From 556c546b2ea6ee2d3db6fa41766c25653c02159b Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sat, 6 Feb 2021 22:48:25 +0100
Subject: [PATCH 01/80] Deploy Scipt for TrueNAs Server

acme .sh deploy Scipt for TrueNAS Server that uses the REST API from TrueNAS.

- Authentification with API Key
- If HTTP redirect is configured, automatik switch to HTTPS
- If WebDAV Certificate is the same as Web UI Certificate, Webdav Certificate get also an updated
- If FTP Certificate is the same as Web UI Certificate, FTP Certificate get also an updated
---
 deploy/truenas.sh | 191 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 191 insertions(+)
 create mode 100644 deploy/truenas.sh

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
new file mode 100644
index 00000000..43d39a3d
--- /dev/null
+++ b/deploy/truenas.sh
@@ -0,0 +1,191 @@
+#!/usr/local/bin/bash
+
+#Here is a scipt to deploy the cert to your TrueNAS using the REST API.
+# https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
+#
+# Written by Frank Plass github@f-plass.de
+#
+#
+# Following environment variables must be set:
+#
+# export DEPLOY_TRUENAS_APIKEY="<API_KEY_GENERATED_IN_THE_WEB_UI"
+#
+# The following environmental variables may be set if you don't like their
+# default values:
+#
+# DEPLOY_TRUENAS_HOSTNAME - defaults to localhost
+# DEPLOY_TRUENAS_SCHEME - defaults to http, set alternatively to https
+#
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+truenas_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  _getdeployconf DEPLOY_TRUENAS_APIKEY
+
+  if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
+    _err "TrueNAS Api Key is not found, please define DEPLOY_TRUENAS_APIKEY."
+    return 1
+  fi
+  _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+
+# Optional hostname, scheme for TrueNAS
+  _getdeployconf DEPLOY_TRUENAS_HOSTNAME
+  _getdeployconf DEPLOY_TRUENAS_SCHEME
+
+# default values for hostname and scheme
+  [ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] || DEPLOY_TRUENAS_HOSTNAME="localhost"
+  [ -n "${DEPLOY_TRUENAS_SCHEME}" ] || DEPLOY_TRUENAS_SCHEME="http"
+
+  _debug2 DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
+  _debug2 DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
+
+  _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
+  _debug _api_url "$_api_url"
+
+  _H1="Authorization: Bearer $DEPLOY_TRUENAS_APIKEY"
+  _secure_debug3 _H1 "$_H1"
+
+  _info "Testing Connection TrueNAS"
+  _response=$(_get "$_api_url/system/state")
+  _info "TrueNAS System State: $_response."
+
+  if [ -z "$_response" ]; then
+    _err "Unable to authenticate to $_api_url."
+    _err 'Check your Connection and set DEPLOY_TRUENAS_HOSTNAME="192.168.178.x".'
+    _err 'or'
+    _err 'set DEPLOY_TRUENAS_HOSTNAME="<truenas_dnsname>".'
+    _err 'Check your Connection and set DEPLOY_TRUENAS_SCHEME="https".'
+    _err "Check your Api Key."
+    return 1
+  fi
+
+  _saveaccountconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _saveaccountconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
+  _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
+
+
+  _info "Getting active certificate from TrueNAS"
+  _response=$(_get "$_api_url/system/general")
+  _active_cert_id=$(echo "$_response" | grep -B2 '"name":' | grep 'id' | tr -d -- '"id: ,')
+  _active_cert_name=$(echo "$_response" | grep '"name":' | sed -n 's/.*: "\(.\{1,\}\)",$/\1/p')
+  _param_httpsredirect=$(echo "$_response" | grep '"ui_httpsredirect":' | sed -n 's/.*": \(.\{1,\}\),$/\1/p')
+  _debug Active_UI_Certificate_ID "$_active_cert_id"
+  _debug Active_UI_Certificate_Name "$_active_cert_name"
+  _debug Active_UI_http_redirect "$_param_httpsredirect"
+
+  if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ] ; then
+    _info "http Redirect active"
+    _info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
+    DEPLOY_TRUENAS_SCHEME="https"
+    _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
+    _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
+  fi
+
+
+  _info "Upload new certifikate to TrueNAS"
+  _date_now() {
+          date -u "+%Y-%m-%d_%H%M%S"
+  }
+  _certname="Letsencrypt_$(_date_now)"
+  _debug3 _certname "$_certname"
+
+  _certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
+  _add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"
+
+  _debug3 _add_cert_result "$_add_cert_result"
+
+
+  _info "Getting Certificate list to get new Cert ID"
+  _cert_list=$(_get "$_api_url/system/general/ui_certificate_choices")
+  _cert_id=$(echo "$_cert_list" | grep "$_certname" | sed -n 's/.*"\([0-9]\{1,\}\)".*$/\1/p')
+
+  _debug3 _cert_id "$_cert_id"
+
+
+  _info "Activate Certificate ID: $_cert_id"
+  _activateData="{\"ui_certificate\": \"${_cert_id}\"}"
+  _activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"
+
+  _debug3 _activate_result $(echo "$_activate_result" )
+
+
+  _info "Check if WebDAV certificate is the same as the WEB UI"
+  _webdav_list=$(_get "$_api_url/webdav")
+  _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
+
+  if [ "$_webdav_cert_id" = "$_active_cert_id" ]; then
+    _info "Update the WebDAV Certificate"
+    _debug _webdav_cert_id "$_webdav_cert_id"
+    _webdav_data="{\"certssl\": \"${_cert_id}\"}"
+    _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
+    _webdav_new_cert_id=$(echo $_activate_webdav_cert | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
+    if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
+      _info "WebDAV Certificate update successfully"
+    else
+      _err "Unable to set WebDAV certificate"
+      _debug3 _activate_webdav_cert "$_activate_webdav_cert"
+      _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
+      return 1
+    fi
+    _debug3 _webdav_new_cert_id "$_webdav_new_cert_id"
+  else
+    _info "WebDAV certificate not set or not the same as Web UI"
+  fi
+
+
+  _info "Check if FTP certificate is the same as the WEB UI"
+  _ftp_list=$(_get "$_api_url/ftp")
+  _ftp_cert_id=$(echo "$_ftp_list" | grep '"ssltls_certificate":' | tr -d -- '"certislfa:_ ,')
+
+  if [ "$_ftp_cert_id" = "$_active_cert_id" ]; then
+    _info "Update the FTP Certificate"
+    _debug _ftp_cert_id "$_ftp_cert_id"
+    _ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}"
+    _activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")"
+    _ftp_new_cert_id=$(echo $_activate_ftp_cert | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
+    if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then
+      _info "FTP Certificate update successfully"
+    else
+      _err "Unable to set FTP certificate"
+      _debug3 _activate_ftp_cert "$_activate_ftp_cert"
+      _debug3 _ftp_new_cert_id "$_ftp_new_cert_id"
+      return 1
+    fi
+    _debug3 _activate_ftp_cert "$_activate_ftp_cert"
+  else
+    _info "FTP certificate not set or not the same as Web UI"
+  fi
+
+
+  _info "Delete old Certificate"
+  _delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"
+
+  _debug3 _delete_result "$_delete_result"
+
+
+  _info "Reload WebUI from TrueNAS"
+  curl --silent -L --no-keepalive --user-agent "$USER_AGENT" "$_api_url/system/general/ui_restart"
+  ret=$?
+
+  _debug CURL_RETURN "$ret"
+  if [ "$ret" != "0" ]; then
+    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
+    return 1
+  fi
+
+  return 0
+}

From a4f9746d3afe5bfcae0808fd49cd3572c40bc550 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sat, 6 Feb 2021 23:03:07 +0100
Subject: [PATCH 02/80] Danksagung an danb35

---
 deploy/truenas.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 43d39a3d..6a52e166 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -1,10 +1,11 @@
 #!/usr/local/bin/bash
 
-#Here is a scipt to deploy the cert to your TrueNAS using the REST API.
+# Here is a scipt to deploy the cert to your TrueNAS using the REST API.
 # https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
 #
 # Written by Frank Plass github@f-plass.de
-#
+# https://github.com/danb35/deploy-freenas/blob/master/deploy_freenas.py
+# Thanks to danb35 for your template!
 #
 # Following environment variables must be set:
 #

From 0e341726d29b82b448248945e8e30d8fc3963043 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sat, 6 Feb 2021 23:20:52 +0100
Subject: [PATCH 03/80] Edits after DoShellcheck

---
 deploy/truenas.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 6a52e166..cfc3e7f7 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -121,7 +121,7 @@ truenas_deploy() {
   _activateData="{\"ui_certificate\": \"${_cert_id}\"}"
   _activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"
 
-  _debug3 _activate_result $(echo "$_activate_result" )
+  _debug3 _activate_result "$_activate_result"
 
 
   _info "Check if WebDAV certificate is the same as the WEB UI"
@@ -133,7 +133,7 @@ truenas_deploy() {
     _debug _webdav_cert_id "$_webdav_cert_id"
     _webdav_data="{\"certssl\": \"${_cert_id}\"}"
     _activate_webdav_cert="$(_post "$_webdav_data" "$_api_url/webdav" "" "PUT" "application/json")"
-    _webdav_new_cert_id=$(echo $_activate_webdav_cert | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
+    _webdav_new_cert_id=$(echo "$_activate_webdav_cert" | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
     if [ "$_webdav_new_cert_id" -eq "$_cert_id" ]; then
       _info "WebDAV Certificate update successfully"
     else
@@ -157,7 +157,7 @@ truenas_deploy() {
     _debug _ftp_cert_id "$_ftp_cert_id"
     _ftp_data="{\"ssltls_certificate\": \"${_cert_id}\"}"
     _activate_ftp_cert="$(_post "$_ftp_data" "$_api_url/ftp" "" "PUT" "application/json")"
-    _ftp_new_cert_id=$(echo $_activate_ftp_cert | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
+    _ftp_new_cert_id=$(echo "$_activate_ftp_cert" | _json_decode | sed -n 's/.*: \([0-9]\{1,\}\) }$/\1/p')
     if [ "$_ftp_new_cert_id" -eq "$_cert_id" ]; then
       _info "FTP Certificate update successfully"
     else

From 4f7c2bf8c31786d11f58e85130c8f95db1f01557 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 16:12:24 +0100
Subject: [PATCH 04/80] Update truenas.sh

---
 deploy/truenas.sh | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index cfc3e7f7..f52ba89c 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -179,14 +179,9 @@ truenas_deploy() {
 
 
   _info "Reload WebUI from TrueNAS"
-  curl --silent -L --no-keepalive --user-agent "$USER_AGENT" "$_api_url/system/general/ui_restart"
-  ret=$?
+  _restart_UI=$(_get "$_api_url/system/general/ui_restart")
 
-  _debug CURL_RETURN "$ret"
-  if [ "$ret" != "0" ]; then
-    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
-    return 1
-  fi
+  _debug3 _restart_UI "$_restart_UI"
 
-  return 0
+   return 0
 }

From ed46a078f9cec4c846f8ecdee414f8ff7d877d8f Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 16:35:51 +0100
Subject: [PATCH 05/80] Update truenas.sh

---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index f52ba89c..8ccf226a 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -183,5 +183,5 @@ truenas_deploy() {
 
   _debug3 _restart_UI "$_restart_UI"
 
-   return 0
+  return 0
 }

From c8a2308739ec70d1ba70e1cc1ead721e91e4bdb0 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 18:42:48 +0100
Subject: [PATCH 06/80] Update truenas.sh

---
 deploy/truenas.sh | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 8ccf226a..37ddb2b0 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -179,9 +179,18 @@ truenas_deploy() {
 
 
   _info "Reload WebUI from TrueNAS"
-  _restart_UI=$(_get "$_api_url/system/general/ui_restart")
+  # the command
+  # _restart_UI=$(_get "$_api_url/system/general/ui_restart")
+  # throws the Error 52
+  # for this command direct curl command
+  curl --silent -L --no-keepalive --user-agent "$USER_AGENT" -H "$_H1" "$_api_url/system/general/ui_restart"
+  ret=$?
+  _debug2 CURL_RETURN "$ret"
 
-  _debug3 _restart_UI "$_restart_UI"
-
-  return 0
+  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$ret" == "52" ]; then
+    return 0
+  else
+    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
+    return 1
+  fi
 }

From 05737b85eb263551234385bfd457fb204749063b Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 18:47:04 +0100
Subject: [PATCH 07/80] Update truenas.sh

---
 deploy/truenas.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 37ddb2b0..35631900 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -187,10 +187,10 @@ truenas_deploy() {
   ret=$?
   _debug2 CURL_RETURN "$ret"
 
-  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$ret" == "52" ]; then
-    return 0
-  else
+  if [ -z "$_add_cert_result" ] && [ -z "$_activate_result" ] && [ "$ret" != "52" ]; then
     _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
     return 1
+  else
+    return 0
   fi
 }

From 854e52052825fcdff2fad52cb1e048faa99e2383 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 19:02:03 +0100
Subject: [PATCH 08/80] Update truenas.sh

---
 deploy/truenas.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 35631900..ad83f760 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -184,13 +184,13 @@ truenas_deploy() {
   # throws the Error 52
   # for this command direct curl command
   curl --silent -L --no-keepalive --user-agent "$USER_AGENT" -H "$_H1" "$_api_url/system/general/ui_restart"
-  ret=$?
-  _debug2 CURL_RETURN "$ret"
+  _ret=$?
+  _debug2 CURL_RETURN "$_ret"
 
-  if [ -z "$_add_cert_result" ] && [ -z "$_activate_result" ] && [ "$ret" != "52" ]; then
-    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
-    return 1
-  else
+  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$ret" == "52" ]; then
     return 0
+  else
+    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
+    return 1
   fi
 }

From 052c9be111fa1180479eb89a9e65ac69519d539e Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 19:12:39 +0100
Subject: [PATCH 09/80] Update truenas.sh

---
 deploy/truenas.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index ad83f760..f7d5c1cb 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -1,4 +1,4 @@
-#!/usr/local/bin/bash
+#!/usr/bin/env sh
 
 # Here is a scipt to deploy the cert to your TrueNAS using the REST API.
 # https://www.truenas.com/docs/hub/additional-topics/api/rest_api.html
@@ -187,7 +187,7 @@ truenas_deploy() {
   _ret=$?
   _debug2 CURL_RETURN "$_ret"
 
-  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$ret" == "52" ]; then
+  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$_ret" == "52" ]; then
     return 0
   else
     _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"

From f8c11a324a2bb4cd3ad19fd4bc9f6cda2156d412 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 19:19:04 +0100
Subject: [PATCH 10/80] Update truenas.sh

---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index f7d5c1cb..5ca8f2af 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -187,7 +187,7 @@ truenas_deploy() {
   _ret=$?
   _debug2 CURL_RETURN "$_ret"
 
-  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$_ret" == "52" ]; then
+  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$_ret" = "52" ]; then
     return 0
   else
     _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"

From a836842a7eecf770e30bbe46243ff0c127d9ef56 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 21:20:56 +0100
Subject: [PATCH 11/80] Update truenas.sh

---
 deploy/truenas.sh | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 5ca8f2af..1b58cc90 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -43,11 +43,11 @@ truenas_deploy() {
   fi
   _secure_debug2 DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
 
-# Optional hostname, scheme for TrueNAS
+  # Optional hostname, scheme for TrueNAS
   _getdeployconf DEPLOY_TRUENAS_HOSTNAME
   _getdeployconf DEPLOY_TRUENAS_SCHEME
 
-# default values for hostname and scheme
+  # default values for hostname and scheme
   [ -n "${DEPLOY_TRUENAS_HOSTNAME}" ] || DEPLOY_TRUENAS_HOSTNAME="localhost"
   [ -n "${DEPLOY_TRUENAS_SCHEME}" ] || DEPLOY_TRUENAS_SCHEME="http"
 
@@ -63,6 +63,7 @@ truenas_deploy() {
   _info "Testing Connection TrueNAS"
   _response=$(_get "$_api_url/system/state")
   _info "TrueNAS System State: $_response."
+  _debug _response "$_response"
 
   if [ -z "$_response" ]; then
     _err "Unable to authenticate to $_api_url."
@@ -78,7 +79,6 @@ truenas_deploy() {
   _saveaccountconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
   _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
 
-
   _info "Getting active certificate from TrueNAS"
   _response=$(_get "$_api_url/system/general")
   _active_cert_id=$(echo "$_response" | grep -B2 '"name":' | grep 'id' | tr -d -- '"id: ,')
@@ -88,7 +88,7 @@ truenas_deploy() {
   _debug Active_UI_Certificate_Name "$_active_cert_name"
   _debug Active_UI_http_redirect "$_param_httpsredirect"
 
-  if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ] ; then
+  if [ "$DEPLOY_TRUENAS_SCHEME" = "http" ] && [ "$_param_httpsredirect" = "true" ]; then
     _info "http Redirect active"
     _info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
     DEPLOY_TRUENAS_SCHEME="https"
@@ -96,34 +96,29 @@ truenas_deploy() {
     _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
   fi
 
-
   _info "Upload new certifikate to TrueNAS"
-  _date_now() {
-          date -u "+%Y-%m-%d_%H%M%S"
-  }
-  _certname="Letsencrypt_$(_date_now)"
+  _certname="Letsencrypt_$(_utc_date | tr ' ' '_' | tr -d -- ':')"
   _debug3 _certname "$_certname"
 
+  return 0
+
   _certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
   _add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"
 
   _debug3 _add_cert_result "$_add_cert_result"
 
-
   _info "Getting Certificate list to get new Cert ID"
   _cert_list=$(_get "$_api_url/system/general/ui_certificate_choices")
   _cert_id=$(echo "$_cert_list" | grep "$_certname" | sed -n 's/.*"\([0-9]\{1,\}\)".*$/\1/p')
 
   _debug3 _cert_id "$_cert_id"
 
-
   _info "Activate Certificate ID: $_cert_id"
   _activateData="{\"ui_certificate\": \"${_cert_id}\"}"
   _activate_result="$(_post "$_activateData" "$_api_url/system/general" "" "PUT" "application/json")"
 
   _debug3 _activate_result "$_activate_result"
 
-
   _info "Check if WebDAV certificate is the same as the WEB UI"
   _webdav_list=$(_get "$_api_url/webdav")
   _webdav_cert_id=$(echo "$_webdav_list" | grep '"certssl":' | tr -d -- '"certsl: ,')
@@ -147,7 +142,6 @@ truenas_deploy() {
     _info "WebDAV certificate not set or not the same as Web UI"
   fi
 
-
   _info "Check if FTP certificate is the same as the WEB UI"
   _ftp_list=$(_get "$_api_url/ftp")
   _ftp_cert_id=$(echo "$_ftp_list" | grep '"ssltls_certificate":' | tr -d -- '"certislfa:_ ,')
@@ -171,18 +165,16 @@ truenas_deploy() {
     _info "FTP certificate not set or not the same as Web UI"
   fi
 
-
   _info "Delete old Certificate"
   _delete_result="$(_post "" "$_api_url/certificate/id/$_active_cert_id" "" "DELETE" "application/json")"
 
   _debug3 _delete_result "$_delete_result"
 
-
-  _info "Reload WebUI from TrueNAS"
   # the command
   # _restart_UI=$(_get "$_api_url/system/general/ui_restart")
   # throws the Error 52
   # for this command direct curl command
+  _info "Reload WebUI from TrueNAS"
   curl --silent -L --no-keepalive --user-agent "$USER_AGENT" -H "$_H1" "$_api_url/system/general/ui_restart"
   _ret=$?
   _debug2 CURL_RETURN "$_ret"
@@ -193,4 +185,4 @@ truenas_deploy() {
     _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
     return 1
   fi
-}
+}
\ No newline at end of file

From a7ca010d4e3db0011d935cc710d7ba5e20352fc4 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 21:24:06 +0100
Subject: [PATCH 12/80] Update truenas.sh

---
 deploy/truenas.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 1b58cc90..27b67dce 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -100,8 +100,6 @@ truenas_deploy() {
   _certname="Letsencrypt_$(_utc_date | tr ' ' '_' | tr -d -- ':')"
   _debug3 _certname "$_certname"
 
-  return 0
-
   _certData="{\"create_type\": \"CERTIFICATE_CREATE_IMPORTED\", \"name\": \"${_certname}\", \"certificate\": \"$(_json_encode <"$_cfullchain")\", \"privatekey\": \"$(_json_encode <"$_ckey")\"}"
   _add_cert_result="$(_post "$_certData" "$_api_url/certificate" "" "POST" "application/json")"
 

From 6f4c5fcc8738aabc26a188ca94361dbc32cb7705 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 7 Feb 2021 21:25:49 +0100
Subject: [PATCH 13/80] Update truenas.sh

---
 deploy/truenas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 27b67dce..e25523df 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -183,4 +183,4 @@ truenas_deploy() {
     _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
     return 1
   fi
-}
\ No newline at end of file
+}

From 93fd6170a360a41034ea8033f8147de1b378a417 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sat, 13 Feb 2021 12:38:57 +0100
Subject: [PATCH 14/80] Update truenas.sh

---
 deploy/truenas.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index e25523df..be8fac12 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -75,9 +75,9 @@ truenas_deploy() {
     return 1
   fi
 
-  _saveaccountconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
-  _saveaccountconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
-  _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
+  _savedeployconf DEPLOY_TRUENAS_APIKEY "$DEPLOY_TRUENAS_APIKEY"
+  _savedeployconf DEPLOY_TRUENAS_HOSTNAME "$DEPLOY_TRUENAS_HOSTNAME"
+  _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
 
   _info "Getting active certificate from TrueNAS"
   _response=$(_get "$_api_url/system/general")
@@ -93,7 +93,7 @@ truenas_deploy() {
     _info "Setting DEPLOY_TRUENAS_SCHEME to 'https'"
     DEPLOY_TRUENAS_SCHEME="https"
     _api_url="$DEPLOY_TRUENAS_SCHEME://$DEPLOY_TRUENAS_HOSTNAME/api/v2.0"
-    _saveaccountconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
+    _savedeployconf DEPLOY_TRUENAS_SCHEME "$DEPLOY_TRUENAS_SCHEME"
   fi
 
   _info "Upload new certifikate to TrueNAS"

From eacc00f7868dc01c8df4de43474910863fc12bed Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 21 Feb 2021 22:42:24 +0100
Subject: [PATCH 15/80] Update truenas.sh

- check if curl exists
- check if wget exist, then errortext and exit scipt
- _get command "restartUI"  wirh info about curl error 52
---
 deploy/truenas.sh | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index be8fac12..1be4aeb0 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -35,6 +35,19 @@ truenas_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
+  if _exists "curl"; then
+    _debug "curl found, no Message to restartUI error"
+  else
+    if _exists "wget"; then
+      _err "Until Version of TrueNAS is older than TrueNAS-12.0-U2 there are problems with using wget"
+      _err "There is a bug when using the API Call restartUI with wget"
+      _err "The API call does not give any response, whit wget the api call restartUI would be called about 20 times"
+      _err "Please use curl!"
+      _err "Bug Report at https://jira.ixsystems.com/browse/NAS-109435"
+      return 1
+    fi
+  fi
+
   _getdeployconf DEPLOY_TRUENAS_APIKEY
 
   if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
@@ -63,7 +76,6 @@ truenas_deploy() {
   _info "Testing Connection TrueNAS"
   _response=$(_get "$_api_url/system/state")
   _info "TrueNAS System State: $_response."
-  _debug _response "$_response"
 
   if [ -z "$_response" ]; then
     _err "Unable to authenticate to $_api_url."
@@ -168,14 +180,12 @@ truenas_deploy() {
 
   _debug3 _delete_result "$_delete_result"
 
-  # the command
-  # _restart_UI=$(_get "$_api_url/system/general/ui_restart")
-  # throws the Error 52
-  # for this command direct curl command
   _info "Reload WebUI from TrueNAS"
-  curl --silent -L --no-keepalive --user-agent "$USER_AGENT" -H "$_H1" "$_api_url/system/general/ui_restart"
-  _ret=$?
-  _debug2 CURL_RETURN "$_ret"
+  _restart_UI=$(_get "$_api_url/system/general/ui_restart")
+  _info "Until Version of TrueNAS is older than TrueNAS-12.0-U3 curl returns error 52"
+  _info "This is not a problem for tis scipt"
+  _info "See Bugreport: https://jira.ixsystems.com/browse/NAS-109435"
+  _debug2 _restart_UI "$_restart_UI"
 
   if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$_ret" = "52" ]; then
     return 0

From 4bb8e3a121442c3bb9b12cd54467608c551eeb4a Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Sun, 21 Feb 2021 22:48:31 +0100
Subject: [PATCH 16/80] Update truenas.sh

-error handling
---
 deploy/truenas.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 1be4aeb0..7d8f3238 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -187,10 +187,10 @@ truenas_deploy() {
   _info "See Bugreport: https://jira.ixsystems.com/browse/NAS-109435"
   _debug2 _restart_UI "$_restart_UI"
 
-  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ] && [ "$_ret" = "52" ]; then
+  if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then
     return 0
   else
-    _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
+    _err "Certupdate was not succesfull, please use --debug"
     return 1
   fi
 }

From 3bcb91f6ae0c0b09203cf5a66b3aa66f76c7c527 Mon Sep 17 00:00:00 2001
From: F-Plass <60349140+F-Plass@users.noreply.github.com>
Date: Thu, 11 Nov 2021 23:03:00 +0100
Subject: [PATCH 17/80] Update truenas.sh

solved the problem of UI-Restart after 12.0-U3
---
 deploy/truenas.sh | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/deploy/truenas.sh b/deploy/truenas.sh
index 7d8f3238..6f1a31b0 100644
--- a/deploy/truenas.sh
+++ b/deploy/truenas.sh
@@ -35,19 +35,6 @@ truenas_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
-  if _exists "curl"; then
-    _debug "curl found, no Message to restartUI error"
-  else
-    if _exists "wget"; then
-      _err "Until Version of TrueNAS is older than TrueNAS-12.0-U2 there are problems with using wget"
-      _err "There is a bug when using the API Call restartUI with wget"
-      _err "The API call does not give any response, whit wget the api call restartUI would be called about 20 times"
-      _err "Please use curl!"
-      _err "Bug Report at https://jira.ixsystems.com/browse/NAS-109435"
-      return 1
-    fi
-  fi
-
   _getdeployconf DEPLOY_TRUENAS_APIKEY
 
   if [ -z "$DEPLOY_TRUENAS_APIKEY" ]; then
@@ -182,9 +169,6 @@ truenas_deploy() {
 
   _info "Reload WebUI from TrueNAS"
   _restart_UI=$(_get "$_api_url/system/general/ui_restart")
-  _info "Until Version of TrueNAS is older than TrueNAS-12.0-U3 curl returns error 52"
-  _info "This is not a problem for tis scipt"
-  _info "See Bugreport: https://jira.ixsystems.com/browse/NAS-109435"
   _debug2 _restart_UI "$_restart_UI"
 
   if [ -n "$_add_cert_result" ] && [ -n "$_activate_result" ]; then

From 4635dacf7ff0285f523b7a7b3fc9b54e8f40891a Mon Sep 17 00:00:00 2001
From: Nasser Alansari <alansari.n@gmail.com>
Date: Sat, 13 Nov 2021 12:56:10 +0300
Subject: [PATCH 18/80] Add SYNO_TOTP_SECRET for user with two-factor
 authentication

---
 deploy/synology_dsm.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 177b3fbe..66e28f93 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -2,8 +2,7 @@
 
 # Here is a script to deploy cert to Synology DSM
 #
-# it requires the jq and curl are in the $PATH and the following
-# environment variables must be set:
+# It requires following environment variables:
 #
 # SYNO_Username - Synology Username to login (must be an administrator)
 # SYNO_Password - Synology Password to login
@@ -16,6 +15,12 @@
 # SYNO_Hostname - defaults to localhost
 # SYNO_Port - defaults to 5000
 # SYNO_DID - device ID to skip OTP - defaults to empty
+# SYNO_TOTP_SECRET - TOTP secret to generate OTP - defaults to empty
+#
+# Dependencies:
+# -------------
+# - jq and curl
+# - oathtool (When using 2 Factor Authentication and SYNO_TOTP_SECRET is set)
 #
 #returns 0 means success, otherwise error.
 
@@ -36,6 +41,7 @@ synology_dsm_deploy() {
   _getdeployconf SYNO_Password
   _getdeployconf SYNO_Create
   _getdeployconf SYNO_DID
+  _getdeployconf SYNO_TOTP_SECRET
   if [ -z "${SYNO_Username:-}" ] || [ -z "${SYNO_Password:-}" ]; then
     _err "SYNO_Username & SYNO_Password must be set"
     return 1
@@ -86,13 +92,18 @@ synology_dsm_deploy() {
   encoded_username="$(printf "%s" "$SYNO_Username" | _url_encode)"
   encoded_password="$(printf "%s" "$SYNO_Password" | _url_encode)"
 
+  otp_code=""
+  if [ -n "$SYNO_TOTP_SECRET" ]; then
+    otp_code="$(oathtool --base32 --totp "${SYNO_TOTP_SECRET}" 2>/dev/null)"
+  fi
+
   if [ -n "$SYNO_DID" ]; then
     _H1="Cookie: did=$SYNO_DID"
     export _H1
     _debug3 H1 "${_H1}"
   fi
 
-  response=$(_post "method=login&account=$encoded_username&passwd=$encoded_password&api=SYNO.API.Auth&version=$api_version&enable_syno_token=yes" "$_base_url/webapi/auth.cgi?enable_syno_token=yes")
+  response=$(_post "method=login&account=$encoded_username&passwd=$encoded_password&api=SYNO.API.Auth&version=$api_version&enable_syno_token=yes&otp_code=$otp_code" "$_base_url/webapi/auth.cgi?enable_syno_token=yes")
   token=$(echo "$response" | grep "synotoken" | sed -n 's/.*"synotoken" *: *"\([^"]*\).*/\1/p')
   _debug3 response "$response"
   _debug token "$token"
@@ -100,7 +111,7 @@ synology_dsm_deploy() {
   if [ -z "$token" ]; then
     _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
     _err "Check your username and password."
-    _err "If two-factor authentication is enabled for the user, you have to choose another user."
+    _err "If two-factor authentication is enabled for the user, set SYNO_TOTP_SECRET."
     return 1
   fi
   sid=$(echo "$response" | grep "sid" | sed -n 's/.*"sid" *: *"\([^"]*\).*/\1/p')
@@ -113,6 +124,7 @@ synology_dsm_deploy() {
   _savedeployconf SYNO_Username "$SYNO_Username"
   _savedeployconf SYNO_Password "$SYNO_Password"
   _savedeployconf SYNO_DID "$SYNO_DID"
+  _savedeployconf SYNO_TOTP_SECRET "$SYNO_TOTP_SECRET"
 
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1&_sid=$sid" "$_base_url/webapi/entry.cgi")

From eaae0547f2687cdd7c1c9f00a437a204425dce56 Mon Sep 17 00:00:00 2001
From: neilpang <win@neilpang.com>
Date: Sun, 5 Dec 2021 16:15:39 +0800
Subject: [PATCH 19/80] upgrade Solaris

---
 .github/workflows/DNS.yml     | 2 +-
 .github/workflows/Solaris.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 56781fff..2b15e14c 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -223,7 +223,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/solaris-vm@v0.0.3
+    - uses: vmactions/solaris-vm@v0.0.4
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkgutil -y -i socat
diff --git a/.github/workflows/Solaris.yml b/.github/workflows/Solaris.yml
index 4df10099..a5f5bc7d 100644
--- a/.github/workflows/Solaris.yml
+++ b/.github/workflows/Solaris.yml
@@ -40,7 +40,7 @@ jobs:
       TEST_PREFERRED_CHAIN: ${{ matrix.TEST_PREFERRED_CHAIN }}
     steps:
     - uses: actions/checkout@v2
-    - uses: vmactions/cf-tunnel@v0.0.3
+    - uses: vmactions/cf-tunnel@v0.0.4
       id: tunnel
       with:
         protocol: http

From 4f386663e75e319b832560234b86922d14fe4184 Mon Sep 17 00:00:00 2001
From: neilpang <win@neilpang.com>
Date: Sun, 5 Dec 2021 18:23:19 +0800
Subject: [PATCH 20/80] fix for OpenBSD7
 https://github.com/acmesh-official/acme.sh/issues/3833

---
 acme.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index d2e8b04d..96392f5b 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4196,7 +4196,12 @@ _match_issuer() {
 #ip
 _isIPv4() {
   for seg in $(echo "$1" | tr '.' ' '); do
-    if [ $seg -ge 0 ] 2>/dev/null && [ $seg -le 255 ] 2>/dev/null; then
+    _debug2 seg "$seg"
+    if [ "$(echo "$seg" | tr -d [0-9])" ]; then
+      #not all number
+      return 1
+    fi
+    if [ $seg -ge 0 ] && [ $seg -lt 256 ]; then
       continue
     fi
     return 1

From 69c02cae764665be83d291ab0224c3220e4b2082 Mon Sep 17 00:00:00 2001
From: neilpang <win@neilpang.com>
Date: Sun, 5 Dec 2021 21:05:18 +0800
Subject: [PATCH 21/80] pass TEST_DNS_NO_SUBDOMAIN

---
 .github/workflows/DNS.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 2b15e14c..47bbc48f 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -49,6 +49,7 @@ jobs:
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_NO_SUBDOMAIN: ${{ secrets.TEST_DNS_NO_SUBDOMAIN }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
       TEST_LOCAL: 1

From 267e582827fd7fd6c5020fe926a5ab3835bd56a4 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 6 Dec 2021 22:03:38 +0800
Subject: [PATCH 22/80] add TEST_DNS_NO_SUBDOMAIN

---
 .github/workflows/DNS.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 47bbc48f..fc3886f2 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -88,6 +88,7 @@ jobs:
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_NO_SUBDOMAIN: ${{ secrets.TEST_DNS_NO_SUBDOMAIN }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
       TEST_LOCAL: 1
@@ -125,6 +126,7 @@ jobs:
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_NO_SUBDOMAIN: ${{ secrets.TEST_DNS_NO_SUBDOMAIN }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
       TEST_LOCAL: 1
@@ -177,6 +179,7 @@ jobs:
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_NO_SUBDOMAIN: ${{ secrets.TEST_DNS_NO_SUBDOMAIN }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
       TEST_LOCAL: 1
@@ -187,7 +190,7 @@ jobs:
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - uses: vmactions/freebsd-vm@v0.1.4
       with:
-        envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
+        envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_NO_SUBDOMAIN TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkg install -y socat curl
         usesh: true
         run: |
@@ -216,6 +219,7 @@ jobs:
       TEST_DNS : ${{ secrets.TEST_DNS }}
       TestingDomain: ${{ secrets.TestingDomain }}
       TEST_DNS_NO_WILDCARD: ${{ secrets.TEST_DNS_NO_WILDCARD }}
+      TEST_DNS_NO_SUBDOMAIN: ${{ secrets.TEST_DNS_NO_SUBDOMAIN }}
       TEST_DNS_SLEEP: ${{ secrets.TEST_DNS_SLEEP }}
       CASE: le_test_dnsapi
       TEST_LOCAL: 1
@@ -226,7 +230,7 @@ jobs:
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - uses: vmactions/solaris-vm@v0.0.4
       with:
-        envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
+        envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_NO_SUBDOMAIN TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkgutil -y -i socat
         run: |
           pkg set-mediator -v -I default@1.1 openssl

From beed123fb00fd8780e4090c5e7f4ef8ed818ce7f Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 13 Dec 2021 20:04:23 +0800
Subject: [PATCH 23/80] fix tunnel version

---
 .github/workflows/Solaris.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/Solaris.yml b/.github/workflows/Solaris.yml
index a5f5bc7d..f0f2f670 100644
--- a/.github/workflows/Solaris.yml
+++ b/.github/workflows/Solaris.yml
@@ -40,7 +40,7 @@ jobs:
       TEST_PREFERRED_CHAIN: ${{ matrix.TEST_PREFERRED_CHAIN }}
     steps:
     - uses: actions/checkout@v2
-    - uses: vmactions/cf-tunnel@v0.0.4
+    - uses: vmactions/cf-tunnel@v0.0.3
       id: tunnel
       with:
         protocol: http
@@ -49,7 +49,7 @@ jobs:
       run: echo "TestingDomain=${{steps.tunnel.outputs.server}}" >> $GITHUB_ENV
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/solaris-vm@v0.0.3
+    - uses: vmactions/solaris-vm@v0.0.4
       with:
         envs: 'TEST_LOCAL TestingDomain TEST_ACME_Server CA_ECDSA CA CA_EMAIL TEST_PREFERRED_CHAIN'
         nat: |

From dac7a3d2721cfb9cc13f34ede6553aff580c656d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jens=20Mei=C3=9Fner?= <meissner@b1-systems.de>
Date: Sun, 12 Dec 2021 14:17:13 +0100
Subject: [PATCH 24/80] [dns_knot] Use key command instead of command line
 argument to transmit dns key data.

---
 dnsapi/dns_knot.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_knot.sh b/dnsapi/dns_knot.sh
index 094a6981..729a89cb 100644
--- a/dnsapi/dns_knot.sh
+++ b/dnsapi/dns_knot.sh
@@ -19,8 +19,9 @@ dns_knot_add() {
 
   _info "Adding ${fulldomain}. 60 TXT \"${txtvalue}\""
 
-  knsupdate -y "${KNOT_KEY}" <<EOF
+  knsupdate <<EOF
 server ${KNOT_SERVER}
+key ${KNOT_KEY}
 zone ${_domain}.
 update add ${fulldomain}. 60 TXT "${txtvalue}"
 send
@@ -49,8 +50,9 @@ dns_knot_rm() {
 
   _info "Removing ${fulldomain}. TXT"
 
-  knsupdate -y "${KNOT_KEY}" <<EOF
+  knsupdate <<EOF
 server ${KNOT_SERVER}
+key ${KNOT_KEY}
 zone ${_domain}.
 update del ${fulldomain}. TXT
 send

From e0b179e5f3713f50c456b97b5b29926d5796da18 Mon Sep 17 00:00:00 2001
From: Christian Burmeister <christianbur@users.noreply.github.com>
Date: Tue, 21 Dec 2021 22:20:42 +0100
Subject: [PATCH 25/80] Update Dockerfile - alpine:3.12 -> alpine:3.15

The support for the base image alpine:3.12 will expire in 4 months (https://endoflife.date/alpine), so it would make sense to upgrade to the current version alpine:3.15.
I was able to create the acme.sh image with the new alpine:3.15 version without errors and also create and deploy a certificate, but further testing would be useful.
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index fb842c83..4046c726 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.12
+FROM alpine:3.15
 
 RUN apk --no-cache add -f \
   openssl \

From c6a0ec64cb993221643412c702a32a4085b41957 Mon Sep 17 00:00:00 2001
From: neilpang <win@neilpang.com>
Date: Sat, 25 Dec 2021 09:57:58 +0800
Subject: [PATCH 26/80] upgrade solaris vm

---
 .github/workflows/DNS.yml     | 2 +-
 .github/workflows/Solaris.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index fc3886f2..32d97614 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -228,7 +228,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/solaris-vm@v0.0.4
+    - uses: vmactions/solaris-vm@v0.0.5
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_NO_SUBDOMAIN TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkgutil -y -i socat
diff --git a/.github/workflows/Solaris.yml b/.github/workflows/Solaris.yml
index f0f2f670..77fdcc9a 100644
--- a/.github/workflows/Solaris.yml
+++ b/.github/workflows/Solaris.yml
@@ -49,7 +49,7 @@ jobs:
       run: echo "TestingDomain=${{steps.tunnel.outputs.server}}" >> $GITHUB_ENV
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/solaris-vm@v0.0.4
+    - uses: vmactions/solaris-vm@v0.0.5
       with:
         envs: 'TEST_LOCAL TestingDomain TEST_ACME_Server CA_ECDSA CA CA_EMAIL TEST_PREFERRED_CHAIN'
         nat: |

From f485f3fdb5327218978f83ec2d4ef957d9774f19 Mon Sep 17 00:00:00 2001
From: wacki4 <wacki4@gmail.com>
Date: Sat, 16 Oct 2021 14:08:03 +0200
Subject: [PATCH 27/80] Update dns_opnsense.sh

Update for opnsense regards to error in #3735
---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 069f6c32..63723f5a 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -150,7 +150,7 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\"(,\"allownotifyslave\":{\"\":{[^}]*}},|,)\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":{.*}(,\"allownotifyslave\":{\"\":{[^}]*}},|,)\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
 
     if [ -n "$id" ]; then
       _debug id "$id"

From aa9f5b8c4af784dedcaa6411959ef8bb8a7933bb Mon Sep 17 00:00:00 2001
From: wacki4 <wacki4@gmail.com>
Date: Sat, 16 Oct 2021 16:57:12 +0200
Subject: [PATCH 28/80] Update dns_opnsense.sh

Correction when having many zones.
---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 63723f5a..26a422f8 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -150,7 +150,7 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":{.*}(,\"allownotifyslave\":{\"\":{[^}]*}},|,)\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":{\"\":{[^}]*}}(,\"allownotifyslave\":{\"\":{[^}]*}},|,)\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
 
     if [ -n "$id" ]; then
       _debug id "$id"

From 4dd709b543016f3e8d7ee5bf0eb20918a618a153 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Fri, 10 Dec 2021 01:10:41 +0000
Subject: [PATCH 29/80] feat: Mythic Beasts DNS API script

---
 dnsapi/dns_mythic_beasts.sh | 230 ++++++++++++++++++++++++++++++++++++
 1 file changed, 230 insertions(+)
 create mode 100755 dnsapi/dns_mythic_beasts.sh

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
new file mode 100755
index 00000000..2d1b6551
--- /dev/null
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -0,0 +1,230 @@
+#!/usr/bin/env sh
+# Mythic Beasts is a long-standing UK service provider using standards-based OAuth2 authentication
+# To test: ./acme.sh --dns dns_mythic_beasts --test --debug 1 --output-insecure --issue --domain domain.com
+# Cannot retest once cert is issued
+# OAuth2 tokens only valid for 300 seconds so we do not store
+# NOTE: This will remove all TXT records matching the fulldomain, not just the added ones (_acme-challenge.www.domain.com)
+
+# Test OAuth2 credentials
+#MB_AK="aaaaaaaaaaaaaaaa"
+#MB_AS="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+
+# URLs
+MB_API='https://api.mythic-beasts.com/dns/v2/zones'
+MB_AUTH='https://auth.mythic-beasts.com/login'
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_mythic_beasts_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "MYTHIC BEASTS Adding record $fulldomain = $txtvalue"
+  if ! _initAuth; then
+    return 1
+  fi
+
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+
+  # method path body_data
+  if _mb_rest POST "$_domain/records/$_sub_domain/TXT" "$txtvalue"; then
+
+    if _contains "$response" "1 records added"; then
+      _info "Added, verifying..."
+      # Max 120 seconds to publish
+      for i in $(seq 1 6); do
+        # Retry on error
+        if ! _mb_rest GET "$_domain/records/$_sub_domain/TXT?verify"; then
+          _sleep 20
+        else
+          _info "Record published!"
+          return 0
+        fi
+      done
+
+    else
+      _err "\n$response"
+    fi
+
+  fi
+  _err "Add txt record error."
+  return 1
+}
+
+#Usage: rm  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_mythic_beasts_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "MYTHIC BEASTS Removing record $fulldomain = $txtvalue"
+  if ! _initAuth; then
+    return 1
+  fi
+
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+
+  # method path body_data
+  if _mb_rest DELETE "$_domain/records/$_sub_domain/TXT" "$txtvalue"; then
+    _info "Record removed"
+    return 0
+  fi
+  _err "Remove txt record error."
+  return 1
+}
+
+####################  Private functions below ##################################
+
+#Possible formats:
+# _acme-challenge.www.example.com
+# _acme-challenge.example.com
+# _acme-challenge.example.co.uk
+# _acme-challenge.www.example.co.uk
+# _acme-challenge.sub1.sub2.www.example.co.uk
+# sub1.sub2.example.co.uk
+# example.com
+# example.co.uk
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+
+  _debug "Detect the root zone"
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      _err "Domain exhausted"
+      return 1
+    fi
+
+    # Use the status errors to find the domain, continue on 403 Access denied
+    # method path body_data
+    _mb_rest GET "$h/records"
+    ret="$?"
+    if [ "$ret" -eq 0 ]; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain="$h"
+      _debug _sub_domain "$_sub_domain"
+      _debug _domain "$_domain"
+      return 0
+    elif [ "$ret" -eq 1 ]; then
+      return 1
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+
+    if [ "$i" -gt 50 ]; then
+      break
+    fi
+  done
+  _err "Domain too long"
+  return 1
+}
+
+_initAuth() {
+  MB_AK="${MB_AK:-$(_readaccountconf_mutable MB_AK)}"
+  MB_AS="${MB_AS:-$(_readaccountconf_mutable MB_AS)}"
+
+  if [ -z "$MB_AK" ] || [ -z "$MB_AS" ]; then
+    MB_AK=""
+    MB_AS=""
+    _err "Please specify an OAuth2 Key & Secret"
+    return 1
+  fi
+
+  _saveaccountconf_mutable MB_AK "$MB_AK"
+  _saveaccountconf_mutable MB_AS "$MB_AS"
+
+  if ! _oauth2; then
+    return 1
+  fi
+
+  _info "Checking authentication"
+  _secure_debug access_token "$MB_TK"
+  _sleep 1
+
+  # GET a list of zones
+  # method path body_data
+  if ! _mb_rest GET ""; then
+    _err "The token is invalid"
+    return 1
+  fi
+  _info "Token OK"
+  return 0
+}
+
+_oauth2() {
+  # HTTP Basic Authentication
+  _H1="Authorization: Basic $(echo "$MB_AK:$MB_AS" | _base64)"
+  _H2="Accepts: application/json"
+  export _H1 _H2
+  body="grant_type=client_credentials"
+
+  _info "Getting OAuth2 token..."
+  # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+  response="$(_post "$body" "$MB_AUTH" "" "POST" "application/x-www-form-urlencoded")"
+  if _contains "$response" "\"token_type\":\"bearer\""; then
+    MB_TK="$(echo "$response" | _egrep_o "access_token\":\"[^\"]*\"" | cut -d : -f 2 | tr -d '"')"
+    if [ -z "$MB_TK" ]; then
+      _err "Unable to get access_token"
+      _err "\n$response"
+      return 1
+    fi
+  else
+    _err "OAuth2 token_type not Bearer"
+    _err "\n$response"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}
+
+# method path body_data
+_mb_rest() {
+  # URL encoded body for single API operations
+  m="$1"
+  ep="$2"
+  data="$3"
+
+  if [ -z "$ep" ]; then
+    _mb_url="$MB_API"
+  else
+    _mb_url="$MB_API/$ep"
+  fi
+
+  _H1="Authorization: Bearer $MB_TK"
+  _H2="Accepts: application/json"
+  export _H1 _H2
+  if [ "$data" ] || [ "$m" = "POST" ] || [ "$m" = "PUT" ] || [ "$m" = "DELETE" ]; then
+    # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+    response="$(_post "data=$data" "$_mb_url" "" "$m" "application/x-www-form-urlencoded")"
+  else
+    response="$(_get "$_mb_url")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Request error"
+    return 1
+  fi
+
+  header="$(cat "$HTTP_HEADER")"
+  status="$(echo "$header" | _egrep_o "^HTTP[^ ]* .*$" | cut -d " " -f 2-100 | tr -d "\f\n")"
+  code="$(echo "$status" | _egrep_o "^[0-9]*")"
+  if [ "$code" -ge 400 ] || _contains "$response" "\"error\"" || _contains "$response" "invalid_client"; then
+    _err "error $status"
+    _err "\n$response"
+    _debug "\n$header"
+    return 2
+  fi
+
+  _debug2 response "$response"
+  return 0
+}

From 6a2c9a0dc1cca74fb44f3804aa979acdc1c0e08d Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Mon, 20 Dec 2021 00:31:15 +0000
Subject: [PATCH 30/80] fix: floating token for github

---
 dnsapi/dns_mythic_beasts.sh | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 2d1b6551..3cff3b02 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -161,7 +161,20 @@ _initAuth() {
   return 0
 }
 
+# Github appears to use an outbound proxy for requests which means subsequent requests may not have the same
+# source IP. The standard Mythic Beasts OAuth2 tokens are tied to an IP, meaning github test requests fail
+# authentication. This works arounds this by using an undocumented MB API to obtain a token not tied to an
+# IP just for the github tests.
 _oauth2() {
+  printenv
+  if [ -z "$TEST_DNS_SLEEP" ]; then
+    return _oauth2_std
+  else
+    return _oauth2_github
+  fi
+}
+
+_oauth2_std() {
   # HTTP Basic Authentication
   _H1="Authorization: Basic $(echo "$MB_AK:$MB_AS" | _base64)"
   _H2="Accepts: application/json"
@@ -187,6 +200,24 @@ _oauth2() {
   return 0
 }
 
+_oauth2_github() {
+  _H1="Accepts: application/json"
+  export _H1
+  body="{\"login\":{\"handle\":$MB_AK,\"pass\":$MB_AS,\"floating\":1}}"
+
+  _info "Getting Floating token..."
+  # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+  response="$(_post "$body" "$MB_AUTH" "" "POST" "application/json")"
+  MB_TK="$(echo "$response" | _egrep_o "\"token\":\"[^\"]*\"" | cut -d : -f 2 | tr -d '"')"
+  if [ -z "$MB_TK" ]; then
+    _err "Unable to get access_token"
+    _err "\n$response"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}
+
 # method path body_data
 _mb_rest() {
   # URL encoded body for single API operations

From 6251652c936259e7c43794413a795b527d86e867 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Mon, 20 Dec 2021 00:35:14 +0000
Subject: [PATCH 31/80] fix: correct return value

---
 dnsapi/dns_mythic_beasts.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 3cff3b02..9de5d34c 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -168,10 +168,11 @@ _initAuth() {
 _oauth2() {
   printenv
   if [ -z "$TEST_DNS_SLEEP" ]; then
-    return _oauth2_std
+    _oauth2_std
   else
-    return _oauth2_github
+    _oauth2_github
   fi
+  return $?
 }
 
 _oauth2_std() {

From 56d799f4492416f05efb5216b031af29718ddff9 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Mon, 20 Dec 2021 00:50:33 +0000
Subject: [PATCH 32/80] fix: debugging

---
 dnsapi/dns_mythic_beasts.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 9de5d34c..96230bf1 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -166,7 +166,7 @@ _initAuth() {
 # authentication. This works arounds this by using an undocumented MB API to obtain a token not tied to an
 # IP just for the github tests.
 _oauth2() {
-  printenv
+  _info "$(printenv)"
   if [ -z "$TEST_DNS_SLEEP" ]; then
     _oauth2_std
   else
@@ -211,7 +211,7 @@ _oauth2_github() {
   response="$(_post "$body" "$MB_AUTH" "" "POST" "application/json")"
   MB_TK="$(echo "$response" | _egrep_o "\"token\":\"[^\"]*\"" | cut -d : -f 2 | tr -d '"')"
   if [ -z "$MB_TK" ]; then
-    _err "Unable to get access_token"
+    _err "Unable to get token"
     _err "\n$response"
     return 1
   fi

From f46ee935978bcd3bf0a1c8ab74403a28b831d3e7 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Mon, 20 Dec 2021 00:58:37 +0000
Subject: [PATCH 33/80] fix: github switch

---
 dnsapi/dns_mythic_beasts.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 96230bf1..8956ec36 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -166,8 +166,8 @@ _initAuth() {
 # authentication. This works arounds this by using an undocumented MB API to obtain a token not tied to an
 # IP just for the github tests.
 _oauth2() {
-  _info "$(printenv)"
-  if [ -z "$TEST_DNS_SLEEP" ]; then
+  _info "DOMAIN: $TEST_DNS"
+  if [ "$TEST_DNS" != "dns_mythic_beasts" ]; then
     _oauth2_std
   else
     _oauth2_github

From 95f13360601e27071ccdc2dff4c46b00bb988720 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Mon, 20 Dec 2021 01:09:02 +0000
Subject: [PATCH 34/80] fix: token request body quoting

---
 dnsapi/dns_mythic_beasts.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 8956ec36..77eed04f 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -166,7 +166,6 @@ _initAuth() {
 # authentication. This works arounds this by using an undocumented MB API to obtain a token not tied to an
 # IP just for the github tests.
 _oauth2() {
-  _info "DOMAIN: $TEST_DNS"
   if [ "$TEST_DNS" != "dns_mythic_beasts" ]; then
     _oauth2_std
   else
@@ -204,7 +203,7 @@ _oauth2_std() {
 _oauth2_github() {
   _H1="Accepts: application/json"
   export _H1
-  body="{\"login\":{\"handle\":$MB_AK,\"pass\":$MB_AS,\"floating\":1}}"
+  body="{\"login\":{\"handle\":\"$MB_AK\",\"pass\":\"$MB_AS\",\"floating\":1}}"
 
   _info "Getting Floating token..."
   # body  url [needbase64] [POST|PUT|DELETE] [ContentType]

From 2b6aa2670343e7e6a975c3d0961770f86b4ebfc9 Mon Sep 17 00:00:00 2001
From: racitup <rich@racitup.com>
Date: Tue, 28 Dec 2021 14:45:02 +0000
Subject: [PATCH 35/80] fix: Neilpang review

---
 dnsapi/dns_mythic_beasts.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_mythic_beasts.sh b/dnsapi/dns_mythic_beasts.sh
index 77eed04f..294ae84c 100755
--- a/dnsapi/dns_mythic_beasts.sh
+++ b/dnsapi/dns_mythic_beasts.sh
@@ -163,13 +163,13 @@ _initAuth() {
 
 # Github appears to use an outbound proxy for requests which means subsequent requests may not have the same
 # source IP. The standard Mythic Beasts OAuth2 tokens are tied to an IP, meaning github test requests fail
-# authentication. This works arounds this by using an undocumented MB API to obtain a token not tied to an
+# authentication. This is a work around using an undocumented MB API to obtain a token not tied to an
 # IP just for the github tests.
 _oauth2() {
-  if [ "$TEST_DNS" != "dns_mythic_beasts" ]; then
-    _oauth2_std
-  else
+  if [ "$GITHUB_ACTIONS" = "true" ]; then
     _oauth2_github
+  else
+    _oauth2_std
   fi
   return $?
 }

From d32cedd7dc925cad381920334316f6b563042f96 Mon Sep 17 00:00:00 2001
From: Viktor G <viktor@netgate.com>
Date: Thu, 30 Dec 2021 18:06:17 +0300
Subject: [PATCH 36/80] DNS-ISPConfig ISPC_Api_Insecure argument check fix

---
 dnsapi/dns_ispconfig.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ispconfig.sh b/dnsapi/dns_ispconfig.sh
index e68ddd49..765e0eb5 100755
--- a/dnsapi/dns_ispconfig.sh
+++ b/dnsapi/dns_ispconfig.sh
@@ -32,7 +32,7 @@ dns_ispconfig_rm() {
 ####################  Private functions below ##################################
 
 _ISPC_credentials() {
-  if [ -z "${ISPC_User}" ] || [ -z "$ISPC_Password" ] || [ -z "${ISPC_Api}" ] || [ -z "${ISPC_Api_Insecure}" ]; then
+  if [ -z "${ISPC_User}" ] || [ -z "$ISPC_Password" ] || [ -z "${ISPC_Api}" ] || [ -n "${ISPC_Api_Insecure}" ]; then
     ISPC_User=""
     ISPC_Password=""
     ISPC_Api=""

From 737eba57bd87be29de0f5b9ab52fcdd1bffaca4b Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 3 Jan 2022 11:20:53 +0800
Subject: [PATCH 37/80] send notifications for renew command
 https://github.com/acmesh-official/acme.sh/issues/3869#issuecomment-1003546762

---
 acme.sh | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/acme.sh b/acme.sh
index 96392f5b..65ed2fd4 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5254,13 +5254,13 @@ renewAll() {
         _error_level="$NOTIFY_LEVEL_RENEW"
         _notify_code=0
       fi
-      if [ "$_ACME_IN_CRON" ]; then
-        if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
-          if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
-            _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
-          fi
+
+      if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
+        if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+          _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
         fi
       fi
+
       _success_msg="${_success_msg}    $d
 "
     elif [ "$rc" = "$RENEW_SKIP" ]; then
@@ -5268,13 +5268,13 @@ renewAll() {
         _error_level="$NOTIFY_LEVEL_SKIP"
         _notify_code=$RENEW_SKIP
       fi
-      if [ "$_ACME_IN_CRON" ]; then
-        if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
-          if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
-            _send_notify "Renew $d skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
-          fi
+
+      if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
+        if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+          _send_notify "Renew $d skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
         fi
       fi
+
       _info "Skipped $d"
       _skipped_msg="${_skipped_msg}    $d
 "
@@ -5283,13 +5283,13 @@ renewAll() {
         _error_level="$NOTIFY_LEVEL_ERROR"
         _notify_code=1
       fi
-      if [ "$_ACME_IN_CRON" ]; then
-        if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
-          if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
-            _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
-          fi
+
+      if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
+        if [ "$NOTIFY_MODE" = "$NOTIFY_MODE_CERT" ]; then
+          _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
         fi
       fi
+
       _error_msg="${_error_msg}    $d
 "
       if [ "$_stopRenewOnError" ]; then
@@ -5304,7 +5304,7 @@ renewAll() {
   done
   _debug _error_level "$_error_level"
   _debug _set_level "$_set_level"
-  if [ "$_ACME_IN_CRON" ] && [ $_error_level -le $_set_level ]; then
+  if [ $_error_level -le $_set_level ]; then
     if [ -z "$NOTIFY_MODE" ] || [ "$NOTIFY_MODE" = "$NOTIFY_MODE_BULK" ]; then
       _msg_subject="Renew"
       if [ "$_error_msg" ]; then

From 1566656af30524717545965cc9b91727c7f38c7d Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 3 Jan 2022 11:46:12 +0800
Subject: [PATCH 38/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3869

---
 acme.sh | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 65ed2fd4..9fc44610 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5154,7 +5154,7 @@ renew() {
   _isEcc="$2"
 
   _initpath "$Le_Domain" "$_isEcc"
-
+  _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
   _info "$(__green "Renew: '$Le_Domain'")"
   if [ ! -f "$DOMAIN_CONF" ]; then
     _info "'$Le_Domain' is not an issued domain, skip."
@@ -5189,6 +5189,11 @@ renew() {
   if [ -z "$FORCE" ] && [ "$Le_NextRenewTime" ] && [ "$(_time)" -lt "$Le_NextRenewTime" ]; then
     _info "Skip, Next renewal time is: $(__green "$Le_NextRenewTimeStr")"
     _info "Add '$(__red '--force')' to force to renew."
+    if [ -z "$_ACME_IN_RENEWALL" ]; then
+      if [ $_set_level -ge $NOTIFY_LEVEL_SKIP ]; then
+        _send_notify "Renew $Le_Domain skipped" "Good, the cert is skipped." "$NOTIFY_HOOK" "$RENEW_SKIP"
+      fi
+    fi
     return "$RENEW_SKIP"
   fi
 
@@ -5215,6 +5220,17 @@ renew() {
   fi
 
   _ACME_IS_RENEW=""
+  if [ -z "$_ACME_IN_RENEWALL" ]; then
+    if [ "$res" = "0" ]; then
+      if [ $_set_level -ge $NOTIFY_LEVEL_RENEW ]; then
+        _send_notify "Renew $d success" "Good, the cert is renewed." "$NOTIFY_HOOK" 0
+      fi
+    else
+      if [ $_set_level -ge $NOTIFY_LEVEL_ERROR ]; then
+        _send_notify "Renew $d error" "There is an error." "$NOTIFY_HOOK" 1
+      fi
+    fi
+  fi
 
   return "$res"
 }
@@ -5232,6 +5248,7 @@ renewAll() {
   _notify_code=$RENEW_SKIP
   _set_level=${NOTIFY_LEVEL:-$NOTIFY_LEVEL_DEFAULT}
   _debug "_set_level" "$_set_level"
+  export _ACME_IN_RENEWALL=1
   for di in "${CERT_HOME}"/*.*/; do
     _debug di "$di"
     if ! [ -d "$di" ]; then

From c39e6c44231a9c077a77a131d39fefe8428ae932 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 3 Jan 2022 12:38:59 +0800
Subject: [PATCH 39/80] add `--info` command to show the global configs or
 domain configs. https://github.com/acmesh-official/acme.sh/issues/2444

---
 Dockerfile |  1 +
 acme.sh    | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 4046c726..0421da34 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -40,6 +40,7 @@ RUN for verb in help \
   revoke \
   remove \
   list \
+  info \
   showcsr \
   install-cronjob \
   uninstall-cronjob \
diff --git a/acme.sh b/acme.sh
index 9fc44610..fe4dc1bd 100755
--- a/acme.sh
+++ b/acme.sh
@@ -144,6 +144,8 @@ NOTIFY_MODE_CERT=1
 
 NOTIFY_MODE_DEFAULT=$NOTIFY_MODE_BULK
 
+_BASE64_ENCODED_CFGS="Le_PreHook Le_PostHook Le_RenewHook Le_Preferred_Chain Le_ReloadCmd"
+
 _DEBUG_WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh"
 
 _PREPARE_LINK="https://github.com/acmesh-official/acme.sh/wiki/Install-preparations"
@@ -6609,6 +6611,7 @@ Commands:
   --revoke                 Revoke a cert.
   --remove                 Remove the cert from list of certs known to $PROJECT_NAME.
   --list                   List all the certs.
+  --info                   Show the $PROJECT_NAME configs, or the configs for a domain with [-d domain] parameter.
   --to-pkcs12              Export the certificate and key to a pfx file.
   --to-pkcs8               Convert to pkcs8 format.
   --sign-csr               Issue a cert from an existing csr.
@@ -6926,6 +6929,28 @@ setdefaultchain() {
   _savecaconf "DEFAULT_PREFERRED_CHAIN" "$_preferred_chain"
 }
 
+#domain ecc
+info() {
+  _domain="$1"
+  _ecc="$2"
+  _initpath
+  if [ -z "$_domain" ]; then
+    _debug "Show global configs"
+    echo "LE_WORKING_DIR=$LE_WORKING_DIR"
+    echo "LE_CONFIG_HOME=$LE_CONFIG_HOME"
+    cat "$ACCOUNT_CONF_PATH"
+  else
+    _debug "Show domain configs"
+    (
+      _initpath "$_domain" "$_ecc"
+      echo "DOMAIN_CONF=$DOMAIN_CONF"
+      for seg in $(cat $DOMAIN_CONF | cut -d = -f 1); do
+        echo "$seg=$(_readdomainconf "$seg")"
+      done
+    )
+  fi
+}
+
 _process() {
   _CMD=""
   _domain=""
@@ -7035,6 +7060,9 @@ _process() {
     --list)
       _CMD="list"
       ;;
+    --info)
+      _CMD="info"
+      ;;
     --install-cronjob | --installcronjob)
       _CMD="installcronjob"
       ;;
@@ -7586,6 +7614,9 @@ _process() {
   list)
     list "$_listraw" "$_domain"
     ;;
+  info)
+    info "$_domain" "$_ecc"
+    ;;
   installcronjob) installcronjob "$_confighome" ;;
   uninstallcronjob) uninstallcronjob ;;
   cron) cron ;;

From 37cc611e3fdad187d33b3f618ca67fbb79babe8a Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 3 Jan 2022 13:41:57 +0800
Subject: [PATCH 40/80] fix gentoo image

---
 .github/workflows/Linux.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index cba708b3..7b24eac9 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -20,7 +20,7 @@ jobs:
   Linux:
     strategy:
       matrix:
-        os: ["ubuntu:latest", "debian:latest", "almalinux:latest", "fedora:latest", "centos:latest", "opensuse/leap:latest", "alpine:latest", "oraclelinux:8", "kalilinux/kali", "archlinux:latest", "mageia", "gentoo/stage3-amd64"]
+        os: ["ubuntu:latest", "debian:latest", "almalinux:latest", "fedora:latest", "centos:latest", "opensuse/leap:latest", "alpine:latest", "oraclelinux:8", "kalilinux/kali", "archlinux:latest", "mageia", "gentoo/stage3"]
     runs-on: ubuntu-latest
     env:
       TEST_LOCAL: 1

From 0727f7054bc4df6112988d44f45d795099d41b63 Mon Sep 17 00:00:00 2001
From: Joel Pearson <joel.pearson@gmail.com>
Date: Mon, 13 Dec 2021 17:15:49 +1100
Subject: [PATCH 41/80] Allow optional "NEW" in CSR header and footer

When generating a CSR in Windows it seems to create a CSR header that looks like "-----BEGIN NEW CERTIFICATE REQUEST-----", but the addition of "NEW" breaks the parsing of the CSR. Making "NEW " optional fixes the problem.

Apparently certbot is tolerant of both forms, see: https://community.letsencrypt.org/t/error-parsing-certificate-request-resolved/40039/6 for more information.
---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index fe4dc1bd..b536d742 100755
--- a/acme.sh
+++ b/acme.sh
@@ -80,8 +80,8 @@ NGINX="nginx:"
 NGINX_START="#ACME_NGINX_START"
 NGINX_END="#ACME_NGINX_END"
 
-BEGIN_CSR="-----BEGIN CERTIFICATE REQUEST-----"
-END_CSR="-----END CERTIFICATE REQUEST-----"
+BEGIN_CSR="-----BEGIN [NEW ]\{0,4\}CERTIFICATE REQUEST-----"
+END_CSR="-----END [NEW ]\{0,4\}CERTIFICATE REQUEST-----"
 
 BEGIN_CERT="-----BEGIN CERTIFICATE-----"
 END_CERT="-----END CERTIFICATE-----"

From 6aa1ec08020ca9edb9813cb4148d0f467524d46d Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Thu, 6 Jan 2022 16:20:43 +0100
Subject: [PATCH 42/80] deploy/fritzbox: allow hook to be used with multiple
 fritzboxes

Previously the deploy hook config was stored in the account config.
This seems odd and adds unnecessary limitations to the hook.
Now we're using the correct _*deployconf() functions to read and
write the deploy hook config.
---
 deploy/fritzbox.sh | 44 ++++++++++++++++++++++++++------------------
 1 file changed, 26 insertions(+), 18 deletions(-)

diff --git a/deploy/fritzbox.sh b/deploy/fritzbox.sh
index 2ca7ab7d..416a4121 100644
--- a/deploy/fritzbox.sh
+++ b/deploy/fritzbox.sh
@@ -36,43 +36,51 @@ fritzbox_deploy() {
     fi
   fi
 
-  _fritzbox_username="${DEPLOY_FRITZBOX_USERNAME}"
-  _fritzbox_password="${DEPLOY_FRITZBOX_PASSWORD}"
-  _fritzbox_url="${DEPLOY_FRITZBOX_URL}"
+  # Clear traces of incorrectly stored values
+  _clearaccountconf DEPLOY_FRITZBOX_USERNAME
+  _clearaccountconf DEPLOY_FRITZBOX_PASSWORD
+  _clearaccountconf DEPLOY_FRITZBOX_URL
 
-  _debug _fritzbox_url "$_fritzbox_url"
-  _debug _fritzbox_username "$_fritzbox_username"
-  _secure_debug _fritzbox_password "$_fritzbox_password"
-  if [ -z "$_fritzbox_username" ]; then
+  # Read config from saved values or env
+  _getdeployconf DEPLOY_FRITZBOX_USERNAME
+  _getdeployconf DEPLOY_FRITZBOX_PASSWORD
+  _getdeployconf DEPLOY_FRITZBOX_URL
+
+  _debug DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL"
+  _debug DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME"
+  _secure_debug DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD"
+
+  if [ -z "$DEPLOY_FRITZBOX_USERNAME" ]; then
     _err "FRITZ!Box username is not found, please define DEPLOY_FRITZBOX_USERNAME."
     return 1
   fi
-  if [ -z "$_fritzbox_password" ]; then
+  if [ -z "$DEPLOY_FRITZBOX_PASSWORD" ]; then
     _err "FRITZ!Box password is not found, please define DEPLOY_FRITZBOX_PASSWORD."
     return 1
   fi
-  if [ -z "$_fritzbox_url" ]; then
+  if [ -z "$DEPLOY_FRITZBOX_URL" ]; then
     _err "FRITZ!Box url is not found, please define DEPLOY_FRITZBOX_URL."
     return 1
   fi
 
-  _saveaccountconf DEPLOY_FRITZBOX_USERNAME "${_fritzbox_username}"
-  _saveaccountconf DEPLOY_FRITZBOX_PASSWORD "${_fritzbox_password}"
-  _saveaccountconf DEPLOY_FRITZBOX_URL "${_fritzbox_url}"
+  # Save current values
+  _savedeployconf DEPLOY_FRITZBOX_USERNAME "$DEPLOY_FRITZBOX_USERNAME"
+  _savedeployconf DEPLOY_FRITZBOX_PASSWORD "$DEPLOY_FRITZBOX_PASSWORD"
+  _savedeployconf DEPLOY_FRITZBOX_URL "$DEPLOY_FRITZBOX_URL"
 
   # Do not check for a valid SSL certificate, because initially the cert is not valid, so it could not install the LE generated certificate
   export HTTPS_INSECURE=1
 
   _info "Log in to the FRITZ!Box"
-  _fritzbox_challenge="$(_get "${_fritzbox_url}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
+  _fritzbox_challenge="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
   if _exists iconv; then
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
   elif _exists uconv; then
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | uconv -f ASCII -t UTF16LE | _digest md5 hex)"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | uconv -f ASCII -t UTF16LE | _digest md5 hex)"
   else
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${DEPLOY_FRITZBOX_PASSWORD}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
   fi
-  _fritzbox_sid="$(_get "${_fritzbox_url}/login_sid.lua?sid=0000000000000000&username=${_fritzbox_username}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
+  _fritzbox_sid="$(_get "${DEPLOY_FRITZBOX_URL}/login_sid.lua?sid=0000000000000000&username=${DEPLOY_FRITZBOX_USERNAME}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
 
   if [ -z "${_fritzbox_sid}" ] || [ "${_fritzbox_sid}" = "0000000000000000" ]; then
     _err "Logging in to the FRITZ!Box failed. Please check username, password and URL."
@@ -104,7 +112,7 @@ fritzbox_deploy() {
   _info "Upload certificate to the FRITZ!Box"
 
   export _H1="Content-type: multipart/form-data boundary=${_post_boundary}"
-  _post "$(cat "${_post_request}")" "${_fritzbox_url}/cgi-bin/firmwarecfg" | grep SSL
+  _post "$(cat "${_post_request}")" "${DEPLOY_FRITZBOX_URL}/cgi-bin/firmwarecfg" | grep SSL
 
   retval=$?
   if [ $retval = 0 ]; then

From 8cdceb83b2422b17ba5c5e6242a46c6cd481c669 Mon Sep 17 00:00:00 2001
From: Jacob Vandborg <16362036+jvandborg@users.noreply.github.com>
Date: Thu, 6 Jan 2022 19:21:05 +0100
Subject: [PATCH 43/80] Cannot wait for PR #3673 to be completed

PR #3673 Fix simply.com API seems abandoned by maintainer and I need this fixed asap

Changes implemented
* Normalize JSON and fix not handling return code correctly
* Add some information to comments
* Fix trailing slash on URIs
* Add 60 second sleep for zone to be written
* Fix parsing record_data and record_type
---
 dnsapi/dns_simply.sh | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/dnsapi/dns_simply.sh b/dnsapi/dns_simply.sh
index e0e05017..2baa4581 100644
--- a/dnsapi/dns_simply.sh
+++ b/dnsapi/dns_simply.sh
@@ -1,15 +1,15 @@
 #!/usr/bin/env sh
 
-#
+# API-integration for Simply.com (https://www.simply.com)
+
 #SIMPLY_AccountName="accountname"
-#
 #SIMPLY_ApiKey="apikey"
 #
 #SIMPLY_Api="https://api.simply.com/1/[ACCOUNTNAME]/[APIKEY]"
 SIMPLY_Api_Default="https://api.simply.com/1"
 
 #This is used for determining success of REST call
-SIMPLY_SUCCESS_CODE='"status": 200'
+SIMPLY_SUCCESS_CODE='"status":200'
 
 ########  Public functions #####################
 #Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
@@ -51,7 +51,7 @@ dns_simply_rm() {
 
   _simply_save_config
 
-  _debug "First detect the root zone"
+  _debug "Find the DNS zone"
 
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
@@ -77,8 +77,8 @@ dns_simply_rm() {
   for record in $records; do
     _debug record "$record"
 
-    record_data=$(echo "$record" | cut -d "," -f 3 | sed 's/"//g' | grep "data" | cut -d ":" -f 2)
-    record_type=$(echo "$record" | cut -d "," -f 4 | sed 's/"//g' | grep "type" | cut -d ":" -f 2)
+    record_data=$(echo "$record" | sed -n "s/.*\"data\":\"\([^\"]*\)\".*/\1/p")
+    record_type=$(echo "$record" | sed -n "s/.*\"type\":\"\([^\"]*\)\".*/\1/p")
 
     _debug2 record_data "$record_data"
     _debug2 record_type "$record_type"
@@ -151,7 +151,7 @@ _simply_save_config() {
 _simply_get_all_records() {
   domain=$1
 
-  if ! _simply_rest GET "my/products/$domain/dns/records"; then
+  if ! _simply_rest GET "my/products/$domain/dns/records/"; then
     return 1
   fi
 
@@ -169,7 +169,7 @@ _get_root() {
       return 1
     fi
 
-    if ! _simply_rest GET "my/products/$h/dns"; then
+    if ! _simply_rest GET "my/products/$h/dns/"; then
       return 1
     fi
 
@@ -193,7 +193,7 @@ _simply_add_record() {
 
   data="{\"name\": \"$sub_domain\", \"type\":\"TXT\", \"data\": \"$txtval\", \"priority\":0, \"ttl\": 3600}"
 
-  if ! _simply_rest POST "my/products/$domain/dns/records" "$data"; then
+  if ! _simply_rest POST "my/products/$domain/dns/records/" "$data"; then
     _err "Adding record not successfull!"
     return 1
   fi
@@ -203,6 +203,9 @@ _simply_add_record() {
     _err "$response"
     return 1
   fi
+  
+  _info "Waiting 60 seconds for DNS changes to be written"
+  _sleep 60
 
   return 0
 }
@@ -214,7 +217,7 @@ _simply_delete_record() {
 
   _debug record_id "Delete record with id $record_id"
 
-  if ! _simply_rest DELETE "my/products/$domain/dns/records/$record_id"; then
+  if ! _simply_rest DELETE "my/products/$domain/dns/records/$record_id/"; then
     _err "Deleting record not successfull!"
     return 1
   fi
@@ -249,6 +252,8 @@ _simply_rest() {
     _err "error $ep"
     return 1
   fi
+  
+  response="$(echo "$response" | _normalizeJson)"
 
   _debug2 response "$response"
 

From 459faf4dfb121154aa0e9a48bac3c07cd3657239 Mon Sep 17 00:00:00 2001
From: jvandborg <16362036+jvandborg@users.noreply.github.com>
Date: Thu, 6 Jan 2022 22:03:39 +0100
Subject: [PATCH 44/80] Format to comply with style guide

---
 dnsapi/dns_simply.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_simply.sh b/dnsapi/dns_simply.sh
index 2baa4581..85819ab8 100644
--- a/dnsapi/dns_simply.sh
+++ b/dnsapi/dns_simply.sh
@@ -203,7 +203,7 @@ _simply_add_record() {
     _err "$response"
     return 1
   fi
-  
+
   _info "Waiting 60 seconds for DNS changes to be written"
   _sleep 60
 
@@ -252,7 +252,7 @@ _simply_rest() {
     _err "error $ep"
     return 1
   fi
-  
+
   response="$(echo "$response" | _normalizeJson)"
 
   _debug2 response "$response"

From e23c02575db58790a4e3c96734549afa4aefe40e Mon Sep 17 00:00:00 2001
From: Jacob Vandborg <16362036+jvandborg@users.noreply.github.com>
Date: Fri, 7 Jan 2022 08:10:31 +0100
Subject: [PATCH 45/80] Removed DNS sleep

Users should use command line parameter --dnssleep instead
---
 dnsapi/dns_simply.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/dnsapi/dns_simply.sh b/dnsapi/dns_simply.sh
index 85819ab8..437e5e5c 100644
--- a/dnsapi/dns_simply.sh
+++ b/dnsapi/dns_simply.sh
@@ -204,9 +204,6 @@ _simply_add_record() {
     return 1
   fi
 
-  _info "Waiting 60 seconds for DNS changes to be written"
-  _sleep 60
-
   return 0
 }
 

From d43b587d175f3631df72d1a1d833a775df6a1066 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 22:06:18 +0800
Subject: [PATCH 46/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3870

---
 acme.sh | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index b536d742..97d1e257 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1272,9 +1272,17 @@ _createcsr() {
   _csr_cn="$(_idn "$domain")"
   _debug2 _csr_cn "$_csr_cn"
   if _contains "$(uname -a)" "MINGW"; then
-    ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
+    if _isIP "$_csr_cn"; then
+      ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//O=$PROJECT_NAME" -config "$csrconf" -out "$csr"
+    else
+      ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "//CN=$_csr_cn" -config "$csrconf" -out "$csr"
+    fi
   else
-    ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
+    if _isIP "$_csr_cn"; then
+      ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/O=$PROJECT_NAME" -config "$csrconf" -out "$csr"
+    else
+      ${ACME_OPENSSL_BIN:-openssl} req -new -sha256 -key "$csrkey" -subj "/CN=$_csr_cn" -config "$csrconf" -out "$csr"
+    fi
   fi
 }
 

From b2f4cc2dc55459f4ca1e927670935b04afe2695e Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 22:58:42 +0800
Subject: [PATCH 47/80] add Step-ca to CI
 https://github.com/acmesh-official/acme.sh/issues/3871

---
 .github/workflows/Ubuntu.yml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 28b06541..0f6a4799 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -30,6 +30,11 @@ jobs:
            CA: "ZeroSSL RSA Domain Secure Site CA"
            CA_EMAIL: "githubtest@acme.sh"
            TEST_PREFERRED_CHAIN: ""
+         - TEST_ACME_Server: "https://localhost:9000/acme/acme/directory"
+           CA_ECDSA: ""
+           CA: "Smallstep Intermediate CA"
+           CA_EMAIL: ""
+           TEST_PREFERRED_CHAIN: ""
 
     runs-on: ubuntu-latest
     env:
@@ -44,6 +49,18 @@ jobs:
     - uses: actions/checkout@v2
     - name: Install tools
       run: sudo apt-get install -y socat
+    - name: Start StepCA
+      if: ${{ matrix.TEST_ACME_Server=='https://localhost:9000/acme/acme/directory' }}
+      run: |
+           docker run -d \
+            -p 9000:9000 \
+            -e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
+            -e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
+            --name stepca \
+            smallstep/step-ca \
+            && docker exec -it stepca step ca provisioner add acme --type ACME \
+            && docker exec -it stepca kill -1 1 \
+            && docker exec -it stepca cat /home/step/certs/root_ca.crt >>/etc/ssl/certs/ca-certificates.crt
     - name: Clone acmetest
       run: |
           cd .. \

From 735db1a12be7b88e4f1a1c7e622dddbc751dd432 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:00:34 +0800
Subject: [PATCH 48/80] fix ci

---
 .github/workflows/Ubuntu.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 0f6a4799..33c20161 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -58,9 +58,9 @@ jobs:
             -e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
             --name stepca \
             smallstep/step-ca \
-            && docker exec -it stepca step ca provisioner add acme --type ACME \
-            && docker exec -it stepca kill -1 1 \
-            && docker exec -it stepca cat /home/step/certs/root_ca.crt >>/etc/ssl/certs/ca-certificates.crt
+            && docker exec  stepca step ca provisioner add acme --type ACME \
+            && docker exec  stepca kill -1 1 \
+            && docker exec  stepca cat /home/step/certs/root_ca.crt >>/etc/ssl/certs/ca-certificates.crt
     - name: Clone acmetest
       run: |
           cd .. \

From 10f171b6e4cdd2211207f75f0e00d07fdc91a87e Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:05:49 +0800
Subject: [PATCH 49/80] fix ci

---
 .github/workflows/Ubuntu.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 33c20161..1123c1ac 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -52,13 +52,13 @@ jobs:
     - name: Start StepCA
       if: ${{ matrix.TEST_ACME_Server=='https://localhost:9000/acme/acme/directory' }}
       run: |
-           docker run -d \
+           docker run --rm -d \
             -p 9000:9000 \
             -e "DOCKER_STEPCA_INIT_NAME=Smallstep" \
             -e "DOCKER_STEPCA_INIT_DNS_NAMES=localhost,$(hostname -f)" \
             --name stepca \
             smallstep/step-ca \
-            && docker exec  stepca step ca provisioner add acme --type ACME \
+            && sleep 5 && docker exec  stepca step ca provisioner add acme --type ACME \
             && docker exec  stepca kill -1 1 \
             && docker exec  stepca cat /home/step/certs/root_ca.crt >>/etc/ssl/certs/ca-certificates.crt
     - name: Clone acmetest

From 49deb4af24d539a407b9fae4675d17d0b16b96f9 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:09:56 +0800
Subject: [PATCH 50/80] fix CI

---
 .github/workflows/Ubuntu.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 1123c1ac..e967e3b4 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -60,7 +60,7 @@ jobs:
             smallstep/step-ca \
             && sleep 5 && docker exec  stepca step ca provisioner add acme --type ACME \
             && docker exec  stepca kill -1 1 \
-            && docker exec  stepca cat /home/step/certs/root_ca.crt >>/etc/ssl/certs/ca-certificates.crt
+            && docker exec  stepca cat /home/step/certs/root_ca.crt | sudo cat - >>/etc/ssl/certs/ca-certificates.crt
     - name: Clone acmetest
       run: |
           cd .. \

From ec10a3eab4ba87fce47ce83eeff3a7831fb4ad31 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:14:46 +0800
Subject: [PATCH 51/80] fix CI

---
 .github/workflows/Ubuntu.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index e967e3b4..3ac7d6ab 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -60,7 +60,7 @@ jobs:
             smallstep/step-ca \
             && sleep 5 && docker exec  stepca step ca provisioner add acme --type ACME \
             && docker exec  stepca kill -1 1 \
-            && docker exec  stepca cat /home/step/certs/root_ca.crt | sudo cat - >>/etc/ssl/certs/ca-certificates.crt
+            && docker exec  stepca cat /home/step/certs/root_ca.crt | sudo bash -c "cat - >>/etc/ssl/certs/ca-certificates.crt"
     - name: Clone acmetest
       run: |
           cd .. \

From 8e9bbd1bb3e83d1af7687a16dd9b4b7a2c3f407f Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:35:18 +0800
Subject: [PATCH 52/80] fix CI

---
 .github/workflows/Ubuntu.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 3ac7d6ab..1f8db98a 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -35,6 +35,7 @@ jobs:
            CA: "Smallstep Intermediate CA"
            CA_EMAIL: ""
            TEST_PREFERRED_CHAIN: ""
+           NO_REVOKE: 1
 
     runs-on: ubuntu-latest
     env:
@@ -45,6 +46,7 @@ jobs:
       CA_EMAIL: ${{ matrix.CA_EMAIL }}
       NO_ECC_384: ${{ matrix.NO_ECC_384 }}
       TEST_PREFERRED_CHAIN: ${{ matrix.TEST_PREFERRED_CHAIN }}
+      NO_REVOKE: ${{ matrix.NO_REVOKE }}
     steps:
     - uses: actions/checkout@v2
     - name: Install tools

From 45971b80834c0bea59f3dc549f23e968ccd04fbc Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:43:08 +0800
Subject: [PATCH 53/80] add ip cert test for stepCA

---
 .github/workflows/Ubuntu.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index 1f8db98a..ebf69a3b 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -36,6 +36,14 @@ jobs:
            CA_EMAIL: ""
            TEST_PREFERRED_CHAIN: ""
            NO_REVOKE: 1
+         - TEST_ACME_Server: "https://localhost:9000/acme/acme/directory"
+           CA_ECDSA: ""
+           CA: "Smallstep Intermediate CA"
+           CA_EMAIL: ""
+           TEST_PREFERRED_CHAIN: ""
+           NO_REVOKE: 1
+           TEST_IPCERT: 1
+           TestingDomain: "172.17.0.1"
 
     runs-on: ubuntu-latest
     env:
@@ -47,6 +55,8 @@ jobs:
       NO_ECC_384: ${{ matrix.NO_ECC_384 }}
       TEST_PREFERRED_CHAIN: ${{ matrix.TEST_PREFERRED_CHAIN }}
       NO_REVOKE: ${{ matrix.NO_REVOKE }}
+      TEST_IPCERT: ${{ matrix.TEST_IPCERT }}
+      TestingDomain: ${{ matrix.TestingDomain }}
     steps:
     - uses: actions/checkout@v2
     - name: Install tools

From d42feae0af801ad1c1ec0236925c350b8372571b Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Fri, 7 Jan 2022 23:44:19 +0800
Subject: [PATCH 54/80] fix ecdsa name for stepca

---
 .github/workflows/Ubuntu.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/Ubuntu.yml b/.github/workflows/Ubuntu.yml
index ebf69a3b..4540580c 100644
--- a/.github/workflows/Ubuntu.yml
+++ b/.github/workflows/Ubuntu.yml
@@ -31,13 +31,13 @@ jobs:
            CA_EMAIL: "githubtest@acme.sh"
            TEST_PREFERRED_CHAIN: ""
          - TEST_ACME_Server: "https://localhost:9000/acme/acme/directory"
-           CA_ECDSA: ""
+           CA_ECDSA: "Smallstep Intermediate CA"
            CA: "Smallstep Intermediate CA"
            CA_EMAIL: ""
            TEST_PREFERRED_CHAIN: ""
            NO_REVOKE: 1
          - TEST_ACME_Server: "https://localhost:9000/acme/acme/directory"
-           CA_ECDSA: ""
+           CA_ECDSA: "Smallstep Intermediate CA"
            CA: "Smallstep Intermediate CA"
            CA_EMAIL: ""
            TEST_PREFERRED_CHAIN: ""

From 75ae57e1945c7f6883aa8b494a9b0f6a43a79f63 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Sat, 8 Jan 2022 19:19:51 +0800
Subject: [PATCH 55/80] report false

---
 .github/workflows/DNS.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 32d97614..46fd8283 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -37,7 +37,7 @@ jobs:
     - name: "Read this:   https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test"
       run: |
         echo "Read this:   https://github.com/acmesh-official/acme.sh/wiki/DNS-API-Test"
-        if [ "${{github.actor}}" != "Neilpang" ]; then
+        if [ "${{github.repository_owner}}" != "acmesh-official" ]; then
           false
         fi
 

From 86c3fa0df030d3b5ac7c1597b19b0b36d9616e1a Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Sat, 8 Jan 2022 19:51:04 +0800
Subject: [PATCH 56/80] remove retry for get and post

---
 acme.sh | 72 ++++-----------------------------------------------------
 1 file changed, 5 insertions(+), 67 deletions(-)

diff --git a/acme.sh b/acme.sh
index b536d742..b0a4388b 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1831,8 +1831,6 @@ _inithttp() {
 
 }
 
-_HTTP_MAX_RETRY=8
-
 # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
 _post() {
   body="$1"
@@ -1840,33 +1838,6 @@ _post() {
   needbase64="$3"
   httpmethod="$4"
   _postContentType="$5"
-  _sleep_retry_sec=1
-  _http_retry_times=0
-  _hcode=0
-  while [ "${_http_retry_times}" -le "$_HTTP_MAX_RETRY" ]; do
-    [ "$_http_retry_times" = "$_HTTP_MAX_RETRY" ]
-    _lastHCode="$?"
-    _debug "Retrying post"
-    _post_impl "$body" "$_post_url" "$needbase64" "$httpmethod" "$_postContentType" "$_lastHCode"
-    _hcode="$?"
-    _debug _hcode "$_hcode"
-    if [ "$_hcode" = "0" ]; then
-      break
-    fi
-    _http_retry_times=$(_math $_http_retry_times + 1)
-    _sleep $_sleep_retry_sec
-  done
-  return $_hcode
-}
-
-# body  url [needbase64] [POST|PUT|DELETE] [ContentType] [displayError]
-_post_impl() {
-  body="$1"
-  _post_url="$2"
-  needbase64="$3"
-  httpmethod="$4"
-  _postContentType="$5"
-  displayError="$6"
 
   if [ -z "$httpmethod" ]; then
     httpmethod="POST"
@@ -1918,9 +1889,7 @@ _post_impl() {
     fi
     _ret="$?"
     if [ "$_ret" != "0" ]; then
-      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
-        _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
-      fi
+      _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $_ret"
       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
         _err "Here is the curl dump log:"
         _err "$(cat "$_CURL_DUMP")"
@@ -1976,9 +1945,7 @@ _post_impl() {
       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
     fi
     if [ "$_ret" != "0" ]; then
-      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
-        _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
-      fi
+      _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $_ret"
     fi
     _sed_i "s/^ *//g" "$HTTP_HEADER"
   else
@@ -1992,38 +1959,13 @@ _post_impl() {
 
 # url getheader timeout
 _get() {
-  url="$1"
-  onlyheader="$2"
-  t="$3"
-  _sleep_retry_sec=1
-  _http_retry_times=0
-  _hcode=0
-  while [ "${_http_retry_times}" -le "$_HTTP_MAX_RETRY" ]; do
-    [ "$_http_retry_times" = "$_HTTP_MAX_RETRY" ]
-    _lastHCode="$?"
-    _debug "Retrying GET"
-    _get_impl "$url" "$onlyheader" "$t" "$_lastHCode"
-    _hcode="$?"
-    _debug _hcode "$_hcode"
-    if [ "$_hcode" = "0" ]; then
-      break
-    fi
-    _http_retry_times=$(_math $_http_retry_times + 1)
-    _sleep $_sleep_retry_sec
-  done
-  return $_hcode
-}
-
-# url getheader timeout displayError
-_get_impl() {
   _debug GET
   url="$1"
   onlyheader="$2"
   t="$3"
-  displayError="$4"
   _debug url "$url"
   _debug "timeout=$t"
-  _debug "displayError" "$displayError"
+
   _inithttp
 
   if [ "$_ACME_CURL" ] && [ "${ACME_USE_WGET:-0}" = "0" ]; then
@@ -2042,9 +1984,7 @@ _get_impl() {
     fi
     ret=$?
     if [ "$ret" != "0" ]; then
-      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
-        _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
-      fi
+      _err "Please refer to https://curl.haxx.se/libcurl/c/libcurl-errors.html for error code: $ret"
       if [ "$DEBUG" ] && [ "$DEBUG" -ge "2" ]; then
         _err "Here is the curl dump log:"
         _err "$(cat "$_CURL_DUMP")"
@@ -2070,9 +2010,7 @@ _get_impl() {
       _debug "wget returns 8, the server returns a 'Bad request' response, lets process the response later."
     fi
     if [ "$ret" != "0" ]; then
-      if [ -z "$displayError" ] || [ "$displayError" = "0" ]; then
-        _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
-      fi
+      _err "Please refer to https://www.gnu.org/software/wget/manual/html_node/Exit-Status.html for error code: $ret"
     fi
   else
     ret=$?

From e67d26caeb94c54d4daee8b8ce691b77d4861ce3 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Sat, 8 Jan 2022 19:58:49 +0800
Subject: [PATCH 57/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3845#issuecomment-999367478

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index b0a4388b..b25619bf 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1252,7 +1252,7 @@ _createcsr() {
   else
     domainlist="$(_idn "$domainlist")"
     _debug2 domainlist "$domainlist"
-    alt="$(_getIdType "$domain" | _upper_case):$domain"
+    alt="$(_getIdType "$domain" | _upper_case):$(_idn "$domain")"
     for dl in $(echo "$domainlist" | tr "," ' '); do
       alt="$alt,$(_getIdType "$dl" | _upper_case):$dl"
     done

From 4346139d65ee013578e5e0893f425d1bab9863d7 Mon Sep 17 00:00:00 2001
From: Bodenhaltung <12759677+Bodenhaltung@users.noreply.github.com>
Date: Sun, 9 Jan 2022 03:32:22 +0100
Subject: [PATCH 58/80] Add dnsHome.de API (#3823)

Add dnsHome.de API
---
 dnsapi/dns_dnshome.sh | 87 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100755 dnsapi/dns_dnshome.sh

diff --git a/dnsapi/dns_dnshome.sh b/dnsapi/dns_dnshome.sh
new file mode 100755
index 00000000..99608769
--- /dev/null
+++ b/dnsapi/dns_dnshome.sh
@@ -0,0 +1,87 @@
+#!/usr/bin/env sh
+
+# dnsHome.de API for acme.sh
+#
+# This Script adds the necessary TXT record to a Subdomain
+#
+# Author dnsHome.de (https://github.com/dnsHome-de)
+#
+# Report Bugs to https://github.com/acmesh-official/acme.sh/issues/3819
+#
+# export DNSHOME_Subdomain=""
+# export DNSHOME_SubdomainPassword=""
+
+# Usage: add subdomain.ddnsdomain.tld "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+dns_dnshome_add() {
+  txtvalue=$2
+
+  DNSHOME_Subdomain="${DNSHOME_Subdomain:-$(_readdomainconf DNSHOME_Subdomain)}"
+  DNSHOME_SubdomainPassword="${DNSHOME_SubdomainPassword:-$(_readdomainconf DNSHOME_SubdomainPassword)}"
+
+  if [ -z "$DNSHOME_Subdomain" ] || [ -z "$DNSHOME_SubdomainPassword" ]; then
+    DNSHOME_Subdomain=""
+    DNSHOME_SubdomainPassword=""
+    _err "Please specify/export your dnsHome.de Subdomain and Password"
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _savedomainconf DNSHOME_Subdomain "$DNSHOME_Subdomain"
+  _savedomainconf DNSHOME_SubdomainPassword "$DNSHOME_SubdomainPassword"
+
+  DNSHOME_Api="https://$DNSHOME_Subdomain:$DNSHOME_SubdomainPassword@www.dnshome.de/dyndns.php"
+
+  _DNSHOME_rest POST "acme=add&txt=$txtvalue"
+  if ! echo "$response" | grep 'successfully' >/dev/null; then
+    _err "Error"
+    _err "$response"
+    return 1
+  fi
+
+  return 0
+}
+
+# Usage: txtvalue
+# Used to remove the txt record after validation
+dns_dnshome_rm() {
+  txtvalue=$2
+
+  DNSHOME_Subdomain="${DNSHOME_Subdomain:-$(_readdomainconf DNSHOME_Subdomain)}"
+  DNSHOME_SubdomainPassword="${DNSHOME_SubdomainPassword:-$(_readdomainconf DNSHOME_SubdomainPassword)}"
+
+  DNSHOME_Api="https://$DNSHOME_Subdomain:$DNSHOME_SubdomainPassword@www.dnshome.de/dyndns.php"
+
+  if [ -z "$DNSHOME_Subdomain" ] || [ -z "$DNSHOME_SubdomainPassword" ]; then
+    DNSHOME_Subdomain=""
+    DNSHOME_SubdomainPassword=""
+    _err "Please specify/export your dnsHome.de Subdomain and Password"
+    return 1
+  fi
+
+  _DNSHOME_rest POST "acme=rm&txt=$txtvalue"
+  if ! echo "$response" | grep 'successfully' >/dev/null; then
+    _err "Error"
+    _err "$response"
+    return 1
+  fi
+
+  return 0
+}
+
+####################  Private functions below ##################################
+_DNSHOME_rest() {
+  method=$1
+  data="$2"
+  _debug "$data"
+
+  _debug data "$data"
+  response="$(_post "$data" "$DNSHOME_Api" "" "$method")"
+
+  if [ "$?" != "0" ]; then
+    _err "error $data"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From 61c853a3c15656f2be5259285f571e53cb400211 Mon Sep 17 00:00:00 2001
From: "Victor R. Santos" <victor-rds@users.noreply.github.com>
Date: Sun, 9 Jan 2022 02:39:28 +0000
Subject: [PATCH 59/80] Add Gotify notification (#3759)

---
 notify/gotify.sh | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 notify/gotify.sh

diff --git a/notify/gotify.sh b/notify/gotify.sh
new file mode 100644
index 00000000..e370bc21
--- /dev/null
+++ b/notify/gotify.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env sh
+
+#Support Gotify
+
+#GOTIFY_URL="https://gotify.example.com"
+#GOTIFY_TOKEN="123456789ABCDEF"
+
+#optional
+#GOTIFY_PRIORITY=0
+
+# subject  content statusCode
+gotify_send() {
+  _subject="$1"
+  _content="$2"
+  _statusCode="$3" #0: success, 1: error 2($RENEW_SKIP): skipped
+  _debug "_subject" "$_subject"
+  _debug "_content" "$_content"
+  _debug "_statusCode" "$_statusCode"
+
+  GOTIFY_URL="${GOTIFY_URL:-$(_readaccountconf_mutable GOTIFY_URL)}"
+  if [ -z "$GOTIFY_URL" ]; then
+    GOTIFY_URL=""
+    _err "You didn't specify the gotify server url GOTIFY_URL."
+    return 1
+  fi
+  _saveaccountconf_mutable GOTIFY_URL "$GOTIFY_URL"
+
+  GOTIFY_TOKEN="${GOTIFY_TOKEN:-$(_readaccountconf_mutable GOTIFY_TOKEN)}"
+  if [ -z "$GOTIFY_TOKEN" ]; then
+    GOTIFY_TOKEN=""
+    _err "You didn't specify the gotify token GOTIFY_TOKEN."
+    return 1
+  fi
+  _saveaccountconf_mutable GOTIFY_TOKEN "$GOTIFY_TOKEN"
+
+  GOTIFY_PRIORITY="${GOTIFY_PRIORITY:-$(_readaccountconf_mutable GOTIFY_PRIORITY)}"
+  if [ -z "$GOTIFY_PRIORITY" ]; then
+    GOTIFY_PRIORITY=0
+  else
+    _saveaccountconf_mutable GOTIFY_PRIORITY "$GOTIFY_PRIORITY"
+  fi
+
+  export _H1="X-Gotify-Key: ${GOTIFY_TOKEN}"
+  export _H2="Content-Type: application/json"
+
+  _content=$(echo "$_content" | _json_encode)
+  _subject=$(echo "$_subject" | _json_encode)
+
+  _data="{\"title\": \"${_subject}\", \"message\": \"${_content}\", \"priority\": ${GOTIFY_PRIORITY}}"
+
+  response="$(_post "${_data}" "${GOTIFY_URL}/message" "" "POST" "application/json")"
+
+  if [ "$?" != "0" ]; then
+    _err "Failed to send message"
+    _err "$response"
+    return 1
+  fi
+
+  _debug2 response "$response"
+
+  return 0
+}

From 7e7291ace9d36ed2674c0042a2aa288396869a61 Mon Sep 17 00:00:00 2001
From: Sergey Pashinin <sergey@pashinin.com>
Date: Sun, 9 Jan 2022 06:01:38 +0300
Subject: [PATCH 60/80] Support Vault KV v2 (#3502)

---
 deploy/vault.sh | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/deploy/vault.sh b/deploy/vault.sh
index 70c80444..399abaee 100644
--- a/deploy/vault.sh
+++ b/deploy/vault.sh
@@ -56,12 +56,23 @@ vault_deploy() {
   export _H1="X-Vault-Token: $VAULT_TOKEN"
 
   if [ -n "$FABIO" ]; then
-    _post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL"
+    if [ -n "$VAULT_KV_V2" ]; then
+      _post "{ \"data\": {\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"} }" "$URL"
+    else
+      _post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL"
+    fi
   else
-    _post "{\"value\": \"$_ccert\"}" "$URL/cert.pem"
-    _post "{\"value\": \"$_ckey\"}" "$URL/cert.key"
-    _post "{\"value\": \"$_cca\"}" "$URL/chain.pem"
-    _post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem"
+    if [ -n "$VAULT_KV_V2" ]; then
+      _post "{\"data\": {\"value\": \"$_ccert\"}}" "$URL/cert.pem"
+      _post "{\"data\": {\"value\": \"$_ckey\"}}" "$URL/cert.key"
+      _post "{\"data\": {\"value\": \"$_cca\"}}" "$URL/chain.pem"
+      _post "{\"data\": {\"value\": \"$_cfullchain\"}}" "$URL/fullchain.pem"
+    else
+      _post "{\"value\": \"$_ccert\"}" "$URL/cert.pem"
+      _post "{\"value\": \"$_ckey\"}" "$URL/cert.key"
+      _post "{\"value\": \"$_cca\"}" "$URL/chain.pem"
+      _post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem"
+    fi
   fi
 
 }

From 2ce145f359deaaaff9bea06312984c70a04ef87c Mon Sep 17 00:00:00 2001
From: Felix Matouschek <felix@matouschek.org>
Date: Sun, 9 Jan 2022 04:11:00 +0100
Subject: [PATCH 61/80] Refactoring amcedns api (second try) (#3231)

---
 dnsapi/dns_acmedns.sh | 63 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 51 insertions(+), 12 deletions(-)
 mode change 100644 => 100755 dnsapi/dns_acmedns.sh

diff --git a/dnsapi/dns_acmedns.sh b/dnsapi/dns_acmedns.sh
old mode 100644
new mode 100755
index 9b3efa48..057f9742
--- a/dnsapi/dns_acmedns.sh
+++ b/dnsapi/dns_acmedns.sh
@@ -1,31 +1,70 @@
 #!/usr/bin/env sh
 #
 #Author: Wolfgang Ebner
-#Report Bugs here: https://github.com/webner/acme.sh
+#Author: Sven Neubuaer
+#Report Bugs here: https://github.com/dampfklon/acme.sh
+#
+# Usage:
+# export ACMEDNS_BASE_URL="https://auth.acme-dns.io"
+#
+# You can optionally define an already existing account:
+#
+# export ACMEDNS_USERNAME="<username>"
+# export ACMEDNS_PASSWORD="<password>"
+# export ACMEDNS_SUBDOMAIN="<subdomain>"
 #
 ########  Public functions #####################
 
 #Usage: dns_acmedns_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
 dns_acmedns_add() {
   fulldomain=$1
   txtvalue=$2
   _info "Using acme-dns"
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
+  _debug "fulldomain $fulldomain"
+  _debug "txtvalue $txtvalue"
 
-  ACMEDNS_UPDATE_URL="${ACMEDNS_UPDATE_URL:-$(_readaccountconf_mutable ACMEDNS_UPDATE_URL)}"
+  #for compatiblity from account conf
   ACMEDNS_USERNAME="${ACMEDNS_USERNAME:-$(_readaccountconf_mutable ACMEDNS_USERNAME)}"
+  _clearaccountconf_mutable ACMEDNS_USERNAME
   ACMEDNS_PASSWORD="${ACMEDNS_PASSWORD:-$(_readaccountconf_mutable ACMEDNS_PASSWORD)}"
+  _clearaccountconf_mutable ACMEDNS_PASSWORD
   ACMEDNS_SUBDOMAIN="${ACMEDNS_SUBDOMAIN:-$(_readaccountconf_mutable ACMEDNS_SUBDOMAIN)}"
+  _clearaccountconf_mutable ACMEDNS_SUBDOMAIN
 
-  if [ "$ACMEDNS_UPDATE_URL" = "" ]; then
-    ACMEDNS_UPDATE_URL="https://auth.acme-dns.io/update"
+  ACMEDNS_BASE_URL="${ACMEDNS_BASE_URL:-$(_readdomainconf ACMEDNS_BASE_URL)}"
+  ACMEDNS_USERNAME="${ACMEDNS_USERNAME:-$(_readdomainconf ACMEDNS_USERNAME)}"
+  ACMEDNS_PASSWORD="${ACMEDNS_PASSWORD:-$(_readdomainconf ACMEDNS_PASSWORD)}"
+  ACMEDNS_SUBDOMAIN="${ACMEDNS_SUBDOMAIN:-$(_readdomainconf ACMEDNS_SUBDOMAIN)}"
+
+  if [ "$ACMEDNS_BASE_URL" = "" ]; then
+    ACMEDNS_BASE_URL="https://auth.acme-dns.io"
   fi
 
-  _saveaccountconf_mutable ACMEDNS_UPDATE_URL "$ACMEDNS_UPDATE_URL"
-  _saveaccountconf_mutable ACMEDNS_USERNAME "$ACMEDNS_USERNAME"
-  _saveaccountconf_mutable ACMEDNS_PASSWORD "$ACMEDNS_PASSWORD"
-  _saveaccountconf_mutable ACMEDNS_SUBDOMAIN "$ACMEDNS_SUBDOMAIN"
+  ACMEDNS_UPDATE_URL="$ACMEDNS_BASE_URL/update"
+  ACMEDNS_REGISTER_URL="$ACMEDNS_BASE_URL/register"
+
+  if [ -z "$ACMEDNS_USERNAME" ] || [ -z "$ACMEDNS_PASSWORD" ]; then
+    response="$(_post "" "$ACMEDNS_REGISTER_URL" "" "POST")"
+    _debug response "$response"
+    ACMEDNS_USERNAME=$(echo "$response" | sed -n 's/^{.*\"username\":[ ]*\"\([^\"]*\)\".*}/\1/p')
+    _debug "received username: $ACMEDNS_USERNAME"
+    ACMEDNS_PASSWORD=$(echo "$response" | sed -n 's/^{.*\"password\":[ ]*\"\([^\"]*\)\".*}/\1/p')
+    _debug "received password: $ACMEDNS_PASSWORD"
+    ACMEDNS_SUBDOMAIN=$(echo "$response" | sed -n 's/^{.*\"subdomain\":[ ]*\"\([^\"]*\)\".*}/\1/p')
+    _debug "received subdomain: $ACMEDNS_SUBDOMAIN"
+    ACMEDNS_FULLDOMAIN=$(echo "$response" | sed -n 's/^{.*\"fulldomain\":[ ]*\"\([^\"]*\)\".*}/\1/p')
+    _info "##########################################################"
+    _info "# Create $fulldomain CNAME $ACMEDNS_FULLDOMAIN DNS entry #"
+    _info "##########################################################"
+    _info "Press enter to continue... "
+    read -r _
+  fi
+
+  _savedomainconf ACMEDNS_BASE_URL "$ACMEDNS_BASE_URL"
+  _savedomainconf ACMEDNS_USERNAME "$ACMEDNS_USERNAME"
+  _savedomainconf ACMEDNS_PASSWORD "$ACMEDNS_PASSWORD"
+  _savedomainconf ACMEDNS_SUBDOMAIN "$ACMEDNS_SUBDOMAIN"
 
   export _H1="X-Api-User: $ACMEDNS_USERNAME"
   export _H2="X-Api-Key: $ACMEDNS_PASSWORD"
@@ -48,8 +87,8 @@ dns_acmedns_rm() {
   fulldomain=$1
   txtvalue=$2
   _info "Using acme-dns"
-  _debug fulldomain "$fulldomain"
-  _debug txtvalue "$txtvalue"
+  _debug "fulldomain $fulldomain"
+  _debug "txtvalue $txtvalue"
 }
 
 ####################  Private functions below ##################################

From bda454fe9cbb3ba2d73251416a703db28a7d4ff7 Mon Sep 17 00:00:00 2001
From: I Komang Suryadana <suryadana80@gmail.com>
Date: Tue, 11 Jan 2022 15:25:10 +0800
Subject: [PATCH 62/80] Remove cloud domain record with cloud master zone.
 (#3507)

---
 dnsapi/dns_cloudns.sh | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/dnsapi/dns_cloudns.sh b/dnsapi/dns_cloudns.sh
index 381d17ec..b03fd579 100755
--- a/dnsapi/dns_cloudns.sh
+++ b/dnsapi/dns_cloudns.sh
@@ -2,11 +2,14 @@
 
 # Author: Boyan Peychev <boyan at cloudns dot net>
 # Repository: https://github.com/ClouDNS/acme.sh/
+# Editor: I Komang Suryadana
 
 #CLOUDNS_AUTH_ID=XXXXX
 #CLOUDNS_SUB_AUTH_ID=XXXXX
 #CLOUDNS_AUTH_PASSWORD="YYYYYYYYY"
 CLOUDNS_API="https://api.cloudns.net"
+DOMAIN_TYPE=
+DOMAIN_MASTER=
 
 ########  Public functions #####################
 
@@ -61,6 +64,15 @@ dns_cloudns_rm() {
   host="$(echo "$1" | sed "s/\.$zone\$//")"
   record=$2
 
+  _dns_cloudns_get_zone_info "$zone"
+
+  _debug "Type" "$DOMAIN_TYPE"
+  _debug "Cloud Master" "$DOMAIN_MASTER"
+  if _contains "$DOMAIN_TYPE" "cloud"; then
+    zone=$DOMAIN_MASTER
+  fi
+  _debug "ZONE" "$zone"
+
   _dns_cloudns_http_api_call "dns/records.json" "domain-name=$zone&host=$host&type=TXT"
   if ! _contains "$response" "\"id\":"; then
     return 1
@@ -134,6 +146,18 @@ _dns_cloudns_init_check() {
   return 0
 }
 
+_dns_cloudns_get_zone_info() {
+  zone=$1
+  _dns_cloudns_http_api_call "dns/get-zone-info.json" "domain-name=$zone"
+  if ! _contains "$response" "\"status\":\"Failed\""; then
+    DOMAIN_TYPE=$(echo "$response" | _egrep_o '"type":"[^"]*"' | cut -d : -f 2 | tr -d '"')
+    if _contains "$DOMAIN_TYPE" "cloud"; then
+      DOMAIN_MASTER=$(echo "$response" | _egrep_o '"cloud-master":"[^"]*"' | cut -d : -f 2 | tr -d '"')
+    fi
+  fi
+  return 0
+}
+
 _dns_cloudns_get_zone_name() {
   i=2
   while true; do

From e07795e8f0e8f5d9c1cd6e68cbb35d4d4d5fff06 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Tue, 11 Jan 2022 16:56:02 +0800
Subject: [PATCH 63/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3883

---
 acme.sh | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index f013fae2..9ec0c851 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1631,6 +1631,24 @@ _stat() {
   return 1 #error, 'stat' not found
 }
 
+#keyfile
+_isRSA() {
+  keyfile=$1
+  if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1 || ${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" >/dev/null 2>&1; then
+    return 0
+  fi
+  return 1
+}
+
+#keyfile
+_isEcc() {
+  keyfile=$1
+  if grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1 || ${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" >/dev/null 2>&1; then
+    return 0
+  fi
+  return 1
+}
+
 #keyfile
 _calcjwk() {
   keyfile="$1"
@@ -1644,7 +1662,7 @@ _calcjwk() {
     return 0
   fi
 
-  if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
+  if _isRSA "$keyfile"; then
     _debug "RSA key"
     pub_exp=$(${ACME_OPENSSL_BIN:-openssl} rsa -in "$keyfile" -noout -text | grep "^publicExponent:" | cut -d '(' -f 2 | cut -d 'x' -f 2 | cut -d ')' -f 1)
     if [ "${#pub_exp}" = "5" ]; then
@@ -1666,7 +1684,7 @@ _calcjwk() {
     JWK_HEADER='{"alg": "RS256", "jwk": '$jwk'}'
     JWK_HEADERPLACE_PART1='{"nonce": "'
     JWK_HEADERPLACE_PART2='", "alg": "RS256"'
-  elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
+  elif _isEcc "$keyfile"; then
     _debug "EC key"
     crv="$(${ACME_OPENSSL_BIN:-openssl} ec -in "$keyfile" -noout -text 2>/dev/null | grep "^NIST CURVE:" | cut -d ":" -f 2 | tr -d " \r\n")"
     _debug3 crv "$crv"

From 188274277a18deb386f160de53262f22f8f7d7c2 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Tue, 11 Jan 2022 17:16:51 +0800
Subject: [PATCH 64/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3883

---
 acme.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 9ec0c851..78684267 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1053,9 +1053,9 @@ _sign() {
 
   _sign_openssl="${ACME_OPENSSL_BIN:-openssl} dgst -sign $keyfile "
 
-  if grep "BEGIN RSA PRIVATE KEY" "$keyfile" >/dev/null 2>&1 || grep "BEGIN PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
+  if _isRSA "$keyfile" >/dev/null 2>&1; then
     $_sign_openssl -$alg | _base64
-  elif grep "BEGIN EC PRIVATE KEY" "$keyfile" >/dev/null 2>&1; then
+  elif _isEcc "$keyfile" >/dev/null 2>&1; then
     if ! _signedECText="$($_sign_openssl -sha$__ECC_KEY_LEN | ${ACME_OPENSSL_BIN:-openssl} asn1parse -inform DER)"; then
       _err "Sign failed: $_sign_openssl"
       _err "Key file: $keyfile"

From e49ece87937aa258f32fa277c9f1a6d46b7484ce Mon Sep 17 00:00:00 2001
From: Yuan Ming <tutugreen@users.noreply.github.com>
Date: Fri, 14 Jan 2022 22:10:26 +0800
Subject: [PATCH 65/80] dns_huaweicloud.sh minor bug fixes

1. Match zone name in response in case multiple items return.
2. Use string '"id"' (single quotation marks added) to check if zone/record exist in _get_zoneid() & _get_recordset_id(). Fix domain can't contain string "id".

(Sensitive _debug Access Token Commented out, For CICD Run)
---
 dnsapi/dns_huaweicloud.sh | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_huaweicloud.sh b/dnsapi/dns_huaweicloud.sh
index f7192725..caac3e1e 100644
--- a/dnsapi/dns_huaweicloud.sh
+++ b/dnsapi/dns_huaweicloud.sh
@@ -35,7 +35,7 @@ dns_huaweicloud_add() {
     _err "dns_api(dns_huaweicloud): Error getting token."
     return 1
   fi
-  _debug "Access token is: ${token}"
+  # _debug "Access token is: ${token}"
 
   unset zoneid
   zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
@@ -86,7 +86,7 @@ dns_huaweicloud_rm() {
     _err "dns_api(dns_huaweicloud): Error getting token."
     return 1
   fi
-  _debug "Access token is: ${token}"
+  # _debug "Access token is: ${token}"
 
   unset zoneid
   zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
@@ -129,14 +129,25 @@ _get_zoneid() {
     fi
     _debug "$h"
     response=$(_get "${dns_api}/v2/zones?name=${h}")
-
-    if _contains "${response}" "id"; then
-      _debug "Get Zone ID Success."
-      _zoneid=$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
-      printf "%s" "${_zoneid}"
-      return 0
+    # _debug2 "$response"
+    if _contains "${response}" '"id"'; then
+      zoneidlist=$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
+      zonenamelist=$(echo "${response}" | _egrep_o "\"name\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
+      _debug2 "Return Zone ID(s):${zoneidlist}"
+      _debug2 "Return Zone Name(s):${zonenamelist}"
+      zoneidnum=0
+      echo "${zonenamelist}" | while read -r zonename; do
+        zoneidnum=$(_math "$zoneidnum" + 1)
+        _debug "Check Zone Name $zonename"
+        if [ "${zonename}" = "${h}." ]; then
+          _debug "Get Zone ID Success."
+          _zoneid=$(echo "${zoneidlist}" | sed -n "${zoneidnum}p")
+          _debug2 "ZoneID:${_zoneid}"
+          printf "%s" "${_zoneid}"
+          return 0
+        fi
+      done
     fi
-
     i=$(_math "$i" + 1)
   done
   return 1
@@ -149,7 +160,7 @@ _get_recordset_id() {
   export _H1="X-Auth-Token: ${_token}"
 
   response=$(_get "${dns_api}/v2/zones/${_zoneid}/recordsets?name=${_domain}")
-  if _contains "${response}" "id"; then
+  if _contains "${response}" '"id"'; then
     _id="$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")"
     printf "%s" "${_id}"
     return 0
@@ -269,7 +280,7 @@ _get_token() {
   _post "${body}" "${iam_api}/v3/auth/tokens" >/dev/null
   _code=$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")
   _token=$(grep "^X-Subject-Token" "$HTTP_HEADER" | cut -d " " -f 2-)
-  _debug2 "${_code}"
+  # _debug2 "${_code}"
   printf "%s" "${_token}"
   return 0
 }

From 9d2ee2127de6ebcd2382e4cf9270276412d3f26f Mon Sep 17 00:00:00 2001
From: Yuan Ming <tutugreen@users.noreply.github.com>
Date: Sat, 15 Jan 2022 19:23:30 +0800
Subject: [PATCH 66/80] dns_huaweicloud debug info adjust

_secure_debug for sensitive token.
---
 dnsapi/dns_huaweicloud.sh | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_huaweicloud.sh b/dnsapi/dns_huaweicloud.sh
index caac3e1e..cc21396a 100644
--- a/dnsapi/dns_huaweicloud.sh
+++ b/dnsapi/dns_huaweicloud.sh
@@ -35,7 +35,7 @@ dns_huaweicloud_add() {
     _err "dns_api(dns_huaweicloud): Error getting token."
     return 1
   fi
-  # _debug "Access token is: ${token}"
+  _secure_debug "Access token is:" "${token}"
 
   unset zoneid
   zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
@@ -43,7 +43,7 @@ dns_huaweicloud_add() {
     _err "dns_api(dns_huaweicloud): Error getting zone id."
     return 1
   fi
-  _debug "Zone ID is: ${zoneid}"
+  _debug "Zone ID is:" "${zoneid}"
 
   _debug "Adding Record"
   _add_record "${token}" "${fulldomain}" "${txtvalue}"
@@ -86,7 +86,7 @@ dns_huaweicloud_rm() {
     _err "dns_api(dns_huaweicloud): Error getting token."
     return 1
   fi
-  # _debug "Access token is: ${token}"
+  _secure_debug "Access token is:" "${token}"
 
   unset zoneid
   zoneid="$(_get_zoneid "${token}" "${fulldomain}")"
@@ -94,7 +94,7 @@ dns_huaweicloud_rm() {
     _err "dns_api(dns_huaweicloud): Error getting zone id."
     return 1
   fi
-  _debug "Zone ID is: ${zoneid}"
+  _debug "Zone ID is:" "${zoneid}"
 
   # Remove all records
   # Therotically HuaweiCloud does not allow more than one record set
@@ -129,20 +129,20 @@ _get_zoneid() {
     fi
     _debug "$h"
     response=$(_get "${dns_api}/v2/zones?name=${h}")
-    # _debug2 "$response"
+    _debug2 "$response"
     if _contains "${response}" '"id"'; then
       zoneidlist=$(echo "${response}" | _egrep_o "\"id\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
       zonenamelist=$(echo "${response}" | _egrep_o "\"name\": *\"[^\"]*\"" | cut -d : -f 2 | tr -d \" | tr -d " ")
-      _debug2 "Return Zone ID(s):${zoneidlist}"
-      _debug2 "Return Zone Name(s):${zonenamelist}"
+      _debug2 "Return Zone ID(s):" "${zoneidlist}"
+      _debug2 "Return Zone Name(s):" "${zonenamelist}"
       zoneidnum=0
       echo "${zonenamelist}" | while read -r zonename; do
         zoneidnum=$(_math "$zoneidnum" + 1)
-        _debug "Check Zone Name $zonename"
+        _debug "Check Zone Name" "${zonename}"
         if [ "${zonename}" = "${h}." ]; then
           _debug "Get Zone ID Success."
           _zoneid=$(echo "${zoneidlist}" | sed -n "${zoneidnum}p")
-          _debug2 "ZoneID:${_zoneid}"
+          _debug2 "ZoneID:" "${_zoneid}"
           printf "%s" "${_zoneid}"
           return 0
         fi
@@ -208,7 +208,7 @@ _add_record() {
   fi
 
   _record_id="$(_get_recordset_id "${_token}" "${_domain}" "${zoneid}")"
-  _debug "Record Set ID is: ${_record_id}"
+  _debug "Record Set ID is:" "${_record_id}"
 
   # Remove all records
   while [ "${_record_id}" != "0" ]; do
@@ -280,7 +280,7 @@ _get_token() {
   _post "${body}" "${iam_api}/v3/auth/tokens" >/dev/null
   _code=$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")
   _token=$(grep "^X-Subject-Token" "$HTTP_HEADER" | cut -d " " -f 2-)
-  # _debug2 "${_code}"
+  _secure_debug "${_code}"
   printf "%s" "${_token}"
   return 0
 }

From edee7ea284c0b4f5670d859442c945b8cebd5b98 Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Sun, 16 Jan 2022 20:46:09 +0800
Subject: [PATCH 67/80] routeros deploy hook: store the env vars within the
 domainconf

related to #2344 and #2413
---
 deploy/routeros.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index 2f349999..9965d65c 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -66,21 +66,31 @@ routeros_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
+  _getdeployconf ROUTER_OS_HOST
+
   if [ -z "$ROUTER_OS_HOST" ]; then
     _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct."
     ROUTER_OS_HOST="$_cdomain"
   fi
 
+  _getdeployconf ROUTER_OS_USERNAME
+
   if [ -z "$ROUTER_OS_USERNAME" ]; then
     _err "Need to set the env variable ROUTER_OS_USERNAME"
     return 1
   fi
 
+  _getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
+
   if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
     _debug "Not enabling additional services"
     ROUTER_OS_ADDITIONAL_SERVICES=""
   fi
 
+  _savedeployconf ROUTER_OS_HOST "$ROUTER_OS_HOST"
+  _savedeployconf ROUTER_OS_USERNAME "$ROUTER_OS_USERNAME"
+  _savedeployconf ROUTER_OS_ADDITIONAL_SERVICES "$ROUTER_OS_ADDITIONAL_SERVICES"
+
   _info "Trying to push key '$_ckey' to router"
   scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
   _info "Trying to push cert '$_cfullchain' to router"

From dca9def42c2d8fb86551d5d5c6e70124defebb29 Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Wed, 19 Jan 2022 12:36:54 +0800
Subject: [PATCH 68/80] add remote deploy hook for openmediavault 5

based on #3757
---
 Dockerfile               |  3 +-
 deploy/openmediavault.sh | 85 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 87 insertions(+), 1 deletion(-)
 create mode 100644 deploy/openmediavault.sh

diff --git a/Dockerfile b/Dockerfile
index 0421da34..fa11ea8a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,7 +11,8 @@ RUN apk --no-cache add -f \
   tzdata \
   oath-toolkit-oathtool \
   tar \
-  libidn
+  libidn \
+  jq
 
 ENV LE_CONFIG_HOME /acme.sh
 
diff --git a/deploy/openmediavault.sh b/deploy/openmediavault.sh
new file mode 100644
index 00000000..26743326
--- /dev/null
+++ b/deploy/openmediavault.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env sh
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+openmediavault_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  _getdeployconf DEPLOY_OMV_HOST
+
+  if [ -z "$DEPLOY_OMV_HOST" ]; then
+    _debug "Using _cdomain as DEPLOY_OMV_HOST, please set if not correct."
+    DEPLOY_OMV_HOST="$_cdomain"
+  fi
+
+  _getdeployconf DEPLOY_OMV_USER
+
+  if [ -z "$DEPLOY_OMV_USER" ]; then
+    DEPLOY_OMV_USER="admin"
+  fi
+
+  _savedeployconf DEPLOY_OMV_HOST "$DEPLOY_OMV_HOST"
+  _savedeployconf DEPLOY_OMV_USER "$DEPLOY_OMV_USER"
+
+  _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
+  # shellcheck disable=SC2086
+  _uuid=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+  _debug _command "$_command"
+
+  if [ -z "$_uuid" ]; then
+    _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
+    _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
+    # shellcheck disable=SC2086
+    _uuid=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+    _debug _command "$_command"
+
+    if [ -z "$_uuid" ]; then
+      _err "[OMB deploy-hook] An error occured while creating the certificate"
+      return 1
+    fi
+  fi
+
+  _info "[OMV deploy-hook] Domain $_cdomain has uuid: $_uuid"
+  _fullchain=$(jq <"$_cfullchain" -aRs .)
+  _key=$(jq <"$_ckey" -aRs .)
+
+  _debug _fullchain "$_fullchain"
+  _debug _key "$_key"
+
+  _info "[OMV deploy-hook] Updating key and certificate in openmediavault"
+  _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
+  # shellcheck disable=SC2029
+  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+  _debug _result "$_result"
+
+  _debug _command "$_command"
+
+  _info "[OMV deploy-hook] Asking openmediavault to apply changes... (this could take some time, hang in there)"
+  _command="omv-rpc -u $DEPLOY_OMV_USER 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
+  # shellcheck disable=SC2029
+  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+
+  _debug _command "$_command"
+  _debug _result "$_result"
+
+  _info "[OMV deploy-hook] Asking nginx to reload"
+  _command="nginx -s reload"
+  # shellcheck disable=SC2029
+  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+
+  _debug _command "$_command"
+  _debug _result "$_result"
+
+  return 0
+}

From df671a77f674f9c75cff975b214de95b8cefc8b7 Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Sun, 16 Jan 2022 20:46:09 +0800
Subject: [PATCH 69/80] routeros deploy hook: store the env vars within the
 domainconf

related to #2344 and #2413
---
 deploy/routeros.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index 2f349999..9965d65c 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -66,21 +66,31 @@ routeros_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
+  _getdeployconf ROUTER_OS_HOST
+
   if [ -z "$ROUTER_OS_HOST" ]; then
     _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct."
     ROUTER_OS_HOST="$_cdomain"
   fi
 
+  _getdeployconf ROUTER_OS_USERNAME
+
   if [ -z "$ROUTER_OS_USERNAME" ]; then
     _err "Need to set the env variable ROUTER_OS_USERNAME"
     return 1
   fi
 
+  _getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
+
   if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
     _debug "Not enabling additional services"
     ROUTER_OS_ADDITIONAL_SERVICES=""
   fi
 
+  _savedeployconf ROUTER_OS_HOST "$ROUTER_OS_HOST"
+  _savedeployconf ROUTER_OS_USERNAME "$ROUTER_OS_USERNAME"
+  _savedeployconf ROUTER_OS_ADDITIONAL_SERVICES "$ROUTER_OS_ADDITIONAL_SERVICES"
+
   _info "Trying to push key '$_ckey' to router"
   scp "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
   _info "Trying to push cert '$_cfullchain' to router"

From 6bbf927f57f8a7b1dcdd1f24220c09397368a541 Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Wed, 19 Jan 2022 21:13:02 +0800
Subject: [PATCH 70/80] omv deploy hook: separate DEPLOY_OMV_WEBUI_ADMIN and
 DEPLOY_OMV_SSH_USER

---
 deploy/openmediavault.sh | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/deploy/openmediavault.sh b/deploy/openmediavault.sh
index 26743326..eb04f5bc 100644
--- a/deploy/openmediavault.sh
+++ b/deploy/openmediavault.sh
@@ -23,25 +23,32 @@ openmediavault_deploy() {
     DEPLOY_OMV_HOST="$_cdomain"
   fi
 
-  _getdeployconf DEPLOY_OMV_USER
+  _getdeployconf DEPLOY_OMV_WEBUI_ADMIN
 
-  if [ -z "$DEPLOY_OMV_USER" ]; then
-    DEPLOY_OMV_USER="admin"
+  if [ -z "$DEPLOY_OMV_WEBUI_ADMIN" ]; then
+    DEPLOY_OMV_WEBUI_ADMIN="admin"
+  fi
+
+  _getdeployconf DEPLOY_OMV_SSH_USER
+
+  if [ -z "$DEPLOY_OMV_SSH_USER" ]; then
+    DEPLOY_OMV_SSH_USER="root"
   fi
 
   _savedeployconf DEPLOY_OMV_HOST "$DEPLOY_OMV_HOST"
-  _savedeployconf DEPLOY_OMV_USER "$DEPLOY_OMV_USER"
+  _savedeployconf DEPLOY_OMV_WEBUI_ADMIN "$DEPLOY_OMV_WEBUI_ADMIN"
+  _savedeployconf DEPLOY_OMV_SSH_USER "$DEPLOY_OMV_SSH_USER"
 
-  _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
+  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
   # shellcheck disable=SC2086
-  _uuid=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+  _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
   _debug _command "$_command"
 
   if [ -z "$_uuid" ]; then
     _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
-    _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
     # shellcheck disable=SC2086
-    _uuid=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+    _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
     _debug _command "$_command"
 
     if [ -z "$_uuid" ]; then
@@ -58,17 +65,17 @@ openmediavault_deploy() {
   _debug _key "$_key"
 
   _info "[OMV deploy-hook] Updating key and certificate in openmediavault"
-  _command="omv-rpc -u $DEPLOY_OMV_USER 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
+  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
   # shellcheck disable=SC2029
-  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
-  _debug _result "$_result"
+  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
 
   _debug _command "$_command"
+  _debug _result "$_result"
 
   _info "[OMV deploy-hook] Asking openmediavault to apply changes... (this could take some time, hang in there)"
-  _command="omv-rpc -u $DEPLOY_OMV_USER 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
+  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
   # shellcheck disable=SC2029
-  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
 
   _debug _command "$_command"
   _debug _result "$_result"
@@ -76,7 +83,7 @@ openmediavault_deploy() {
   _info "[OMV deploy-hook] Asking nginx to reload"
   _command="nginx -s reload"
   # shellcheck disable=SC2029
-  _result=$(ssh "root@$DEPLOY_OMV_HOST" "$_command")
+  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
 
   _debug _command "$_command"
   _debug _result "$_result"

From a78a4e67168599a2e898271a57e99aba6cbc5792 Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Wed, 19 Jan 2022 21:42:17 +0800
Subject: [PATCH 71/80] omv deploy hook: shellcheck disable=SC2029

---
 deploy/openmediavault.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/openmediavault.sh b/deploy/openmediavault.sh
index eb04f5bc..b0bb4cb2 100644
--- a/deploy/openmediavault.sh
+++ b/deploy/openmediavault.sh
@@ -40,14 +40,14 @@ openmediavault_deploy() {
   _savedeployconf DEPLOY_OMV_SSH_USER "$DEPLOY_OMV_SSH_USER"
 
   _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
-  # shellcheck disable=SC2086
+  # shellcheck disable=SC2029
   _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
   _debug _command "$_command"
 
   if [ -z "$_uuid" ]; then
     _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
     _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
-    # shellcheck disable=SC2086
+    # shellcheck disable=SC2029
     _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
     _debug _command "$_command"
 

From e1a0f5706d6b7b46062668b54f3823666010c61d Mon Sep 17 00:00:00 2001
From: Vitaly Kireev <vitaly80@ya.ru>
Date: Tue, 28 Dec 2021 22:29:42 +0300
Subject: [PATCH 72/80] DNS REGRU utf-list to idn (punycode)

service/get_list returns domains in utf. But if utf, then error Error parsing certificate request: x509: SAN dNSName is malformed

early using my patch by IDN_ITEM="$(echo "${ITEM}" | idn)"

Now replacing by IDN_ITEM="$(_idn "${ITEM}")"
---
 dnsapi/dns_regru.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_regru.sh b/dnsapi/dns_regru.sh
index 29f758ea..2a1ebaa5 100644
--- a/dnsapi/dns_regru.sh
+++ b/dnsapi/dns_regru.sh
@@ -92,9 +92,10 @@ _get_root() {
   domains_list=$(echo "${response}" | grep dname | sed -r "s/.*dname=\"([^\"]+)\".*/\\1/g")
 
   for ITEM in ${domains_list}; do
+    IDN_ITEM="$(_idn "${ITEM}")"
     case "${domain}" in
-    *${ITEM}*)
-      _domain=${ITEM}
+    *${IDN_ITEM}*)
+      _domain=${IDN_ITEM}
       _debug _domain "${_domain}"
       return 0
       ;;

From faedea212095c398729224d5c9ce72f2a4d55237 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Wed, 19 Jan 2022 22:22:53 +0800
Subject: [PATCH 73/80] Update dns_ddnss.sh

---
 dnsapi/dns_ddnss.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_ddnss.sh b/dnsapi/dns_ddnss.sh
index ecc4f174..b9da33ff 100644
--- a/dnsapi/dns_ddnss.sh
+++ b/dnsapi/dns_ddnss.sh
@@ -12,7 +12,7 @@
 # --
 #
 
-DDNSS_DNS_API="https://ip4.ddnss.de/upd.php"
+DDNSS_DNS_API="https://ddnss.de/upd.php"
 
 ########  Public functions #####################
 
@@ -77,7 +77,7 @@ dns_ddnss_rm() {
 
   # Now remove the TXT record from DDNS DNS
   _info "Trying to remove TXT record"
-  if _ddnss_rest GET "key=$DDNSS_Token&host=$_ddnss_domain&txtm=1&txt=."; then
+  if _ddnss_rest GET "key=$DDNSS_Token&host=$_ddnss_domain&txtm=2"; then
     if [ "$response" = "Updated 1 hostname." ]; then
       _info "TXT record has been successfully removed from your DDNSS domain."
       return 0

From 9088c8741a865301af48be2a87deab7ebe288759 Mon Sep 17 00:00:00 2001
From: Yuan Ming <tutugreen@users.noreply.github.com>
Date: Thu, 20 Jan 2022 14:01:33 +0800
Subject: [PATCH 74/80] Fix dns_huaweicloud subshell return

Replace pipe read with line count loop, fix useless return in subshell.
---
 dnsapi/dns_huaweicloud.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_huaweicloud.sh b/dnsapi/dns_huaweicloud.sh
index cc21396a..ac3ede65 100644
--- a/dnsapi/dns_huaweicloud.sh
+++ b/dnsapi/dns_huaweicloud.sh
@@ -136,13 +136,16 @@ _get_zoneid() {
       _debug2 "Return Zone ID(s):" "${zoneidlist}"
       _debug2 "Return Zone Name(s):" "${zonenamelist}"
       zoneidnum=0
-      echo "${zonenamelist}" | while read -r zonename; do
+      zoneidcount=$(echo "${zoneidlist}" | grep -c '^')
+      _debug "Retund Zone ID(s) Count:" "${zoneidcount}"
+      while [ "${zoneidnum}" -lt "${zoneidcount}" ]; do
         zoneidnum=$(_math "$zoneidnum" + 1)
+        _zoneid=$(echo "${zoneidlist}" | sed -n "${zoneidnum}p")
+        zonename=$(echo "${zonenamelist}" | sed -n "${zoneidnum}p")
         _debug "Check Zone Name" "${zonename}"
         if [ "${zonename}" = "${h}." ]; then
           _debug "Get Zone ID Success."
-          _zoneid=$(echo "${zoneidlist}" | sed -n "${zoneidnum}p")
-          _debug2 "ZoneID:" "${_zoneid}"
+          _debug "ZoneID:" "${_zoneid}"
           printf "%s" "${_zoneid}"
           return 0
         fi

From 0292e20c862c49d8729a832961d72dcf5a38101b Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Thu, 20 Jan 2022 17:27:11 +0800
Subject: [PATCH 75/80] omv deploy hook: support both local and remote
 deployment

---
 deploy/openmediavault.sh | 162 ++++++++++++++++++++++++++-------------
 1 file changed, 109 insertions(+), 53 deletions(-)

diff --git a/deploy/openmediavault.sh b/deploy/openmediavault.sh
index b0bb4cb2..859eabe7 100644
--- a/deploy/openmediavault.sh
+++ b/deploy/openmediavault.sh
@@ -16,77 +16,133 @@ openmediavault_deploy() {
   _debug _cca "$_cca"
   _debug _cfullchain "$_cfullchain"
 
-  _getdeployconf DEPLOY_OMV_HOST
-
-  if [ -z "$DEPLOY_OMV_HOST" ]; then
-    _debug "Using _cdomain as DEPLOY_OMV_HOST, please set if not correct."
-    DEPLOY_OMV_HOST="$_cdomain"
-  fi
-
   _getdeployconf DEPLOY_OMV_WEBUI_ADMIN
 
   if [ -z "$DEPLOY_OMV_WEBUI_ADMIN" ]; then
     DEPLOY_OMV_WEBUI_ADMIN="admin"
   fi
 
+  _savedeployconf DEPLOY_OMV_WEBUI_ADMIN "$DEPLOY_OMV_WEBUI_ADMIN"
+
+  _getdeployconf DEPLOY_OMV_HOST
   _getdeployconf DEPLOY_OMV_SSH_USER
 
-  if [ -z "$DEPLOY_OMV_SSH_USER" ]; then
-    DEPLOY_OMV_SSH_USER="root"
+  if [ -n "$DEPLOY_OMV_HOST" ] && [ -n "$DEPLOY_OMV_SSH_USER" ]; then
+    _info "[OMV deploy-hook] Deploy certificate remotely through ssh."
+    _savedeployconf DEPLOY_OMV_HOST "$DEPLOY_OMV_HOST"
+    _savedeployconf DEPLOY_OMV_SSH_USER "$DEPLOY_OMV_SSH_USER"
+  else
+    _info "[OMV deploy-hook] Deploy certificate locally."
   fi
 
-  _savedeployconf DEPLOY_OMV_HOST "$DEPLOY_OMV_HOST"
-  _savedeployconf DEPLOY_OMV_WEBUI_ADMIN "$DEPLOY_OMV_WEBUI_ADMIN"
-  _savedeployconf DEPLOY_OMV_SSH_USER "$DEPLOY_OMV_SSH_USER"
+  if [ -n "$DEPLOY_OMV_HOST" ] && [ -n "$DEPLOY_OMV_SSH_USER" ]; then
 
-  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
-  # shellcheck disable=SC2029
-  _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
-  _debug _command "$_command"
-
-  if [ -z "$_uuid" ]; then
-    _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
-    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'getList' '{\"start\": 0, \"limit\": -1}' | jq -r '.data[] | select(.name==\"/CN='$_cdomain'\") | .uuid'"
     # shellcheck disable=SC2029
     _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
     _debug _command "$_command"
 
     if [ -z "$_uuid" ]; then
-      _err "[OMB deploy-hook] An error occured while creating the certificate"
-      return 1
+      _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
+      _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'create' '{\"cn\": \"test.example.com\", \"size\": 4096, \"days\": 3650, \"c\": \"\", \"st\": \"\", \"l\": \"\", \"o\": \"\", \"ou\": \"\", \"email\": \"\"}' | jq -r '.uuid'"
+      # shellcheck disable=SC2029
+      _uuid=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
+      _debug _command "$_command"
+
+      if [ -z "$_uuid" ]; then
+        _err "[OMV deploy-hook] An error occured while creating the certificate"
+        return 1
+      fi
     fi
+
+    _info "[OMV deploy-hook] Domain $_cdomain has uuid: $_uuid"
+    _fullchain=$(jq <"$_cfullchain" -aRs .)
+    _key=$(jq <"$_ckey" -aRs .)
+
+    _debug _fullchain "$_fullchain"
+    _debug _key "$_key"
+
+    _info "[OMV deploy-hook] Updating key and certificate in openmediavault"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
+    # shellcheck disable=SC2029
+    _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'WebGui' 'setSettings' \$(omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'WebGui' 'getSettings' | jq -c '.sslcertificateref=\"$_uuid\"')"
+    # shellcheck disable=SC2029
+    _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _info "[OMV deploy-hook] Asking openmediavault to apply changes... (this could take some time, hang in there)"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
+    # shellcheck disable=SC2029
+    _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _info "[OMV deploy-hook] Asking nginx to reload"
+    _command="nginx -s reload"
+    # shellcheck disable=SC2029
+    _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+  else
+
+    # shellcheck disable=SC2086
+    _uuid=$(omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'getList' '{"start": 0, "limit": -1}' | jq -r '.data[] | select(.name=="/CN='$_cdomain'") | .uuid')
+    if [ -z "$_uuid" ]; then
+      _info "[OMV deploy-hook] Domain $_cdomain has no certificate in openmediavault, creating it!"
+      # shellcheck disable=SC2086
+      _uuid=$(omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'create' '{"cn": "test.example.com", "size": 4096, "days": 3650, "c": "", "st": "", "l": "", "o": "", "ou": "", "email": ""}' | jq -r '.uuid')
+
+      if [ -z "$_uuid" ]; then
+        _err "[OMB deploy-hook] An error occured while creating the certificate"
+        return 1
+      fi
+    fi
+
+    _info "[OMV deploy-hook] Domain $_cdomain has uuid: $_uuid"
+    _fullchain=$(jq <"$_cfullchain" -aRs .)
+    _key=$(jq <"$_ckey" -aRs .)
+
+    _debug _fullchain "$_fullchain"
+    _debug _key "$_key"
+
+    _info "[OMV deploy-hook] Updating key and certificate in openmediavault"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
+    _result=$(eval "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'WebGui' 'setSettings' \$(omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'WebGui' 'getSettings' | jq -c '.sslcertificateref=\"$_uuid\"')"
+    _result=$(eval "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _info "[OMV deploy-hook] Asking openmediavault to apply changes... (this could take some time, hang in there)"
+    _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
+    _result=$(eval "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
+    _info "[OMV deploy-hook] Asking nginx to reload"
+    _command="nginx -s reload"
+    _result=$(eval "$_command")
+
+    _debug _command "$_command"
+    _debug _result "$_result"
+
   fi
 
-  _info "[OMV deploy-hook] Domain $_cdomain has uuid: $_uuid"
-  _fullchain=$(jq <"$_cfullchain" -aRs .)
-  _key=$(jq <"$_ckey" -aRs .)
-
-  _debug _fullchain "$_fullchain"
-  _debug _key "$_key"
-
-  _info "[OMV deploy-hook] Updating key and certificate in openmediavault"
-  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'CertificateMgmt' 'set' '{\"uuid\":\"$_uuid\", \"certificate\":$_fullchain, \"privatekey\":$_key, \"comment\":\"acme.sh deployed $(date)\"}'"
-  # shellcheck disable=SC2029
-  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
-
-  _debug _command "$_command"
-  _debug _result "$_result"
-
-  _info "[OMV deploy-hook] Asking openmediavault to apply changes... (this could take some time, hang in there)"
-  _command="omv-rpc -u $DEPLOY_OMV_WEBUI_ADMIN 'Config' 'applyChanges' '{\"modules\":[], \"force\": false}'"
-  # shellcheck disable=SC2029
-  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
-
-  _debug _command "$_command"
-  _debug _result "$_result"
-
-  _info "[OMV deploy-hook] Asking nginx to reload"
-  _command="nginx -s reload"
-  # shellcheck disable=SC2029
-  _result=$(ssh "$DEPLOY_OMV_SSH_USER@$DEPLOY_OMV_HOST" "$_command")
-
-  _debug _command "$_command"
-  _debug _result "$_result"
-
   return 0
 }

From 67c990e8cfd6503bc8bdeb19a71b53d34b32090e Mon Sep 17 00:00:00 2001
From: Ross Shen <sjtuross@msn.com>
Date: Thu, 20 Jan 2022 17:46:47 +0800
Subject: [PATCH 76/80] omv deploy hook: add usage comments

---
 deploy/openmediavault.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/deploy/openmediavault.sh b/deploy/openmediavault.sh
index 859eabe7..cfc2d332 100644
--- a/deploy/openmediavault.sh
+++ b/deploy/openmediavault.sh
@@ -1,5 +1,13 @@
 #!/usr/bin/env sh
 
+# This deploy hook is tested on OpenMediaVault 5.x. It supports both local and remote deployment.
+# The way it works is that if a cert with the matching domain name is not found, it will firstly create a dummy cert to get its uuid, and then replace it with your cert.
+#
+# DEPLOY_OMV_WEBUI_ADMIN - This is OMV web gui admin account. Default value is admin. It's required as the user parameter (-u) for the omv-rpc command.
+# DEPLOY_OMV_HOST and DEPLOY_OMV_SSH_USER are optional. They are used for remote deployment through ssh (support public key authentication only). Per design, OMV web gui admin doesn't have ssh permission, so another account is needed for ssh.
+#
+# returns 0 means success, otherwise error.
+
 ########  Public functions #####################
 
 #domain keyfile certfile cafile fullchain

From 7250a300df82ef79b9fce9d1f8287aef6686fe2e Mon Sep 17 00:00:00 2001
From: michal <michal.hejniak@gmail.com>
Date: Tue, 14 Dec 2021 20:27:40 +0100
Subject: [PATCH 77/80] add managed identity support for azure dns

---
 dnsapi/dns_azure.sh | 192 +++++++++++++++++++++++++-------------------
 1 file changed, 111 insertions(+), 81 deletions(-)

diff --git a/dnsapi/dns_azure.sh b/dnsapi/dns_azure.sh
index ce8a3fa7..1c33c13a 100644
--- a/dnsapi/dns_azure.sh
+++ b/dnsapi/dns_azure.sh
@@ -9,57 +9,72 @@ WIKI="https://github.com/acmesh-official/acme.sh/wiki/How-to-use-Azure-DNS"
 #
 # Ref: https://docs.microsoft.com/en-us/rest/api/dns/recordsets/createorupdate
 #
+
 dns_azure_add() {
   fulldomain=$1
   txtvalue=$2
 
   AZUREDNS_SUBSCRIPTIONID="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
-  AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
-  AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
-  AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-
   if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
     AZUREDNS_SUBSCRIPTIONID=""
     AZUREDNS_TENANTID=""
     AZUREDNS_APPID=""
     AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure Subscription ID "
+    _err "You didn't specify the Azure Subscription ID"
     return 1
   fi
-
-  if [ -z "$AZUREDNS_TENANTID" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure Tenant ID "
-    return 1
-  fi
-
-  if [ -z "$AZUREDNS_APPID" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure App ID"
-    return 1
-  fi
-
-  if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure Client Secret"
-    return 1
-  fi
-  #save account details to account conf file.
+  #save subscription id to account conf file.
   _saveaccountconf_mutable AZUREDNS_SUBSCRIPTIONID "$AZUREDNS_SUBSCRIPTIONID"
-  _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
-  _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
-  _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
 
-  accesstoken=$(_azure_getaccess_token "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  AZUREDNS_MANAGEDIDENTITY="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
+  if [ "$AZUREDNS_MANAGEDIDENTITY" = true ]; then
+    _info "Using Azure managed identity"
+    #save managed identity as preferred authentication method, clear service principal credentials from conf file.
+    _saveaccountconf_mutable AZUREDNS_MANAGEDIDENTITY "$AZUREDNS_MANAGEDIDENTITY"
+    _saveaccountconf_mutable AZUREDNS_TENANTID ""
+    _saveaccountconf_mutable AZUREDNS_APPID ""
+    _saveaccountconf_mutable AZUREDNS_CLIENTSECRET ""
+  else
+    _info "You didn't ask to use Azure managed identity, checking service principal credentials"
+    AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
+    AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
+    AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+
+    if [ -z "$AZUREDNS_TENANTID" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure Tenant ID "
+      return 1
+    fi
+
+    if [ -z "$AZUREDNS_APPID" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure App ID"
+      return 1
+    fi
+
+    if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure Client Secret"
+      return 1
+    fi
+
+    #save account details to account conf file, don't opt in for azure manages identity check.
+    _saveaccountconf_mutable AZUREDNS_MANAGEDIDENTITY "false"
+    _saveaccountconf_mutable AZUREDNS_TENANTID "$AZUREDNS_TENANTID"
+    _saveaccountconf_mutable AZUREDNS_APPID "$AZUREDNS_APPID"
+    _saveaccountconf_mutable AZUREDNS_CLIENTSECRET "$AZUREDNS_CLIENTSECRET"
+  fi
+
+  accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
     _err "invalid domain"
@@ -116,10 +131,6 @@ dns_azure_rm() {
   txtvalue=$2
 
   AZUREDNS_SUBSCRIPTIONID="${AZUREDNS_SUBSCRIPTIONID:-$(_readaccountconf_mutable AZUREDNS_SUBSCRIPTIONID)}"
-  AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
-  AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
-  AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
-
   if [ -z "$AZUREDNS_SUBSCRIPTIONID" ]; then
     AZUREDNS_SUBSCRIPTIONID=""
     AZUREDNS_TENANTID=""
@@ -129,34 +140,44 @@ dns_azure_rm() {
     return 1
   fi
 
-  if [ -z "$AZUREDNS_TENANTID" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure Tenant ID "
-    return 1
+  AZUREDNS_MANAGEDIDENTITY="${AZUREDNS_MANAGEDIDENTITY:-$(_readaccountconf_mutable AZUREDNS_MANAGEDIDENTITY)}"
+  if [ "$AZUREDNS_MANAGEDIDENTITY" = true ]; then
+    _info "Using Azure managed identity"
+  else
+    _info "You didn't ask to use Azure managed identity, checking service principal credentials"
+    AZUREDNS_TENANTID="${AZUREDNS_TENANTID:-$(_readaccountconf_mutable AZUREDNS_TENANTID)}"
+    AZUREDNS_APPID="${AZUREDNS_APPID:-$(_readaccountconf_mutable AZUREDNS_APPID)}"
+    AZUREDNS_CLIENTSECRET="${AZUREDNS_CLIENTSECRET:-$(_readaccountconf_mutable AZUREDNS_CLIENTSECRET)}"
+
+    if [ -z "$AZUREDNS_TENANTID" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure Tenant ID "
+      return 1
+    fi
+
+    if [ -z "$AZUREDNS_APPID" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure App ID"
+      return 1
+    fi
+
+    if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
+      AZUREDNS_SUBSCRIPTIONID=""
+      AZUREDNS_TENANTID=""
+      AZUREDNS_APPID=""
+      AZUREDNS_CLIENTSECRET=""
+      _err "You didn't specify the Azure Client Secret"
+      return 1
+    fi
   fi
 
-  if [ -z "$AZUREDNS_APPID" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure App ID"
-    return 1
-  fi
-
-  if [ -z "$AZUREDNS_CLIENTSECRET" ]; then
-    AZUREDNS_SUBSCRIPTIONID=""
-    AZUREDNS_TENANTID=""
-    AZUREDNS_APPID=""
-    AZUREDNS_CLIENTSECRET=""
-    _err "You didn't specify the Azure Client Secret"
-    return 1
-  fi
-
-  accesstoken=$(_azure_getaccess_token "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
+  accesstoken=$(_azure_getaccess_token "$AZUREDNS_MANAGEDIDENTITY" "$AZUREDNS_TENANTID" "$AZUREDNS_APPID" "$AZUREDNS_CLIENTSECRET")
 
   if ! _get_root "$fulldomain" "$AZUREDNS_SUBSCRIPTIONID" "$accesstoken"; then
     _err "invalid domain"
@@ -258,9 +279,10 @@ _azure_rest() {
 
 ## Ref: https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-protocols-oauth-service-to-service#request-an-access-token
 _azure_getaccess_token() {
-  tenantID=$1
-  clientID=$2
-  clientSecret=$3
+  managedIdentity=$1
+  tenantID=$2
+  clientID=$3
+  clientSecret=$4
 
   accesstoken="${AZUREDNS_BEARERTOKEN:-$(_readaccountconf_mutable AZUREDNS_BEARERTOKEN)}"
   expires_on="${AZUREDNS_TOKENVALIDTO:-$(_readaccountconf_mutable AZUREDNS_TOKENVALIDTO)}"
@@ -278,17 +300,25 @@ _azure_getaccess_token() {
   fi
   _debug "getting new bearer token"
 
-  export _H1="accept: application/json"
-  export _H2="Content-Type: application/x-www-form-urlencoded"
-
-  body="resource=$(printf "%s" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s" "$clientID" | _url_encode)&client_secret=$(printf "%s" "$clientSecret" | _url_encode)&grant_type=client_credentials"
-  _secure_debug2 "data $body"
-  response="$(_post "$body" "https://login.microsoftonline.com/$tenantID/oauth2/token" "" "POST")"
-  _ret="$?"
-  _secure_debug2 "response $response"
-  response="$(echo "$response" | _normalizeJson)"
-  accesstoken=$(echo "$response" | _egrep_o "\"access_token\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
-  expires_on=$(echo "$response" | _egrep_o "\"expires_on\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
+  if [ "$managedIdentity" = true ]; then
+    # https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http
+    export _H1="Metadata: true"
+    response="$(_get http://169.254.169.254/metadata/identity/oauth2/token\?api-version=2018-02-01\&resource=https://management.azure.com/)"
+    response="$(echo "$response" | _normalizeJson)"
+    accesstoken=$(echo "$response" | _egrep_o "\"access_token\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
+    expires_on=$(echo "$response" | _egrep_o "\"expires_on\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
+  else
+    export _H1="accept: application/json"
+    export _H2="Content-Type: application/x-www-form-urlencoded"
+    body="resource=$(printf "%s" 'https://management.core.windows.net/' | _url_encode)&client_id=$(printf "%s" "$clientID" | _url_encode)&client_secret=$(printf "%s" "$clientSecret" | _url_encode)&grant_type=client_credentials"
+    _secure_debug2 "data $body"
+    response="$(_post "$body" "https://login.microsoftonline.com/$tenantID/oauth2/token" "" "POST")"
+    _ret="$?"
+    _secure_debug2 "response $response"
+    response="$(echo "$response" | _normalizeJson)"
+    accesstoken=$(echo "$response" | _egrep_o "\"access_token\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
+    expires_on=$(echo "$response" | _egrep_o "\"expires_on\":\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d \")
+  fi
 
   if [ -z "$accesstoken" ]; then
     _err "no acccess token received. Check your Azure settings see $WIKI"

From 90b65c6618dbb00f1718667979f8aa375df67fd0 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Thu, 27 Jan 2022 18:00:44 +0800
Subject: [PATCH 78/80] fix
 https://github.com/acmesh-official/acme.sh/issues/3898

https://github.com/acmesh-official/acme.sh/issues/3898
---
 acme.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 78684267..11286130 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1253,7 +1253,8 @@ _createcsr() {
     domainlist="$(_idn "$domainlist")"
     _debug2 domainlist "$domainlist"
     alt="$(_getIdType "$domain" | _upper_case):$(_idn "$domain")"
-    for dl in $(echo "$domainlist" | tr "," ' '); do
+    for dl in $(echo "'$domainlist'" | sed "s/,/' '/g"); do
+      dl=$(echo "$dl" | tr -d "'")
       alt="$alt,$(_getIdType "$dl" | _upper_case):$dl"
     done
     #multi

From 36752cb6a88d5beb347a7951d14ee64ec5f5d19a Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Fri, 4 Feb 2022 13:49:58 +0800
Subject: [PATCH 79/80] Update acme.sh

fix zerossl endpoint
---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 11286130..18456968 100755
--- a/acme.sh
+++ b/acme.sh
@@ -29,7 +29,7 @@ CA_BUYPASS="https://api.buypass.com/acme/directory"
 CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory"
 
 CA_ZEROSSL="https://acme.zerossl.com/v2/DV90"
-_ZERO_EAB_ENDPOINT="http://api.zerossl.com/acme/eab-credentials-email"
+_ZERO_EAB_ENDPOINT="https://api.zerossl.com/acme/eab-credentials-email"
 
 CA_SSLCOM_RSA="https://acme.ssl.com/sslcom-dv-rsa"
 CA_SSLCOM_ECC="https://acme.ssl.com/sslcom-dv-ecc"

From 0f762d98a43546c82aa8eb14fdcffbea1e5cd358 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Fri, 4 Feb 2022 13:52:23 +0800
Subject: [PATCH 80/80] Update Linux.yml

use centos:7
---
 .github/workflows/Linux.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index 7b24eac9..63e3136c 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -20,7 +20,7 @@ jobs:
   Linux:
     strategy:
       matrix:
-        os: ["ubuntu:latest", "debian:latest", "almalinux:latest", "fedora:latest", "centos:latest", "opensuse/leap:latest", "alpine:latest", "oraclelinux:8", "kalilinux/kali", "archlinux:latest", "mageia", "gentoo/stage3"]
+        os: ["ubuntu:latest", "debian:latest", "almalinux:latest", "fedora:latest", "centos:7", "opensuse/leap:latest", "alpine:latest", "oraclelinux:8", "kalilinux/kali", "archlinux:latest", "mageia", "gentoo/stage3"]
     runs-on: ubuntu-latest
     env:
       TEST_LOCAL: 1