain a `=` instead of a whitespace.
Other projects have hit the same issue:
https://github.com/nghttp2/nghttp2/issues/742

This commit determines the OpenSSL/LibreSSL version and then adjusts the request accordingly.
Also removed the duplicate command line and added some more debug output.
---
 deploy/haproxy.sh | 52 +++++++++++++++++++++++++----------------------
 1 file changed, 28 insertions(+), 24 deletions(-)

diff --git a/deploy/haproxy.sh b/deploy/haproxy.sh
index 836c5182..3cd2a80a 100644
--- a/deploy/haproxy.sh
+++ b/deploy/haproxy.sh
@@ -208,33 +208,37 @@ haproxy_deploy() {
         _issuerdn=$(openssl x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
         _debug _issuerdn "${_issuerdn}"
         _info "Requesting OCSP response"
-        # Request the OCSP response from the issuer and store it
+        # If the issuer is a CA cert then our command line has "-CAfile" added
         if [ "${_subjectdn}" = "${_issuerdn}" ]; then
-          # If the issuer is a CA cert then our command line has "-CAfile" added
-          openssl ocsp \
-            -issuer "${_issuer}" \
-            -cert "${_pem}" \
-            -url "${_ocsp_url}" \
-            -header Host "${_ocsp_host}" \
-            -respout "${_ocsp}" \
-            -verify_other "${_issuer}" \
-            -no_nonce \
-            -CAfile "${_issuer}" \
-            | grep -q "${_pem}: good"
-          _ret=$?
+          _cafile_argument="-CAfile \"${_issuer}\""
         else
-          # Issuer is not a root CA so no "-CAfile" option
-          openssl ocsp \
-            -issuer "${_issuer}" \
-            -cert "${_pem}" \
-            -url "${_ocsp_url}" \
-            -header Host "${_ocsp_host}" \
-            -respout "${_ocsp}" \
-            -verify_other "${_issuer}" \
-            -no_nonce \
-            | grep -q "${_pem}: good"
-          _ret=$?
+          _cafile_argument=""
         fi
+        _debug _cafile_argument "${_cafile_argument}"
+        # if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
+        _openssl_version=$(openssl version | cut -d' ' -f2)
+        _debug _openssl_version "${_openssl_version}"
+        _openssl_major=$(echo "${_openssl_version}" | cut -d '.' -f1)
+        _openssl_minor=$(echo "${_openssl_version}" | cut -d '.' -f2)
+        if [ "${_openssl_major}" -eq "1" ] && [ "${_openssl_minor}" -ge "1" ] || [ "${_openssl_major}" -ge "2" ]; then
+          _header_sep="="
+        else
+          _header_sep=" "
+        fi
+        # Request the OCSP response from the issuer and store it
+        _openssl_ocsp_cmd="openssl ocsp \
+          -issuer \"${_issuer}\" \
+          -cert \"${_pem}\" \
+          -url \"${_ocsp_url}\" \
+          -header Host${_header_sep}\"${_ocsp_host}\" \
+          -respout \"${_ocsp}\" \
+          -verify_other \"${_issuer}\" \
+          -no_nonce \
+          ${_cafile_argument} \
+          | grep -q \"${_pem}: good\""
+        _debug _openssl_ocsp_cmd "${_openssl_ocsp_cmd}"
+        eval "${_openssl_ocsp_cmd}"
+        _ret=$?
       else
         # Non fatal: No issuer file was present so no OCSP stapling file created
         _err "OCSP stapling in use but no .issuer file was present"

From 22f9a3b467095635b4ab755f6229888ff563f92b Mon Sep 17 00:00:00 2001
From: alex <alexej.disterhoft@vindler.de>
Date: Tue, 25 Feb 2020 12:33:50 +0100
Subject: [PATCH 246/246] Fix error on docker deploy command with spaces.

This adds quotes to the last eval in _getdeployconf which is reponsible
for loading and exporting saved environment variables back into the
acme.sh process. This caused some errors if used with the docker
deploy-hook and the example nginx "service nginx force-reload" command
as it contains spaces.
---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 3a01c13d..283b0a39 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2166,7 +2166,7 @@ _getdeployconf() {
     return 0 # do nothing
   fi
   _saved=$(_readdomainconf "SAVED_$_rac_key")
-  eval "export $_rac_key=$_saved"
+  eval "export $_rac_key=\"$_saved\""
 }
 
 #_saveaccountconf  key  value  base64encode