From 1167cdcaec8e21dfd68bd2300412a733658b258d Mon Sep 17 00:00:00 2001
From: Sebastiaan Hoogeveen <sebastiaan@hoogeveen.me>
Date: Tue, 5 Feb 2019 16:32:41 +0100
Subject: [PATCH 01/53] Added DNS API support for NederHost
 (https://www.nederhost.nl/)

---
 dnsapi/dns_nederhost.sh | 133 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 133 insertions(+)
 create mode 100755 dnsapi/dns_nederhost.sh

diff --git a/dnsapi/dns_nederhost.sh b/dnsapi/dns_nederhost.sh
new file mode 100755
index 00000000..32357f83
--- /dev/null
+++ b/dnsapi/dns_nederhost.sh
@@ -0,0 +1,133 @@
+#!/usr/bin/env sh
+
+#NederHost_Key="sdfgikogfdfghjklkjhgfcdcfghjk"
+
+NederHost_Api="https://api.nederhost.nl/dns/v1"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_nederhost_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  NederHost_Key="${NederHost_Key:-$(_readaccountconf_mutable NederHost_Key)}"
+  if [ -z "$NederHost_Key" ]; then
+    NederHost_Key=""
+    _err "You didn't specify a NederHost api key."
+    _err "You can get yours from https://www.nederhost.nl/mijn_nederhost"
+    return 1
+  fi
+
+  #save the api key and email to the account conf file.
+  _saveaccountconf_mutable NederHost_Key "$NederHost_Key"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _info "Adding record"
+  if _nederhost_rest PATCH "zones/$_domain/records/$fulldomain/TXT" "[{\"content\":\"$txtvalue\",\"ttl\":60}]"; then
+    if _contains "$response" "$fulldomain"; then
+      _info "Added, OK"
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+  return 1
+
+}
+
+#fulldomain txtvalue
+dns_nederhost_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  NederHost_Key="${NederHost_Key:-$(_readaccountconf_mutable NederHost_Key)}"
+  if [ -z "$NederHost_Key" ]; then
+    NederHost_Key=""
+    _err "You didn't specify a NederHost api key."
+    _err "You can get yours from https://www.nederhost.nl/mijn_nederhost"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Removing txt record"
+  _nederhost_rest DELETE "zones/${_domain}/records/$fulldomain/TXT?content=$txtvalue"
+
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  while true; do
+    _domain=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+    _debug _domain "$_domain"
+    if [ -z "$_domain" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _nederhost_rest GET "zones/${_domain}"; then
+      if [ "${_code}" == "204" ]; then
+        return 0;
+      fi
+    else
+      return 1;
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_nederhost_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Authorization: Bearer $NederHost_Key"
+  export _H2="Content-Type: application/json"
+
+  :>$HTTP_HEADER
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$NederHost_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$NederHost_Api/$ep")"
+  fi
+
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug "http response code $_code"
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From b3e3e080a9a18c005384942de6616fe076e8a8d4 Mon Sep 17 00:00:00 2001
From: Sebastiaan Hoogeveen <sebastiaan@hoogeveen.me>
Date: Tue, 5 Feb 2019 16:37:08 +0100
Subject: [PATCH 02/53] Cleaned up some of the comments from shellcheck.

---
 dnsapi/dns_nederhost.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_nederhost.sh b/dnsapi/dns_nederhost.sh
index 32357f83..0058c848 100755
--- a/dnsapi/dns_nederhost.sh
+++ b/dnsapi/dns_nederhost.sh
@@ -91,7 +91,7 @@ _get_root() {
     fi
 
     if _nederhost_rest GET "zones/${_domain}"; then
-      if [ "${_code}" == "204" ]; then
+      if [ "${_code}" = "204" ]; then
         return 0;
       fi
     else
@@ -112,7 +112,7 @@ _nederhost_rest() {
   export _H1="Authorization: Bearer $NederHost_Key"
   export _H2="Content-Type: application/json"
 
-  :>$HTTP_HEADER
+  :>"$HTTP_HEADER"
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"

From 44dcb0d0a9b0b22f88d3d7942b1aac9004a273b7 Mon Sep 17 00:00:00 2001
From: Sebastiaan Hoogeveen <sebastiaan@hoogeveen.me>
Date: Wed, 6 Feb 2019 11:46:47 +0100
Subject: [PATCH 03/53] Make Travis happy; fixed formatting of return
 statements.

---
 dnsapi/dns_nederhost.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_nederhost.sh b/dnsapi/dns_nederhost.sh
index 0058c848..84c5ecd1 100755
--- a/dnsapi/dns_nederhost.sh
+++ b/dnsapi/dns_nederhost.sh
@@ -92,10 +92,10 @@ _get_root() {
 
     if _nederhost_rest GET "zones/${_domain}"; then
       if [ "${_code}" = "204" ]; then
-        return 0;
+        return 0
       fi
     else
-      return 1;
+      return 1
     fi
     p=$i
     i=$(_math "$i" + 1)

From b7e92dbcedf358a2234ed6567662b71bb5ee2953 Mon Sep 17 00:00:00 2001
From: Sebastiaan Hoogeveen <sebastiaan@hoogeveen.me>
Date: Wed, 6 Feb 2019 14:27:26 +0100
Subject: [PATCH 04/53] Documentation update.

---
 README.md        |  1 +
 dnsapi/README.md | 14 ++++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/README.md b/README.md
index 90a648d5..4bde4ea4 100644
--- a/README.md
+++ b/README.md
@@ -351,6 +351,7 @@ You don't have to do anything manually!
 1. PointDNS API (https://pointhq.com/)
 1. Active24.cz API (https://www.active24.cz/)
 1. do.de API (https://www.do.de/)
+1. NederHost API (https://www.nederhost.nl/)
 
 And:
 
diff --git a/dnsapi/README.md b/dnsapi/README.md
index 4f9b4100..a2bf0c18 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1172,6 +1172,20 @@ acme.sh --issue --dns dns_doapi -d example.com -d *.example.com
 
 The API token will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+## 61. Use NederHost API
+
+Create an API token in Mijn NederHost.
+
+Set your API key:
+```
+export NederHost_Key='xxx'
+```
+
+To issue a certificate run:
+```
+acme.sh --issue --dns dns_nederhost -d example.com -d *.example.com
+```
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.

From e7f7e96d589ca757ab91744a97893f83d615c481 Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Wed, 27 Feb 2019 20:36:13 +0800
Subject: [PATCH 05/53] Peb (#2126)

* support pebble
* support async finalize order
---
 acme.sh | 88 ++++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 74 insertions(+), 14 deletions(-)

diff --git a/acme.sh b/acme.sh
index 93112a1a..8ee22479 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1827,23 +1827,29 @@ _send_signed_request() {
         nonceurl="$ACME_NEW_NONCE"
         if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type"; then
           _headers="$(cat "$HTTP_HEADER")"
+          _debug2 _headers "$_headers"
+          _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
         fi
       fi
-      if [ -z "$_headers" ]; then
+      if [ -z "$_CACHED_NONCE" ]; then
         _debug2 "Get nonce with GET. ACME_DIRECTORY" "$ACME_DIRECTORY"
         nonceurl="$ACME_DIRECTORY"
         _headers="$(_get "$nonceurl" "onlyheader")"
+        _debug2 _headers "$_headers"
+        _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
       fi
-
+      if [ -z "$_CACHED_NONCE" ] && [ "$ACME_NEW_NONCE" ]; then
+        _debug2 "Get nonce with GET. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
+        nonceurl="$ACME_NEW_NONCE"
+        _headers="$(_get "$nonceurl" "onlyheader")"
+        _debug2 _headers "$_headers"
+        _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
+      fi
+      _debug2 _CACHED_NONCE "$_CACHED_NONCE"
       if [ "$?" != "0" ]; then
         _err "Can not connect to $nonceurl to get nonce."
         return 1
       fi
-
-      _debug2 _headers "$_headers"
-
-      _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
-      _debug2 _CACHED_NONCE "$_CACHED_NONCE"
     else
       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
     fi
@@ -2060,6 +2066,7 @@ _clearcaconf() {
 _startserver() {
   content="$1"
   ncaddr="$2"
+  _debug "content" "$content"
   _debug "ncaddr" "$ncaddr"
 
   _debug "startserver: $$"
@@ -2086,8 +2093,14 @@ _startserver() {
     SOCAT_OPTIONS="$SOCAT_OPTIONS,bind=${ncaddr}"
   fi
 
+  _content_len="$(printf "%s" "$content" | wc -c)"
+  _debug _content_len "$_content_len"
   _debug "_NC" "$_NC $SOCAT_OPTIONS"
-  $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; echo HTTP/1.0 200 OK; echo ; echo  $content; echo;" &
+  $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
+echo 'HTTP/1.0 200 OK'; \
+echo 'Content-Length\: $_content_len'; \
+echo ''; \
+printf '$content';" &
   serverproc="$!"
 }
 
@@ -3062,6 +3075,7 @@ _on_before_issue() {
       _info "Standalone mode."
       if [ -z "$Le_HTTPPort" ]; then
         Le_HTTPPort=80
+        _cleardomainconf "Le_HTTPPort"
       else
         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
       fi
@@ -3269,7 +3283,7 @@ _regAccount() {
   fi
 
   _debug2 responseHeaders "$responseHeaders"
-  _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
+  _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
   _debug "_accUri" "$_accUri"
   if [ -z "$_accUri" ]; then
     _err "Can not find account id url."
@@ -3435,7 +3449,7 @@ __trigger_validation() {
   _t_vtype="$3"
   _debug2 _t_vtype "$_t_vtype"
   if [ "$ACME_VERSION" = "2" ]; then
-    _send_signed_request "$_t_url" "{\"keyAuthorization\": \"$_t_key_authz\"}"
+    _send_signed_request "$_t_url" "{}"
   else
     _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"type\": \"$_t_vtype\", \"keyAuthorization\": \"$_t_key_authz\"}"
   fi
@@ -4205,20 +4219,66 @@ $_authorizations_map"
   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
 
   if [ "$ACME_VERSION" = "2" ]; then
+    _info "Lets finalize the order, Le_OrderFinalize: $Le_OrderFinalize"
     if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
       _err "Sign failed."
       _on_issue_err "$_post_hook"
       return 1
     fi
     if [ "$code" != "200" ]; then
-      _err "Sign failed, code is not 200."
+      _err "Sign failed, finalize code is not 200."
       _err "$response"
       _on_issue_err "$_post_hook"
       return 1
     fi
-    Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
+    Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+    if [ -z "$Le_LinkOrder" ]; then
+      _err "Sign error, can not get order link location header"
+      _err "responseHeaders" "$responseHeaders"
+      _on_issue_err "$_post_hook"
+      return 1
+    fi
+    _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
 
-    _tempSignedResponse="$response"
+    _link_cert_retry=0
+    _MAX_CERT_RETRY=5
+    while [ -z "$Le_LinkCert" ] && [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
+      if _contains "$response" "\"status\":\"valid\""; then
+        _debug "Order status is valid."
+        Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
+        _debug Le_LinkCert "$Le_LinkCert"
+        if [ -z "$Le_LinkCert" ]; then
+          _err "Sign error, can not find Le_LinkCert"
+          _err "$response"
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        break
+      elif _contains "$response" "\"processing\""; then
+        _info "Order status is processing, lets sleep and retry."
+        _sleep 2
+      else
+        _err "Sign error, wrong status"
+        _err "$response"
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+      if ! _send_signed_request "$Le_LinkOrder"; then
+        _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
+        _err "$response"
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+      _link_cert_retry="$(_math $_link_cert_retry + 1)"
+    done
+
+    if [ -z "$Le_LinkCert" ]; then
+      _err "Sign failed, can not get Le_LinkCert, retry time limit."
+      _err "$response"
+      _on_issue_err "$_post_hook"
+      return 1
+    fi
+    _info "Download cert, Le_LinkCert: $Le_LinkCert"
     if ! _send_signed_request "$Le_LinkCert"; then
       _err "Sign failed, can not download cert:$Le_LinkCert."
       _err "$response"
@@ -4237,7 +4297,7 @@ $_authorizations_map"
       _end_n="$(_math $_end_n + 1)"
       sed -n "${_end_n},9999p" "$CERT_FULLCHAIN_PATH" >"$CA_CERT_PATH"
     fi
-    response="$_tempSignedResponse"
+
   else
     if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
       _err "Sign failed. $response"

From 81f0189d2342069ca74bd942f2d3592c1054232b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 27 Feb 2019 20:40:10 +0800
Subject: [PATCH 06/53] add Pebble

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index f79b8602..f68eb002 100644
--- a/README.md
+++ b/README.md
@@ -74,6 +74,7 @@ https://github.com/Neilpang/acmetest
 
 - Letsencrypt.org CA(default)
 - [BuyPass.com CA](https://github.com/Neilpang/acme.sh/wiki/BuyPass.com-CA)
+- [Pebble strict Mode](https://github.com/letsencrypt/pebble)
 
 # Supported modes
 

From 693d692a472e9298c3bf3ee71ffc7d3328451887 Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Wed, 27 Feb 2019 20:41:50 +0800
Subject: [PATCH 07/53] sync (#2127)

* Support for MyDevil.net (#2076)

support mydevil

* Fix verification for namecheap domains not *owned* by the calling user (#2106)

* Peb (#2126)

* support pebble
* support async finalize order

* add Pebble
---
 README.md               |  2 +
 acme.sh                 | 88 +++++++++++++++++++++++++++++++------
 deploy/README.md        | 10 +++++
 deploy/mydevil.sh       | 59 +++++++++++++++++++++++++
 dnsapi/README.md        | 20 +++++++++
 dnsapi/dns_mydevil.sh   | 97 +++++++++++++++++++++++++++++++++++++++++
 dnsapi/dns_namecheap.sh | 45 +++++++++++++++++++
 7 files changed, 307 insertions(+), 14 deletions(-)
 create mode 100755 deploy/mydevil.sh
 create mode 100755 dnsapi/dns_mydevil.sh

diff --git a/README.md b/README.md
index 8d749dcc..f68eb002 100644
--- a/README.md
+++ b/README.md
@@ -74,6 +74,7 @@ https://github.com/Neilpang/acmetest
 
 - Letsencrypt.org CA(default)
 - [BuyPass.com CA](https://github.com/Neilpang/acme.sh/wiki/BuyPass.com-CA)
+- [Pebble strict Mode](https://github.com/letsencrypt/pebble)
 
 # Supported modes
 
@@ -356,6 +357,7 @@ You don't have to do anything manually!
 1. Futurehosting API (https://www.futurehosting.com)
 1. Rackspace Cloud DNS (https://www.rackspace.com)
 1. Online.net API (https://online.net/)
+1. MyDevil.net (https://www.mydevil.net/)
 
 And:
 
diff --git a/acme.sh b/acme.sh
index 93112a1a..8ee22479 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1827,23 +1827,29 @@ _send_signed_request() {
         nonceurl="$ACME_NEW_NONCE"
         if _post "" "$nonceurl" "" "HEAD" "$__request_conent_type"; then
           _headers="$(cat "$HTTP_HEADER")"
+          _debug2 _headers "$_headers"
+          _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
         fi
       fi
-      if [ -z "$_headers" ]; then
+      if [ -z "$_CACHED_NONCE" ]; then
         _debug2 "Get nonce with GET. ACME_DIRECTORY" "$ACME_DIRECTORY"
         nonceurl="$ACME_DIRECTORY"
         _headers="$(_get "$nonceurl" "onlyheader")"
+        _debug2 _headers "$_headers"
+        _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
       fi
-
+      if [ -z "$_CACHED_NONCE" ] && [ "$ACME_NEW_NONCE" ]; then
+        _debug2 "Get nonce with GET. ACME_NEW_NONCE" "$ACME_NEW_NONCE"
+        nonceurl="$ACME_NEW_NONCE"
+        _headers="$(_get "$nonceurl" "onlyheader")"
+        _debug2 _headers "$_headers"
+        _CACHED_NONCE="$(echo "$_headers" | grep -i "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
+      fi
+      _debug2 _CACHED_NONCE "$_CACHED_NONCE"
       if [ "$?" != "0" ]; then
         _err "Can not connect to $nonceurl to get nonce."
         return 1
       fi
-
-      _debug2 _headers "$_headers"
-
-      _CACHED_NONCE="$(echo "$_headers" | grep "Replay-Nonce:" | _head_n 1 | tr -d "\r\n " | cut -d ':' -f 2)"
-      _debug2 _CACHED_NONCE "$_CACHED_NONCE"
     else
       _debug2 "Use _CACHED_NONCE" "$_CACHED_NONCE"
     fi
@@ -2060,6 +2066,7 @@ _clearcaconf() {
 _startserver() {
   content="$1"
   ncaddr="$2"
+  _debug "content" "$content"
   _debug "ncaddr" "$ncaddr"
 
   _debug "startserver: $$"
@@ -2086,8 +2093,14 @@ _startserver() {
     SOCAT_OPTIONS="$SOCAT_OPTIONS,bind=${ncaddr}"
   fi
 
+  _content_len="$(printf "%s" "$content" | wc -c)"
+  _debug _content_len "$_content_len"
   _debug "_NC" "$_NC $SOCAT_OPTIONS"
-  $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; echo HTTP/1.0 200 OK; echo ; echo  $content; echo;" &
+  $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
+echo 'HTTP/1.0 200 OK'; \
+echo 'Content-Length\: $_content_len'; \
+echo ''; \
+printf '$content';" &
   serverproc="$!"
 }
 
@@ -3062,6 +3075,7 @@ _on_before_issue() {
       _info "Standalone mode."
       if [ -z "$Le_HTTPPort" ]; then
         Le_HTTPPort=80
+        _cleardomainconf "Le_HTTPPort"
       else
         _savedomainconf "Le_HTTPPort" "$Le_HTTPPort"
       fi
@@ -3269,7 +3283,7 @@ _regAccount() {
   fi
 
   _debug2 responseHeaders "$responseHeaders"
-  _accUri="$(echo "$responseHeaders" | grep "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
+  _accUri="$(echo "$responseHeaders" | grep -i "^Location:" | _head_n 1 | cut -d ' ' -f 2 | tr -d "\r\n")"
   _debug "_accUri" "$_accUri"
   if [ -z "$_accUri" ]; then
     _err "Can not find account id url."
@@ -3435,7 +3449,7 @@ __trigger_validation() {
   _t_vtype="$3"
   _debug2 _t_vtype "$_t_vtype"
   if [ "$ACME_VERSION" = "2" ]; then
-    _send_signed_request "$_t_url" "{\"keyAuthorization\": \"$_t_key_authz\"}"
+    _send_signed_request "$_t_url" "{}"
   else
     _send_signed_request "$_t_url" "{\"resource\": \"challenge\", \"type\": \"$_t_vtype\", \"keyAuthorization\": \"$_t_key_authz\"}"
   fi
@@ -4205,20 +4219,66 @@ $_authorizations_map"
   der="$(_getfile "${CSR_PATH}" "${BEGIN_CSR}" "${END_CSR}" | tr -d "\r\n" | _url_replace)"
 
   if [ "$ACME_VERSION" = "2" ]; then
+    _info "Lets finalize the order, Le_OrderFinalize: $Le_OrderFinalize"
     if ! _send_signed_request "${Le_OrderFinalize}" "{\"csr\": \"$der\"}"; then
       _err "Sign failed."
       _on_issue_err "$_post_hook"
       return 1
     fi
     if [ "$code" != "200" ]; then
-      _err "Sign failed, code is not 200."
+      _err "Sign failed, finalize code is not 200."
       _err "$response"
       _on_issue_err "$_post_hook"
       return 1
     fi
-    Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
+    Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+    if [ -z "$Le_LinkOrder" ]; then
+      _err "Sign error, can not get order link location header"
+      _err "responseHeaders" "$responseHeaders"
+      _on_issue_err "$_post_hook"
+      return 1
+    fi
+    _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
 
-    _tempSignedResponse="$response"
+    _link_cert_retry=0
+    _MAX_CERT_RETRY=5
+    while [ -z "$Le_LinkCert" ] && [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
+      if _contains "$response" "\"status\":\"valid\""; then
+        _debug "Order status is valid."
+        Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
+        _debug Le_LinkCert "$Le_LinkCert"
+        if [ -z "$Le_LinkCert" ]; then
+          _err "Sign error, can not find Le_LinkCert"
+          _err "$response"
+          _on_issue_err "$_post_hook"
+          return 1
+        fi
+        break
+      elif _contains "$response" "\"processing\""; then
+        _info "Order status is processing, lets sleep and retry."
+        _sleep 2
+      else
+        _err "Sign error, wrong status"
+        _err "$response"
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+      if ! _send_signed_request "$Le_LinkOrder"; then
+        _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
+        _err "$response"
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+      _link_cert_retry="$(_math $_link_cert_retry + 1)"
+    done
+
+    if [ -z "$Le_LinkCert" ]; then
+      _err "Sign failed, can not get Le_LinkCert, retry time limit."
+      _err "$response"
+      _on_issue_err "$_post_hook"
+      return 1
+    fi
+    _info "Download cert, Le_LinkCert: $Le_LinkCert"
     if ! _send_signed_request "$Le_LinkCert"; then
       _err "Sign failed, can not download cert:$Le_LinkCert."
       _err "$response"
@@ -4237,7 +4297,7 @@ $_authorizations_map"
       _end_n="$(_math $_end_n + 1)"
       sed -n "${_end_n},9999p" "$CERT_FULLCHAIN_PATH" >"$CA_CERT_PATH"
     fi
-    response="$_tempSignedResponse"
+
   else
     if ! _send_signed_request "${ACME_NEW_ORDER}" "{\"resource\": \"$ACME_NEW_ORDER_RES\", \"csr\": \"$der\"}" "needbase64"; then
       _err "Sign failed. $response"
diff --git a/deploy/README.md b/deploy/README.md
index 091e9feb..f290756a 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -381,3 +381,13 @@ you want to update:
 $ export QINIU_CDN_DOMAIN="cdn.example.com"
 $ acme.sh --deploy -d example.com --deploy-hook qiniu
 ```
+
+## 14. Deploy your cert on MyDevil.net
+
+Once you have acme.sh installed and certificate issued (see info in [DNS API](../dnsapi/README.md#61-use-mydevilnet)), you can install it by following command:
+
+```sh
+acme.sh --deploy --deploy-hook mydevil -d example.com
+```
+
+That will remove old certificate and install new one.
diff --git a/deploy/mydevil.sh b/deploy/mydevil.sh
new file mode 100755
index 00000000..bd9868aa
--- /dev/null
+++ b/deploy/mydevil.sh
@@ -0,0 +1,59 @@
+#!/usr/bin/env sh
+
+# MyDevil.net API (2019-02-03)
+#
+# MyDevil.net already supports automatic Let's Encrypt certificates,
+# except for wildcard domains.
+#
+# This script depends on `devil` command that MyDevil.net provides,
+# which means that it works only on server side.
+#
+# Author: Marcin Konicki <https://ahwayakchih.neoni.net>
+#
+########  Public functions #####################
+
+# Usage: mydevil_deploy domain keyfile certfile cafile fullchain
+mydevil_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+  ip=""
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  if ! _exists "devil"; then
+    _err "Could not find 'devil' command."
+    return 1
+  fi
+
+  ip=$(mydevil_get_ip "$_cdomain")
+  if [ -z "$ip" ]; then
+    _err "Could not find IP for domain $_cdomain."
+    return 1
+  fi
+
+  # Delete old certificate first
+  _info "Removing old certificate for $_cdomain at $ip"
+  devil ssl www del "$ip" "$_cdomain"
+
+  # Add new certificate
+  _info "Adding new certificate for $_cdomain at $ip"
+  devil ssl www add "$ip" "$_cfullchain" "$_ckey" "$_cdomain" || return 1
+
+  return 0
+}
+
+####################  Private functions below ##################################
+
+# Usage: ip=$(mydevil_get_ip domain.com)
+#        echo $ip
+mydevil_get_ip() {
+  devil dns list "$1" | cut -w -s -f 3,7 | grep "^A$(printf '\t')" | cut -w -s -f 2 || return 1
+  return 0
+}
diff --git a/dnsapi/README.md b/dnsapi/README.md
index f022cab0..9f176c0d 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1259,6 +1259,26 @@ acme.sh --issue --dns dns_online -d example.com -d www.example.com
 
 `ONLINE_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+## 66. Use MyDevil.net
+
+Make sure that you can execute own binaries:
+
+```sh
+devil binexec on
+```
+
+Install acme.sh, or simply `git clone` it into some directory on your MyDevil host account (in which case you should link to it from your `~/bin` directory).
+
+If you're not using private IP and depend on default IP provided by host, you may want to edit `crontab` too, and make sure that `acme.sh --cron` is run also after reboot (you can find out how to do that on their wiki pages).
+
+To issue a new certificate, run:
+
+```sh
+acme.sh --issue --dns dns_mydevil -d example.com -d *.example.com
+```
+
+After certificate is ready, you can install it with [deploy command](../deploy/README.md#14-deploy-your-cert-on-mydevilnet).
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
diff --git a/dnsapi/dns_mydevil.sh b/dnsapi/dns_mydevil.sh
new file mode 100755
index 00000000..2f398959
--- /dev/null
+++ b/dnsapi/dns_mydevil.sh
@@ -0,0 +1,97 @@
+#!/usr/bin/env sh
+
+# MyDevil.net API (2019-02-03)
+#
+# MyDevil.net already supports automatic Let's Encrypt certificates,
+# except for wildcard domains.
+#
+# This script depends on `devil` command that MyDevil.net provides,
+# which means that it works only on server side.
+#
+# Author: Marcin Konicki <https://ahwayakchih.neoni.net>
+#
+########  Public functions #####################
+
+#Usage: dns_mydevil_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_mydevil_add() {
+  fulldomain=$1
+  txtvalue=$2
+  domain=""
+
+  if ! _exists "devil"; then
+    _err "Could not find 'devil' command."
+    return 1
+  fi
+
+  _info "Using mydevil"
+
+  domain=$(mydevil_get_domain "$fulldomain")
+  if [ -z "$domain" ]; then
+    _err "Invalid domain name: could not find root domain of $fulldomain."
+    return 1
+  fi
+
+  # No need to check if record name exists, `devil` always adds new record.
+  # In worst case scenario, we end up with multiple identical records.
+
+  _info "Adding $fulldomain record for domain $domain"
+  if devil dns add "$domain" "$fulldomain" TXT "$txtvalue"; then
+    _info "Successfully added TXT record, ready for validation."
+    return 0
+  else
+    _err "Unable to add DNS record."
+    return 1
+  fi
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_mydevil_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  domain=""
+
+  if ! _exists "devil"; then
+    _err "Could not find 'devil' command."
+    return 1
+  fi
+
+  _info "Using mydevil"
+
+  domain=$(mydevil_get_domain "$fulldomain")
+  if [ -z "$domain" ]; then
+    _err "Invalid domain name: could not find root domain of $fulldomain."
+    return 1
+  fi
+
+  # catch one or more numbers
+  num='[0-9][0-9]*'
+  # catch one or more whitespace
+  w=$(printf '[\t ][\t ]*')
+  # catch anything, except newline
+  any='.*'
+  # filter to make sure we do not delete other records
+  validRecords="^${num}${w}${fulldomain}${w}TXT${w}${any}${txtvalue}$"
+  for id in $(devil dns list "$domain" | tail -n+2 | grep "${validRecords}" | cut -w -s -f 1); do
+    _info "Removing record $id from domain $domain"
+    devil dns del "$domain" "$id" || _err "Could not remove DNS record."
+  done
+}
+
+####################  Private functions below ##################################
+
+# Usage: domain=$(mydevil_get_domain "_acme-challenge.www.domain.com" || _err "Invalid domain name")
+#        echo $domain
+mydevil_get_domain() {
+  fulldomain=$1
+  domain=""
+
+  for domain in $(devil dns list | cut -w -s -f 1 | tail -n+2); do
+    if _endswith "$fulldomain" "$domain"; then
+      printf -- "%s" "$domain"
+      return 0
+    fi
+  done
+
+  return 1
+}
diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index fbf93c32..6553deb6 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -76,6 +76,22 @@ dns_namecheap_rm() {
 # _sub_domain=_acme-challenge.www
 # _domain=domain.com
 _get_root() {
+  fulldomain=$1
+
+  if ! _get_root_by_getList "$fulldomain"; then
+    _debug "Failed domain lookup via domains.getList api call. Trying domain lookup via domains.dns.getHosts api."
+    # The above "getList" api will only return hosts *owned* by the calling user. However, if the calling
+    # user is not the owner, but still has administrative rights, we must query the getHosts api directly.
+    # See this comment and the official namecheap response: http://disq.us/p/1q6v9x9
+    if ! _get_root_by_getHosts "$fulldomain"; then
+      return 1
+    fi
+  fi
+
+  return 0
+}
+
+_get_root_by_getList() {
   domain=$1
 
   if ! _namecheap_post "namecheap.domains.getList"; then
@@ -94,6 +110,10 @@ _get_root() {
       #not valid
       return 1
     fi
+    if ! _contains "$h" "\\."; then
+      #not valid
+      return 1
+    fi
 
     if ! _contains "$response" "$h"; then
       _debug "$h not found"
@@ -108,6 +128,31 @@ _get_root() {
   return 1
 }
 
+_get_root_by_getHosts() {
+  i=100
+  p=99
+
+  while [ $p -ne 0 ]; do
+
+    h=$(printf "%s" "$1" | cut -d . -f $i-100)
+    if [ -n "$h" ]; then
+      if _contains "$h" "\\."; then
+        _debug h "$h"
+        if _namecheap_set_tld_sld "$h"; then
+          _sub_domain=$(printf "%s" "$1" | cut -d . -f 1-$p)
+          _domain="$h"
+          return 0
+        else
+          _debug "$h not found"
+        fi
+      fi
+    fi
+    i="$p"
+    p=$(_math "$p" - 1)
+  done
+  return 1
+}
+
 _namecheap_set_publicip() {
 
   if [ -z "$NAMECHEAP_SOURCEIP" ]; then

From af5f7a77796ff03e82bf554675816962d523fe28 Mon Sep 17 00:00:00 2001
From: tianji <tj@hhttech.com>
Date: Thu, 28 Feb 2019 23:43:58 +0800
Subject: [PATCH 08/53] fix deploy/qiniu.sh base64

According to the doc (https://developer.qiniu.com/kodo/manual/1231/appendix#1), we should use URL-safe base64 instead of plain base64 for token calculation.
---
 deploy/qiniu.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/qiniu.sh b/deploy/qiniu.sh
index 158b8dbf..e46e6fb3 100644
--- a/deploy/qiniu.sh
+++ b/deploy/qiniu.sh
@@ -87,6 +87,6 @@ qiniu_deploy() {
 }
 
 _make_access_token() {
-  _token="$(printf "%s\n" "$1" | _hmac "sha1" "$(printf "%s" "$QINIU_SK" | _hex_dump | tr -d " ")" | _base64)"
+  _token="$(printf "%s\n" "$1" | _hmac "sha1" "$(printf "%s" "$QINIU_SK" | _hex_dump | tr -d " ")" | _base64 | tr -- '+/' '-_')"
   echo "$QINIU_AK:$_token"
 }

From 22e7b4c91184201225a8dbe52d5cb20efb90e860 Mon Sep 17 00:00:00 2001
From: tianji <tj@hhttech.com>
Date: Thu, 28 Feb 2019 23:51:43 +0800
Subject: [PATCH 09/53] fix doc of qiniu deploy script

A leading dot should be included when updating wildcard domains.
---
 deploy/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index f290756a..44d53225 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -349,10 +349,10 @@ $ export QINIU_SK="bar"
 $ acme.sh --deploy -d example.com --deploy-hook qiniu
 ```
 
-假如您部署的证书为泛域名证书，您还需要设置 `QINIU_CDN_DOMAIN` 变量，指定实际需要部署的域名：
+假如您部署的证书为泛域名证书，您还需要设置 `QINIU_CDN_DOMAIN` 变量，指定实际需要部署的域名(请注意泛域名前的点)：
 
 ```sh
-$ export QINIU_CDN_DOMAIN="cdn.example.com"
+$ export QINIU_CDN_DOMAIN=".cdn.example.com"
 $ acme.sh --deploy -d example.com --deploy-hook qiniu
 ```
 
@@ -375,10 +375,10 @@ $ acme.sh --deploy -d example.com --deploy-hook qiniu
 
 (Optional), If you are using wildcard certificate,
 you may need export `QINIU_CDN_DOMAIN` to specify which domain
-you want to update:
+you want to update (please note the leading dot):
 
 ```sh
-$ export QINIU_CDN_DOMAIN="cdn.example.com"
+$ export QINIU_CDN_DOMAIN=".cdn.example.com"
 $ acme.sh --deploy -d example.com --deploy-hook qiniu
 ```
 

From b3f6129718bf0e7b7f352344b7149c725cf1576b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 2 Mar 2019 20:44:08 +0800
Subject: [PATCH 10/53] fix https://github.com/Neilpang/acme.sh/issues/2122

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 8ee22479..005b1333 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4886,7 +4886,7 @@ _installcert() {
       export CERT_KEY_PATH
       export CA_CERT_PATH
       export CERT_FULLCHAIN_PATH
-      export Le_Domain
+      export Le_Domain="$_main_domain"
       cd "$DOMAIN_PATH" && eval "$_reload_cmd"
     ); then
       _info "$(__green "Reload success")"

From 7690f73e815a0b3af86fdf2901cc27519a1b0b33 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 5 Mar 2019 21:05:10 +0800
Subject: [PATCH 11/53] base64 encode reloadcmd. fix
 https://github.com/Neilpang/acme.sh/issues/2134

---
 acme.sh | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/acme.sh b/acme.sh
index 005b1333..6c42d7ee 100755
--- a/acme.sh
+++ b/acme.sh
@@ -66,6 +66,9 @@ END_CERT="-----END CERTIFICATE-----"
 CONTENT_TYPE_JSON="application/jose+json"
 RENEW_SKIP=2
 
+B64CONF_START="__ACME_BASE64__START_"
+B64CONF_END="__ACME_BASE64__END_"
+
 ECC_SEP="_"
 ECC_SUFFIX="${ECC_SEP}ecc"
 
@@ -1964,12 +1967,16 @@ _setopt() {
   _debug3 "$(grep -n "^$__opt$__sep" "$__conf")"
 }
 
-#_save_conf  file key  value
+#_save_conf  file key  value base64encode
 #save to conf
 _save_conf() {
   _s_c_f="$1"
   _sdkey="$2"
   _sdvalue="$3"
+  _b64encode="$4"
+  if [ "$_b64encode" ]; then
+    _sdvalue="${B64CONF_START}$(printf "%s" "${_sdvalue}" | _base64)${B64CONF_END}"
+  fi
   if [ "$_s_c_f" ]; then
     _setopt "$_s_c_f" "$_sdkey" "=" "'$_sdvalue'"
   else
@@ -1994,19 +2001,20 @@ _read_conf() {
   _r_c_f="$1"
   _sdkey="$2"
   if [ -f "$_r_c_f" ]; then
-    (
-      eval "$(grep "^$_sdkey *=" "$_r_c_f")"
-      eval "printf \"%s\" \"\$$_sdkey\""
-    )
+    _sdv="$(grep "^$_sdkey *=" "$_r_c_f" | cut  -d = -f 2-1000 | tr -d "'")"
+    if _startswith "$_sdv" "${B64CONF_START}" && _endswith "$_sdv" "${B64CONF_END}"; then
+      _sdv="$(echo "$_sdv" | sed "s/${B64CONF_START}//" | sed "s/${B64CONF_END}//" | _dbase64)"
+    fi
+    printf "%s" "$_sdv"
   else
     _debug "config file is empty, can not read $_sdkey"
   fi
 }
 
-#_savedomainconf   key  value
+#_savedomainconf   key  value  base64encode
 #save to domain.conf
 _savedomainconf() {
-  _save_conf "$DOMAIN_CONF" "$1" "$2"
+  _save_conf "$DOMAIN_CONF" "$@"
 }
 
 #_cleardomainconf   key
@@ -2019,14 +2027,14 @@ _readdomainconf() {
   _read_conf "$DOMAIN_CONF" "$1"
 }
 
-#_saveaccountconf  key  value
+#_saveaccountconf  key  value  base64encode
 _saveaccountconf() {
-  _save_conf "$ACCOUNT_CONF_PATH" "$1" "$2"
+  _save_conf "$ACCOUNT_CONF_PATH" "$@"
 }
 
-#key  value
+#key  value base64encode
 _saveaccountconf_mutable() {
-  _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2"
+  _save_conf "$ACCOUNT_CONF_PATH" "SAVED_$1" "$2" "$3"
   #remove later
   _clearaccountconf "$1"
 }
@@ -4455,7 +4463,7 @@ $_authorizations_map"
     _savedomainconf "Le_RealCertPath" "$_real_cert"
     _savedomainconf "Le_RealCACertPath" "$_real_ca"
     _savedomainconf "Le_RealKeyPath" "$_real_key"
-    _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
+    _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
     _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
     if ! _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"; then
       return 1
@@ -4522,6 +4530,7 @@ renew() {
   fi
 
   IS_RENEW="1"
+  Le_ReloadCmd="$(_readdomainconf Le_ReloadCmd)"
   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias"
   res="$?"
   if [ "$res" != "0" ]; then
@@ -4802,7 +4811,7 @@ installcert() {
   _savedomainconf "Le_RealCertPath" "$_real_cert"
   _savedomainconf "Le_RealCACertPath" "$_real_ca"
   _savedomainconf "Le_RealKeyPath" "$_real_key"
-  _savedomainconf "Le_ReloadCmd" "$_reload_cmd"
+  _savedomainconf "Le_ReloadCmd" "$_reload_cmd" "base64"
   _savedomainconf "Le_RealFullChainPath" "$_real_fullchain"
 
   _installcert "$_main_domain" "$_real_cert" "$_real_key" "$_real_ca" "$_real_fullchain" "$_reload_cmd"

From dfca8c09e046ee157516b6f05dadf4d5240ba2fa Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 5 Mar 2019 21:22:03 +0800
Subject: [PATCH 12/53] fix format

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 6c42d7ee..c63f2945 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2001,7 +2001,7 @@ _read_conf() {
   _r_c_f="$1"
   _sdkey="$2"
   if [ -f "$_r_c_f" ]; then
-    _sdv="$(grep "^$_sdkey *=" "$_r_c_f" | cut  -d = -f 2-1000 | tr -d "'")"
+    _sdv="$(grep "^$_sdkey *=" "$_r_c_f" | cut -d = -f 2-1000 | tr -d "'")"
     if _startswith "$_sdv" "${B64CONF_START}" && _endswith "$_sdv" "${B64CONF_END}"; then
       _sdv="$(echo "$_sdv" | sed "s/${B64CONF_START}//" | sed "s/${B64CONF_END}//" | _dbase64)"
     fi

From c7257bcf464d09096b9543e42fef12094fcdf18b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 5 Mar 2019 21:44:34 +0800
Subject: [PATCH 13/53] base64 hooks, fix
 https://github.com/Neilpang/acme.sh/issues/1969

---
 acme.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index c63f2945..408f09cd 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3650,9 +3650,9 @@ issue() {
   _savedomainconf "Le_Alt" "$_alt_domains"
   _savedomainconf "Le_Webroot" "$_web_roots"
 
-  _savedomainconf "Le_PreHook" "$_pre_hook"
-  _savedomainconf "Le_PostHook" "$_post_hook"
-  _savedomainconf "Le_RenewHook" "$_renew_hook"
+  _savedomainconf "Le_PreHook" "$_pre_hook" "base64"
+  _savedomainconf "Le_PostHook" "$_post_hook" "base64"
+  _savedomainconf "Le_RenewHook" "$_renew_hook" "base64"
 
   if [ "$_local_addr" ]; then
     _savedomainconf "Le_LocalAddress" "$_local_addr"
@@ -4531,6 +4531,9 @@ renew() {
 
   IS_RENEW="1"
   Le_ReloadCmd="$(_readdomainconf Le_ReloadCmd)"
+  Le_PreHook="$(_readdomainconf Le_PreHook)"
+  Le_PostHook="$(_readdomainconf Le_PostHook)"
+  Le_RenewHook="$(_readdomainconf Le_RenewHook)"
   issue "$Le_Webroot" "$Le_Domain" "$Le_Alt" "$Le_Keylength" "$Le_RealCertPath" "$Le_RealKeyPath" "$Le_RealCACertPath" "$Le_ReloadCmd" "$Le_RealFullChainPath" "$Le_PreHook" "$Le_PostHook" "$Le_RenewHook" "$Le_LocalAddress" "$Le_ChallengeAlias"
   res="$?"
   if [ "$res" != "0" ]; then

From a3d8b9935ab7eb6656d63f95c69ae0423c747cfa Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Fri, 8 Mar 2019 14:31:11 +0800
Subject: [PATCH 14/53] fix https://github.com/Neilpang/acme.sh/issues/2141

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 408f09cd..d81812fe 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4250,7 +4250,7 @@ $_authorizations_map"
 
     _link_cert_retry=0
     _MAX_CERT_RETRY=5
-    while [ -z "$Le_LinkCert" ] && [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
+    while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
       if _contains "$response" "\"status\":\"valid\""; then
         _debug "Order status is valid."
         Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"

From 110a41d18def8f8305952600c07240e72aba7a67 Mon Sep 17 00:00:00 2001
From: 5ll <5ll@users.noreply.github.com>
Date: Fri, 8 Mar 2019 10:33:09 +0100
Subject: [PATCH 15/53] initial commit

DNS API for acme.sh for Core-Networks (https://beta.api.core-networks.de/doc/)
---
 dnsapi/dns_cn.sh | 158 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)
 create mode 100644 dnsapi/dns_cn.sh

diff --git a/dnsapi/dns_cn.sh b/dnsapi/dns_cn.sh
new file mode 100644
index 00000000..b35f81cb
--- /dev/null
+++ b/dnsapi/dns_cn.sh
@@ -0,0 +1,158 @@
+#!/usr/bin/env sh
+
+# DNS API for acme.sh for Core-Networks (https://beta.api.core-networks.de/doc/).
+# created by 5ll and francis
+
+CN_API="https://beta.api.core-networks.de"
+
+########  Public functions  #####################
+
+dns_cn_add(){
+  fulldomain=$1
+  txtvalue=$2
+
+  if ! _cn_login; then
+    _err "login failed"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _cn_get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  
+  _debug "_sub_domain $_sub_domain"
+  _debug "_domain $_domain"
+  
+  _info "Adding record"
+  curData="{\"name\":\"$_sub_domain\",\"ttl\":120,\"type\":\"TXT\",\"data\":\"$txtvalue\"}"
+  curResult="$(_post "${curData}" "${CN_API}/dnszones/${_domain}/records/")"
+
+  _debug "curData $curData"
+  _debug "curResult $curResult"
+  
+  if _contains "$curResult" ""; then
+    _info "Added, OK"
+
+    if ! _cn_commit; then
+      _err "commiting changes failed"
+      return 1
+    fi
+    return 0
+  
+  else
+    _err "Add txt record error."
+    _debug "curData is $curData"
+    _debug "curResult is $curResult"
+    _err "error adding text record, response was $curResult"
+    return 1
+  fi
+}
+
+dns_cn_rm(){
+  fulldomain=$1
+  txtvalue=$2
+
+  if ! _cn_login; then
+    _err "login failed"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _cn_get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  
+  _info "Deleting record"
+  curData="{\"name\":\"$_sub_domain\",\"data\":\"$txtvalue\"}"
+  curResult="$(_post "${curData}" "${CN_API}/dnszones/${_domain}/records/delete")"
+  _debug curData is "$curData"
+  
+  _info "commiting changes"
+    if ! _cn_commit; then
+    _err "commiting changes failed"
+    return 1
+  fi
+
+  _info "Deletet txt record"
+  return 0
+}
+
+
+###################  Private functions below  ##################################
+_cn_login() {
+  CN_User="${CN_User:-$(_readaccountconf_mutable CN_User)}"
+  CN_Password="${CN_Password:-$(_readaccountconf_mutable CN_Password)}"
+  if [ -z "$CN_User" ] || [ -z "$CN_Password" ]; then
+    CN_User=""
+    CN_Password=""
+    _err "You must export variables: CN_User and CN_Password"
+    return 1
+  fi
+
+  #save the config variables to the account conf file.
+  _saveaccountconf_mutable CN_User "$CN_User"
+  _saveaccountconf_mutable CN_Password "$CN_Password"
+
+  _info "Getting an AUTH-Token"
+  curData="{\"login\":\"${CN_User}\",\"password\":\"${CN_Password}\"}"
+  curResult="$(_post "${curData}" "${CN_API}/auth/token")"
+  _debug "Calling _CN_login: '${curData}' '${CN_API}/auth/token'"
+  
+  if _contains "${curResult}" '"token":"'; then
+    authToken=$(echo "${curResult}" | cut -d ":" -f2 | cut -d "," -f1 | sed 's/^.\(.*\).$/\1/')
+    export _H1="Authorization: Bearer $authToken"
+    _info "Successfully acquired AUTH-Token"
+    _debug "AUTH-Token: '${authToken}'"
+    _debug "_H1 '${_H1}'"
+  else
+    _err "Couldn't acquire an AUTH-Token"
+    return 1
+  fi
+}
+
+# Commit changes
+_cn_commit(){
+  _info "Commiting changes"
+  _post "" "${CN_API}/dnszones/$h/records/commit"
+}
+
+_cn_get_root(){
+  domain=$1
+  i=2
+  p=1
+  while true; do
+
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    _debug _H1 "${_H1}"
+
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+    
+    _cn_zonelist="$(_get ${CN_API}/dnszones/)"
+    _debug _cn_zonelist "${_cn_zonelist}"
+
+    if [ "$?" != "0" ]; then
+      _err "something went wrong while getting the zone list"
+      return 1
+    fi
+
+    if _contains "$_cn_zonelist" "\"name\":\"$h\"" >/dev/null; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    else
+      _debug "Zonelist does not contain domain - iterating "
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+
+  done
+  _err "Zonelist does not contain domain - exiting"
+  return 1
+}

From 1d5967d143ddedddb8831be9e09583c406fd7c16 Mon Sep 17 00:00:00 2001
From: 5ll <5ll@users.noreply.github.com>
Date: Fri, 8 Mar 2019 10:45:36 +0100
Subject: [PATCH 16/53] Updated README with Core-Networks support

---
 dnsapi/README.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 9f176c0d..23620c4a 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1300,3 +1300,22 @@ See:  https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 # Use lexicon DNS API
 
 https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
+
+
+## Use Core-Networks API to automatically issue cert
+
+First you need to login to your Core-Networks account to to set up an API-User.
+Then export username and password to use these credentials.
+
+```
+export CN_User="user"
+export CN_Password="passowrd"
+```
+
+Ok, let's issue a cert now:
+```
+acme.sh --issue --dns dns_cn -d example.com -d www.example.com
+```
+
+The `CN_User` and `CN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+

From 3d5c75420a517eb199dcd4fb572856e77f1cc549 Mon Sep 17 00:00:00 2001
From: 5ll <5ll@users.noreply.github.com>
Date: Fri, 8 Mar 2019 10:46:35 +0100
Subject: [PATCH 17/53] Changed Order

---
 dnsapi/README.md | 37 ++++++++++++++++++++-----------------
 1 file changed, 20 insertions(+), 17 deletions(-)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 23620c4a..33d724c7 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1279,6 +1279,26 @@ acme.sh --issue --dns dns_mydevil -d example.com -d *.example.com
 
 After certificate is ready, you can install it with [deploy command](../deploy/README.md#14-deploy-your-cert-on-mydevilnet).
 
+## 67. Use Core-Networks API to automatically issue cert
+
+First you need to login to your Core-Networks account to to set up an API-User.
+Then export username and password to use these credentials.
+
+```
+export CN_User="user"
+export CN_Password="passowrd"
+```
+
+Ok, let's issue a cert now:
+```
+acme.sh --issue --dns dns_cn -d example.com -d www.example.com
+```
+
+The `CN_User` and `CN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+
+
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
@@ -1302,20 +1322,3 @@ See:  https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
 
 
-## Use Core-Networks API to automatically issue cert
-
-First you need to login to your Core-Networks account to to set up an API-User.
-Then export username and password to use these credentials.
-
-```
-export CN_User="user"
-export CN_Password="passowrd"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_cn -d example.com -d www.example.com
-```
-
-The `CN_User` and `CN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-

From 30d0ac0784311d0f55c1737bb035242f58349c0e Mon Sep 17 00:00:00 2001
From: 5ll <5ll@users.noreply.github.com>
Date: Fri, 8 Mar 2019 10:48:06 +0100
Subject: [PATCH 18/53] Updated README with Core-Networks support

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index f68eb002..d0d526d0 100644
--- a/README.md
+++ b/README.md
@@ -358,7 +358,7 @@ You don't have to do anything manually!
 1. Rackspace Cloud DNS (https://www.rackspace.com)
 1. Online.net API (https://online.net/)
 1. MyDevil.net (https://www.mydevil.net/)
-
+1. Core-Networks.de (https://core-networks.de)
 And:
 
 **lexicon DNS API: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api

From f5850d0c08bb72c1453043482ac5dd365df1e66b Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Fri, 8 Mar 2019 22:20:56 +0800
Subject: [PATCH 19/53] fix format

---
 dnsapi/dns_cn.sh | 23 +++++++++++------------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_cn.sh b/dnsapi/dns_cn.sh
index b35f81cb..e90d7e60 100644
--- a/dnsapi/dns_cn.sh
+++ b/dnsapi/dns_cn.sh
@@ -7,7 +7,7 @@ CN_API="https://beta.api.core-networks.de"
 
 ########  Public functions  #####################
 
-dns_cn_add(){
+dns_cn_add() {
   fulldomain=$1
   txtvalue=$2
 
@@ -21,17 +21,17 @@ dns_cn_add(){
     _err "invalid domain"
     return 1
   fi
-  
+
   _debug "_sub_domain $_sub_domain"
   _debug "_domain $_domain"
-  
+
   _info "Adding record"
   curData="{\"name\":\"$_sub_domain\",\"ttl\":120,\"type\":\"TXT\",\"data\":\"$txtvalue\"}"
   curResult="$(_post "${curData}" "${CN_API}/dnszones/${_domain}/records/")"
 
   _debug "curData $curData"
   _debug "curResult $curResult"
-  
+
   if _contains "$curResult" ""; then
     _info "Added, OK"
 
@@ -40,7 +40,7 @@ dns_cn_add(){
       return 1
     fi
     return 0
-  
+
   else
     _err "Add txt record error."
     _debug "curData is $curData"
@@ -50,7 +50,7 @@ dns_cn_add(){
   fi
 }
 
-dns_cn_rm(){
+dns_cn_rm() {
   fulldomain=$1
   txtvalue=$2
 
@@ -64,14 +64,14 @@ dns_cn_rm(){
     _err "invalid domain"
     return 1
   fi
-  
+
   _info "Deleting record"
   curData="{\"name\":\"$_sub_domain\",\"data\":\"$txtvalue\"}"
   curResult="$(_post "${curData}" "${CN_API}/dnszones/${_domain}/records/delete")"
   _debug curData is "$curData"
   
   _info "commiting changes"
-    if ! _cn_commit; then
+  if ! _cn_commit; then
     _err "commiting changes failed"
     return 1
   fi
@@ -80,7 +80,6 @@ dns_cn_rm(){
   return 0
 }
 
-
 ###################  Private functions below  ##################################
 _cn_login() {
   CN_User="${CN_User:-$(_readaccountconf_mutable CN_User)}"
@@ -100,7 +99,7 @@ _cn_login() {
   curData="{\"login\":\"${CN_User}\",\"password\":\"${CN_Password}\"}"
   curResult="$(_post "${curData}" "${CN_API}/auth/token")"
   _debug "Calling _CN_login: '${curData}' '${CN_API}/auth/token'"
-  
+
   if _contains "${curResult}" '"token":"'; then
     authToken=$(echo "${curResult}" | cut -d ":" -f2 | cut -d "," -f1 | sed 's/^.\(.*\).$/\1/')
     export _H1="Authorization: Bearer $authToken"
@@ -114,12 +113,12 @@ _cn_login() {
 }
 
 # Commit changes
-_cn_commit(){
+_cn_commit() {
   _info "Commiting changes"
   _post "" "${CN_API}/dnszones/$h/records/commit"
 }
 
-_cn_get_root(){
+_cn_get_root() {
   domain=$1
   i=2
   p=1

From 04eaf7f1751149ae0af7c29728996004cf6e1de2 Mon Sep 17 00:00:00 2001
From: Sylvia van Os <sylvia@hackerchick.me>
Date: Fri, 22 Feb 2019 15:10:39 +0100
Subject: [PATCH 20/53] Add OpenProvider support

---
 README.md                  |   1 +
 dnsapi/README.md           |  17 +++
 dnsapi/dns_openprovider.sh | 244 +++++++++++++++++++++++++++++++++++++
 3 files changed, 262 insertions(+)
 create mode 100755 dnsapi/dns_openprovider.sh

diff --git a/README.md b/README.md
index f79b8602..e7ad4cfb 100644
--- a/README.md
+++ b/README.md
@@ -357,6 +357,7 @@ You don't have to do anything manually!
 1. Rackspace Cloud DNS (https://www.rackspace.com)
 1. Online.net API (https://online.net/)
 1. MyDevil.net (https://www.mydevil.net/)
+1. OpenProvider API (https://www.openprovider.com/)
 
 And:
 
diff --git a/dnsapi/README.md b/dnsapi/README.md
index 9f176c0d..3cbfe19a 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1279,6 +1279,23 @@ acme.sh --issue --dns dns_mydevil -d example.com -d *.example.com
 
 After certificate is ready, you can install it with [deploy command](../deploy/README.md#14-deploy-your-cert-on-mydevilnet).
 
+## 67. Use OpenProvider API
+
+First, you need to enable API access and retrieve your password hash on https://rcp.openprovider.eu/account/dashboard.php
+
+```
+export OPENPROVIDER_USER='username'
+export OPENPROVIDER_PASSWORDHASH='xxx'
+```
+
+To issue a cert run:
+
+```
+acme.sh --issue --dns dns_openprovider -d example.com -d www.example.com
+```
+
+`OPENPROVIDER_USER` and `OPENPROVIDER_PASSWORDHASH` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
diff --git a/dnsapi/dns_openprovider.sh b/dnsapi/dns_openprovider.sh
new file mode 100755
index 00000000..3d66dfe4
--- /dev/null
+++ b/dnsapi/dns_openprovider.sh
@@ -0,0 +1,244 @@
+#!/usr/bin/env sh
+
+# This is the OpenProvider API wrapper for acme.sh
+#
+# Author: Sylvia van Os
+# Report Bugs here: https://github.com/Neilpang/acme.sh/issues/2104
+#
+#     export OPENPROVIDER_USER="username"
+#     export OPENPROVIDER_PASSWORDHASH="hashed_password"
+#
+# Usage:
+#     acme.sh --issue --dns dns_openprovider -d example.com
+
+OPENPROVIDER_API="https://api.openprovider.eu/"
+#OPENPROVIDER_API="https://api.cte.openprovider.eu/" # Test API
+
+########  Public functions #####################
+
+#Usage: dns_openprovider_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_openprovider_add() {
+  fulldomain="$1"
+  txtvalue="$2"
+
+  OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
+  OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
+
+  if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
+    _err "You didn't specify the openprovider user and/or password hash."
+    return 1
+  fi
+
+  # save the username and password to the account conf file.
+  _saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
+  _saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _domain_name "$_domain_name"
+  _debug _domain_extension "$_domain_extension"
+
+  _debug "Getting current records"
+  existing_items=""
+  results_retrieved=0
+  while true; do
+    _openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
+
+    items="$response"
+    while true; do
+      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<item>.*<\/item>).*/\1/p')"
+      _debug existing_items "$existing_items"
+      _debug results_retrieved "$results_retrieved"
+      _debug item "$item"
+
+      if [ -z "$item" ]; then
+        break
+      fi
+
+      items="$(printf '%s' "$items" | sed "s
$item

")"
+
+      results_retrieved=$((results_retrieved + 1))
+      new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)\.$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+      if [ -z "$new_item" ]; then
+        # Base record
+        new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+      fi
+
+      if [ -z "$(printf '%s' "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
+        _debug "not an allowed record type, skipping" "$new_item"
+        continue
+      fi
+
+      existing_items="$(printf '%s%s' "$existing_items" "$new_item")"
+    done
+
+    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+
+    _debug total "$total"
+    if [ "$results_retrieved" -eq "$total" ]; then
+      break
+    fi
+  done
+
+  _debug "Creating acme record"
+  acme_record="$(printf '%s' "$fulldomain" | sed -e "s/.$_domain_name.$_domain_extension$//")"
+  _openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s<item><name>%s</name><type>TXT</type><value>%s</value><ttl>86400</ttl></item></array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items" "$acme_record" "$txtvalue")"
+
+  return 0
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_openprovider_rm() {
+  fulldomain="$1"
+  txtvalue="$2"
+
+  OPENPROVIDER_USER="${OPENPROVIDER_USER:-$(_readaccountconf_mutable OPENPROVIDER_USER)}"
+  OPENPROVIDER_PASSWORDHASH="${OPENPROVIDER_PASSWORDHASH:-$(_readaccountconf_mutable OPENPROVIDER_PASSWORDHASH)}"
+
+  if [ -z "$OPENPROVIDER_USER" ] || [ -z "$OPENPROVIDER_PASSWORDHASH" ]; then
+    _err "You didn't specify the openprovider user and/or password hash."
+    return 1
+  fi
+
+  # save the username and password to the account conf file.
+  _saveaccountconf_mutable OPENPROVIDER_USER "$OPENPROVIDER_USER"
+  _saveaccountconf_mutable OPENPROVIDER_PASSWORDHASH "$OPENPROVIDER_PASSWORDHASH"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _domain_name "$_domain_name"
+  _debug _domain_extension "$_domain_extension"
+
+  _debug "Getting current records"
+  existing_items=""
+  results_retrieved=0
+  while true; do
+    _openprovider_request "$(printf '<searchZoneRecordDnsRequest><name>%s.%s</name><offset>%s</offset></searchZoneRecordDnsRequest>' "$_domain_name" "$_domain_extension" "$results_retrieved")"
+
+    # Remove acme records from items
+    items="$response"
+    while true; do
+      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<item>.*<\/item>).*/\1/p')"
+      _debug existing_items "$existing_items"
+      _debug results_retrieved "$results_retrieved"
+      _debug item "$item"
+
+      if [ -z "$item" ]; then
+        break
+      fi
+
+      items="$(printf '%s' "$items" | sed "s
$item

")"
+
+      results_retrieved=$((results_retrieved + 1))
+      if ! printf '%s' "$item" | grep -v "$fulldomain"; then
+        _debug "acme record, skipping" "$item"
+        continue
+      fi
+
+      new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)\.$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+
+      if [ -z "$new_item" ]; then
+        # Base record
+        new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+      fi
+
+      if [ -z "$(printf '%s' "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
+        _debug "not an allowed record type, skipping" "$new_item"
+        continue
+      fi
+
+      existing_items="$(printf '%s%s' "$existing_items" "$new_item")"
+    done
+
+    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+
+    _debug total "$total"
+
+    if [ "$results_retrieved" -eq "$total" ]; then
+      break
+    fi
+  done
+
+  _debug "Removing acme record"
+  _openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s</array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items")"
+
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _domain_name=domain
+# _domain_extension=com
+_get_root() {
+  domain=$1
+  i=2
+
+  results_retrieved=0
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    _openprovider_request "$(printf '<searchDomainRequest><domainNamePattern>%s</domainNamePattern><offset>%s</offset></searchDomainRequest>' "$(printf "%s" "$h" | cut -d . -f 1)" "$results_retrieved")"
+
+    items="$response"
+    while true; do
+      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<domain>.*<\/domain>).*/\1/p')"
+      _debug existing_items "$existing_items"
+      _debug results_retrieved "$results_retrieved"
+      _debug item "$item"
+
+      if [ -z "$item" ]; then
+        break
+      fi
+
+      items="$(printf '%s' "$items" | sed "s
$item

")"
+
+      results_retrieved=$((results_retrieved + 1))
+
+      _domain_name="$(printf "%s" "$item" | sed -n -E 's/.*<domain>.*<name>(.*)<\/name>.*<\/domain>.*/\1/p')"
+      _domain_extension="$(printf "%s" "$item" | sed -n -E 's/.*<domain>.*<extension>(.*)<\/extension>.*<\/domain>.*/\1/p')"
+      _debug _domain_name "$_domain_name"
+      _debug _domain_extension "$_domain_extension"
+      if [ "$(printf "%s.%s" "$_domain_name" "$_domain_extension")" = "$h" ]; then
+        return 0
+      fi
+    done
+
+    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+
+    _debug total "$total"
+
+    if [ "$results_retrieved" -eq "$total" ]; then
+      results_retrieved=0
+      i=$(_math "$i" + 1)
+    fi
+  done
+  return 1
+}
+
+_openprovider_request() {
+  request_xml=$1
+
+  xml_prefix=$(printf '<?xml version="1.0" encoding="UTF-8"?>')
+  xml_content=$(printf '<openXML><credentials><username>%s</username><hash>%s</hash></credentials>%s</openXML>' "$OPENPROVIDER_USER" "$OPENPROVIDER_PASSWORDHASH" "$request_xml")
+  response="$(_post "$(printf "%s%s" "$xml_prefix" "$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
+  _debug response "$response"
+  if ! _contains "$response" "<openXML><reply><code>0</code>.*</reply></openXML>"; then
+    _err "API request failed."
+    return 1
+  fi
+}

From 725addafda8c3ffbad2b0feb2ff03b4ff518abb9 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 9 Mar 2019 09:13:49 +0800
Subject: [PATCH 21/53] fix format

---
 dnsapi/dns_cn.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_cn.sh b/dnsapi/dns_cn.sh
index e90d7e60..38d1f4aa 100644
--- a/dnsapi/dns_cn.sh
+++ b/dnsapi/dns_cn.sh
@@ -69,7 +69,7 @@ dns_cn_rm() {
   curData="{\"name\":\"$_sub_domain\",\"data\":\"$txtvalue\"}"
   curResult="$(_post "${curData}" "${CN_API}/dnszones/${_domain}/records/delete")"
   _debug curData is "$curData"
-  
+
   _info "commiting changes"
   if ! _cn_commit; then
     _err "commiting changes failed"
@@ -132,7 +132,7 @@ _cn_get_root() {
       #not valid
       return 1
     fi
-    
+
     _cn_zonelist="$(_get ${CN_API}/dnszones/)"
     _debug _cn_zonelist "${_cn_zonelist}"
 

From 53c018824862934939ac91c8e06c558c15d469a4 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Mon, 11 Mar 2019 21:30:24 +0800
Subject: [PATCH 22/53] fix https://github.com/Neilpang/acme.sh/issues/2150

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index d81812fe..a31cf085 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1974,7 +1974,7 @@ _save_conf() {
   _sdkey="$2"
   _sdvalue="$3"
   _b64encode="$4"
-  if [ "$_b64encode" ]; then
+  if [ "$_sdvalue" ] && [ "$_b64encode" ]; then
     _sdvalue="${B64CONF_START}$(printf "%s" "${_sdvalue}" | _base64)${B64CONF_END}"
   fi
   if [ "$_s_c_f" ]; then

From f2add8de94e0ad9646f86dba3ea8666c9e39b348 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Tue, 12 Mar 2019 21:16:15 +0800
Subject: [PATCH 23/53] use acme v2 as default

---
 acme.sh | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/acme.sh b/acme.sh
index a31cf085..b3ccf9ee 100755
--- a/acme.sh
+++ b/acme.sh
@@ -19,8 +19,8 @@ LETSENCRYPT_STAGING_CA_V1="https://acme-staging.api.letsencrypt.org/directory"
 LETSENCRYPT_CA_V2="https://acme-v02.api.letsencrypt.org/directory"
 LETSENCRYPT_STAGING_CA_V2="https://acme-staging-v02.api.letsencrypt.org/directory"
 
-DEFAULT_CA=$LETSENCRYPT_CA_V1
-DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V1
+DEFAULT_CA=$LETSENCRYPT_CA_V2
+DEFAULT_STAGING_CA=$LETSENCRYPT_STAGING_CA_V2
 
 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
 DEFAULT_ACCOUNT_EMAIL=""
@@ -3665,8 +3665,12 @@ issue() {
     _cleardomainconf "Le_ChallengeAlias"
   fi
 
-  Le_API="$ACME_DIRECTORY"
-  _savedomainconf "Le_API" "$Le_API"
+  if [ "$ACME_DIRECTORY" != "$DEFAULT_CA" ]; then
+    Le_API="$ACME_DIRECTORY"
+    _savedomainconf "Le_API" "$Le_API"
+  else
+    _cleardomainconf Le_API
+  fi
 
   if [ "$_alt_domains" = "$NO_VALUE" ]; then
     _alt_domains=""
@@ -4500,6 +4504,16 @@ renew() {
 
   . "$DOMAIN_CONF"
   _debug Le_API "$Le_API"
+
+  if [ "$Le_API" = "$LETSENCRYPT_CA_V1" ]; then
+    _cleardomainconf Le_API
+    Le_API="$DEFAULT_CA"
+  fi
+  if [ "$Le_API" = "$LETSENCRYPT_STAGING_CA_V1" ]; then
+    _cleardomainconf Le_API
+    Le_API="$DEFAULT_STAGING_CA"
+  fi
+
   if [ "$Le_API" ]; then
     if [ "$_OLD_CA_HOST" = "$Le_API" ]; then
       export Le_API="$DEFAULT_CA"

From db6db6a4e964befb0575030f1703d4e0a37db36a Mon Sep 17 00:00:00 2001
From: Sebastiaan Hoogeveen <sebastiaan@hoogeveen.me>
Date: Tue, 12 Mar 2019 14:36:42 +0100
Subject: [PATCH 24/53] Removed overwriting of the HTTP header file before
 sending a request.

---
 dnsapi/dns_nederhost.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/dnsapi/dns_nederhost.sh b/dnsapi/dns_nederhost.sh
index 84c5ecd1..0954ab65 100755
--- a/dnsapi/dns_nederhost.sh
+++ b/dnsapi/dns_nederhost.sh
@@ -112,8 +112,6 @@ _nederhost_rest() {
   export _H1="Authorization: Bearer $NederHost_Key"
   export _H2="Content-Type: application/json"
 
-  :>"$HTTP_HEADER"
-
   if [ "$m" != "GET" ]; then
     _debug data "$data"
     response="$(_post "$data" "$NederHost_Api/$ep" "" "$m")"

From 77f96b386e9d60380a1dcfc80577c126eadba49c Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 13 Mar 2019 20:42:02 +0800
Subject: [PATCH 25/53] support Windows scheduler. fix
 https://github.com/Neilpang/acme.sh/issues/2145

---
 acme.sh | 130 +++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 110 insertions(+), 20 deletions(-)

diff --git a/acme.sh b/acme.sh
index b3ccf9ee..ceacd574 100755
--- a/acme.sh
+++ b/acme.sh
@@ -9,6 +9,9 @@ PROJECT_ENTRY="acme.sh"
 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
 
 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
+
+_WINDOWS_SCHEDULER_NAME="$PROJECT_NAME.cron"
+
 _SCRIPT_="$0"
 
 _SUB_FOLDERS="dnsapi deploy"
@@ -4923,35 +4926,108 @@ _installcert() {
 
 }
 
+__read_password() {
+  unset _pp
+  prompt="Enter Password:"
+  while IFS= read -p "$prompt" -r -s -n 1 char
+  do
+      if [ "$char" = $'\0' ]; then
+          break
+      fi
+      prompt='*'
+      _pp="$_pp$char"
+  done
+  echo "$_pp"
+}
+
+_install_win_taskscheduler() {
+  _lesh="$1"
+  _centry="$2"
+  _randomminute="$3"
+  if ! _exists cygpath; then
+    _err "cygpath not found"
+    return 1
+  fi
+  if ! _exists schtasks; then
+    _err "schtasks.exe is not found, are you on Windows?"
+    return 1
+  fi
+  _winbash="$(cygpath -w $(which bash))"
+  _debug _winbash "$_winbash"
+  if [ -z "$_winbash" ]; then
+    _err "can not find bash path"
+    return 1
+  fi
+  _myname="$(whoami)"
+  _debug "_myname" "$_myname"
+  if [ -z "$_myname" ]; then
+    _err "can not find my user name"
+    return 1
+  fi
+  _debug "_lesh" "$_lesh"
+
+  _info "To install scheduler task in your Windows account, you must input your windows password."
+  _info "$PROJECT_NAME doesn't save your password."
+  _info "Please input your Windows password for: $(__green "$_myname")"
+  _password="$(__read_password)"
+  #SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'" >/dev/null
+  echo SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "\"$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'\"" | cmd.exe >/dev/null
+  echo
+
+}
+
+_uninstall_win_taskscheduler() {
+  if ! _exists schtasks; then
+    _err "schtasks.exe is not found, are you on Windows?"
+    return 1
+  fi
+  if ! echo SCHTASKS /query /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null; then
+    _debug "scheduler $_WINDOWS_SCHEDULER_NAME is not found."
+  else
+    _info "Removing $_WINDOWS_SCHEDULER_NAME"
+    echo SCHTASKS  /delete  /f  /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
+  fi
+}
+
 #confighome
 installcronjob() {
   _c_home="$1"
   _initpath
   _CRONTAB="crontab"
+  if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
+    lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
+  else
+    _err "Can not install cronjob, $PROJECT_ENTRY not found."
+    return 1
+  fi
+  if [ "$_c_home" ]; then
+    _c_entry="--config-home \"$_c_home\" "
+  fi
+  _t=$(_time)
+  random_minute=$(_math $_t % 60)
+
   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
     _CRONTAB="fcrontab"
   fi
+
   if ! _exists "$_CRONTAB"; then
+    if _exists cygpath && _exists schtasks.exe; then
+      _info "It seems you are on Windows,  let's install Windows scheduler task."
+      if _install_win_taskscheduler "$lesh" "$_c_entry" "$random_minute"; then
+        _info "Install Windows scheduler task success."
+        return 0
+      else
+        _err "Install Windows scheduler task failed."
+        return 1
+      fi
+    fi
     _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
     _err "All your certs will not be renewed automatically."
     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
     return 1
   fi
-
   _info "Installing cron job"
   if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
-    if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
-      lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
-    else
-      _err "Can not install cronjob, $PROJECT_ENTRY not found."
-      return 1
-    fi
-
-    if [ "$_c_home" ]; then
-      _c_entry="--config-home \"$_c_home\" "
-    fi
-    _t=$(_time)
-    random_minute=$(_math $_t % 60)
     if _exists uname && uname -a | grep SunOS >/dev/null; then
       $_CRONTAB -l | {
         cat
@@ -4979,6 +5055,16 @@ uninstallcronjob() {
   fi
 
   if ! _exists "$_CRONTAB"; then
+    if _exists cygpath && _exists schtasks.exe; then
+      _info "It seems you are on Windows,  let's uninstall Windows scheduler task."
+      if _uninstall_win_taskscheduler; then
+        _info "Uninstall Windows scheduler task success."
+        return 0
+      else
+        _err "Uninstall Windows scheduler task failed."
+        return 1
+      fi
+    fi
     return
   fi
   _info "Removing cron job"
@@ -5306,13 +5392,17 @@ _precheck() {
 
   if [ -z "$_nocron" ]; then
     if ! _exists "crontab" && ! _exists "fcrontab"; then
-      _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
-      _err "We need to set cron job to renew the certs automatically."
-      _err "Otherwise, your certs will not be able to be renewed automatically."
-      if [ -z "$FORCE" ]; then
-        _err "Please add '--force' and try install again to go without crontab."
-        _err "./$PROJECT_ENTRY --install --force"
-        return 1
+      if _exists cygpath && _exists schtasks.exe; then
+        _info "It seems you are on Windows,  we will install Windows scheduler task."
+      else
+        _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
+        _err "We need to set cron job to renew the certs automatically."
+        _err "Otherwise, your certs will not be able to be renewed automatically."
+        if [ -z "$FORCE" ]; then
+          _err "Please add '--force' and try install again to go without crontab."
+          _err "./$PROJECT_ENTRY --install --force"
+          return 1
+        fi
       fi
     fi
   fi

From 0b04a7f17f467db477fca6588d8d078e2ac017f0 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 13 Mar 2019 20:49:26 +0800
Subject: [PATCH 26/53] fix format

---
 acme.sh | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/acme.sh b/acme.sh
index ceacd574..127b6ab3 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4929,13 +4929,12 @@ _installcert() {
 __read_password() {
   unset _pp
   prompt="Enter Password:"
-  while IFS= read -p "$prompt" -r -s -n 1 char
-  do
-      if [ "$char" = $'\0' ]; then
-          break
-      fi
-      prompt='*'
-      _pp="$_pp$char"
+  while IFS= read -p "$prompt" -r -s -n 1 char; do
+    if [ "$char" = $'\0' ]; then
+        break
+    fi
+    prompt='*'
+    _pp="$_pp$char"
   done
   echo "$_pp"
 }
@@ -4985,7 +4984,7 @@ _uninstall_win_taskscheduler() {
     _debug "scheduler $_WINDOWS_SCHEDULER_NAME is not found."
   else
     _info "Removing $_WINDOWS_SCHEDULER_NAME"
-    echo SCHTASKS  /delete  /f  /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
+    echo SCHTASKS /delete /f /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
   fi
 }
 

From 4ebad10557d3f05de6b4bddb8c173a2030af4145 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 13 Mar 2019 21:11:59 +0800
Subject: [PATCH 27/53] fix format

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 127b6ab3..1887bc90 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4931,7 +4931,7 @@ __read_password() {
   prompt="Enter Password:"
   while IFS= read -p "$prompt" -r -s -n 1 char; do
     if [ "$char" = $'\0' ]; then
-        break
+      break
     fi
     prompt='*'
     _pp="$_pp$char"

From 532e79c7d0d8dcfcf514195c0d8b2873aa4717ee Mon Sep 17 00:00:00 2001
From: Oliver Dick <o.dick@hosting.de>
Date: Wed, 13 Mar 2019 14:14:40 +0100
Subject: [PATCH 28/53] Fix reading endpoint

---
 dnsapi/dns_hostingde.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_hostingde.sh b/dnsapi/dns_hostingde.sh
index 50aa142f..1819e639 100644
--- a/dnsapi/dns_hostingde.sh
+++ b/dnsapi/dns_hostingde.sh
@@ -28,6 +28,7 @@ dns_hostingde_rm() {
 
 _hostingde_apiKey() {
   HOSTINGDE_APIKEY="${HOSTINGDE_APIKEY:-$(_readaccountconf_mutable HOSTINGDE_APIKEY)}"
+  HOSTINGDE_ENDPOINT="${HOSTINGDE_ENDPOINT:-$(_readaccountconf_mutable HOSTINGDE_ENDPOINT)}"
   if [ -z "$HOSTINGDE_APIKEY" ] || [ -z "$HOSTINGDE_ENDPOINT" ]; then
     HOSTINGDE_APIKEY=""
     HOSTINGDE_ENDPOINT=""

From 0f00862e5efd76cf998fe2b7511432c4893a249f Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Wed, 13 Mar 2019 21:28:30 +0800
Subject: [PATCH 29/53] support windows scheduler (#2158)

* support Windows scheduler. fix https://github.com/Neilpang/acme.sh/issues/2145
---
 acme.sh | 129 +++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 109 insertions(+), 20 deletions(-)

diff --git a/acme.sh b/acme.sh
index b3ccf9ee..1887bc90 100755
--- a/acme.sh
+++ b/acme.sh
@@ -9,6 +9,9 @@ PROJECT_ENTRY="acme.sh"
 PROJECT="https://github.com/Neilpang/$PROJECT_NAME"
 
 DEFAULT_INSTALL_HOME="$HOME/.$PROJECT_NAME"
+
+_WINDOWS_SCHEDULER_NAME="$PROJECT_NAME.cron"
+
 _SCRIPT_="$0"
 
 _SUB_FOLDERS="dnsapi deploy"
@@ -4923,35 +4926,107 @@ _installcert() {
 
 }
 
+__read_password() {
+  unset _pp
+  prompt="Enter Password:"
+  while IFS= read -p "$prompt" -r -s -n 1 char; do
+    if [ "$char" = $'\0' ]; then
+      break
+    fi
+    prompt='*'
+    _pp="$_pp$char"
+  done
+  echo "$_pp"
+}
+
+_install_win_taskscheduler() {
+  _lesh="$1"
+  _centry="$2"
+  _randomminute="$3"
+  if ! _exists cygpath; then
+    _err "cygpath not found"
+    return 1
+  fi
+  if ! _exists schtasks; then
+    _err "schtasks.exe is not found, are you on Windows?"
+    return 1
+  fi
+  _winbash="$(cygpath -w $(which bash))"
+  _debug _winbash "$_winbash"
+  if [ -z "$_winbash" ]; then
+    _err "can not find bash path"
+    return 1
+  fi
+  _myname="$(whoami)"
+  _debug "_myname" "$_myname"
+  if [ -z "$_myname" ]; then
+    _err "can not find my user name"
+    return 1
+  fi
+  _debug "_lesh" "$_lesh"
+
+  _info "To install scheduler task in your Windows account, you must input your windows password."
+  _info "$PROJECT_NAME doesn't save your password."
+  _info "Please input your Windows password for: $(__green "$_myname")"
+  _password="$(__read_password)"
+  #SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'" >/dev/null
+  echo SCHTASKS.exe '/create' '/SC' 'DAILY' '/TN' "$_WINDOWS_SCHEDULER_NAME" '/F' '/ST' "00:$_randomminute" '/RU' "$_myname" '/RP' "$_password" '/TR' "\"$_winbash -l -c '$_lesh --cron --home \"$LE_WORKING_DIR\" $_centry'\"" | cmd.exe >/dev/null
+  echo
+
+}
+
+_uninstall_win_taskscheduler() {
+  if ! _exists schtasks; then
+    _err "schtasks.exe is not found, are you on Windows?"
+    return 1
+  fi
+  if ! echo SCHTASKS /query /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null; then
+    _debug "scheduler $_WINDOWS_SCHEDULER_NAME is not found."
+  else
+    _info "Removing $_WINDOWS_SCHEDULER_NAME"
+    echo SCHTASKS /delete /f /tn "$_WINDOWS_SCHEDULER_NAME" | cmd.exe >/dev/null
+  fi
+}
+
 #confighome
 installcronjob() {
   _c_home="$1"
   _initpath
   _CRONTAB="crontab"
+  if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
+    lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
+  else
+    _err "Can not install cronjob, $PROJECT_ENTRY not found."
+    return 1
+  fi
+  if [ "$_c_home" ]; then
+    _c_entry="--config-home \"$_c_home\" "
+  fi
+  _t=$(_time)
+  random_minute=$(_math $_t % 60)
+
   if ! _exists "$_CRONTAB" && _exists "fcrontab"; then
     _CRONTAB="fcrontab"
   fi
+
   if ! _exists "$_CRONTAB"; then
+    if _exists cygpath && _exists schtasks.exe; then
+      _info "It seems you are on Windows,  let's install Windows scheduler task."
+      if _install_win_taskscheduler "$lesh" "$_c_entry" "$random_minute"; then
+        _info "Install Windows scheduler task success."
+        return 0
+      else
+        _err "Install Windows scheduler task failed."
+        return 1
+      fi
+    fi
     _err "crontab/fcrontab doesn't exist, so, we can not install cron jobs."
     _err "All your certs will not be renewed automatically."
     _err "You must add your own cron job to call '$PROJECT_ENTRY --cron' everyday."
     return 1
   fi
-
   _info "Installing cron job"
   if ! $_CRONTAB -l | grep "$PROJECT_ENTRY --cron"; then
-    if [ -f "$LE_WORKING_DIR/$PROJECT_ENTRY" ]; then
-      lesh="\"$LE_WORKING_DIR\"/$PROJECT_ENTRY"
-    else
-      _err "Can not install cronjob, $PROJECT_ENTRY not found."
-      return 1
-    fi
-
-    if [ "$_c_home" ]; then
-      _c_entry="--config-home \"$_c_home\" "
-    fi
-    _t=$(_time)
-    random_minute=$(_math $_t % 60)
     if _exists uname && uname -a | grep SunOS >/dev/null; then
       $_CRONTAB -l | {
         cat
@@ -4979,6 +5054,16 @@ uninstallcronjob() {
   fi
 
   if ! _exists "$_CRONTAB"; then
+    if _exists cygpath && _exists schtasks.exe; then
+      _info "It seems you are on Windows,  let's uninstall Windows scheduler task."
+      if _uninstall_win_taskscheduler; then
+        _info "Uninstall Windows scheduler task success."
+        return 0
+      else
+        _err "Uninstall Windows scheduler task failed."
+        return 1
+      fi
+    fi
     return
   fi
   _info "Removing cron job"
@@ -5306,13 +5391,17 @@ _precheck() {
 
   if [ -z "$_nocron" ]; then
     if ! _exists "crontab" && ! _exists "fcrontab"; then
-      _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
-      _err "We need to set cron job to renew the certs automatically."
-      _err "Otherwise, your certs will not be able to be renewed automatically."
-      if [ -z "$FORCE" ]; then
-        _err "Please add '--force' and try install again to go without crontab."
-        _err "./$PROJECT_ENTRY --install --force"
-        return 1
+      if _exists cygpath && _exists schtasks.exe; then
+        _info "It seems you are on Windows,  we will install Windows scheduler task."
+      else
+        _err "It is recommended to install crontab first. try to install 'cron, crontab, crontabs or vixie-cron'."
+        _err "We need to set cron job to renew the certs automatically."
+        _err "Otherwise, your certs will not be able to be renewed automatically."
+        if [ -z "$FORCE" ]; then
+          _err "Please add '--force' and try install again to go without crontab."
+          _err "./$PROJECT_ENTRY --install --force"
+          return 1
+        fi
       fi
     fi
   fi

From 709d82e7641916da2ad9e9035472e4f5f622dd0d Mon Sep 17 00:00:00 2001
From: neil <github@byneil.com>
Date: Wed, 13 Mar 2019 21:32:10 +0800
Subject: [PATCH 30/53] sync

sync
---
 dnsapi/dns_hostingde.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_hostingde.sh b/dnsapi/dns_hostingde.sh
index 50aa142f..1819e639 100644
--- a/dnsapi/dns_hostingde.sh
+++ b/dnsapi/dns_hostingde.sh
@@ -28,6 +28,7 @@ dns_hostingde_rm() {
 
 _hostingde_apiKey() {
   HOSTINGDE_APIKEY="${HOSTINGDE_APIKEY:-$(_readaccountconf_mutable HOSTINGDE_APIKEY)}"
+  HOSTINGDE_ENDPOINT="${HOSTINGDE_ENDPOINT:-$(_readaccountconf_mutable HOSTINGDE_ENDPOINT)}"
   if [ -z "$HOSTINGDE_APIKEY" ] || [ -z "$HOSTINGDE_ENDPOINT" ]; then
     HOSTINGDE_APIKEY=""
     HOSTINGDE_ENDPOINT=""

From 5048c6c22a19ae31006c3d5fa6a15733045fd4f8 Mon Sep 17 00:00:00 2001
From: tambetliiv <35329231+tambetliiv@users.noreply.github.com>
Date: Thu, 14 Mar 2019 14:20:39 +0200
Subject: [PATCH 31/53] Add zone.ee (zone.eu) DNS API (#2151)

* add zone.ee (zone.eu) dns api
---
 README.md          |   1 +
 dnsapi/README.md   |  16 +++++
 dnsapi/dns_zone.sh | 149 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 166 insertions(+)
 create mode 100755 dnsapi/dns_zone.sh

diff --git a/README.md b/README.md
index fae0bbf5..50466ad7 100644
--- a/README.md
+++ b/README.md
@@ -360,6 +360,7 @@ You don't have to do anything manually!
 1. MyDevil.net (https://www.mydevil.net/)
 1. Core-Networks.de (https://core-networks.de)
 1. NederHost API (https://www.nederhost.nl/)
+1. Zone.ee (zone.eu) API (https://api.zone.eu/v2)
 
 And:
 
diff --git a/dnsapi/README.md b/dnsapi/README.md
index 7ef1c306..de3148cf 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1310,6 +1310,22 @@ To issue a certificate run:
 acme.sh --issue --dns dns_nederhost -d example.com -d *.example.com
 ```
 
+## 69. Use Zone.ee DNS API
+
+First, you'll need to retrive your API key. Estonian insructions https://help.zone.eu/kb/zoneid-api-v2/
+
+```
+export ZONE_Username=yourusername
+export ZONE_Key=keygoeshere
+```
+
+To issue a cert run:
+
+```
+acme.sh --issue -d example.com -d www.example.com --dns dns_zone
+```
+
+`ZONE_Username` and `ZONE_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
diff --git a/dnsapi/dns_zone.sh b/dnsapi/dns_zone.sh
new file mode 100755
index 00000000..847e32cd
--- /dev/null
+++ b/dnsapi/dns_zone.sh
@@ -0,0 +1,149 @@
+#!/usr/bin/env sh
+
+# Zone.ee dns API
+# https://help.zone.eu/kb/zoneid-api-v2/
+# required ZONE_Username and ZONE_Key
+
+ZONE_Api="https://api.zone.eu/v2"
+########  Public functions #####################
+
+#Usage: dns_zone_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_zone_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using zone.ee dns api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  ZONE_Username="${ZONE_Username:-$(_readaccountconf_mutable ZONE_Username)}"
+  ZONE_Key="${ZONE_Key:-$(_readaccountconf_mutable ZONE_Key)}"
+  if [ -z "$ZONE_Username" ] || [ -z "$ZONE_Key" ]; then
+    ZONE_Username=""
+    ZONE_Key=""
+    _err "Zone api key and username must be present."
+    return 1
+  fi
+  _saveaccountconf_mutable ZONE_Username "$ZONE_Username"
+  _saveaccountconf_mutable ZONE_Key "$ZONE_Key"
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug "Adding txt record"
+
+  if _zone_rest POST "dns/${_domain}/txt" "{\"name\": \"$fulldomain\", \"destination\": \"$txtvalue\"}"; then
+    if printf -- "%s" "$response" | grep "$fulldomain" >/dev/null; then
+      _info "Added, OK"
+      return 0
+    else
+      _err "Adding txt record error."
+      return 1
+    fi
+  else
+    _err "Adding txt record error."
+  fi
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_zone_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using zone.ee dns api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  ZONE_Username="${ZONE_Username:-$(_readaccountconf_mutable ZONE_Username)}"
+  ZONE_Key="${ZONE_Key:-$(_readaccountconf_mutable ZONE_Key)}"
+  if [ -z "$ZONE_Username" ] || [ -z "$ZONE_Key" ]; then
+    ZONE_Username=""
+    ZONE_Key=""
+    _err "Zone api key and username must be present."
+    return 1
+  fi
+  _saveaccountconf_mutable ZONE_Username "$ZONE_Username"
+  _saveaccountconf_mutable ZONE_Key "$ZONE_Key"
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug "Getting txt records"
+  _debug _domain "$_domain"
+
+  _zone_rest GET "dns/${_domain}/txt"
+
+  if printf "%s" "$response" | grep \"error\" >/dev/null; then
+    _err "Error"
+    return 1
+  fi
+
+  count=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$fulldomain\"" | wc -l)
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Nothing to remove."
+  else
+    record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":\"[^\"]*\",\"resource_url\":\"[^\"]*\",\"name\":\"$fulldomain\"," | cut -d : -f2 | cut -d , -f1 | tr -d \" | _head_n 1)
+    if [ -z "$record_id" ]; then
+      _err "No id found to remove."
+      return 1
+    fi
+    if ! _zone_rest DELETE "dns/${_domain}/txt/$record_id"; then
+      _err "Record deleting error."
+      return 1
+    fi
+    _info "Record deleted"
+    return 0
+  fi
+
+}
+
+####################  Private functions below ##################################
+
+_zone_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  realm="$(printf "%s" "$ZONE_Username:$ZONE_Key" | _base64)"
+
+  export _H1="Authorization: Basic $realm"
+  export _H2="Content-Type: application/json"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$ZONE_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$ZONE_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}
+
+_get_root() {
+  domain=$1
+  i=2
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      return 1
+    fi
+    if ! _zone_rest GET "dns/$h/a"; then
+      return 1
+    fi
+    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
+      _domain=$h
+      return 0
+    fi
+    i=$(_math "$i" + 1)
+  done
+  return 0
+}

From 46fbd7f1e1fc355c34c76b6457e6a6959b5a387b Mon Sep 17 00:00:00 2001
From: "Steven M. Miano" <mianosm@gmail.com>
Date: Thu, 14 Mar 2019 08:41:13 -0400
Subject: [PATCH 32/53] support ultradns.com api (#2117)

support ultradns.com api (#2117)
---
 README.md           |   1 +
 dnsapi/README.md    |  24 +++++++
 dnsapi/dns_ultra.sh | 164 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 189 insertions(+)
 create mode 100644 dnsapi/dns_ultra.sh

diff --git a/README.md b/README.md
index 50466ad7..68d1b57d 100644
--- a/README.md
+++ b/README.md
@@ -361,6 +361,7 @@ You don't have to do anything manually!
 1. Core-Networks.de (https://core-networks.de)
 1. NederHost API (https://www.nederhost.nl/)
 1. Zone.ee (zone.eu) API (https://api.zone.eu/v2)
+1. UltraDNS API (https://portal.ultradns.com)
 
 And:
 
diff --git a/dnsapi/README.md b/dnsapi/README.md
index de3148cf..3cce294a 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1326,6 +1326,30 @@ acme.sh --issue -d example.com -d www.example.com --dns dns_zone
 ```
 
 `ZONE_Username` and `ZONE_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+## 70. Use UltraDNS API
+
+UltraDNS is a paid for service that provides DNS, as well as Web and Mail forwarding (as well as reporting, auditing, and advanced tools).
+
+More information can be found here: https://www.security.neustar/lp/ultra20/index.html
+
+The REST API documentation for this service is found here: https://portal.ultradns.com/static/docs/REST-API_User_Guide.pdf 
+
+Set your UltraDNS User name, and password; these would be the same you would use here:
+
+https://portal.ultradns.com/ - or if you create an API only user, that username and password would be better utilized.
+
+```
+export ULTRA_USR="abcd"
+export ULTRA_PWD="efgh"
+
+To issue a cert run:
+
+acme.sh --issue --dns dns_ultra -d example.com -d www.example.com
+```
+
+`ULTRA_USR` and `ULTRA_PWD` will be saved in `~/.acme.sh/account.conf` and will be resued when needed.
+
 # Use custom API
 
 If your API is not supported yet, you can write your own DNS API.
diff --git a/dnsapi/dns_ultra.sh b/dnsapi/dns_ultra.sh
new file mode 100644
index 00000000..0100b3b7
--- /dev/null
+++ b/dnsapi/dns_ultra.sh
@@ -0,0 +1,164 @@
+#!/usr/bin/env sh
+
+#
+# ULTRA_USR="your_user_goes_here"
+#
+# ULTRA_PWD="some_password_goes_here"
+
+ULTRA_API="https://restapi.ultradns.com/v2/"
+
+#Usage: add _acme-challenge.www.domain.com "some_long_string_of_characters_go_here_from_lets_encrypt"
+dns_ultra_add() {
+  fulldomain=$1
+  txtvalue=$2
+  export txtvalue
+  ULTRA_USR="${ULTRA_USR:-$(_readaccountconf_mutable ULTRA_USR)}"
+  ULTRA_PWD="${ULTRA_PWD:-$(_readaccountconf_mutable ULTRA_PWD)}"
+  if [ -z "$ULTRA_USR" ] || [ -z "$ULTRA_PWD" ]; then
+    ULTRA_USR=""
+    ULTRA_PWD=""
+    _err "You didn't specify an UltraDNS username and password yet"
+    return 1
+  fi
+  # save the username and password to the account conf file.
+  _saveaccountconf_mutable ULTRA_USR "$ULTRA_USR"
+  _saveaccountconf_mutable ULTRA_PWD "$ULTRA_PWD"
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "${_domain_id}"
+  _debug _sub_domain "${_sub_domain}"
+  _debug _domain "${_domain}"
+  _debug "Getting txt records"
+  _ultra_rest GET "zones/${_domain_id}/rrsets/TXT?q=value:${fulldomain}"
+  if printf "%s" "$response" | grep \"totalCount\" >/dev/null; then
+    _err "Error, it would appear that this record already exists. Please review existing TXT records for this domain."
+    return 1
+  fi
+
+  _info "Adding record"
+  if _ultra_rest POST "zones/$_domain_id/rrsets/TXT/${_sub_domain}" '{"ttl":300,"rdata":["'"${txtvalue}"'"]}'; then
+    if _contains "$response" "Successful"; then
+      _info "Added, OK"
+      return 0
+    elif _contains "$response" "Resource Record of type 16 with these attributes already exists"; then
+      _info "Already exists, OK"
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+
+}
+
+dns_ultra_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  export txtvalue
+  ULTRA_USR="${ULTRA_USR:-$(_readaccountconf_mutable ULTRA_USR)}"
+  ULTRA_PWD="${ULTRA_PWD:-$(_readaccountconf_mutable ULTRA_PWD)}"
+  if [ -z "$ULTRA_USR" ] || [ -z "$ULTRA_PWD" ]; then
+    ULTRA_USR=""
+    ULTRA_PWD=""
+    _err "You didn't specify an UltraDNS username and password yet"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "${_domain_id}"
+  _debug _sub_domain "${_sub_domain}"
+  _debug _domain "${domain}"
+
+  _debug "Getting TXT records"
+  _ultra_rest GET "zones/${_domain_id}/rrsets?q=kind:RECORDS+owner:${_sub_domain}"
+
+  if ! printf "%s" "$response" | grep \"resultInfo\" >/dev/null; then
+    _err "There was an error in obtaining the resource records for ${_domain_id}"
+    return 1
+  fi
+
+  count=$(echo "$response" | _egrep_o "\"returnedCount\":[^,]*" | cut -d: -f2 | cut -d'}' -f1)
+  _debug count "${count}"
+  if [ "${count}" = "" ]; then
+    _info "Text record is not present, will not delete anything."
+  else
+    if ! _ultra_rest DELETE "zones/$_domain_id/rrsets/TXT/${_sub_domain}" '{"ttl":300,"rdata":["'"${txtvalue}"'"]}'; then
+      _err "Deleting the record did not succeed, please verify/check."
+      return 1
+    fi
+    _contains "$response" ""
+  fi
+
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    _debug response "$response"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+    if ! _ultra_rest GET "zones"; then
+      return 1
+    fi
+    if _contains "${response}" "${h}." >/dev/null; then
+      _domain_id=$(echo "$response" | _egrep_o "${h}")
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+        _domain="${h}"
+        _debug sub_domain "${_sub_domain}"
+        _debug domain "${_domain}"
+        return 0
+      fi
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_ultra_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+  _debug TOKEN "${AUTH_TOKEN}"
+
+  _ultra_login
+  export _H1="Content-Type: application/json"
+  export _H2="Authorization: Bearer ${AUTH_TOKEN}"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "${data}"
+    response="$(_post "${data}" "${ULTRA_API}"/"${ep}" "" "${m}")"
+  else
+    response="$(_get "$ULTRA_API/$ep")"
+  fi
+}
+
+_ultra_login() {
+  export _H1=""
+  export _H2=""
+  AUTH_TOKEN=$(_post "grant_type=password&username=${ULTRA_USR}&password=${ULTRA_PWD}" "${ULTRA_API}authorization/token" | cut -d, -f3 | cut -d\" -f4)
+  export AUTH_TOKEN
+}

From dbc44c08df9e06c5db45ee85e797185dea81fd6e Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 13:38:17 +0800
Subject: [PATCH 33/53] fix for solaris

---
 acme.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index 1887bc90..f4f51268 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3751,7 +3751,7 @@ issue() {
         return 1
       fi
 
-      Le_OrderFinalize="$(echo "$response" | tr -d '\r\n' | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
+      Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
       _debug Le_OrderFinalize "$Le_OrderFinalize"
       if [ -z "$Le_OrderFinalize" ]; then
         _err "Create new order error. Le_OrderFinalize not found. $response"
@@ -3763,7 +3763,7 @@ issue() {
       #for dns manual mode
       _savedomainconf "Le_OrderFinalize" "$Le_OrderFinalize"
 
-      _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
+      _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
       _debug2 _authorizations_seg "$_authorizations_seg"
       if [ -z "$_authorizations_seg" ]; then
         _err "_authorizations_seg not found."
@@ -3849,7 +3849,7 @@ $_authorizations_map"
         thumbprint="$(__calc_account_thumbprint)"
       fi
 
-      entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
+      entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
       _debug entry "$entry"
       if [ -z "$entry" ]; then
         _err "Error, can not get domain token entry $d"
@@ -3861,7 +3861,7 @@ $_authorizations_map"
         _on_issue_err "$_post_hook"
         return 1
       fi
-      token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
+      token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
       _debug token "$token"
 
       if [ -z "$token" ]; then
@@ -3871,9 +3871,9 @@ $_authorizations_map"
         return 1
       fi
       if [ "$ACME_VERSION" = "2" ]; then
-        uri="$(printf "%s\n" "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
+        uri="$(echo "$entry" | _egrep_o '"url":"[^"]*' | cut -d '"' -f 4 | _head_n 1)"
       else
-        uri="$(printf "%s\n" "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
+        uri="$(echo "$entry" | _egrep_o '"uri":"[^"]*' | cut -d '"' -f 4)"
       fi
       _debug uri "$uri"
 

From d0d749074e35057aacc020448b700a3af7e4e63f Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 14:00:15 +0800
Subject: [PATCH 34/53] fix for solaris

---
 acme.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/acme.sh b/acme.sh
index f4f51268..3c7bc6d0 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4194,7 +4194,7 @@ $_authorizations_map"
       fi
 
       if [ "$status" = "invalid" ]; then
-        error="$(echo "$response" | tr -d "\r\n" | _egrep_o '"error":\{[^\}]*')"
+        error="$(echo "$response" | _egrep_o '"error":\{[^\}]*')"
         _debug2 error "$error"
         errordetail="$(echo "$error" | _egrep_o '"detail": *"[^"]*' | cut -d '"' -f 4)"
         _debug2 errordetail "$errordetail"
@@ -4260,7 +4260,7 @@ $_authorizations_map"
     while [ "$_link_cert_retry" -lt "$_MAX_CERT_RETRY" ]; do
       if _contains "$response" "\"status\":\"valid\""; then
         _debug "Order status is valid."
-        Le_LinkCert="$(echo "$response" | tr -d '\r\n' | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
+        Le_LinkCert="$(echo "$response" | _egrep_o '"certificate" *: *"[^"]*"' | cut -d '"' -f 4)"
         _debug Le_LinkCert "$Le_LinkCert"
         if [ -z "$Le_LinkCert" ]; then
           _err "Sign error, can not find Le_LinkCert"
@@ -5195,7 +5195,7 @@ _deactivate() {
       _err "Can not get domain new order."
       return 1
     fi
-    _authorizations_seg="$(echo "$response" | tr -d '\r\n' | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
+    _authorizations_seg="$(echo "$response" | _egrep_o '"authorizations" *: *\[[^\]*\]' | cut -d '[' -f 2 | tr -d ']' | tr -d '"')"
     _debug2 _authorizations_seg "$_authorizations_seg"
     if [ -z "$_authorizations_seg" ]; then
       _err "_authorizations_seg not found."
@@ -5241,16 +5241,16 @@ _deactivate() {
     fi
     _debug "Trigger validation."
     vtype="$VTYPE_DNS"
-    entry="$(printf "%s\n" "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
+    entry="$(echo "$response" | _egrep_o '[^\{]*"type":"'$vtype'"[^\}]*')"
     _debug entry "$entry"
     if [ -z "$entry" ]; then
       _err "Error, can not get domain token $d"
       return 1
     fi
-    token="$(printf "%s\n" "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
+    token="$(echo "$entry" | _egrep_o '"token":"[^"]*' | cut -d : -f 2 | tr -d '"')"
     _debug token "$token"
 
-    uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
+    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
     _debug uri "$uri"
 
     keyauthorization="$token.$thumbprint"
@@ -5272,11 +5272,11 @@ _deactivate() {
       break
     fi
 
-    _vtype="$(printf "%s\n" "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
+    _vtype="$(echo "$entry" | _egrep_o '"type": *"[^"]*"' | cut -d : -f 2 | tr -d '"')"
     _debug _vtype "$_vtype"
     _info "Found $_vtype"
 
-    uri="$(printf "%s\n" "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
+    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
     _debug uri "$uri"
 
     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then

From 2ffd8637e10d3ed7178769d219a6a85a09d79c63 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 14:28:24 +0800
Subject: [PATCH 35/53] fix standalone content

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 3c7bc6d0..d9ea4ee5 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2111,7 +2111,7 @@ _startserver() {
 echo 'HTTP/1.0 200 OK'; \
 echo 'Content-Length\: $_content_len'; \
 echo ''; \
-printf '$content';" &
+printf -- '$content';" &
   serverproc="$!"
 }
 

From 3f35006c264cf002a875b21a9cde97cc67ffccfa Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 14:35:33 +0800
Subject: [PATCH 36/53] fix error message

---
 dnsapi/dns_namecom.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_namecom.sh b/dnsapi/dns_namecom.sh
index 254952d6..a9a7ac51 100755
--- a/dnsapi/dns_namecom.sh
+++ b/dnsapi/dns_namecom.sh
@@ -130,6 +130,8 @@ _namecom_login() {
     if [ "$retcode" ]; then
       _info "Successfully logged in."
     else
+      _err "$response"
+      _err "Please add your ip to api whitelist"
       _err "Logging in failed."
       return 1
     fi

From 82b0ebb787ac87d1712a8cc3cc4982e030ed659a Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 14:53:02 +0800
Subject: [PATCH 37/53] minor, remove dns records only when it's added success

---
 acme.sh | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index d9ea4ee5..752b49bc 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3931,21 +3931,21 @@ $_authorizations_map"
           else
             txtdomain="_acme-challenge.$_d_alias"
           fi
-          dns_entries="${dns_entries}${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$txtdomain$dvsep$_currentRoot"
+          dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$txtdomain$dvsep$_currentRoot"
         else
           txtdomain="_acme-challenge.$_dns_root_d"
-          dns_entries="${dns_entries}${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$dvsep$_currentRoot"
+          dns_entry="${_dns_root_d}${dvsep}_acme-challenge.$_dns_root_d$dvsep$dvsep$_currentRoot"
         fi
+
         _debug txtdomain "$txtdomain"
         txt="$(printf "%s" "$keyauthorization" | _digest "sha256" | _url_replace)"
         _debug txt "$txt"
 
         d_api="$(_findHook "$_dns_root_d" dnsapi "$_currentRoot")"
-
         _debug d_api "$d_api"
-        dns_entries="$dns_entries$dvsep$txt${dvsep}$d_api
-"
-        _debug2 "$dns_entries"
+
+        dns_entry="$dns_entry$dvsep$txt${dvsep}$d_api"
+        _debug2 dns_entry "$dns_entry"
         if [ "$d_api" ]; then
           _info "Found domain api file: $d_api"
         else
@@ -3984,6 +3984,9 @@ $_authorizations_map"
           _clearup
           return 1
         fi
+        dns_entries="$dns_entries$dns_entry
+"
+        _debug2 "$dns_entries"
         dnsadded='1'
       fi
     done

From 2b36f4f57f1f9a484c5f6caf8fcff5472636a6a4 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 15:07:34 +0800
Subject: [PATCH 38/53] update

---
 dnsapi/dns_namecom.sh | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/dnsapi/dns_namecom.sh b/dnsapi/dns_namecom.sh
index a9a7ac51..769a2082 100755
--- a/dnsapi/dns_namecom.sh
+++ b/dnsapi/dns_namecom.sh
@@ -13,6 +13,8 @@ dns_namecom_add() {
   fulldomain=$1
   txtvalue=$2
 
+  Namecom_Username="${Namecom_Username:-$(_readaccountconf_mutable Namecom_Username)}"
+  Namecom_Token="${Namecom_Token:-$(_readaccountconf_mutable Namecom_Token)}"
   # First we need name.com credentials.
   if [ -z "$Namecom_Username" ]; then
     Namecom_Username=""
@@ -29,8 +31,8 @@ dns_namecom_add() {
   fi
 
   # Save them in configuration.
-  _saveaccountconf Namecom_Username "$Namecom_Username"
-  _saveaccountconf Namecom_Token "$Namecom_Token"
+  _saveaccountconf_mutable Namecom_Username "$Namecom_Username"
+  _saveaccountconf_mutable Namecom_Token "$Namecom_Token"
 
   # Login in using API
   if ! _namecom_login; then
@@ -46,7 +48,7 @@ dns_namecom_add() {
   # Add TXT record.
   _namecom_addtxt_json="{\"host\":\"$_sub_domain\",\"type\":\"TXT\",\"answer\":\"$txtvalue\",\"ttl\":\"300\"}"
   if _namecom_rest POST "domains/$_domain/records" "$_namecom_addtxt_json"; then
-    _retvalue=$(printf "%s\n" "$response" | _egrep_o "\"$_sub_domain\"")
+    _retvalue=$(echo "$response" | _egrep_o "\"$_sub_domain\"")
     if [ "$_retvalue" ]; then
       _info "Successfully added TXT record, ready for validation."
       return 0
@@ -63,6 +65,8 @@ dns_namecom_rm() {
   fulldomain=$1
   txtvalue=$2
 
+  Namecom_Username="${Namecom_Username:-$(_readaccountconf_mutable Namecom_Username)}"
+  Namecom_Token="${Namecom_Token:-$(_readaccountconf_mutable Namecom_Token)}"
   if ! _namecom_login; then
     return 1
   fi
@@ -75,7 +79,7 @@ dns_namecom_rm() {
 
   # Get the record id.
   if _namecom_rest GET "domains/$_domain/records"; then
-    _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+,\"domainName\":\"$_domain\",\"host\":\"$_sub_domain\",\"fqdn\":\"$fulldomain.\",\"type\":\"TXT\",\"answer\":\"$txtvalue\"" | cut -d \" -f 3 | _egrep_o [0-9]+)
+    _record_id=$(echo "$response" | _egrep_o "\"id\":[0-9]+,\"domainName\":\"$_domain\",\"host\":\"$_sub_domain\",\"fqdn\":\"$fulldomain.\",\"type\":\"TXT\",\"answer\":\"$txtvalue\"" | cut -d \" -f 3 | _egrep_o [0-9]+)
     _debug record_id "$_record_id"
     if [ "$_record_id" ]; then
       _info "Successfully retrieved the record id for ACME challenge."
@@ -126,7 +130,7 @@ _namecom_login() {
   _namecom_auth=$(printf "%s:%s" "$Namecom_Username" "$Namecom_Token" | _base64)
 
   if _namecom_rest GET "hello"; then
-    retcode=$(printf "%s\n" "$response" | _egrep_o "\"username\"\:\"$Namecom_Username\"")
+    retcode=$(echo "$response" | _egrep_o "\"username\"\:\"$Namecom_Username\"")
     if [ "$retcode" ]; then
       _info "Successfully logged in."
     else

From 653c77e852b879559c3daa338b9f4f247ac97ed2 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 15:09:49 +0800
Subject: [PATCH 39/53] update

---
 dnsapi/dns_namecom.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_namecom.sh b/dnsapi/dns_namecom.sh
index 769a2082..0d5dd2c4 100755
--- a/dnsapi/dns_namecom.sh
+++ b/dnsapi/dns_namecom.sh
@@ -29,7 +29,8 @@ dns_namecom_add() {
     _err "Please specify that in your environment variable."
     return 1
   fi
-
+  _debug Namecom_Username "$Namecom_Username"
+  _secure_debug Namecom_Token "$Namecom_Token"
   # Save them in configuration.
   _saveaccountconf_mutable Namecom_Username "$Namecom_Username"
   _saveaccountconf_mutable Namecom_Token "$Namecom_Token"

From c74d597c84342f14a3f5af9d7c6c2514383a1242 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Sat, 16 Mar 2019 18:34:44 +0800
Subject: [PATCH 40/53] add debug info

---
 dnsapi/dns_netcup.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dnsapi/dns_netcup.sh b/dnsapi/dns_netcup.sh
index 2273eb7c..d5d7c22e 100644
--- a/dnsapi/dns_netcup.sh
+++ b/dnsapi/dns_netcup.sh
@@ -8,6 +8,7 @@ end="https://ccp.netcup.net/run/webservice/servers/endpoint.php?JSON"
 client=""
 
 dns_netcup_add() {
+  _debug NC_Apikey "$NC_Apikey"
   login
   if [ "$NC_Apikey" = "" ] || [ "$NC_Apipw" = "" ] || [ "$NC_CID" = "" ]; then
     _err "No Credentials given"

From 7decce97180bd1431eb63c6ed027bbb2898bdff1 Mon Sep 17 00:00:00 2001
From: Sylvia van Os <sylvia@hackerchick.me>
Date: Mon, 18 Mar 2019 14:48:01 +0100
Subject: [PATCH 41/53] Resolve comments on pull request

---
 dnsapi/dns_openprovider.sh | 60 +++++++++++++++++++-------------------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/dnsapi/dns_openprovider.sh b/dnsapi/dns_openprovider.sh
index 3d66dfe4..a0171e4e 100755
--- a/dnsapi/dns_openprovider.sh
+++ b/dnsapi/dns_openprovider.sh
@@ -50,7 +50,7 @@ dns_openprovider_add() {
 
     items="$response"
     while true; do
-      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<item>.*<\/item>).*/\1/p')"
+      item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
       _debug existing_items "$existing_items"
       _debug results_retrieved "$results_retrieved"
       _debug item "$item"
@@ -59,24 +59,24 @@ dns_openprovider_add() {
         break
       fi
 
-      items="$(printf '%s' "$items" | sed "s
$item

")"
+      items="$(echo "$items" | sed "s|${item}||")"
 
-      results_retrieved=$((results_retrieved + 1))
-      new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)\.$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+      results_retrieved="$(_math "$results_retrieved" + 1)"
+      new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
       if [ -z "$new_item" ]; then
         # Base record
-        new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+        new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
       fi
 
-      if [ -z "$(printf '%s' "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
+      if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
         _debug "not an allowed record type, skipping" "$new_item"
         continue
       fi
 
-      existing_items="$(printf '%s%s' "$existing_items" "$new_item")"
+      existing_items="$existing_items$new_item"
     done
 
-    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+    total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
 
     _debug total "$total"
     if [ "$results_retrieved" -eq "$total" ]; then
@@ -85,7 +85,7 @@ dns_openprovider_add() {
   done
 
   _debug "Creating acme record"
-  acme_record="$(printf '%s' "$fulldomain" | sed -e "s/.$_domain_name.$_domain_extension$//")"
+  acme_record="$(echo "$fulldomain" | sed -e "s/.$_domain_name.$_domain_extension$//")"
   _openprovider_request "$(printf '<modifyZoneDnsRequest><domain><name>%s</name><extension>%s</extension></domain><type>master</type><records><array>%s<item><name>%s</name><type>TXT</type><value>%s</value><ttl>86400</ttl></item></array></records></modifyZoneDnsRequest>' "$_domain_name" "$_domain_extension" "$existing_items" "$acme_record" "$txtvalue")"
 
   return 0
@@ -127,7 +127,7 @@ dns_openprovider_rm() {
     # Remove acme records from items
     items="$response"
     while true; do
-      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<item>.*<\/item>).*/\1/p')"
+      item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<item>.*<\/item>\).*/\1/p')"
       _debug existing_items "$existing_items"
       _debug results_retrieved "$results_retrieved"
       _debug item "$item"
@@ -136,30 +136,30 @@ dns_openprovider_rm() {
         break
       fi
 
-      items="$(printf '%s' "$items" | sed "s
$item

")"
+      items="$(echo "$items" | sed "s|${item}||")"
 
-      results_retrieved=$((results_retrieved + 1))
-      if ! printf '%s' "$item" | grep -v "$fulldomain"; then
+      results_retrieved="$(_math "$results_retrieved" + 1)"
+      if ! echo "$item" | grep -v "$fulldomain"; then
         _debug "acme record, skipping" "$item"
         continue
       fi
 
-      new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)\.$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+      new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)\.'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
 
       if [ -z "$new_item" ]; then
         # Base record
-        new_item="$(printf '%s' "$item" | sed -n -E "s/.*<item>.*(<name>(.*)$_domain_name\.$_domain_extension<\/name>.*(<type>.*<\/type>).*(<value>.*<\/value>).*(<prio>.*<\/prio>).*(<ttl>.*<\/ttl>)).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p")"
+        new_item="$(echo "$item" | sed -n 's/.*<item>.*\(<name>\(.*\)'"$_domain_name"'\.'"$_domain_extension"'<\/name>.*\(<type>.*<\/type>\).*\(<value>.*<\/value>\).*\(<prio>.*<\/prio>\).*\(<ttl>.*<\/ttl>\)\).*<\/item>.*/<item><name>\2<\/name>\3\4\5\6<\/item>/p')"
       fi
 
-      if [ -z "$(printf '%s' "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
+      if [ -z "$(echo "$new_item" | _egrep_o ".*<type>(A|AAAA|CNAME|MX|SPF|SRV|TXT|TLSA|SSHFP|CAA)<\/type>.*")" ]; then
         _debug "not an allowed record type, skipping" "$new_item"
         continue
       fi
 
-      existing_items="$(printf '%s%s' "$existing_items" "$new_item")"
+      existing_items="$existing_items$new_item"
     done
 
-    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+    total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
 
     _debug total "$total"
 
@@ -185,18 +185,18 @@ _get_root() {
 
   results_retrieved=0
   while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    h=$(echo "$domain" | cut -d . -f $i-100)
     _debug h "$h"
     if [ -z "$h" ]; then
       #not valid
       return 1
     fi
 
-    _openprovider_request "$(printf '<searchDomainRequest><domainNamePattern>%s</domainNamePattern><offset>%s</offset></searchDomainRequest>' "$(printf "%s" "$h" | cut -d . -f 1)" "$results_retrieved")"
+    _openprovider_request "$(printf '<searchDomainRequest><domainNamePattern>%s</domainNamePattern><offset>%s</offset></searchDomainRequest>' "$(echo "$h" | cut -d . -f 1)" "$results_retrieved")"
 
     items="$response"
     while true; do
-      item="$(printf '%s' "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n -E 's/.*(<domain>.*<\/domain>).*/\1/p')"
+      item="$(echo "$items" | _egrep_o '<openXML>.*<\/openXML>' | sed -n 's/.*\(<domain>.*<\/domain>\).*/\1/p')"
       _debug existing_items "$existing_items"
       _debug results_retrieved "$results_retrieved"
       _debug item "$item"
@@ -205,26 +205,26 @@ _get_root() {
         break
       fi
 
-      items="$(printf '%s' "$items" | sed "s
$item

")"
+      items="$(echo "$items" | sed "s|${item}||")"
 
-      results_retrieved=$((results_retrieved + 1))
+      results_retrieved="$(_math "$results_retrieved" + 1)"
 
-      _domain_name="$(printf "%s" "$item" | sed -n -E 's/.*<domain>.*<name>(.*)<\/name>.*<\/domain>.*/\1/p')"
-      _domain_extension="$(printf "%s" "$item" | sed -n -E 's/.*<domain>.*<extension>(.*)<\/extension>.*<\/domain>.*/\1/p')"
+      _domain_name="$(echo "$item" | sed -n 's/.*<domain>.*<name>\(.*\)<\/name>.*<\/domain>.*/\1/p')"
+      _domain_extension="$(echo "$item" | sed -n 's/.*<domain>.*<extension>\(.*\)<\/extension>.*<\/domain>.*/\1/p')"
       _debug _domain_name "$_domain_name"
       _debug _domain_extension "$_domain_extension"
-      if [ "$(printf "%s.%s" "$_domain_name" "$_domain_extension")" = "$h" ]; then
+      if [ "$_domain_name.$_domain_extension" = "$h" ]; then
         return 0
       fi
     done
 
-    total="$(printf '%s' "$response" | _egrep_o '<total>.*?<\/total>' | sed -n -E 's/.*<total>(.*)<\/total>.*/\1/p')"
+    total="$(echo "$response" | _egrep_o '<total>.*?<\/total>' | sed -n 's/.*<total>\(.*\)<\/total>.*/\1/p')"
 
     _debug total "$total"
 
     if [ "$results_retrieved" -eq "$total" ]; then
       results_retrieved=0
-      i=$(_math "$i" + 1)
+      i="$(_math "$i" + 1)"
     fi
   done
   return 1
@@ -233,9 +233,9 @@ _get_root() {
 _openprovider_request() {
   request_xml=$1
 
-  xml_prefix=$(printf '<?xml version="1.0" encoding="UTF-8"?>')
+  xml_prefix=$(echo '<?xml version="1.0" encoding="UTF-8"?>')
   xml_content=$(printf '<openXML><credentials><username>%s</username><hash>%s</hash></credentials>%s</openXML>' "$OPENPROVIDER_USER" "$OPENPROVIDER_PASSWORDHASH" "$request_xml")
-  response="$(_post "$(printf "%s%s" "$xml_prefix" "$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
+  response="$(_post "$(echo "$xml_prefix$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
   _debug response "$response"
   if ! _contains "$response" "<openXML><reply><code>0</code>.*</reply></openXML>"; then
     _err "API request failed."

From 71cfd874aeaa8282efb2f1200666dab5fa6fec68 Mon Sep 17 00:00:00 2001
From: Sylvia van Os <sylvia@hackerchick.me>
Date: Mon, 18 Mar 2019 16:10:58 +0100
Subject: [PATCH 42/53] Fix SC2116

---
 dnsapi/dns_openprovider.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_openprovider.sh b/dnsapi/dns_openprovider.sh
index a0171e4e..1b1b760e 100755
--- a/dnsapi/dns_openprovider.sh
+++ b/dnsapi/dns_openprovider.sh
@@ -233,7 +233,7 @@ _get_root() {
 _openprovider_request() {
   request_xml=$1
 
-  xml_prefix=$(echo '<?xml version="1.0" encoding="UTF-8"?>')
+  xml_prefix='<?xml version="1.0" encoding="UTF-8"?>'
   xml_content=$(printf '<openXML><credentials><username>%s</username><hash>%s</hash></credentials>%s</openXML>' "$OPENPROVIDER_USER" "$OPENPROVIDER_PASSWORDHASH" "$request_xml")
   response="$(_post "$(echo "$xml_prefix$xml_content" | tr -d '\n')" "$OPENPROVIDER_API" "" "POST" "application/xml")"
   _debug response "$response"

From 7679df062c246e72c24ce2a57ca5d58cd02095ca Mon Sep 17 00:00:00 2001
From: Herman Sletteng <herman@sletteng.org>
Date: Tue, 19 Mar 2019 14:16:05 +0100
Subject: [PATCH 43/53] dns_gdnsdk: Fixed stupid regex error, want literal "-",
 not a range

---
 dnsapi/dns_gdnsdk.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_gdnsdk.sh b/dnsapi/dns_gdnsdk.sh
index 7dc7894a..8c4962c0 100755
--- a/dnsapi/dns_gdnsdk.sh
+++ b/dnsapi/dns_gdnsdk.sh
@@ -137,7 +137,7 @@ _mypost() {
 
 _get_domain() {
   _myget 'action=dns_primarydns'
-  _domains=$(echo "$_result" | _egrep_o ' domain="[[:alnum:].-_]+' | sed 's/^.*"//')
+  _domains=$(echo "$_result" | _egrep_o ' domain="[[:alnum:]._-]+' | sed 's/^.*"//')
   if [ -z "$_domains" ]; then
     _err "Primary domain list not found!"
     return 1

From 34be7e99f01c716465f6f3701310ba81f6121d76 Mon Sep 17 00:00:00 2001
From: bz-heilig <35926736+bz-heilig@users.noreply.github.com>
Date: Tue, 19 Mar 2019 15:04:37 +0100
Subject: [PATCH 44/53] Update README.md

Added links for do.de API token creation and documentation of API.
---
 dnsapi/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 3cce294a..a5779a30 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1157,7 +1157,7 @@ The `ACTIVE24_Token` will be saved in `~/.acme.sh/account.conf` and will be reus
 
 ## 60. Use do.de API
 
-Create an API token in your do.de account.
+Create an API token in your do.de account ([Create token here](https://www.do.de/account/letsencrypt/) | [Documentation](https://www.do.de/wiki/LetsEncrypt_-_Entwickler)).
 
 Set your API token:
 ```

From 307336cfc4ca136514423f43294a1768b727a2a7 Mon Sep 17 00:00:00 2001
From: Valentin Brandl <vbrandl@riseup.net>
Date: Tue, 19 Mar 2019 18:42:47 +0100
Subject: [PATCH 45/53] Add deploy hook for mailcow

This hook will copy the key and certificate chain to the specified
mailcow installation (as described in
https://mailcow.github.io/mailcow-dockerized-docs/firststeps-ssl/#use-own-certificates)
and restarts the containers, that are using the certificates.

The hook has 2 parameters:

* `DEPLOY_MAILCOW_PATH`: The path to the mailcow installation (required)
* `DEPLOY_MAILCOW_RELOAD`: The reload command, defaults to `docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow`
---
 deploy/mailcow.sh | 51 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 deploy/mailcow.sh

diff --git a/deploy/mailcow.sh b/deploy/mailcow.sh
new file mode 100644
index 00000000..3b38fa85
--- /dev/null
+++ b/deploy/mailcow.sh
@@ -0,0 +1,51 @@
+#!/usr/bin/env sh
+
+#Here is a script to deploy cert to mailcow.
+
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+mailcow_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  _ssl_path="${DEPLOY_MAILCOW_PATH}/data/assets/ssl/"
+  if [ ! -d "$_ssl_path"; ] then
+      _err "Cannot find mailcow ssl path: $_ssl_path"
+      return 1
+  fi
+
+  _info "Copying key and cert"
+  _real_key="$_ssl_path/key.pem"
+  if ! cat "$_ckey" >"$_real_key"; then
+    _err "Error: write key file to: $_real_key"
+    return 1
+  fi
+
+  _real_fullchain="$_ssl_path/cert.pem"
+  if ! cat "$_cfullchain" >"$_real_fullchain"; then
+    _err "Error: write cert file to: $_real_fullchain"
+    return 1
+  fi
+
+  DEFAULT_MAILCOW_RELOAD="docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
+  _reload="${DEPLOY_MAILCOW_RELOAD:-$DEFAULT_MAILCOW_RELOAD}"
+
+  _info "Run reload: $_reload"
+  if eval "$_reload"; then
+    _info "Reload success!"
+  fi
+  return 0
+
+}

From b581a171f0a09870fcae71272ec6fe5b99c4df20 Mon Sep 17 00:00:00 2001
From: Valentin Brandl <vbrandl@riseup.net>
Date: Tue, 19 Mar 2019 18:43:07 +0100
Subject: [PATCH 46/53] Add documentation for mailcow deploy hook

---
 deploy/README.md | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/deploy/README.md b/deploy/README.md
index 44d53225..8cced4d8 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -391,3 +391,23 @@ acme.sh --deploy --deploy-hook mydevil -d example.com
 ```
 
 That will remove old certificate and install new one.
+
+## 15. Deploy your cert to local mailcow server
+
+You can install your certificates to a local [mailcow](https://github.com/mailcow/mailcow-dockerized/) instance. The
+deploy hook will copy the certificates and reload the containers, that use the certificates (`postfix-mailcow`
+`dovecot-mailcow` and `nginx-mailcow`).
+
+```sh
+$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
+$ acme.sh --deploy -d example.com --deploy-hook mailcow
+```
+
+The default command to restart is `docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow`, if you want a
+custom restart command, specify it by setting `DEPLOY_MAILCOW_RELOAD`:
+
+```sh
+$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
+$ export DEPLOY_MAILCOW_RELOAD="docker-compose restart"
+$ acme.sh --deploy -d example.com --deploy-hook mailcow
+```

From d643a2ff13ae642ca16ecc87c04a0c88bb8a63bb Mon Sep 17 00:00:00 2001
From: Valentin Brandl <vbrandl@riseup.net>
Date: Tue, 19 Mar 2019 19:09:25 +0100
Subject: [PATCH 47/53] Check if mailcow path is set and fix directory check

---
 deploy/mailcow.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/deploy/mailcow.sh b/deploy/mailcow.sh
index 3b38fa85..bdba3e29 100644
--- a/deploy/mailcow.sh
+++ b/deploy/mailcow.sh
@@ -20,8 +20,15 @@ mailcow_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
-  _ssl_path="${DEPLOY_MAILCOW_PATH}/data/assets/ssl/"
-  if [ ! -d "$_ssl_path"; ] then
+  _mailcow_path="${DEPLOY_MAILCOW_PATH}"
+
+  if [ -z "$_mailcow_path" ]; then
+      _err "Mailcow path is not found, please define DEPLOY_MAILCOW_PATH."
+      return 1
+  fi
+
+  _ssl_path="${_mailcow_path}/data/assets/ssl/"
+  if [ ! -d "$_ssl_path" ]; then
       _err "Cannot find mailcow ssl path: $_ssl_path"
       return 1
   fi
@@ -39,7 +46,7 @@ mailcow_deploy() {
     return 1
   fi
 
-  DEFAULT_MAILCOW_RELOAD="docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
+  DEFAULT_MAILCOW_RELOAD="cd ${_mailcow_path} && docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow"
   _reload="${DEPLOY_MAILCOW_RELOAD:-$DEFAULT_MAILCOW_RELOAD}"
 
   _info "Run reload: $_reload"

From d604166194491503a54b5c73be4fc1986fae9456 Mon Sep 17 00:00:00 2001
From: Valentin Brandl <vbrandl@riseup.net>
Date: Tue, 19 Mar 2019 19:15:31 +0100
Subject: [PATCH 48/53] Fix formatting

---
 deploy/mailcow.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/mailcow.sh b/deploy/mailcow.sh
index bdba3e29..3a806e83 100644
--- a/deploy/mailcow.sh
+++ b/deploy/mailcow.sh
@@ -23,14 +23,14 @@ mailcow_deploy() {
   _mailcow_path="${DEPLOY_MAILCOW_PATH}"
 
   if [ -z "$_mailcow_path" ]; then
-      _err "Mailcow path is not found, please define DEPLOY_MAILCOW_PATH."
-      return 1
+    _err "Mailcow path is not found, please define DEPLOY_MAILCOW_PATH."
+    return 1
   fi
 
   _ssl_path="${_mailcow_path}/data/assets/ssl/"
   if [ ! -d "$_ssl_path" ]; then
-      _err "Cannot find mailcow ssl path: $_ssl_path"
-      return 1
+    _err "Cannot find mailcow ssl path: $_ssl_path"
+    return 1
   fi
 
   _info "Copying key and cert"

From fbdc5a0eb540865b52d4647ac5eda84ecaa9a0be Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 20 Mar 2019 22:52:40 +0800
Subject: [PATCH 49/53] fix https://github.com/Neilpang/acme.sh/issues/2179

---
 acme.sh | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index 752b49bc..f47a5ebb 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3750,7 +3750,8 @@ issue() {
         _on_issue_err "$_post_hook"
         return 1
       fi
-
+      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+      _debug Le_LinkOrder "$Le_LinkOrder"
       Le_OrderFinalize="$(echo "$response" | _egrep_o '"finalize" *: *"[^"]*"' | cut -d '"' -f 4)"
       _debug Le_OrderFinalize "$Le_OrderFinalize"
       if [ -z "$Le_OrderFinalize" ]; then
@@ -4249,13 +4250,10 @@ $_authorizations_map"
       _on_issue_err "$_post_hook"
       return 1
     fi
-    Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
     if [ -z "$Le_LinkOrder" ]; then
-      _err "Sign error, can not get order link location header"
-      _err "responseHeaders" "$responseHeaders"
-      _on_issue_err "$_post_hook"
-      return 1
+      Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
     fi
+
     _savedomainconf "Le_LinkOrder" "$Le_LinkOrder"
 
     _link_cert_retry=0
@@ -4281,6 +4279,14 @@ $_authorizations_map"
         _on_issue_err "$_post_hook"
         return 1
       fi
+      #the order is processing, so we are going to poll order status
+      if [ -z "$Le_LinkOrder" ]; then
+        _err "Sign error, can not get order link location header"
+        _err "responseHeaders" "$responseHeaders"
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+      _info "Polling order status: $Le_LinkOrder"
       if ! _send_signed_request "$Le_LinkOrder"; then
         _err "Sign failed, can not post to Le_LinkOrder cert:$Le_LinkOrder."
         _err "$response"

From 0629c2a086e390b5fc502ad5c0e6bdb8d11ac470 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 20 Mar 2019 23:01:24 +0800
Subject: [PATCH 50/53] move to wiki

---
 dnsapi/README.md | 1373 +---------------------------------------------
 1 file changed, 2 insertions(+), 1371 deletions(-)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index a5779a30..d9ab46fa 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -1,1375 +1,6 @@
 # How to use DNS API
+DNS api usage:
 
-If your dns provider doesn't provide api access, you can use our dns alias mode:
-
-https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode
-
-## 1. Use CloudFlare domain API to automatically issue cert
-
-First you need to login to your CloudFlare account to get your [API key](https://dash.cloudflare.com/profile). 
-
-```
-export CF_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export CF_Email="xxxx@sss.com"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_cf -d example.com -d www.example.com
-```
-
-The `CF_Key` and `CF_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 2. Use DNSPod.cn domain API to automatically issue cert
-
-First you need to login to your DNSPod account to get your API Key and ID.
-
-```
-export DP_Id="1234"
-export DP_Key="sADDsdasdgdsf"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_dp -d example.com -d www.example.com
-```
-
-The `DP_Id` and `DP_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 3. Use CloudXNS.com domain API to automatically issue cert
-
-First you need to login to your CloudXNS account to get your API Key and Secret.
-
-```
-export CX_Key="1234"
-export CX_Secret="sADDsdasdgdsf"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_cx -d example.com -d www.example.com
-```
-
-The `CX_Key` and `CX_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 4. Use GoDaddy.com domain API to automatically issue cert
-
-First you need to login to your GoDaddy account to get your API Key and Secret.
-
-https://developer.godaddy.com/keys/
-
-Please create a Production key, instead of a Test key.
-
-```
-export GD_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export GD_Secret="asdfsdafdsfdsfdsfdsfdsafd"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_gd -d example.com -d www.example.com
-```
-
-The `GD_Key` and `GD_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 5. Use PowerDNS embedded API to automatically issue cert
-
-First you need to login to your PowerDNS account to enable the API and set your API-Token in the configuration.
-
-https://doc.powerdns.com/md/httpapi/README/
-
-```
-export PDNS_Url="http://ns.example.com:8081"
-export PDNS_ServerId="localhost"
-export PDNS_Token="0123456789ABCDEF"
-export PDNS_Ttl=60
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_pdns -d example.com -d www.example.com
-```
-
-The `PDNS_Url`, `PDNS_ServerId`, `PDNS_Token` and `PDNS_Ttl` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 6. Use OVH/kimsufi/soyoustart/runabove API to automatically issue cert
-
-https://github.com/Neilpang/acme.sh/wiki/How-to-use-OVH-domain-api
-
-
-## 7. Use nsupdate to automatically issue cert
-
-First, generate a key for updating the zone
-```
-b=$(dnssec-keygen -a hmac-sha512 -b 512 -n USER -K /tmp foo)
-cat > /etc/named/keys/update.key <<EOF
-key "update" {
-    algorithm hmac-sha512;
-    secret "$(awk '/^Key/{print $2}' /tmp/$b.private)";
-};
-EOF
-rm -f /tmp/$b.{private,key}
-```
-
-Include this key in your named configuration
-```
-include "/etc/named/keys/update.key";
-```
-
-Next, configure your zone to allow dynamic updates.
-
-Depending on your named version, use either
-```
-zone "example.com" {
-    type master;
-    allow-update { key "update"; };
-};
-```
-or
-```
-zone "example.com" {
-    type master;
-    update-policy {
-        grant update subdomain example.com.;
-    };
-}
-```
-
-Finally, make the DNS server and update Key available to `acme.sh`
-
-```
-export NSUPDATE_SERVER="dns.example.com"
-export NSUPDATE_KEY="/path/to/your/nsupdate.key"
-```
-and optionally (depending on DNS server)
-```
-export NSUPDATE_ZONE="example.com"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_nsupdate -d example.com -d www.example.com
-```
-
-The `NSUPDATE_SERVER`, `NSUPDATE_KEY`, and `NSUPDATE_ZONE` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 8. Use LuaDNS domain API
-
-Get your API token at https://api.luadns.com/settings
-
-```
-export LUA_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export LUA_Email="xxxx@sss.com"
-```
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_lua -d example.com -d www.example.com
-```
-
-The `LUA_Key` and `LUA_Email` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 9. Use DNSMadeEasy domain API
-
-Get your API credentials at https://cp.dnsmadeeasy.com/account/info
-
-```
-export ME_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export ME_Secret="qdfqsdfkjdskfj"
-```
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_me -d example.com -d www.example.com
-```
-
-The `ME_Key` and `ME_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 10. Use Amazon Route53 domain API
-
-https://github.com/Neilpang/acme.sh/wiki/How-to-use-Amazon-Route53-API
-
-```
-export  AWS_ACCESS_KEY_ID=XXXXXXXXXX
-export  AWS_SECRET_ACCESS_KEY=XXXXXXXXXXXXXXX
-```
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_aws -d example.com -d www.example.com
-```
-
-The `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 11. Use Aliyun domain API to automatically issue cert
-
-First you need to login to your Aliyun account to get your API key.
-[https://ak-console.aliyun.com/#/accesskey](https://ak-console.aliyun.com/#/accesskey)
-
-```
-export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_ali -d example.com -d www.example.com
-```
-
-The `Ali_Key` and `Ali_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 12. Use ISPConfig 3.1 API
-
-This only works for ISPConfig 3.1 (and newer).
-
-Create a Remote User in the ISPConfig Control Panel. The Remote User must have access to at least `DNS zone functions` and `DNS txt functions`.
-
-```
-export ISPC_User="xxx"
-export ISPC_Password="xxx"
-export ISPC_Api="https://ispc.domain.tld:8080/remote/json.php"
-export ISPC_Api_Insecure=1
-```
-If you have installed ISPConfig on a different port, then alter the 8080 accordingly.
-Leaver ISPC_Api_Insecure set to 1 if you have not a valid ssl cert for your installation. Change it to 0 if you have a valid ssl cert.
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_ispconfig -d example.com -d www.example.com
-```
-
-The `ISPC_User`, `ISPC_Password`, `ISPC_Api`and `ISPC_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 13. Use Alwaysdata domain API
-
-First you need to login to your Alwaysdata account to get your API Key.
-
-```sh
-export AD_API_KEY="myalwaysdataapikey"
-```
-
-Ok, let's issue a cert now:
-
-```sh
-acme.sh --issue --dns dns_ad -d example.com -d www.example.com
-```
-
-The `AD_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused
-when needed.
-
-## 14. Use Linode domain API
-
-The tokens created in the classic manager and cloud manager are incompatible
-with one another. While the classic manager makes an all or nothing API, the
-newer cloud manager interface promises to produce API keys with a finer
-permission system. However, either way works just fine.
-
-### Classic Manager ###
-
-Classic Manager: https://manager.linode.com/profile/api
-
-First you need to login to your Linode account to get your API Key.
-
-Then add an API key with label *ACME* and copy the new key into the following
-command.
-
-```sh
-export LINODE_API_KEY="..."
-```
-
-Due to the reload time of any changes in the DNS records, we have to use the
-`dnssleep` option to wait at least 15 minutes for the changes to take effect.
-
-Ok, let's issue a cert now:
-
-```sh
-acme.sh --issue --dns dns_linode --dnssleep 900 -d example.com -d www.example.com
-```
-
-The `LINODE_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be
-reused when needed.
-
-### Cloud Manager ###
-
-Cloud Manager: https://cloud.linode.com/profile/tokens
-
-First you need to login to your Linode account to get your API Key.
-
-   1. Click on "Add a Personal Access Token".
-   2. Give the new key a "Label" (we recommend *ACME*)
-   3. Give it Read/Write access to "Domains"
-   4. "Submit" and copy the new key into the `LINODE_V4_API_KEY` command below.
-
-```sh
-export LINODE_V4_API_KEY="..."
-```
-
-Due to the reload time of any changes in the DNS records, we have to use the
-`dnssleep` option to wait at least 15 minutes for the changes to take effect.
-
-Ok, let's issue a cert now:
-
-```sh
-acme.sh --issue --dns dns_linode_v4 --dnssleep 900 -d example.com -d www.example.com
-```
-
-The `LINODE_V4_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be
-reused when needed.
-
-## 15. Use FreeDNS
-
-FreeDNS (https://freedns.afraid.org/) does not provide an API to update DNS records (other than IPv4 and IPv6
-dynamic DNS addresses).  The acme.sh plugin therefore retrieves and updates domain TXT records by logging
-into the FreeDNS website to read the HTML and posting updates as HTTP.  The plugin needs to know your
-userid and password for the FreeDNS website.
-
-```sh
-export FREEDNS_User="..."
-export FREEDNS_Password="..."
-```
-
-You need only provide this the first time you run the acme.sh client with FreeDNS validation and then again
-whenever you change your password at the FreeDNS site.  The acme.sh FreeDNS plugin does not store your userid
-or password but rather saves an authentication token returned by FreeDNS in `~/.acme.sh/account.conf` and
-reuses that when needed.
-
-Now you can issue a certificate.
-
-```sh
-acme.sh --issue --dns dns_freedns -d example.com -d www.example.com
-```
-
-Note that you cannot use acme.sh automatic DNS validation for FreeDNS public domains or for a subdomain that
-you create under a FreeDNS public domain.  You must own the top level domain in order to automatically
-validate with acme.sh at FreeDNS.
-
-## 16. Use cyon.ch
-
-You only need to set your cyon.ch login credentials.
-If you also have 2 Factor Authentication (OTP) enabled, you need to set your secret token too and have `oathtool` installed.
-
-```
-export CY_Username="your_cyon_username"
-export CY_Password="your_cyon_password"
-export CY_OTP_Secret="your_otp_secret" # Only required if using 2FA
-```
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_cyon -d example.com -d www.example.com
-```
-
-The `CY_Username`, `CY_Password` and `CY_OTP_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 17. Use Domain-Offensive/Resellerinterface/Domainrobot API
-
-ATTENTION: You need to be a registered Reseller to be able to use the ResellerInterface. As a normal user you can not use this method.
-
-You will need your login credentials (Partner ID+Password) to the Resellerinterface, and export them before you run `acme.sh`:
-```
-export DO_PID="KD-1234567"
-export DO_PW="cdfkjl3n2"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_do -d example.com -d www.example.com
-```
-
-## 18. Use Gandi LiveDNS API
-
-You must enable the new Gandi LiveDNS API first and the create your api key, See: http://doc.livedns.gandi.net/
-
-```
-export GANDI_LIVEDNS_KEY="fdmlfsdklmfdkmqsdfk"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_gandi_livedns -d example.com -d www.example.com
-```
-
-## 19. Use Knot (knsupdate) DNS API to automatically issue cert
-
-First, generate a TSIG key for updating the zone.
-
-```
-keymgr tsig generate -t acme_key hmac-sha512 > /etc/knot/acme.key
-```
-
-Include this key in your knot configuration file.
-
-```
-include: /etc/knot/acme.key
-```
-
-Next, configure your zone to allow dynamic updates.
-
-Dynamic updates for the zone are allowed via proper ACL rule with the `update` action. For in-depth instructions, please see [Knot DNS's documentation](https://www.knot-dns.cz/documentation/).
-
-```
-acl:
-  - id: acme_acl
-    address: 192.168.1.0/24
-    key: acme_key
-    action: update
-
-zone:
-  - domain: example.com
-    file: example.com.zone
-    acl: acme_acl
-```
-
-Finally, make the DNS server and TSIG Key available to `acme.sh`
-
-```
-export KNOT_SERVER="dns.example.com"
-export KNOT_KEY=`grep \# /etc/knot/acme.key | cut -d' ' -f2`
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_knot -d example.com -d www.example.com
-```
-
-The `KNOT_SERVER` and `KNOT_KEY` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 20. Use DigitalOcean API (native)
-
-You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/
-
-```
-export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_dgon -d example.com -d www.example.com
-```
-
-## 21. Use ClouDNS.net API
-
-You need to set the HTTP API user ID and password credentials. See: https://www.cloudns.net/wiki/article/42/. For security reasons, it's recommended to use a sub user ID that only has access to the necessary zones, as a regular API user has access to your entire account.
-
-```
-# Use this for a sub auth ID
-export CLOUDNS_SUB_AUTH_ID=XXXXX
-# Use this for a regular auth ID
-#export CLOUDNS_AUTH_ID=XXXXX
-export CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_cloudns -d example.com -d www.example.com
-```
-The `CLOUDNS_AUTH_ID` and `CLOUDNS_AUTH_PASSWORD` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 22. Use Infoblox API
-
-First you need to create/obtain API credentials on your Infoblox appliance.
-
-```
-export Infoblox_Creds="username:password"
-export Infoblox_Server="ip or fqdn of infoblox appliance"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_infoblox -d example.com -d www.example.com
-```
-
-Note: This script will automatically create and delete the ephemeral txt record.
-The `Infoblox_Creds` and `Infoblox_Server` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-## 23. Use VSCALE API
-
-First you need to create/obtain API tokens on your [settings panel](https://vscale.io/panel/settings/tokens/).
-
-```
-export VSCALE_API_KEY="sdfsdfsdfljlbjkljlkjsdfoiwje"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_vscale -d example.com -d www.example.com
-```
-
-##  24. Use Dynu API
-
-First you need to create/obtain API credentials from your Dynu account. See: https://www.dynu.com/resources/api/documentation
-
-```
-export Dynu_ClientId="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
-export Dynu_Secret="yyyyyyyyyyyyyyyyyyyyyyyyy"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_dynu -d example.com -d www.example.com
-```
-
-The `Dynu_ClientId` and `Dynu_Secret` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 25. Use DNSimple API
-
-First you need to login to your DNSimple account and generate a new oauth token.
-
-https://dnsimple.com/a/{your account id}/account/access_tokens
-
-Note that this is an _account_ token and not a user token. The account token is
-needed to infer the `account_id` used in requests. A user token will not be able
-to determine the correct account to use.
-
-```
-export DNSimple_OAUTH_TOKEN="sdfsdfsdfljlbjkljlkjsdfoiwje"
-```
-
-To issue the cert just specify the `dns_dnsimple` API.
-
-```
-acme.sh --issue --dns dns_dnsimple -d example.com
-```
-
-The `DNSimple_OAUTH_TOKEN` will be saved in `~/.acme.sh/account.conf` and will
-be reused when needed.
-
-If you have any issues with this integration please report them to
-https://github.com/pho3nixf1re/acme.sh/issues.
-
-## 26. Use NS1.com API
-
-```
-export NS1_Key="fdmlfsdklmfdkmqsdfk"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_nsone -d example.com -d www.example.com
-```
-
-## 27. Use DuckDNS.org API
-
-```
-export DuckDNS_Token="aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
-```
-
-Please note that since DuckDNS uses StartSSL as their cert provider, thus
---insecure may need to be used when issuing certs:
-```
-acme.sh --insecure --issue --dns dns_duckdns -d mydomain.duckdns.org
-```
-
-For issues, please report to https://github.com/raidenii/acme.sh/issues.
-
-## 28. Use Name.com API
-
-Create your API token here: https://www.name.com/account/settings/api
-
-Note: `Namecom_Username` should be your Name.com username and not the token name.  If you accidentally run the script with the token name as the username see `~/.acme.sh/account.conf` to fix the issue
-
-```
-export Namecom_Username="testuser"
-export Namecom_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-```
-
-And now you can issue certs with:
-
-```
-acme.sh --issue --dns dns_namecom -d example.com -d www.example.com
-```
-
-For issues, please report to https://github.com/raidenii/acme.sh/issues.
-
-## 29. Use Dyn Managed DNS API to automatically issue cert
-
-First, login to your Dyn Managed DNS account: https://portal.dynect.net/login/
-
-It is recommended to add a new user specific for API access.
-
-The minimum "Zones & Records Permissions" required are:
-```
-RecordAdd
-RecordUpdate
-RecordDelete
-RecordGet
-ZoneGet
-ZoneAddNode
-ZoneRemoveNode
-ZonePublish
-```
-
-Pass the API user credentials to the environment:
-```
-export DYN_Customer="customer"
-export DYN_Username="apiuser"
-export DYN_Password="secret"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_dyn -d example.com -d www.example.com
-```
-
-The `DYN_Customer`, `DYN_Username` and `DYN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 30. Use pdd.yandex.ru API
-
-```
-export PDD_Token="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
-```
-
-Follow these instructions to get the token for your domain https://tech.yandex.com/domain/doc/concepts/access-docpage/
-```
-acme.sh --issue --dns dns_yandex -d mydomain.example.org
-```
-
-For issues, please report to https://github.com/non7top/acme.sh/issues.
-
-## 31. Use Hurricane Electric
-
-Hurricane Electric (https://dns.he.net/) doesn't have an API so just set your login credentials like so:
-
-```
-export HE_Username="yourusername"
-export HE_Password="password"
-```
-
-Then you can issue your certificate:
-
-```
-acme.sh --issue --dns dns_he -d example.com -d www.example.com
-```
-
-The `HE_Username` and `HE_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-Please report any issues to https://github.com/angel333/acme.sh or to <me@ondrejsimek.com>.
-
-## 32. Use UnoEuro API to automatically issue cert
-
-First you need to login to your UnoEuro account to get your API key.
-
-```
-export UNO_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-export UNO_User="UExxxxxx"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_unoeuro -d example.com -d www.example.com
-```
-
-The `UNO_Key` and `UNO_User` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 33. Use INWX
-
-[INWX](https://www.inwx.de/) offers an [xmlrpc api](https://www.inwx.de/de/help/apidoc)  with your standard login credentials, set them like so:
-
-```
-export INWX_User="yourusername"
-export INWX_Password="password"
-```
-
-Then you can issue your certificates with:
-
-```
-acme.sh --issue --dns dns_inwx -d example.com -d www.example.com
-```
-
-The `INWX_User` and `INWX_Password` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-If your account is secured by mobile tan you have also defined the shared secret.
-
-```
-export INWX_Shared_Secret="shared secret"
-```
-
-You may need to re-enable the mobile tan to gain the shared secret.
-
-## 34. User Servercow API v1
-
-Create a new user from the servercow control center. Don't forget to activate **DNS API** for this user.
-
-```
-export SERVERCOW_API_Username=username
-export SERVERCOW_API_Password=password
-```
-
-Now you cann issue a cert:
-
-```
-acme.sh --issue --dns dns_servercow -d example.com -d www.example.com
-```
-Both, `SERVERCOW_API_Username` and `SERVERCOW_API_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 35. Use Namesilo.com API
-
-You'll need to generate an API key at https://www.namesilo.com/account_api.php
-Optionally you may restrict the access to an IP range there.
-
-```
-export Namesilo_Key="xxxxxxxxxxxxxxxxxxxxxxxx"
-```
-
-And now you can issue certs with:
-
-```
-acme.sh --issue --dns dns_namesilo --dnssleep 900 -d example.com -d www.example.com
-```
-
-## 36. Use autoDNS (InternetX)
-
-[InternetX](https://www.internetx.com/) offers an [xml api](https://help.internetx.com/display/API/AutoDNS+XML-API)  with your standard login credentials, set them like so:
-
-```
-export AUTODNS_USER="yourusername"
-export AUTODNS_PASSWORD="password"
-export AUTODNS_CONTEXT="context"
-```
-
-Then you can issue your certificates with:
-
-```
-acme.sh --issue --dns dns_autodns -d example.com -d www.example.com
-```
-
-The `AUTODNS_USER`, `AUTODNS_PASSWORD` and `AUTODNS_CONTEXT` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 37. Use Azure DNS
-
-You have to create a service principal first. See:[How to use Azure DNS](../../../wiki/How-to-use-Azure-DNS)
-
-```
-export AZUREDNS_SUBSCRIPTIONID="12345678-9abc-def0-1234-567890abcdef"
-export AZUREDNS_TENANTID="11111111-2222-3333-4444-555555555555"
-export AZUREDNS_APPID="3b5033b5-7a66-43a5-b3b9-a36b9e7c25ed"
-export AZUREDNS_CLIENTSECRET="1b0224ef-34d4-5af9-110f-77f527d561bd"
-```
-
-Then you can issue your certificates with:
-
-```
-acme.sh --issue --dns dns_azure -d example.com -d www.example.com
-```
-
-`AZUREDNS_SUBSCRIPTIONID`, `AZUREDNS_TENANTID`,`AZUREDNS_APPID` and `AZUREDNS_CLIENTSECRET` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 38. Use selectel.com(selectel.ru) domain API to automatically issue cert
-
-First you need to login to your account to get your API key from: https://my.selectel.ru/profile/apikeys.
-
-```sh
-export SL_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
-
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_selectel -d example.com -d www.example.com
-```
-
-The `SL_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 39. Use zonomi.com domain API to automatically issue cert
-
-First you need to login to your account to find your API key from: http://zonomi.com/app/dns/dyndns.jsp
-
-Your will find your api key in the example urls:
-
-```sh
-https://zonomi.com/app/dns/dyndns.jsp?host=example.com&api_key=1063364558943540954358668888888888
-```
-
-```sh
-export ZM_Key="1063364558943540954358668888888888"
-
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_zonomi -d example.com -d www.example.com
-```
-
-The `ZM_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 40. Use DreamHost DNS API
-
-DNS API keys may be created at https://panel.dreamhost.com/?tree=home.api.
-Ensure the created key has add and remove privelages.
-
-```
-export DH_API_KEY="<api key>"
-acme.sh --issue --dns dns_dreamhost -d example.com -d www.example.com
-```
-
-The 'DH_API_KEY' will be saved in `~/.acme.sh/account.conf` and will
-be reused when needed.
-
-## 41. Use DirectAdmin API
-The DirectAdmin interface has it's own Let's encrypt functionality, but this
-script can be used to generate certificates for names which are not hosted on
-DirectAdmin
-
-User must provide login data and URL to the DirectAdmin incl. port.
-You can create an user which only has access to
-
-- CMD_API_DNS_CONTROL
-- CMD_API_SHOW_DOMAINS
-
-By using the Login Keys function.
-See also https://www.directadmin.com/api.php and https://www.directadmin.com/features.php?id=1298
-
-```
-export DA_Api="https://remoteUser:remotePassword@da.domain.tld:8443"
-export DA_Api_Insecure=1
-```
-Set `DA_Api_Insecure` to 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_da -d example.com -d www.example.com
-```
-
-The `DA_Api` and `DA_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 42. Use KingHost DNS API
-
-API access must be enabled at https://painel.kinghost.com.br/painel.api.php
-
-```
-export KINGHOST_Username="yourusername"
-export KINGHOST_Password="yourpassword"
-acme.sh --issue --dns dns_kinghost -d example.com -d *.example.com
-```
-
-The `KINGHOST_username` and `KINGHOST_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 43. Use Zilore DNS API
-
-First, get your API key at https://my.zilore.com/account/api
-
-```
-export Zilore_Key="5dcad3a2-36cb-50e8-cb92-000002f9"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_zilore -d example.com -d *.example.com
-```
-
-The `Zilore_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 44. Use Loopia.se API
-User must provide login credentials to the Loopia API.
-The user needs the following permissions:
-
-- addSubdomain
-- updateZoneRecord
-- getDomains
-- removeSubdomain
-
-Set the login credentials:
-```
-export LOOPIA_User="user@loopiaapi"
-export LOOPIA_Password="password"
-```
-
-And to issue a cert:
-```
-acme.sh --issue --dns dns_loopia -d example.com -d *.example.com
-```
-
-The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-## 45. Use ACME DNS API
-
-ACME DNS is a limited DNS server with RESTful HTTP API to handle ACME DNS challenges easily and securely.
-https://github.com/joohoi/acme-dns
-
-```
-export ACMEDNS_UPDATE_URL="https://auth.acme-dns.io/update"
-export ACMEDNS_USERNAME="<username>"
-export ACMEDNS_PASSWORD="<password>"
-export ACMEDNS_SUBDOMAIN="<subdomain>"
-
-acme.sh --issue --dns dns_acmedns -d example.com -d www.example.com
-```
-
-The credentials will be saved in `~/.acme.sh/account.conf` and will
-be reused when needed.
-## 46. Use TELE3 API
-
-First you need to login to your TELE3 account to set your API-KEY.
-https://www.tele3.cz/system-acme-api.html
-
-```
-export TELE3_Key="MS2I4uPPaI..."
-export TELE3_Secret="kjhOIHGJKHg"
-
-acme.sh --issue --dns dns_tele3 -d example.com -d *.example.com
-```
-
-The TELE3_Key and TELE3_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.
-
-## 47. Use Euserv.eu API
-
-First you need to login to your euserv.eu account and activate your API Administration (API Verwaltung).
-[https://support.euserv.com](https://support.euserv.com)
-
-Once you've activate, login to your API Admin Interface and create an API account.
-Please specify the scope (active groups: domain) and assign the allowed IPs.
-
-```
-export EUSERV_Username="99999.user123"
-export EUSERV_Password="Asbe54gHde"
-```
-
-Ok, let's issue a cert now: (Be aware to use the `--insecure` flag, cause euserv.eu is still using self-signed certificates!)
-```
-acme.sh --issue --dns dns_euserv -d example.com -d *.example.com --insecure
-```
-
-The `EUSERV_Username` and `EUSERV_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-Please report any issues to https://github.com/initit/acme.sh or to <github@initit.de>
-
-## 48. Use DNSPod.com domain API to automatically issue cert
-
-First you need to get your API Key and ID by this [get-the-user-token](https://www.dnspod.com/docs/info.html#get-the-user-token).
-
-```
-export DPI_Id="1234"
-export DPI_Key="sADDsdasdgdsf"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_dpi -d example.com -d www.example.com
-```
-
-The `DPI_Id` and `DPI_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 49. Use Google Cloud DNS API to automatically issue cert
-
-First you need to authenticate to gcloud.
-
-```
-gcloud init
-```
-
-**The `dns_gcloud` script uses the active gcloud configuration and credentials.**
-There is no logic inside `dns_gcloud` to override the project and other settings.
-If needed, create additional [gcloud configurations](https://cloud.google.com/sdk/gcloud/reference/topic/configurations).
-You can change the configuration being used without *activating* it; simply set the `CLOUDSDK_ACTIVE_CONFIG_NAME` environment variable.
-
-To issue a certificate you can:
-```
-export CLOUDSDK_ACTIVE_CONFIG_NAME=default  # see the note above
-acme.sh --issue --dns dns_gcloud -d example.com -d '*.example.com'
-```
-
-`dns_gcloud` also supports [DNS alias mode](https://github.com/Neilpang/acme.sh/wiki/DNS-alias-mode).
-
-## 50. Use ConoHa API
-
-First you need to login to your ConoHa account to get your API credentials.
-
-```
-export CONOHA_Username="xxxxxx"
-export CONOHA_Password="xxxxxx"
-export CONOHA_TenantId="xxxxxx"
-export CONOHA_IdentityServiceApi="https://identity.xxxx.conoha.io/v2.0"
-```
-
-To issue a cert:
-```
-acme.sh --issue --dns dns_conoha -d example.com -d www.example.com
-```
-
-The `CONOHA_Username`, `CONOHA_Password`, `CONOHA_TenantId` and `CONOHA_IdentityServiceApi` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 51. Use netcup DNS API to automatically issue cert
-
-First you need to login in your CCP account to get your API Key and API Password.
-```
-export NC_Apikey="<Apikey>"
-export NC_Apipw="<Apipassword>"
-export NC_CID="<Customernumber>"
-```
-
-Now, let's issue a cert:
-```
-acme.sh --issue --dns dns_netcup -d example.com -d www.example.com
-```
-
-The `NC_Apikey`,`NC_Apipw` and `NC_CID` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-## 52. Use GratisDNS.dk
-
-GratisDNS.dk (https://gratisdns.dk/) does not provide an API to update DNS records (other than IPv4 and IPv6
-dynamic DNS addresses).  The acme.sh plugin therefore retrieves and updates domain TXT records by logging
-into the GratisDNS website to read the HTML and posting updates as HTTP.  The plugin needs to know your
-userid and password for the GratisDNS website.
-
-```sh
-export GDNSDK_Username="..."
-export GDNSDK_Password="..."
-```
-The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-
-Now you can issue a certificate.
-
-Note: It usually takes a few minutes (usually 3-4 minutes) before the changes propagates to gratisdns.dk nameservers (ns3.gratisdns.dk often are slow),
-and in rare cases I have seen over 5 minutes before google DNS catches it. Therefor a DNS sleep of at least 300 seconds are recommended-
-
-```sh
-acme.sh --issue --dns dns_gdnsdk --dnssleep 300 -d example.com -d *.example.com
-```
-
-## 53. Use Namecheap
-
-You will need your namecheap username, API KEY (https://www.namecheap.com/support/api/intro.aspx) and your external IP address (or an URL to get it), this IP will need to be whitelisted at Namecheap.
-Due to Namecheap's API limitation all the records of your domain will be read and re applied, make sure to have a backup of your records you could apply if any issue would arise.
-
-```sh
-export NAMECHEAP_USERNAME="..."
-export NAMECHEAP_API_KEY="..."
-export NAMECHEAP_SOURCEIP="..."
-```
-
-NAMECHEAP_SOURCEIP can either be an IP address or an URL to provide it (e.g. https://ifconfig.co/ip).
-
-The username and password will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-Now you can issue a certificate.
-
-```sh
-acme.sh --issue --dns dns_namecheap -d example.com -d *.example.com
-```
-
-## 54. Use MyDNS.JP API
-
-First, register to MyDNS.JP and get MasterID and Password.
-
-```
-export MYDNSJP_MasterID=MasterID
-export MYDNSJP_Password=Password
-```
-
-To issue a certificate:
-
-```
-acme.sh --issue --dns dns_mydnsjp -d example.com -d www.example.com
-```
-The `MYDNSJP_MasterID` and `MYDNSJP_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 55. Use hosting.de API
-
-Create an API key in your hosting.de account here: https://secure.hosting.de
-
-The key needs the following rights:
-- DNS_ZONES_EDIT
-- DNS_ZONES_LIST
-
-Set your API Key and endpoint:
-
-```
-export HOSTINGDE_APIKEY='xxx'
-export HOSTINGDE_ENDPOINT='https://secure.hosting.de'
-```
-
-The plugin can also be used for the http.net API. http.net customers have to set endpoint to https://partner.http.net.
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_hostingde -d example.com -d *.example.com
-```
-
-The hosting.de API key and endpoint will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 56. Use Neodigit.net API
-
-```
-export NEODIGIT_API_TOKEN="eXJxTkdUVUZmcHQ3QWJackQ4ZGlMejRDSklRYmo5VG5zcFFKK2thYnE0WnVnNnMy"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_neodigit -d example.com -d www.example.com
-```
-
-Neodigit API Token will be saved in `~/.acme.sh/account.conf` and will be used when needed.
-
-## 57. Use Exoscale API
-
-Create an API key and secret key in the Exoscale account section
-
-Set your API and secret key:
-
-```
-export EXOSCALE_API_KEY='xxx'
-export EXOSCALE_SECRET_KEY='xxx'
-```
-
-Now, let's issue a cert:
-```
-acme.sh --issue --dns dns_exoscale -d example.com -d www.example.com
-```
-
-The `EXOSCALE_API_KEY` and `EXOSCALE_SECRET_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 58. Using PointHQ API to issue certs
-
-Log into [PointHQ account management](https://app.pointhq.com/profile) and copy the API key from the page there.
-
-```export PointHQ_Key="apikeystringgoeshere"
-exportPointHQ_Email="accountemail@yourdomain.com"
-```
-
-You can then issue certs by using:
-```acme.sh --issue --dns dns_pointhq -d example.com -d www.example.com
-```
-
-## 59. Use Active24 API
-
-Create an API token in the Active24 account section, documentation on https://faq.active24.com/cz/790131-REST-API-rozhran%C3%AD.
-
-Set your API token:
-
-```
-export ACTIVE24_Token='xxx'
-```
-
-Now, let's issue a cert, set `dnssleep` for propagation new DNS record:
-```
-acme.sh --issue --dns dns_active24 -d example.com -d www.example.com --dnssleep 1000
-```
-
-The `ACTIVE24_Token` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 60. Use do.de API
-
-Create an API token in your do.de account ([Create token here](https://www.do.de/account/letsencrypt/) | [Documentation](https://www.do.de/wiki/LetsEncrypt_-_Entwickler)).
-
-Set your API token:
-```
-export DO_LETOKEN='FmD408PdqT1E269gUK57'
-```
-
-To issue a certificate run:
-```
-acme.sh --issue --dns dns_doapi -d example.com -d *.example.com
-```
-
-The API token will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 61. Use Nexcess API
-
-First, you'll need to login to the [Nexcess.net Client Portal](https://portal.nexcess.net) and [generate a new API token](https://portal.nexcess.net/api-token).
-
-Once you have a token, set it in your systems environment:
-
-```
-export NW_API_TOKEN="YOUR_TOKEN_HERE"
-export NW_API_ENDPOINT="https://portal.nexcess.net"
-```
-
-Finally, we'll issue the certificate: (Nexcess DNS publishes at max every 15 minutes, we recommend setting a 900 second `--dnssleep`)
-
-```
-acme.sh --issue --dns dns_nw -d example.com --dnssleep 900
-```
-
-The `NW_API_TOKEN` and `NW_API_ENDPOINT` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 62. Use Thermo.io API
-
-First, you'll need to login to the [Thermo.io Client Portal](https://core.thermo.io) and [generate a new API token](https://core.thermo.io/api-token).
-
-Once you have a token, set it in your systems environment:
-
-```
-export NW_API_TOKEN="YOUR_TOKEN_HERE"
-export NW_API_ENDPOINT="https://core.thermo.io"
-```
-
-Finally, we'll issue the certificate: (Thermo DNS publishes at max every 15 minutes, we recommend setting a 900 second `--dnssleep`)
-
-```
-acme.sh --issue --dns dns_nw -d example.com --dnssleep 900
-```
-
-The `NW_API_TOKEN` and `NW_API_ENDPOINT` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 63. Use Futurehosting API
-
-First, you'll need to login to the [Futurehosting Client Portal](https://my.futurehosting.com) and [generate a new API token](https://my.futurehosting.com/api-token).
-
-Once you have a token, set it in your systems environment:
-
-```
-export NW_API_TOKEN="YOUR_TOKEN_HERE"
-export NW_API_ENDPOINT="https://my.futurehosting.com"
-```
-
-Finally, we'll issue the certificate: (Futurehosting DNS publishes at max every 15 minutes, we recommend setting a 900 second `--dnssleep`)
-
-```
-acme.sh --issue --dns dns_nw -d example.com --dnssleep 900
-```
-
-The `NW_API_TOKEN` and `NW_API_ENDPOINT` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 64. Use Rackspace API
-
-Set username and API key, which is available under "My Profile & Settings"
-
-```
-export RACKSPACE_Username='username'
-export RACKSPACE_Apikey='xxx'
-```
-
-Now, let's issue a cert:
-
-```
-acme.sh --issue --dns dns_rackspace -d example.com -d www.example.com
-```
-
-## 65. Use Online API
-
-First, you'll need to retrive your API key, which is available under https://console.online.net/en/api/access
-
-```
-export ONLINE_API_KEY='xxx'
-```
-
-To issue a cert run:
-
-```
-acme.sh --issue --dns dns_online -d example.com -d www.example.com
-```
-
-`ONLINE_API_KEY` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 66. Use MyDevil.net
-
-Make sure that you can execute own binaries:
-
-```sh
-devil binexec on
-```
-
-Install acme.sh, or simply `git clone` it into some directory on your MyDevil host account (in which case you should link to it from your `~/bin` directory).
-
-If you're not using private IP and depend on default IP provided by host, you may want to edit `crontab` too, and make sure that `acme.sh --cron` is run also after reboot (you can find out how to do that on their wiki pages).
-
-To issue a new certificate, run:
-
-```sh
-acme.sh --issue --dns dns_mydevil -d example.com -d *.example.com
-```
-
-After certificate is ready, you can install it with [deploy command](../deploy/README.md#14-deploy-your-cert-on-mydevilnet).
-
-## 67. Use Core-Networks API to automatically issue cert
-
-First you need to login to your Core-Networks account to to set up an API-User.
-Then export username and password to use these credentials.
-
-```
-export CN_User="user"
-export CN_Password="passowrd"
-```
-
-Ok, let's issue a cert now:
-```
-acme.sh --issue --dns dns_cn -d example.com -d www.example.com
-```
-
-The `CN_User` and `CN_Password` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 68. Use NederHost API
-
-Create an API token in Mijn NederHost.
-
-Set your API key:
-```
-export NederHost_Key='xxx'
-```
-
-To issue a certificate run:
-```
-acme.sh --issue --dns dns_nederhost -d example.com -d *.example.com
-```
-
-## 69. Use Zone.ee DNS API
-
-First, you'll need to retrive your API key. Estonian insructions https://help.zone.eu/kb/zoneid-api-v2/
-
-```
-export ZONE_Username=yourusername
-export ZONE_Key=keygoeshere
-```
-
-To issue a cert run:
-
-```
-acme.sh --issue -d example.com -d www.example.com --dns dns_zone
-```
-
-`ZONE_Username` and `ZONE_Key` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
-
-## 70. Use UltraDNS API
-
-UltraDNS is a paid for service that provides DNS, as well as Web and Mail forwarding (as well as reporting, auditing, and advanced tools).
-
-More information can be found here: https://www.security.neustar/lp/ultra20/index.html
-
-The REST API documentation for this service is found here: https://portal.ultradns.com/static/docs/REST-API_User_Guide.pdf 
-
-Set your UltraDNS User name, and password; these would be the same you would use here:
-
-https://portal.ultradns.com/ - or if you create an API only user, that username and password would be better utilized.
-
-```
-export ULTRA_USR="abcd"
-export ULTRA_PWD="efgh"
-
-To issue a cert run:
-
-acme.sh --issue --dns dns_ultra -d example.com -d www.example.com
-```
-
-`ULTRA_USR` and `ULTRA_PWD` will be saved in `~/.acme.sh/account.conf` and will be resued when needed.
-
-# Use custom API
-
-If your API is not supported yet, you can write your own DNS API.
-
-Let's assume you want to name it 'myapi':
-
-1. Create a bash script named `~/.acme.sh/dns_myapi.sh`,
-2. In the script you must have a function named `dns_myapi_add()` which will be called by acme.sh to add the DNS records.
-3. Then you can use your API to issue cert like this:
-
-```
-acme.sh --issue --dns dns_myapi -d example.com -d www.example.com
-```
-
-For more details, please check our sample script: [dns_myapi.sh](dns_myapi.sh)
-
-See:  https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-
-# Use lexicon DNS API
-
-https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
+https://github.com/Neilpang/acme.sh/wiki/dnsapi
 
 

From 61bcd67a5d34e0183b421c5d941fa602706e3394 Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 20 Mar 2019 23:03:49 +0800
Subject: [PATCH 51/53] move to wiki

---
 deploy/README.md | 411 +----------------------------------------------
 1 file changed, 2 insertions(+), 409 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index 8cced4d8..fc633ad7 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -1,413 +1,6 @@
 # Using deploy api
 
-Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
+deploy hook usage:
 
-Here are the scripts to deploy the certs/key to the server/services.
+https://github.com/Neilpang/acme.sh/wiki/deployhooks
 
-## 1. Deploy the certs to your cpanel host
-
-If you want to deploy using cpanel UAPI see 7.
-
-(cpanel deploy hook is not finished yet, this is just an example.)
-
-
-
-Then you can deploy now:
-
-```sh
-export DEPLOY_CPANEL_USER=myusername
-export DEPLOY_CPANEL_PASSWORD=PASSWORD
-acme.sh --deploy -d example.com --deploy-hook cpanel
-```
-
-## 2. Deploy ssl cert on kong proxy engine based on api
-
-Before you can deploy your cert, you must [issue the cert first](https://github.com/Neilpang/acme.sh/wiki/How-to-issue-a-cert).
-Currently supports Kong-v0.10.x.
-
-```sh
-acme.sh --deploy -d ftp.example.com --deploy-hook kong
-```
-
-## 3. Deploy the cert to remote server through SSH access
-
-The ssh deploy plugin allows you to deploy certificates to a remote host
-using SSH command to connect to the remote server.  The ssh plugin is invoked
-with the following command...
-
-```sh
-acme.sh --deploy -d example.com --deploy-hook ssh
-```
-Prior to running this for the first time you must tell the plugin where
-and how to deploy the certificates.  This is done by exporting the following
-environment variables.  This is not required for subsequent runs as the
-values are stored by acme.sh in the domain configuration files.
-
-Required...
-```
-export DEPLOY_SSH_USER=username
-```
-Optional...
-```
-export DEPLOY_SSH_CMD=custom ssh command
-export DEPLOY_SSH_SERVER=url or ip address of remote host
-export DEPLOY_SSH_KEYFILE=filename for private key
-export DEPLOY_SSH_CERTFILE=filename for certificate file
-export DEPLOY_SSH_CAFILE=filename for intermediate CA file
-export DEPLOY_SSH_FULLCHAIN=filename for fullchain file
-export DEPLOY_SSH_REMOTE_CMD=command to execute on remote host
-export DEPLOY_SSH_BACKUP=yes or no
-```
-
-**DEPLOY_SSH_USER**
-Username at the remote host that SSH will login with. Note that
-SSH must be able to login to remote host without a password... SSH Keys
-must have been exchanged with the remote host. Validate and test that you
-can login to USER@URL from the host running acme.sh before using this script.
-
-The USER@URL at the remote server must also have has permissions to write to
-the target location of the certificate files and to execute any commands
-(e.g. to stop/start services).
-
-**DEPLOY_SSH_CMD**
-You can customize the ssh command used to connect to the remote host. For example
-if you need to connect to a specific port at the remote server you can set this
-to, for example, "ssh -p 22" or to use `sshpass` to provide password inline
-instead of exchanging ssh keys (this is not recommended, using keys is
-more secure).
-
-**DEPLOY_SSH_SERVER**
-URL or IP Address of the remote server.  If not provided then the domain
-name provided on the acme.sh --deploy command line is used.
-
-**DEPLOY_SSH_KEYFILE**
-Target filename for the private key issued by LetsEncrypt.
-
-**DEPLOY_SSH_CERTFILE**
-Target filename for the certificate issued by LetsEncrypt.
-If this is the same as the previous filename (for keyfile) then it is
-appended to the same file.
-
-**DEPLOY_SSH_CAFILE**
-Target filename for the CA intermediate certificate issued by LetsEncrypt.
-If this is the same as a previous filename (for keyfile or certfile) then
-it is appended to the same file.
-
-**DEPLOY_SSH_FULLCHAIN**
-Target filename for the fullchain certificate issued by LetsEncrypt.
-If this is the same as a previous filename (for keyfile, certfile or
-cafile) then it is appended to the same file.
-
-**DEPLOY_SSH_REMOTE_CMD**
-Command to execute on the remote server after copying any certificates.  This
-could be any additional command required for example to stop and restart
-the service.
-
-**DEPLOY_SSH_BACKUP**
-Before writing a certificate file to the remote server the existing
-certificate will be copied to a backup directory on the remote server.
-These are placed in a hidden directory in the home directory of the SSH
-user
-```sh
-~/.acme_ssh_deploy/[domain name]-backup-[timestamp]
-```
-Any backups older than 180 days will be deleted when new certificates
-are deployed.  This defaults to "yes" set to "no" to disable backup.
-
-###Examples using SSH deploy
-The following example illustrates deploying certificates to a QNAP NAS
-(tested with QTS version 4.2.3)
-
-```sh
-export DEPLOY_SSH_USER="admin"
-export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
-export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
-export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
-export DEPLOY_SSH_REMOTE_CMD="/etc/init.d/stunnel.sh restart"
-
-acme.sh --deploy -d qnap.example.com --deploy-hook ssh
-```
-Note how in this example both the private key and certificate point to
-the same file.  This will result in the certificate being appended
-to the same file as the private key... a common requirement of several
-services.
-
-The next example illustrates deploying certificates to a Unifi
-Controller (tested with version 5.4.11).
-
-```sh
-export DEPLOY_SSH_USER="root"
-export DEPLOY_SSH_KEYFILE="/var/lib/unifi/unifi.example.com.key"
-export DEPLOY_SSH_FULLCHAIN="/var/lib/unifi/unifi.example.com.cer"
-export DEPLOY_SSH_REMOTE_CMD="openssl pkcs12 -export \
-   -inkey /var/lib/unifi/unifi.example.com.key \
-   -in /var/lib/unifi/unifi.example.com.cer \
-   -out /var/lib/unifi/unifi.example.com.p12 \
-   -name ubnt -password pass:temppass \
- && keytool -importkeystore -deststorepass aircontrolenterprise \
-   -destkeypass aircontrolenterprise \
-   -destkeystore /var/lib/unifi/keystore \
-   -srckeystore /var/lib/unifi/unifi.example.com.p12 \
-   -srcstoretype PKCS12 -srcstorepass temppass -alias ubnt -noprompt \
- && service unifi restart"
-
-acme.sh --deploy -d unifi.example.com --deploy-hook ssh
-```
-In this example we execute several commands on the remote host
-after the certificate files have been copied... to generate a pkcs12 file
-compatible with Unifi, to import it into the Unifi keystore and then finally
-to restart the service.
-
-Note also that once the certificate is imported
-into the keystore the individual certificate files are no longer
-required. We could if we desired delete those files immediately. If we
-do that then we should disable backup at the remote host (as there are
-no files to backup -- they were erased during deployment). For example...
-```sh
-export DEPLOY_SSH_BACKUP=no
-# modify the end of the remote command...
-&& rm /var/lib/unifi/unifi.example.com.key \
-      /var/lib/unifi/unifi.example.com.cer \
-      /var/lib/unifi/unifi.example.com.p12 \
-&& service unifi restart
-```
-
-## 4. Deploy the cert to local vsftpd server
-
-```sh
-acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
-```
-
-The default vsftpd conf file is `/etc/vsftpd.conf`,  if your vsftpd conf is not in the default location, you can specify one:
-
-```sh
-export DEPLOY_VSFTPD_CONF="/etc/vsftpd.conf"
-
-acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
-```
-
-The default command to restart vsftpd server is `service vsftpd restart`, if it doesn't work, you can specify one:
-
-```sh
-export DEPLOY_VSFTPD_RELOAD="/etc/init.d/vsftpd restart"
-
-acme.sh --deploy -d ftp.example.com --deploy-hook vsftpd
-```
-
-## 5. Deploy the cert to local exim4 server
-
-```sh
-acme.sh --deploy -d ftp.example.com --deploy-hook exim4
-```
-
-The default exim4 conf file is `/etc/exim/exim.conf`,  if your exim4 conf is not in the default location, you can specify one:
-
-```sh
-export DEPLOY_EXIM4_CONF="/etc/exim4/exim4.conf.template"
-
-acme.sh --deploy -d ftp.example.com --deploy-hook exim4
-```
-
-The default command to restart exim4 server is `service exim4 restart`, if it doesn't work, you can specify one:
-
-```sh
-export DEPLOY_EXIM4_RELOAD="/etc/init.d/exim4 restart"
-
-acme.sh --deploy -d ftp.example.com --deploy-hook exim4
-```
-
-## 6. Deploy the cert to OSX Keychain
-
-```sh
-acme.sh --deploy -d ftp.example.com --deploy-hook keychain
-```
-
-## 7. Deploy to cpanel host using UAPI
-
-This hook is using UAPI and works in cPanel & WHM version 56 or newer.
-```
-acme.sh  --deploy  -d example.com  --deploy-hook cpanel_uapi
-```
-DEPLOY_CPANEL_USER is required only if you run the script as root and it should contain cpanel username.
-```sh
-export DEPLOY_CPANEL_USER=username
-acme.sh  --deploy  -d example.com  --deploy-hook cpanel_uapi
-```
-Please note, that the cpanel_uapi hook will deploy only the first domain when your certificate will automatically renew. Therefore you should issue a separate certificate for each domain. 
-
-## 8. Deploy the cert to your FRITZ!Box router
-
-You must specify the credentials that have administrative privileges on the FRITZ!Box in order to deploy the certificate, plus the URL of your FRITZ!Box, through the following environment variables:
-```sh
-$ export DEPLOY_FRITZBOX_USERNAME=my_username
-$ export DEPLOY_FRITZBOX_PASSWORD=the_password
-$ export DEPLOY_FRITZBOX_URL=https://fritzbox.example.com
-```
-
-After the first deployment, these values will be stored in your $HOME/.acme.sh/account.conf. You may now deploy the certificate like this:
-
-```sh
-acme.sh --deploy -d fritzbox.example.com --deploy-hook fritzbox
-```
-
-## 9. Deploy the cert to strongswan
-
-```sh
-acme.sh --deploy -d ftp.example.com --deploy-hook strongswan
-```
-
-## 10. Deploy the cert to HAProxy
-
-You must specify the path where you want the concatenated key and certificate chain written.
-```sh
-export DEPLOY_HAPROXY_PEM_PATH=/etc/haproxy
-```
-
-You may optionally define the command to reload HAProxy. The value shown below will be used as the default if you don't set this environment variable.
-
-```sh
-export DEPLOY_HAPROXY_RELOAD="/usr/sbin/service haproxy restart"
-```
-
-You can then deploy the certificate as follows
-```sh
-acme.sh --deploy -d haproxy.example.com --deploy-hook haproxy
-```
-
-The path for the PEM file will be stored with the domain configuration and will be available when renewing, so that deploy will happen automatically when renewed.
-
-## 11. Deploy your cert to Gitlab pages
-
-You must define the API key and the informations for the project and Gitlab page you are updating the certificate for.
-
-```sh
-# The token can be created in your user settings under "Access Tokens"
-export GITLAB_TOKEN="xxxxxxxxxxx"
-
-# The project ID is displayed on the home page of the project
-export GITLAB_PROJECT_ID=12345678
-
-# The domain must match the one defined for the Gitlab page, without "https://"
-export GITLAB_DOMAIN="www.mydomain.com"
-```
-
-You can then deploy the certificate as follows
-
-```sh
-acme.sh --deploy -d www.mydomain.com --deploy-hook gitlab
-```
-
-## 12. Deploy your cert to Hashicorp Vault
-
-```sh
-export VAULT_PREFIX="acme"
-```
-
-You can then deploy the certificate as follows
-
-```sh
-acme.sh --deploy -d www.mydomain.com --deploy-hook vault_cli
-```
-
-Your certs will be saved in Vault using this structure:
-
-```sh
-vault write "${VAULT_PREFIX}/${domain}/cert.pem"      value=@"..."
-vault write "${VAULT_PREFIX}/${domain}/cert.key"      value=@"..."
-vault write "${VAULT_PREFIX}/${domain}/chain.pem"     value=@"..."
-vault write "${VAULT_PREFIX}/${domain}/fullchain.pem" value=@"..."
-```
-
-You might be using Fabio load balancer (which can get certs from
-Vault). It needs a bit different structure of your certs in Vault. It
-gets certs only from keys that were saved in `prefix/domain`, like this:
-
-```bash
-vault write <PREFIX>/www.domain.com cert=@cert.pem key=@key.pem
-```
-
-If you want to save certs in Vault this way just set "FABIO" env
-variable to anything (ex: "1") before running `acme.sh`:
-
-```sh
-export FABIO="1"
-```
-
-## 13. Deploy your certificate to Qiniu.com
-
-使用 acme.sh 部署到七牛之前，需要确保部署的域名已打开 HTTPS 功能，您可以访问[融合 CDN - 域名管理](https://portal.qiniu.com/cdn/domain) 设置。
-另外还需要先导出 AK/SK 环境变量，您可以访问[密钥管理](https://portal.qiniu.com/user/key) 获得。
-
-```sh
-$ export QINIU_AK="foo"
-$ export QINIU_SK="bar"
-```
-
-完成准备工作之后，您就可以通过下面的命令开始部署 SSL 证书到七牛上：
-
-```sh
-$ acme.sh --deploy -d example.com --deploy-hook qiniu
-```
-
-假如您部署的证书为泛域名证书，您还需要设置 `QINIU_CDN_DOMAIN` 变量，指定实际需要部署的域名(请注意泛域名前的点)：
-
-```sh
-$ export QINIU_CDN_DOMAIN=".cdn.example.com"
-$ acme.sh --deploy -d example.com --deploy-hook qiniu
-```
-
-### English version
-
-You should create AccessKey/SecretKey pair in https://portal.qiniu.com/user/key 
-before deploying your certificate, and please ensure you have enabled HTTPS for
-your domain name. You can enable it in https://portal.qiniu.com/cdn/domain.
-
-```sh
-$ export QINIU_AK="foo"
-$ export QINIU_SK="bar"
-```
-
-then you can deploy certificate by following command:
-
-```sh
-$ acme.sh --deploy -d example.com --deploy-hook qiniu
-```
-
-(Optional), If you are using wildcard certificate,
-you may need export `QINIU_CDN_DOMAIN` to specify which domain
-you want to update (please note the leading dot):
-
-```sh
-$ export QINIU_CDN_DOMAIN=".cdn.example.com"
-$ acme.sh --deploy -d example.com --deploy-hook qiniu
-```
-
-## 14. Deploy your cert on MyDevil.net
-
-Once you have acme.sh installed and certificate issued (see info in [DNS API](../dnsapi/README.md#61-use-mydevilnet)), you can install it by following command:
-
-```sh
-acme.sh --deploy --deploy-hook mydevil -d example.com
-```
-
-That will remove old certificate and install new one.
-
-## 15. Deploy your cert to local mailcow server
-
-You can install your certificates to a local [mailcow](https://github.com/mailcow/mailcow-dockerized/) instance. The
-deploy hook will copy the certificates and reload the containers, that use the certificates (`postfix-mailcow`
-`dovecot-mailcow` and `nginx-mailcow`).
-
-```sh
-$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
-$ acme.sh --deploy -d example.com --deploy-hook mailcow
-```
-
-The default command to restart is `docker-compose restart postfix-mailcow dovecot-mailcow nginx-mailcow`, if you want a
-custom restart command, specify it by setting `DEPLOY_MAILCOW_RELOAD`:
-
-```sh
-$ export DEPLOY_MAILCOW_PATH="/path/to/mailcow"
-$ export DEPLOY_MAILCOW_RELOAD="docker-compose restart"
-$ acme.sh --deploy -d example.com --deploy-hook mailcow
-```

From 236acbd6e8c45f68d0cecc648cd124796ae4427f Mon Sep 17 00:00:00 2001
From: neilpang <neil@neilpang.com>
Date: Wed, 20 Mar 2019 23:11:13 +0800
Subject: [PATCH 52/53] move to wiki

---
 README.md | 84 ++-----------------------------------------------------
 1 file changed, 2 insertions(+), 82 deletions(-)

diff --git a/README.md b/README.md
index 68d1b57d..6682c556 100644
--- a/README.md
+++ b/README.md
@@ -290,90 +290,10 @@ If your DNS provider supports API access, we can use that API to automatically i
 
 You don't have to do anything manually!
 
-### Currently acme.sh supports:
+### Currently acme.sh supports most of the dns providers:
 
-1. CloudFlare.com API
-1. DNSPod.cn API
-1. CloudXNS.com API
-1. GoDaddy.com API
-1. PowerDNS.com API
-1. OVH, kimsufi, soyoustart and runabove API
-1. nsupdate API
-1. LuaDNS.com API
-1. DNSMadeEasy.com API
-1. AWS Route 53
-1. aliyun.com(阿里云) API
-1. ISPConfig 3.1 API
-1. Alwaysdata.com API
-1. Linode.com API
-1. FreeDNS (https://freedns.afraid.org/)
-1. cyon.ch
-1. Domain-Offensive/Resellerinterface/Domainrobot API
-1. Gandi LiveDNS API
-1. Knot DNS API
-1. DigitalOcean API (native)
-1. ClouDNS.net API
-1. Infoblox NIOS API (https://www.infoblox.com/)
-1. VSCALE (https://vscale.io/)
-1. Dynu API (https://www.dynu.com)
-1. DNSimple API
-1. NS1.com API
-1. DuckDNS.org API
-1. Name.com API
-1. Dyn Managed DNS API
-1. Yandex PDD API (https://pdd.yandex.ru)
-1. Hurricane Electric DNS service (https://dns.he.net)
-1. UnoEuro API (https://www.unoeuro.com/)
-1. INWX (https://www.inwx.de/)
-1. Servercow (https://servercow.de)
-1. Namesilo (https://www.namesilo.com)
-1. InternetX autoDNS API (https://internetx.com)
-1. Azure DNS
-1. selectel.com(selectel.ru) DNS API
-1. zonomi.com DNS API
-1. DreamHost.com API
-1. DirectAdmin API
-1. KingHost (https://www.kinghost.com.br/)
-1. Zilore (https://zilore.com)
-1. Loopia.se API
-1. acme-dns (https://github.com/joohoi/acme-dns)
-1. TELE3 (https://www.tele3.cz)
-1. EUSERV.EU (https://www.euserv.eu)
-1. DNSPod.com API (https://www.dnspod.com)
-1. Google Cloud DNS API
-1. ConoHa (https://www.conoha.jp)
-1. netcup DNS API (https://www.netcup.de)
-1. GratisDNS.dk (https://gratisdns.dk)
-1. Namecheap API (https://www.namecheap.com/)
-1. MyDNS.JP API (https://www.mydns.jp/)
-1. hosting.de (https://www.hosting.de)
-1. Neodigit.net API (https://www.neodigit.net)
-1. Exoscale.com API (https://www.exoscale.com/)
-1. PointDNS API (https://pointhq.com/)
-1. Active24.cz API (https://www.active24.cz/)
-1. do.de API (https://www.do.de/)
-1. Nexcess API (https://www.nexcess.net)
-1. Thermo.io API (https://www.thermo.io)
-1. Futurehosting API (https://www.futurehosting.com)
-1. Rackspace Cloud DNS (https://www.rackspace.com)
-1. Online.net API (https://online.net/)
-1. MyDevil.net (https://www.mydevil.net/)
-1. Core-Networks.de (https://core-networks.de)
-1. NederHost API (https://www.nederhost.nl/)
-1. Zone.ee (zone.eu) API (https://api.zone.eu/v2)
-1. UltraDNS API (https://portal.ultradns.com)
+https://github.com/Neilpang/acme.sh/wiki/dnsapi
 
-And:
-
-**lexicon DNS API: https://github.com/Neilpang/acme.sh/wiki/How-to-use-lexicon-dns-api
-   (DigitalOcean, DNSimple, DNSMadeEasy, DNSPark, EasyDNS, Namesilo, NS1, PointHQ, Rage4 and Vultr etc.)**
-
-
-**More APIs coming soon...**
-
-If your DNS provider is not on the supported list above, you can write your own DNS API script easily. If you do, please consider submitting a [Pull Request](https://github.com/Neilpang/acme.sh/pulls) and contribute it to the project.
-
-For more details: [How to use DNS API](dnsapi)
 
 # 9. Use DNS manual mode:
 

From 3bb97b81ded2d7528cd432d2219df69af5de2870 Mon Sep 17 00:00:00 2001
From: James Qian <sotux82@gmail.com>
Date: Thu, 14 Mar 2019 13:26:58 +0800
Subject: [PATCH 53/53] dnsapi: add deSEC.io api support

Signed-off-by: James Qian <sotux82@gmail.com>
---
 dnsapi/dns_desec.sh | 204 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 204 insertions(+)
 create mode 100644 dnsapi/dns_desec.sh

diff --git a/dnsapi/dns_desec.sh b/dnsapi/dns_desec.sh
new file mode 100644
index 00000000..6488b7fb
--- /dev/null
+++ b/dnsapi/dns_desec.sh
@@ -0,0 +1,204 @@
+#!/usr/bin/env sh
+#
+# deSEC.io Domain API
+#
+# Author: Zheng Qian
+#
+# deSEC API doc
+# https://desec.readthedocs.io/en/latest/
+
+REST_API="https://desec.io/api/v1/domains"
+
+########  Public functions #####################
+
+#Usage: dns_desec_add   _acme-challenge.foobar.dedyn.io   "d41d8cd98f00b204e9800998ecf8427e"
+dns_desec_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using desec.io api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
+  DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
+
+  if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
+    DEDYN_TOKEN=""
+    DEDYN_NAME=""
+    _err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
+    _err "Please create you key and try again."
+    _err "e.g."
+    _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
+    _err "export DEDYN_NAME=foobar.dedyn.io"
+    return 1
+  fi
+  #save the api token and name to the account conf file.
+  _saveaccountconf_mutable DEDYN_TOKEN "$DEDYN_TOKEN"
+  _saveaccountconf_mutable DEDYN_NAME "$DEDYN_NAME"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain" "$REST_API/"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  # Get existing TXT record
+  _debug "Getting txt records"
+  txtvalues="\"\\\"$txtvalue\\\"\""
+  _desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
+
+  if [ "$_code" = "200" ]; then
+    oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
+    _debug "existing TXT found"
+    _debug oldtxtvalues "$oldtxtvalues"
+    if [ -n "$oldtxtvalues" ]; then
+      for oldtxtvalue in $oldtxtvalues; do
+        txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
+      done
+    fi
+  fi
+  _debug txtvalues "$txtvalues"
+  _info "Adding record"
+  body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
+
+  if _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"; then
+    if _contains "$response" "$txtvalue"; then
+      _info "Added, OK"
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+
+  _err "Add txt record error."
+  return 1
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_desec_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using desec.io api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  DEDYN_TOKEN="${DEDYN_TOKEN:-$(_readaccountconf_mutable DEDYN_TOKEN)}"
+  DEDYN_NAME="${DEDYN_NAME:-$(_readaccountconf_mutable DEDYN_NAME)}"
+
+  if [ -z "$DEDYN_TOKEN" ] || [ -z "$DEDYN_NAME" ]; then
+    DEDYN_TOKEN=""
+    DEDYN_NAME=""
+    _err "You don't specify DEDYN_TOKEN and DEDYN_NAME yet."
+    _err "Please create you key and try again."
+    _err "e.g."
+    _err "export DEDYN_TOKEN=d41d8cd98f00b204e9800998ecf8427e"
+    _err "export DEDYN_NAME=foobar.dedyn.io"
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain" "$REST_API/"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  # Get existing TXT record
+  _debug "Getting txt records"
+  txtvalues=""
+  _desec_rest GET "$REST_API/$DEDYN_NAME/rrsets/$_sub_domain/TXT/"
+
+  if [ "$_code" = "200" ]; then
+    oldtxtvalues="$(echo "$response" | _egrep_o "\"records\":\\[\"\\S*\"\\]" | cut -d : -f 2 | tr -d "[]\\\\\"" | sed "s/,/ /g")"
+    _debug "existing TXT found"
+    _debug oldtxtvalues "$oldtxtvalues"
+    if [ -n "$oldtxtvalues" ]; then
+      for oldtxtvalue in $oldtxtvalues; do
+        if [ "$txtvalue" != "$oldtxtvalue" ]; then
+          txtvalues="$txtvalues, \"\\\"$oldtxtvalue\\\"\""
+        fi
+      done
+    fi
+  fi
+  txtvalues="$(echo "$txtvalues" | cut -c3-)"
+  _debug txtvalues "$txtvalues"
+
+  _info "Deleting record"
+  body="[{\"subname\":\"$_sub_domain\", \"type\":\"TXT\", \"records\":[$txtvalues], \"ttl\":60}]"
+  _desec_rest PUT "$REST_API/$DEDYN_NAME/rrsets/" "$body"
+  if [ "$_code" = "200" ]; then
+    _info "Deleted, OK"
+    return 0
+  fi
+
+  _err "Delete txt record error."
+  return 1
+}
+
+####################  Private functions below ##################################
+
+_desec_rest() {
+  m="$1"
+  ep="$2"
+  data="$3"
+
+  export _H1="Authorization: Token $DEDYN_TOKEN"
+  export _H2="Accept: application/json"
+  export _H3="Content-Type: application/json"
+
+  if [ "$m" != "GET" ]; then
+    _secure_debug2 data "$data"
+    response="$(_post "$data" "$ep" "" "$m")"
+  else
+    response="$(_get "$ep")"
+  fi
+  _ret="$?"
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug "http response code $_code"
+  _secure_debug2 response "$response"
+  if [ "$_ret" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+
+  response="$(printf "%s" "$response" | _normalizeJson)"
+  return 0
+}
+
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain="$1"
+  ep="$2"
+  i=2
+  p=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if ! _desec_rest GET "$ep"; then
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}