From 20d23fcb92bcc58360089b8e0f3208c8291602aa Mon Sep 17 00:00:00 2001
From: fradev <fradev@gmail.com>
Date: Wed, 25 Aug 2021 16:55:36 +0200
Subject: [PATCH 01/11] Update ssh.sh

Added scp mode for copy the certs
---
 deploy/ssh.sh | 237 +++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 205 insertions(+), 32 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 18de4aa6..b4a8140e 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -23,6 +23,8 @@
 # export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes or previously saved value
 # export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy"  # path on remote system. Defaults to .acme_ssh_deploy
 # export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no or previously saved value
+# export DEPLOY_SSH_USE_SCP="" yes or no , default to no
+# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -T -q "
 #
 ########  Public functions #####################
 
@@ -73,6 +75,25 @@ ssh_deploy() {
     Le_Deploy_ssh_cmd="ssh -T"
   fi
 
+  # USE_SCP is optional. If not provided then default to previously saved
+  # value (which may be undefined... equivalent to "no").
+  if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+    Le_Deploy_ssh_use_scp="yes"
+    _savedomainconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
+  elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
+    Le_Deploy_ssh_use_scp=""
+    _cleardomainconf Le_Deploy_ssh_use_scp
+  fi
+
+  # SCP_CMD is optional. If not provided then use scp
+  if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
+    Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
+    _savedomainconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
+  elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
+    Le_Deploy_ssh_scp_cmd="scp -T"
+  fi
+
+
   # BACKUP is optional. If not provided then default to previously saved value or yes.
   if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
     Le_Deploy_ssh_backup="no"
@@ -99,6 +120,26 @@ ssh_deploy() {
     _cleardomainconf Le_Deploy_ssh_multi_call
   fi
 
+  # USE_SCP is optional. If not provided then default to previously saved
+  # value (which may be undefined... equivalent to "no").
+  if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+    Le_Deploy_ssh_use_scp="yes"
+    _savedomainconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
+    Le_Deploy_ssh_multi_call="yes"
+    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+  elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
+    Le_Deploy_ssh_use_scp=""
+    _cleardomainconf Le_Deploy_ssh_use_scp
+  fi
+
+  # SCP_CMD is optional. If not provided then use scp
+  if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
+    Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
+    _savedomainconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
+  elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
+    Le_Deploy_ssh_scp_cmd="scp -T -q "
+  fi
+
   _deploy_ssh_servers=$Le_Deploy_ssh_server
   for Le_Deploy_ssh_server in $_deploy_ssh_servers; do
     _ssh_deploy
@@ -110,8 +151,16 @@ _ssh_deploy() {
   _cmdstr=""
   _backupprefix=""
   _backupdir=""
+  _local_cert_file=""
+  _local_ca_file=""
+  _local_full_file=""
 
   _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
+  if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+    _info "Using scp as alternate method for copying files. Multicall Mode is implicit"
+    Le_Deploy_ssh_multi_call="yes"
+    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+  fi
   if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
     _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
   else
@@ -149,15 +198,30 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir >/dev/null;"
-    fi
-    # copy new certificate into file.
-    _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
-    _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-      if ! _ssh_remote_cmd "$_cmdstr"; then
-        return $_err_code
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+
+    # copy new key into file.
+    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+      # scp the file
+      if ! _scp_remote_cmd "$_ckey" "$Le_Deploy_ssh_keyfile"; then
+          return $_err_code
+      fi
+    else
+      _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
+      _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
       fi
-      _cmdstr=""
     fi
   fi
 
@@ -172,18 +236,40 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
+      _local_cert_file=$(_mktemp)
+      cat $_ckey > $_local_cert_file
+      cat $_ccert >> $_local_cert_file
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null;"
-    fi
-    # copy new certificate into file.
-    _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
-    _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-      if ! _ssh_remote_cmd "$_cmdstr"; then
-        return $_err_code
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+      if -n $_local_cert_file ; then
+        if ! _scp_remote_cmd "$_local_cert_file" "$Le_Deploy_ssh_certfile"; then
+            return $_err_code
+        fi
+      else
+        if ! _scp_remote_cmd "$_ccert" "$Le_Deploy_ssh_certfile"; then
+            return $_err_code
+        fi
+      fi
+    else
+      # copy new certificate into file.
+      _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
+      _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
       fi
-      _cmdstr=""
     fi
   fi
 
@@ -199,18 +285,47 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
+      _local_ca_file=$(_mktemp)
+      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ] ; then
+        cat $_ckey >> $_local_ca_file
+      fi
+      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
+        cat $_ccert >> $_local_ca_file
+      fi
+
+      cat $_cca >> $_local_ca_file
+
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir >/dev/null;"
-    fi
-    # copy new certificate into file.
-    _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
-    _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-      if ! _ssh_remote_cmd "$_cmdstr"; then
-        return $_err_code
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+      if -n $_local_ca_file ; then
+        if ! _scp_remote_cmd "$_local_ca_file" "$Le_Deploy_ssh_cafile"; then
+            return $_err_code
+        fi
+      else
+        if ! _scp_remote_cmd "$_cca" "$Le_Deploy_ssh_cafile"; then
+            return $_err_code
+        fi
+      fi
+    else
+      # copy new certificate into file.
+      _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
+      _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
       fi
-      _cmdstr=""
     fi
   fi
 
@@ -227,20 +342,63 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
+      _local_full_file=$(_mktemp)
+      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ] ; then
+        cat $_ckey >> $_local_full_file
+      fi
+      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ]; then
+        cat $_ccert >> $_local_full_file
+      fi
+      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
+        cat $_cca >> $_local_full_file
+      fi
+      cat $_cfullchain >> $_local_full_file
+
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir >/dev/null;"
-    fi
-    # copy new certificate into file.
-    _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
-    _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-      if ! _ssh_remote_cmd "$_cmdstr"; then
-        return $_err_code
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+      if -n $_local_full_file ; then
+        if ! _scp_remote_cmd "$_local_full_file" "$Le_Deploy_ssh_fullchain"; then
+            return $_err_code
+        fi
+      else
+        if ! _scp_remote_cmd "$_cfullchain" "$Le_Deploy_ssh_fullchain"; then
+            return $_err_code
+        fi
+      fi
+    else
+      # copy new certificate into file.
+      _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
+      _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
+      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
       fi
-      _cmdstr=""
     fi
   fi
+  # cleanup local files if any
+
+  if [ -n "$_local_cert_file" ]; then
+    rm $_local_cert_file > /dev/null 1>&2
+  fi
+  if [ -n "$_local_ca_file" ]; then
+    rm $_local_ca_file > /dev/null 1>&2
+  fi
+  if [ -n "$_local_full_file" ]; then
+    rm $_local_full_file > /dev/null 1>&2
+  fi
+
 
   # REMOTE_CMD is optional.
   # If provided then this command will be executed on remote host.
@@ -265,6 +423,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       return $_err_code
     fi
   fi
+  # cleanup in case all is ok
   return 0
 }
 
@@ -284,3 +443,17 @@ _ssh_remote_cmd() {
 
   return $_err_code
 }
+
+# cmd scp
+_scp_remote_cmd() {
+  _secure_debug "Remote scp source $1 and destination $2 using : $Le_Deploy_ssh_scp_cmd"
+  _info "Submitting secure copy command : $Le_Deploy_ssh_scp_cmd"
+  $Le_Deploy_ssh_scp_cmd "$1" "$Le_Deploy_ssh_user"@"$Le_Deploy_ssh_server":"$2"
+  _err_code="$?"
+
+  if [ "$_err_code" != "0" ]; then
+    _err "Error code $_err_code returned from scp"
+  fi
+
+  return $_err_code
+}

From 613475ac264bf9cf48681bd11f72b4d2aa341e54 Mon Sep 17 00:00:00 2001
From: fradev <fradev@gmail.com>
Date: Mon, 30 Aug 2021 11:08:06 +0200
Subject: [PATCH 02/11] Update ssh.sh

---
 deploy/ssh.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index b4a8140e..3424055f 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -237,8 +237,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # if filename is same as previous file then append.
       _pipe=">>"
       _local_cert_file=$(_mktemp)
-      cat $_ckey > $_local_cert_file
-      cat $_ccert >> $_local_cert_file
+      cat "$_ckey" > "$_local_cert_file"
+      cat "$_ccert" >> "$_local_cert_file"
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null;"
@@ -344,15 +344,15 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
       _local_full_file=$(_mktemp)
       if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ] ; then
-        cat $_ckey >> $_local_full_file
+        cat "$_ckey" >> "$_local_full_file"
       fi
       if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ]; then
-        cat $_ccert >> $_local_full_file
+        cat "$_ccert" >> "$_local_full_file"
       fi
       if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
-        cat $_cca >> $_local_full_file
+        cat "$_cca" >> "$_local_full_file"
       fi
-      cat $_cfullchain >> $_local_full_file
+      cat "$_cfullchain" >> "$_local_full_file"
 
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
@@ -390,13 +390,13 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   # cleanup local files if any
 
   if [ -n "$_local_cert_file" ]; then
-    rm $_local_cert_file > /dev/null 1>&2
+    rm "$_local_cert_file" > /dev/null 1>&2
   fi
   if [ -n "$_local_ca_file" ]; then
-    rm $_local_ca_file > /dev/null 1>&2
+    rm "$_local_ca_file" > /dev/null 1>&2
   fi
   if [ -n "$_local_full_file" ]; then
-    rm $_local_full_file > /dev/null 1>&2
+    rm "$_local_full_file" > /dev/null 1>&2
   fi
 
 

From 4cda54774aeaae0f58352cff18dc243a69bdb9e9 Mon Sep 17 00:00:00 2001
From: fradev <fradev@gmail.com>
Date: Mon, 30 Aug 2021 11:17:03 +0200
Subject: [PATCH 03/11] Update ssh.sh

SC2086 and SC2215
---
 deploy/ssh.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 3424055f..8b91a055 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -251,7 +251,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
 
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if -n $_local_cert_file ; then
+      if [ -n "$_local_cert_file" ]; then
         if ! _scp_remote_cmd "$_local_cert_file" "$Le_Deploy_ssh_certfile"; then
             return $_err_code
         fi
@@ -287,13 +287,13 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       _pipe=">>"
       _local_ca_file=$(_mktemp)
       if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ] ; then
-        cat $_ckey >> $_local_ca_file
+        cat "$_ckey" >> "$_local_ca_file"
       fi
       if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
-        cat $_ccert >> $_local_ca_file
+        cat "$_ccert" >> "$_local_ca_file"
       fi
 
-      cat $_cca >> $_local_ca_file
+      cat "$_cca" >> "$_local_ca_file"
 
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
@@ -307,7 +307,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
 
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if -n $_local_ca_file ; then
+      if [ -n "$_local_ca_file" ]; then
         if ! _scp_remote_cmd "$_local_ca_file" "$Le_Deploy_ssh_cafile"; then
             return $_err_code
         fi
@@ -366,7 +366,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
 
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if -n $_local_full_file ; then
+      if [ -n "$_local_full_file" ] ; then
         if ! _scp_remote_cmd "$_local_full_file" "$Le_Deploy_ssh_fullchain"; then
             return $_err_code
         fi

From 08d60fcbf26172a3277a8785b9e161b8d1aa6c23 Mon Sep 17 00:00:00 2001
From: fradev <fradev@gmail.com>
Date: Mon, 30 Aug 2021 11:32:07 +0200
Subject: [PATCH 04/11] Update ssh.sh

shfmt formatting
---
 deploy/ssh.sh | 47 ++++++++++++++++++++++-------------------------
 1 file changed, 22 insertions(+), 25 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 8b91a055..6039eefb 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -93,7 +93,6 @@ ssh_deploy() {
     Le_Deploy_ssh_scp_cmd="scp -T"
   fi
 
-
   # BACKUP is optional. If not provided then default to previously saved value or yes.
   if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
     Le_Deploy_ssh_backup="no"
@@ -206,12 +205,11 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       fi
     fi
 
-
     # copy new key into file.
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
       # scp the file
       if ! _scp_remote_cmd "$_ckey" "$Le_Deploy_ssh_keyfile"; then
-          return $_err_code
+        return $_err_code
       fi
     else
       _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
@@ -237,8 +235,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # if filename is same as previous file then append.
       _pipe=">>"
       _local_cert_file=$(_mktemp)
-      cat "$_ckey" > "$_local_cert_file"
-      cat "$_ccert" >> "$_local_cert_file"
+      cat "$_ckey" >"$_local_cert_file"
+      cat "$_ccert" >>"$_local_cert_file"
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
       _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null;"
@@ -253,11 +251,11 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
       if [ -n "$_local_cert_file" ]; then
         if ! _scp_remote_cmd "$_local_cert_file" "$Le_Deploy_ssh_certfile"; then
-            return $_err_code
+          return $_err_code
         fi
       else
         if ! _scp_remote_cmd "$_ccert" "$Le_Deploy_ssh_certfile"; then
-            return $_err_code
+          return $_err_code
         fi
       fi
     else
@@ -286,14 +284,14 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # if filename is same as previous file then append.
       _pipe=">>"
       _local_ca_file=$(_mktemp)
-      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ] ; then
-        cat "$_ckey" >> "$_local_ca_file"
+      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ]; then
+        cat "$_ckey" >>"$_local_ca_file"
       fi
       if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
-        cat "$_ccert" >> "$_local_ca_file"
+        cat "$_ccert" >>"$_local_ca_file"
       fi
 
-      cat "$_cca" >> "$_local_ca_file"
+      cat "$_cca" >>"$_local_ca_file"
 
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
@@ -309,11 +307,11 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
       if [ -n "$_local_ca_file" ]; then
         if ! _scp_remote_cmd "$_local_ca_file" "$Le_Deploy_ssh_cafile"; then
-            return $_err_code
+          return $_err_code
         fi
       else
         if ! _scp_remote_cmd "$_cca" "$Le_Deploy_ssh_cafile"; then
-            return $_err_code
+          return $_err_code
         fi
       fi
     else
@@ -343,16 +341,16 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # if filename is same as previous file then append.
       _pipe=">>"
       _local_full_file=$(_mktemp)
-      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ] ; then
-        cat "$_ckey" >> "$_local_full_file"
+      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ]; then
+        cat "$_ckey" >>"$_local_full_file"
       fi
       if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ]; then
-        cat "$_ccert" >> "$_local_full_file"
+        cat "$_ccert" >>"$_local_full_file"
       fi
       if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
-        cat "$_cca" >> "$_local_full_file"
+        cat "$_cca" >>"$_local_full_file"
       fi
-      cat "$_cfullchain" >> "$_local_full_file"
+      cat "$_cfullchain" >>"$_local_full_file"
 
     elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
       # backup file we are about to overwrite.
@@ -366,13 +364,13 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
 
     if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if [ -n "$_local_full_file" ] ; then
+      if [ -n "$_local_full_file" ]; then
         if ! _scp_remote_cmd "$_local_full_file" "$Le_Deploy_ssh_fullchain"; then
-            return $_err_code
+          return $_err_code
         fi
       else
         if ! _scp_remote_cmd "$_cfullchain" "$Le_Deploy_ssh_fullchain"; then
-            return $_err_code
+          return $_err_code
         fi
       fi
     else
@@ -390,16 +388,15 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   # cleanup local files if any
 
   if [ -n "$_local_cert_file" ]; then
-    rm "$_local_cert_file" > /dev/null 1>&2
+    rm "$_local_cert_file" >/dev/null 1>&2
   fi
   if [ -n "$_local_ca_file" ]; then
-    rm "$_local_ca_file" > /dev/null 1>&2
+    rm "$_local_ca_file" >/dev/null 1>&2
   fi
   if [ -n "$_local_full_file" ]; then
-    rm "$_local_full_file" > /dev/null 1>&2
+    rm "$_local_full_file" >/dev/null 1>&2
   fi
 
-
   # REMOTE_CMD is optional.
   # If provided then this command will be executed on remote host.
   if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then

From b37bf06de87ab41d495e0a3156f538c5baf9c679 Mon Sep 17 00:00:00 2001
From: fradev <fradev@gmail.com>
Date: Tue, 1 Mar 2022 17:57:59 +0100
Subject: [PATCH 05/11] Update ssh.sh

---
 deploy/ssh.sh | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 604d8642..7d9e82e8 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -24,7 +24,7 @@
 # export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy"  # path on remote system. Defaults to .acme_ssh_deploy
 # export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no or previously saved value
 # export DEPLOY_SSH_USE_SCP="" yes or no , default to no
-# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -T -q "
+# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -q "
 #
 ########  Public functions #####################
 
@@ -53,7 +53,7 @@ ssh_deploy() {
     fi
   else
     Le_Deploy_ssh_user="$DEPLOY_SSH_USER"
-    _savedomainconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
+    _savedeployconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
   fi
 
   # SERVER is optional. If not provided then use _cdomain
@@ -61,7 +61,7 @@ ssh_deploy() {
   _debug2 DEPLOY_SSH_SERVER "$DEPLOY_SSH_SERVER"
   if [ -n "$DEPLOY_SSH_SERVER" ]; then
     Le_Deploy_ssh_server="$DEPLOY_SSH_SERVER"
-    _savedomainconf Le_Deploy_ssh_server "$Le_Deploy_ssh_server"
+    _savedeployconf Le_Deploy_ssh_server "$Le_Deploy_ssh_server"
   elif [ -z "$Le_Deploy_ssh_server" ]; then
     Le_Deploy_ssh_server="$_cdomain"
   fi
@@ -71,7 +71,7 @@ ssh_deploy() {
   _debug2 DEPLOY_SSH_CMD "$DEPLOY_SSH_CMD"
   if [ -n "$DEPLOY_SSH_CMD" ]; then
     Le_Deploy_ssh_cmd="$DEPLOY_SSH_CMD"
-    _savedomainconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
+    _savedeployconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
   elif [ -z "$Le_Deploy_ssh_cmd" ]; then
     Le_Deploy_ssh_cmd="ssh -T"
   fi
@@ -80,7 +80,7 @@ ssh_deploy() {
   # value (which may be undefined... equivalent to "no").
   if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
     Le_Deploy_ssh_use_scp="yes"
-    _savedomainconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
+    _savedeployconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
   elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
     Le_Deploy_ssh_use_scp=""
     _cleardomainconf Le_Deploy_ssh_use_scp
@@ -89,9 +89,9 @@ ssh_deploy() {
   # SCP_CMD is optional. If not provided then use scp
   if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
     Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
-    _savedomainconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
+    _savedeployconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
   elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
-    Le_Deploy_ssh_scp_cmd="scp -T"
+    Le_Deploy_ssh_scp_cmd="scp -q"
   fi
 
   # BACKUP is optional. If not provided then default to previously saved value or yes.
@@ -102,7 +102,7 @@ ssh_deploy() {
   elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
     Le_Deploy_ssh_backup="yes"
   fi
-  _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
+  _savedeployconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
   # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
   _getdeployconf DEPLOY_SSH_BACKUP_PATH
@@ -112,7 +112,7 @@ ssh_deploy() {
   elif [ -z "$Le_Deploy_ssh_backup_path" ]; then
     Le_Deploy_ssh_backup_path=".acme_ssh_deploy"
   fi
-  _savedomainconf Le_Deploy_ssh_backup_path "$Le_Deploy_ssh_backup_path"
+  _savedeployconf Le_Deploy_ssh_backup_path "$Le_Deploy_ssh_backup_path"
 
   # MULTI_CALL is optional. If not provided then default to previously saved
   # value (which may be undefined... equivalent to "no").
@@ -120,7 +120,7 @@ ssh_deploy() {
   _debug2 DEPLOY_SSH_MULTI_CALL "$DEPLOY_SSH_MULTI_CALL"
   if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
     Le_Deploy_ssh_multi_call="yes"
-    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
   elif [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
     Le_Deploy_ssh_multi_call=""
     _cleardomainconf Le_Deploy_ssh_multi_call
@@ -130,9 +130,9 @@ ssh_deploy() {
   # value (which may be undefined... equivalent to "no").
   if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
     Le_Deploy_ssh_use_scp="yes"
-    _savedomainconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
+    _savedeployconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
     Le_Deploy_ssh_multi_call="yes"
-    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
   elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
     Le_Deploy_ssh_use_scp=""
     _cleardomainconf Le_Deploy_ssh_use_scp
@@ -141,7 +141,7 @@ ssh_deploy() {
   # SCP_CMD is optional. If not provided then use scp
   if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
     Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
-    _savedomainconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
+    _savedeployconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
   elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
     Le_Deploy_ssh_scp_cmd="scp -T -q "
   fi
@@ -165,7 +165,7 @@ _ssh_deploy() {
   if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
     _info "Using scp as alternate method for copying files. Multicall Mode is implicit"
     Le_Deploy_ssh_multi_call="yes"
-    _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
+    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
   fi
   if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
     _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
@@ -200,7 +200,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _debug2 DEPLOY_SSH_KEYFILE "$DEPLOY_SSH_KEYFILE"
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
     Le_Deploy_ssh_keyfile="$DEPLOY_SSH_KEYFILE"
-    _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
+    _savedeployconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
   fi
   if [ -n "$Le_Deploy_ssh_keyfile" ]; then
     if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
@@ -238,7 +238,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _debug2 DEPLOY_SSH_CERTFILE "$DEPLOY_SSH_CERTFILE"
   if [ -n "$DEPLOY_SSH_CERTFILE" ]; then
     Le_Deploy_ssh_certfile="$DEPLOY_SSH_CERTFILE"
-    _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
+    _savedeployconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
   fi
   if [ -n "$Le_Deploy_ssh_certfile" ]; then
     _pipe=">"
@@ -288,7 +288,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _debug2 DEPLOY_SSH_CAFILE "$DEPLOY_SSH_CAFILE"
   if [ -n "$DEPLOY_SSH_CAFILE" ]; then
     Le_Deploy_ssh_cafile="$DEPLOY_SSH_CAFILE"
-    _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
+    _savedeployconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
   fi
   if [ -n "$Le_Deploy_ssh_cafile" ]; then
     _pipe=">"
@@ -346,7 +346,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _debug2 DEPLOY_SSH_FULLCHAIN "$DEPLOY_SSH_FULLCHAIN"
   if [ -n "$DEPLOY_SSH_FULLCHAIN" ]; then
     Le_Deploy_ssh_fullchain="$DEPLOY_SSH_FULLCHAIN"
-    _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
+    _savedeployconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
   fi
   if [ -n "$Le_Deploy_ssh_fullchain" ]; then
     _pipe=">"
@@ -418,7 +418,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
   _debug2 DEPLOY_SSH_REMOTE_CMD "$DEPLOY_SSH_REMOTE_CMD"
   if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then
     Le_Deploy_ssh_remote_cmd="$DEPLOY_SSH_REMOTE_CMD"
-    _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
+    _savedeployconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
   fi
   if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
     _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd;"

From 9fb5bb620d2ffa51eabb0354dfccc29ea9d88315 Mon Sep 17 00:00:00 2001
From: PM Extra <pm@jubeat.net>
Date: Sat, 14 May 2022 22:13:24 +0800
Subject: [PATCH 06/11] refact ssh hook to use deploy config

---
 acme.sh       |  20 +++
 deploy/ssh.sh | 434 +++++++++++++++++++++++---------------------------
 2 files changed, 220 insertions(+), 234 deletions(-)

diff --git a/acme.sh b/acme.sh
index 260733a2..37c625d2 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2332,6 +2332,26 @@ _readdomainconf() {
   _read_conf "$DOMAIN_CONF" "$1"
 }
 
+#_migratedomainconf   oldkey  newkey  base64encode
+_migratedomainconf() {
+  _old_key="$1"
+  _new_key="$2"
+  _b64encode="$3"
+  _value=$(_readdomainconf "$_old_key")
+  if [ -z "$_value" ]; then
+    return 1 # oldkey is not found
+  fi
+  _savedomainconf "$_new_key" "$_value" "$_b64encode"
+  _cleardomainconf "$_old_key"
+  _debug "Domain config $_old_key has been migrated to $_new_key"
+}
+
+#_migratedeployconf   oldkey  newkey  base64encode
+_migratedeployconf() {
+  _migratedomainconf "$1" "SAVED_$2" "$3" ||
+  _migratedomainconf "SAVED_$1" "SAVED_$2" "$3" # try only when oldkey itself is not found
+}
+
 #key  value  base64encode
 _savedeployconf() {
   _savedomainconf "SAVED_$1" "$2" "$3"
diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 7d9e82e8..73d71597 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -23,8 +23,8 @@
 # export DEPLOY_SSH_BACKUP=""  # yes or no, default to yes or previously saved value
 # export DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy"  # path on remote system. Defaults to .acme_ssh_deploy
 # export DEPLOY_SSH_MULTI_CALL=""  # yes or no, default to no or previously saved value
-# export DEPLOY_SSH_USE_SCP="" yes or no , default to no
-# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -q "
+# export DEPLOY_SSH_USE_SCP="" yes or no, default to no
+# export DEPLOY_SSH_SCP_CMD="" defaults to "scp -q"
 #
 ########  Public functions #####################
 
@@ -44,110 +44,134 @@ ssh_deploy() {
   _debug _cfullchain "$_cfullchain"
 
   # USER is required to login by SSH to remote host.
+  _migratedeployconf Le_Deploy_ssh_user DEPLOY_SSH_USER
   _getdeployconf DEPLOY_SSH_USER
   _debug2 DEPLOY_SSH_USER "$DEPLOY_SSH_USER"
   if [ -z "$DEPLOY_SSH_USER" ]; then
-    if [ -z "$Le_Deploy_ssh_user" ]; then
-      _err "DEPLOY_SSH_USER not defined."
-      return 1
-    fi
-  else
-    Le_Deploy_ssh_user="$DEPLOY_SSH_USER"
-    _savedeployconf Le_Deploy_ssh_user "$Le_Deploy_ssh_user"
+    _err "DEPLOY_SSH_USER not defined."
+    return 1
   fi
+  _savedeployconf DEPLOY_SSH_USER "$DEPLOY_SSH_USER"
 
   # SERVER is optional. If not provided then use _cdomain
+  _migratedeployconf Le_Deploy_ssh_server DEPLOY_SSH_SERVER
   _getdeployconf DEPLOY_SSH_SERVER
   _debug2 DEPLOY_SSH_SERVER "$DEPLOY_SSH_SERVER"
-  if [ -n "$DEPLOY_SSH_SERVER" ]; then
-    Le_Deploy_ssh_server="$DEPLOY_SSH_SERVER"
-    _savedeployconf Le_Deploy_ssh_server "$Le_Deploy_ssh_server"
-  elif [ -z "$Le_Deploy_ssh_server" ]; then
-    Le_Deploy_ssh_server="$_cdomain"
+  if [ -z "$DEPLOY_SSH_SERVER" ]; then
+    DEPLOY_SSH_SERVER="$_cdomain"
   fi
+  _savedeployconf DEPLOY_SSH_SERVER "$DEPLOY_SSH_SERVER"
 
   # CMD is optional. If not provided then use ssh
+  _migratedeployconf Le_Deploy_ssh_cmd DEPLOY_SSH_CMD
   _getdeployconf DEPLOY_SSH_CMD
   _debug2 DEPLOY_SSH_CMD "$DEPLOY_SSH_CMD"
-  if [ -n "$DEPLOY_SSH_CMD" ]; then
-    Le_Deploy_ssh_cmd="$DEPLOY_SSH_CMD"
-    _savedeployconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
-  elif [ -z "$Le_Deploy_ssh_cmd" ]; then
-    Le_Deploy_ssh_cmd="ssh -T"
-  fi
-
-  # USE_SCP is optional. If not provided then default to previously saved
-  # value (which may be undefined... equivalent to "no").
-  if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
-    Le_Deploy_ssh_use_scp="yes"
-    _savedeployconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
-  elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
-    Le_Deploy_ssh_use_scp=""
-    _cleardomainconf Le_Deploy_ssh_use_scp
-  fi
-
-  # SCP_CMD is optional. If not provided then use scp
-  if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
-    Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
-    _savedeployconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
-  elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
-    Le_Deploy_ssh_scp_cmd="scp -q"
+  if [ -z "$DEPLOY_SSH_CMD" ]; then
+    DEPLOY_SSH_CMD="ssh -T"
   fi
+  _savedeployconf DEPLOY_SSH_CMD "$DEPLOY_SSH_CMD"
 
   # BACKUP is optional. If not provided then default to previously saved value or yes.
+  _migratedeployconf Le_Deploy_ssh_backup DEPLOY_SSH_BACKUP
   _getdeployconf DEPLOY_SSH_BACKUP
   _debug2 DEPLOY_SSH_BACKUP "$DEPLOY_SSH_BACKUP"
-  if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
-    Le_Deploy_ssh_backup="no"
-  elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
-    Le_Deploy_ssh_backup="yes"
+  if [ -z "$DEPLOY_SSH_BACKUP" ]; then
+    DEPLOY_SSH_BACKUP="yes"
   fi
-  _savedeployconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
+  _savedeployconf DEPLOY_SSH_BACKUP "$DEPLOY_SSH_BACKUP"
 
   # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
+  _migratedeployconf Le_Deploy_ssh_backup_path DEPLOY_SSH_BACKUP_PATH
   _getdeployconf DEPLOY_SSH_BACKUP_PATH
   _debug2 DEPLOY_SSH_BACKUP_PATH "$DEPLOY_SSH_BACKUP_PATH"
-  if [ -n "$DEPLOY_SSH_BACKUP_PATH" ]; then
-    Le_Deploy_ssh_backup_path="$DEPLOY_SSH_BACKUP_PATH"
-  elif [ -z "$Le_Deploy_ssh_backup_path" ]; then
-    Le_Deploy_ssh_backup_path=".acme_ssh_deploy"
+  if [ -z "$DEPLOY_SSH_BACKUP_PATH" ]; then
+    DEPLOY_SSH_BACKUP_PATH=".acme_ssh_deploy"
   fi
-  _savedeployconf Le_Deploy_ssh_backup_path "$Le_Deploy_ssh_backup_path"
+  _savedeployconf DEPLOY_SSH_BACKUP_PATH "$DEPLOY_SSH_BACKUP_PATH"
 
   # MULTI_CALL is optional. If not provided then default to previously saved
   # value (which may be undefined... equivalent to "no").
+  _migratedeployconf Le_Deploy_ssh_multi_call DEPLOY_SSH_MULTI_CALL
   _getdeployconf DEPLOY_SSH_MULTI_CALL
   _debug2 DEPLOY_SSH_MULTI_CALL "$DEPLOY_SSH_MULTI_CALL"
-  if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
-    Le_Deploy_ssh_multi_call="yes"
-    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
-  elif [ "$DEPLOY_SSH_MULTI_CALL" = "no" ]; then
-    Le_Deploy_ssh_multi_call=""
-    _cleardomainconf Le_Deploy_ssh_multi_call
+  if [ -z "$DEPLOY_SSH_MULTI_CALL" ]; then
+    DEPLOY_SSH_MULTI_CALL="no"
+  fi
+  _savedeployconf DEPLOY_SSH_MULTI_CALL "$DEPLOY_SSH_MULTI_CALL"
+
+  # KEYFILE is optional.
+  # If provided then private key will be copied to provided filename.
+  _migratedeployconf Le_Deploy_ssh_keyfile DEPLOY_SSH_KEYFILE
+  _getdeployconf DEPLOY_SSH_KEYFILE
+  _debug2 DEPLOY_SSH_KEYFILE "$DEPLOY_SSH_KEYFILE"
+  if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
+    _savedeployconf DEPLOY_SSH_KEYFILE "$DEPLOY_SSH_KEYFILE"
+  fi
+
+  # CERTFILE is optional.
+  # If provided then certificate will be copied or appended to provided filename.
+  _migratedeployconf Le_Deploy_ssh_certfile DEPLOY_SSH_CERTFILE
+  _getdeployconf DEPLOY_SSH_CERTFILE
+  _debug2 DEPLOY_SSH_CERTFILE "$DEPLOY_SSH_CERTFILE"
+  if [ -n "$DEPLOY_SSH_CERTFILE" ]; then
+    _savedeployconf DEPLOY_SSH_CERTFILE "$DEPLOY_SSH_CERTFILE"
+  fi
+
+  # CAFILE is optional.
+  # If provided then CA intermediate certificate will be copied or appended to provided filename.
+  _migratedeployconf Le_Deploy_ssh_cafile DEPLOY_SSH_CAFILE
+  _getdeployconf DEPLOY_SSH_CAFILE
+  _debug2 DEPLOY_SSH_CAFILE "$DEPLOY_SSH_CAFILE"
+  if [ -n "$DEPLOY_SSH_CAFILE" ]; then
+    _savedeployconf DEPLOY_SSH_CAFILE "$DEPLOY_SSH_CAFILE"
+  fi
+
+  # FULLCHAIN is optional.
+  # If provided then fullchain certificate will be copied or appended to provided filename.
+  _migratedeployconf Le_Deploy_ssh_fullchain DEPLOY_SSH_FULLCHAIN
+  _getdeployconf DEPLOY_SSH_FULLCHAIN
+  _debug2 DEPLOY_SSH_FULLCHAIN "$DEPLOY_SSH_FULLCHAIN"
+  if [ -n "$DEPLOY_SSH_FULLCHAIN" ]; then
+    _savedeployconf DEPLOY_SSH_FULLCHAIN "$DEPLOY_SSH_FULLCHAIN"
+  fi
+
+  # REMOTE_CMD is optional.
+  # If provided then this command will be executed on remote host.
+  _migratedeployconf Le_Deploy_ssh_remote_cmd DEPLOY_SSH_REMOTE_CMD
+  _getdeployconf DEPLOY_SSH_REMOTE_CMD
+  _debug2 DEPLOY_SSH_REMOTE_CMD "$DEPLOY_SSH_REMOTE_CMD"
+  if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then
+    _savedeployconf DEPLOY_SSH_REMOTE_CMD "$DEPLOY_SSH_REMOTE_CMD"
   fi
 
   # USE_SCP is optional. If not provided then default to previously saved
   # value (which may be undefined... equivalent to "no").
-  if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
-    Le_Deploy_ssh_use_scp="yes"
-    _savedeployconf Le_Deploy_ssh_use_scp "$Le_Deploy_ssh_use_scp"
-    Le_Deploy_ssh_multi_call="yes"
-    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
-  elif [ "$DEPLOY_SSH_USE_SCP" = "no" ]; then
-    Le_Deploy_ssh_use_scp=""
-    _cleardomainconf Le_Deploy_ssh_use_scp
+  _getdeployconf DEPLOY_SSH_USE_SCP
+  _debug2 DEPLOY_SSH_USE_SCP "$DEPLOY_SSH_USE_SCP"
+  if [ -z "$DEPLOY_SSH_USE_SCP" ]; then
+    DEPLOY_SSH_USE_SCP="no"
   fi
+  _savedeployconf DEPLOY_SSH_USE_SCP "$DEPLOY_SSH_USE_SCP"
 
   # SCP_CMD is optional. If not provided then use scp
-  if [ -n "$DEPLOY_SSH_SCP_CMD" ]; then
-    Le_Deploy_ssh_scp_cmd="$DEPLOY_SSH_SCP_CMD"
-    _savedeployconf Le_Deploy_ssh_scp_cmd "$Le_Deploy_ssh_scp_cmd"
-  elif [ -z "$Le_Deploy_ssh_scp_cmd" ]; then
-    Le_Deploy_ssh_scp_cmd="scp -T -q "
+  _getdeployconf DEPLOY_SSH_SCP_CMD
+  _debug2 DEPLOY_SSH_SCP_CMD "$DEPLOY_SSH_SCP_CMD"
+  if [ -z "$DEPLOY_SSH_SCP_CMD" ]; then
+    DEPLOY_SSH_SCP_CMD="scp -q"
+  fi
+  _savedeployconf DEPLOY_SSH_SCP_CMD "$DEPLOY_SSH_SCP_CMD"
+
+  if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+    DEPLOY_SSH_MULTI_CALL="yes"
+    _info "Using scp as alternate method for copying files. Multicall Mode is implicit"
+  elif [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
+    _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
+  else
+    _info "Required commands batched and sent in single call to remote host"
   fi
 
-  _deploy_ssh_servers=$Le_Deploy_ssh_server
-  for Le_Deploy_ssh_server in $_deploy_ssh_servers; do
+  _deploy_ssh_servers=$DEPLOY_SSH_SERVER
+  for DEPLOY_SSH_SERVER in $_deploy_ssh_servers; do
     _ssh_deploy
   done
 }
@@ -161,20 +185,10 @@ _ssh_deploy() {
   _local_ca_file=""
   _local_full_file=""
 
-  _info "Deploy certificates to remote server $Le_Deploy_ssh_user@$Le_Deploy_ssh_server"
-  if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-    _info "Using scp as alternate method for copying files. Multicall Mode is implicit"
-    Le_Deploy_ssh_multi_call="yes"
-    _savedeployconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
-  fi
-  if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-    _info "Using MULTI_CALL mode... Required commands sent in multiple calls to remote host"
-  else
-    _info "Required commands batched and sent in single call to remote host"
-  fi
+  _info "Deploy certificates to remote server $DEPLOY_SSH_USER@$DEPLOY_SSH_SERVER"
 
-  if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
-    _backupprefix="$Le_Deploy_ssh_backup_path/$_cdomain-backup"
+  if [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
+    _backupprefix="$DEPLOY_SSH_BACKUP_PATH/$_cdomain-backup"
     _backupdir="$_backupprefix-$(_utc_date | tr ' ' '-')"
     # run cleanup on the backup directory, erase all older
     # than 180 days (15552000 seconds).
@@ -186,7 +200,7 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     _cmdstr="mkdir -p $_backupdir; $_cmdstr"
     _info "Backup of old certificate files will be placed in remote directory $_backupdir"
     _info "Backup directories erased after 180 days."
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+    if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -194,19 +208,11 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
   fi
 
-  # KEYFILE is optional.
-  # If provided then private key will be copied to provided filename.
-  _getdeployconf DEPLOY_SSH_KEYFILE
-  _debug2 DEPLOY_SSH_KEYFILE "$DEPLOY_SSH_KEYFILE"
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
-    Le_Deploy_ssh_keyfile="$DEPLOY_SSH_KEYFILE"
-    _savedeployconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
-  fi
-  if [ -n "$Le_Deploy_ssh_keyfile" ]; then
-    if [ "$Le_Deploy_ssh_backup" = "yes" ]; then
+    if [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $Le_Deploy_ssh_keyfile $_backupdir >/dev/null;"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      _cmdstr="$_cmdstr cp $DEPLOY_SSH_KEYFILE $_backupdir >/dev/null;"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -215,15 +221,16 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
 
     # copy new key into file.
-    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
+    if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
       # scp the file
-      if ! _scp_remote_cmd "$_ckey" "$Le_Deploy_ssh_keyfile"; then
+      if ! _scp_remote_cmd "$_ckey" "$DEPLOY_SSH_KEYFILE"; then
         return $_err_code
       fi
     else
-      _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $Le_Deploy_ssh_keyfile;"
-      _info "will copy private key to remote file $Le_Deploy_ssh_keyfile"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      # ssh echo to the file
+      _cmdstr="$_cmdstr echo \"$(cat "$_ckey")\" > $DEPLOY_SSH_KEYFILE;"
+      _info "will copy private key to remote file $DEPLOY_SSH_KEYFILE"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -232,48 +239,38 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
   fi
 
-  # CERTFILE is optional.
-  # If provided then certificate will be copied or appended to provided filename.
-  _getdeployconf DEPLOY_SSH_CERTFILE
-  _debug2 DEPLOY_SSH_CERTFILE "$DEPLOY_SSH_CERTFILE"
   if [ -n "$DEPLOY_SSH_CERTFILE" ]; then
-    Le_Deploy_ssh_certfile="$DEPLOY_SSH_CERTFILE"
-    _savedeployconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
-  fi
-  if [ -n "$Le_Deploy_ssh_certfile" ]; then
     _pipe=">"
-    if [ "$Le_Deploy_ssh_certfile" = "$Le_Deploy_ssh_keyfile" ]; then
+    if [ "$DEPLOY_SSH_CERTFILE" = "$DEPLOY_SSH_KEYFILE" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
+    elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
+      # backup file we are about to overwrite.
+      _cmdstr="$_cmdstr cp $DEPLOY_SSH_CERTFILE $_backupdir >/dev/null;"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+    # copy new certificate into file.
+    if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+      # scp the file
       _local_cert_file=$(_mktemp)
-      cat "$_ckey" >"$_local_cert_file"
-      cat "$_ccert" >>"$_local_cert_file"
-    elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
-      # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $Le_Deploy_ssh_certfile $_backupdir >/dev/null;"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-        if ! _ssh_remote_cmd "$_cmdstr"; then
-          return $_err_code
-        fi
-        _cmdstr=""
+      if [ "$DEPLOY_SSH_CERTFILE" = "$DEPLOY_SSH_KEYFILE" ]; then
+        cat "$_ckey" >> "$_local_cert_file"
       fi
-    fi
-
-    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if [ -n "$_local_cert_file" ]; then
-        if ! _scp_remote_cmd "$_local_cert_file" "$Le_Deploy_ssh_certfile"; then
-          return $_err_code
-        fi
-      else
-        if ! _scp_remote_cmd "$_ccert" "$Le_Deploy_ssh_certfile"; then
-          return $_err_code
-        fi
+      cat "$_ccert" >> "$_local_cert_file"
+      if ! _scp_remote_cmd "$_local_cert_file" "$DEPLOY_SSH_CERTFILE"; then
+        return $_err_code
       fi
     else
-      # copy new certificate into file.
-      _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $Le_Deploy_ssh_certfile;"
-      _info "will copy certificate to remote file $Le_Deploy_ssh_certfile"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      # ssh echo to the file
+      _cmdstr="$_cmdstr echo \"$(cat "$_ccert")\" $_pipe $DEPLOY_SSH_CERTFILE;"
+      _info "will copy certificate to remote file $DEPLOY_SSH_CERTFILE"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -282,56 +279,42 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
   fi
 
-  # CAFILE is optional.
-  # If provided then CA intermediate certificate will be copied or appended to provided filename.
-  _getdeployconf DEPLOY_SSH_CAFILE
-  _debug2 DEPLOY_SSH_CAFILE "$DEPLOY_SSH_CAFILE"
   if [ -n "$DEPLOY_SSH_CAFILE" ]; then
-    Le_Deploy_ssh_cafile="$DEPLOY_SSH_CAFILE"
-    _savedeployconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
-  fi
-  if [ -n "$Le_Deploy_ssh_cafile" ]; then
     _pipe=">"
-    if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ] ||
-      [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
+    if [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_KEYFILE" ] ||
+      [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_CERTFILE" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
+    elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
+      # backup file we are about to overwrite.
+      _cmdstr="$_cmdstr cp $DEPLOY_SSH_CAFILE $_backupdir >/dev/null;"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
+        if ! _ssh_remote_cmd "$_cmdstr"; then
+          return $_err_code
+        fi
+        _cmdstr=""
+      fi
+    fi
+
+    # copy new certificate into file.
+    if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+      # scp the file
       _local_ca_file=$(_mktemp)
-      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_keyfile" ]; then
-        cat "$_ckey" >>"$_local_ca_file"
+      if [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_KEYFILE" ]; then
+        cat "$_ckey" >> "$_local_ca_file"
       fi
-      if [ "$Le_Deploy_ssh_cafile" = "$Le_Deploy_ssh_certfile" ]; then
-        cat "$_ccert" >>"$_local_ca_file"
+      if [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_CERTFILE" ]; then
+        cat "$_ccert" >> "$_local_ca_file"
       fi
-
       cat "$_cca" >>"$_local_ca_file"
-
-    elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
-      # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $Le_Deploy_ssh_cafile $_backupdir >/dev/null;"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
-        if ! _ssh_remote_cmd "$_cmdstr"; then
-          return $_err_code
-        fi
-        _cmdstr=""
-      fi
-    fi
-
-    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if [ -n "$_local_ca_file" ]; then
-        if ! _scp_remote_cmd "$_local_ca_file" "$Le_Deploy_ssh_cafile"; then
-          return $_err_code
-        fi
-      else
-        if ! _scp_remote_cmd "$_cca" "$Le_Deploy_ssh_cafile"; then
-          return $_err_code
-        fi
+      if ! _scp_remote_cmd "$_local_ca_file" "$DEPLOY_SSH_CAFILE"; then
+        return $_err_code
       fi
     else
-      # copy new certificate into file.
-      _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $Le_Deploy_ssh_cafile;"
-      _info "will copy CA file to remote file $Le_Deploy_ssh_cafile"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      # ssh echo to the file
+      _cmdstr="$_cmdstr echo \"$(cat "$_cca")\" $_pipe $DEPLOY_SSH_CAFILE;"
+      _info "will copy CA file to remote file $DEPLOY_SSH_CAFILE"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -340,37 +323,17 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
     fi
   fi
 
-  # FULLCHAIN is optional.
-  # If provided then fullchain certificate will be copied or appended to provided filename.
-  _getdeployconf DEPLOY_SSH_FULLCHAIN
-  _debug2 DEPLOY_SSH_FULLCHAIN "$DEPLOY_SSH_FULLCHAIN"
   if [ -n "$DEPLOY_SSH_FULLCHAIN" ]; then
-    Le_Deploy_ssh_fullchain="$DEPLOY_SSH_FULLCHAIN"
-    _savedeployconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
-  fi
-  if [ -n "$Le_Deploy_ssh_fullchain" ]; then
     _pipe=">"
-    if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ] ||
-      [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ] ||
-      [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
+    if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_KEYFILE" ] ||
+      [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CERTFILE" ] ||
+      [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CAFILE" ]; then
       # if filename is same as previous file then append.
       _pipe=">>"
-      _local_full_file=$(_mktemp)
-      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_keyfile" ]; then
-        cat "$_ckey" >>"$_local_full_file"
-      fi
-      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_certfile" ]; then
-        cat "$_ccert" >>"$_local_full_file"
-      fi
-      if [ "$Le_Deploy_ssh_fullchain" = "$Le_Deploy_ssh_cafile" ]; then
-        cat "$_cca" >>"$_local_full_file"
-      fi
-      cat "$_cfullchain" >>"$_local_full_file"
-
-    elif [ "$Le_Deploy_ssh_backup" = "yes" ]; then
+    elif [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
       # backup file we are about to overwrite.
-      _cmdstr="$_cmdstr cp $Le_Deploy_ssh_fullchain $_backupdir >/dev/null;"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      _cmdstr="$_cmdstr cp $DEPLOY_SSH_FULLCHAIN $_backupdir >/dev/null;"
+      if [ "$DEPLOY_SSH_FULLCHAIN" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -378,21 +341,28 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       fi
     fi
 
-    if [ "$Le_Deploy_ssh_use_scp" = "yes" ]; then
-      if [ -n "$_local_full_file" ]; then
-        if ! _scp_remote_cmd "$_local_full_file" "$Le_Deploy_ssh_fullchain"; then
-          return $_err_code
-        fi
-      else
-        if ! _scp_remote_cmd "$_cfullchain" "$Le_Deploy_ssh_fullchain"; then
-          return $_err_code
-        fi
+    # copy new certificate into file.
+    if [ "$DEPLOY_SSH_USE_SCP" = "yes" ]; then
+      # scp the file
+      _local_full_file=$(_mktemp)
+      if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_KEYFILE" ]; then
+        cat "$_ckey" >> "$_local_full_file"
+      fi
+      if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CERTFILE" ]; then
+        cat "$_ccert" >> "$_local_full_file"
+      fi
+      if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CAFILE" ]; then
+        cat "$_cca" >> "$_local_full_file"
+      fi
+      cat "$_cfullchain" >> "$_local_full_file"
+      if ! _scp_remote_cmd "$_local_full_file" "$DEPLOY_SSH_FULLCHAIN"; then
+        return $_err_code
       fi
     else
-      # copy new certificate into file.
-      _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $Le_Deploy_ssh_fullchain;"
-      _info "will copy fullchain to remote file $Le_Deploy_ssh_fullchain"
-      if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+      # ssh echo to the file
+      _cmdstr="$_cmdstr echo \"$(cat "$_cfullchain")\" $_pipe $DEPLOY_SSH_FULLCHAIN;"
+      _info "will copy fullchain to remote file $DEPLOY_SSH_FULLCHAIN"
+      if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
         if ! _ssh_remote_cmd "$_cmdstr"; then
           return $_err_code
         fi
@@ -400,30 +370,22 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       fi
     fi
   fi
+
   # cleanup local files if any
-
-  if [ -n "$_local_cert_file" ]; then
-    rm "$_local_cert_file" >/dev/null 1>&2
+  if [ -f "$_local_cert_file" ]; then
+    rm -f "$_local_cert_file"
   fi
-  if [ -n "$_local_ca_file" ]; then
-    rm "$_local_ca_file" >/dev/null 1>&2
+  if [ -f "$_local_ca_file" ]; then
+    rm -f "$_local_ca_file"
   fi
-  if [ -n "$_local_full_file" ]; then
-    rm "$_local_full_file" >/dev/null 1>&2
+  if [ -f "$_local_full_file" ]; then
+    rm -f "$_local_full_file"
   fi
 
-  # REMOTE_CMD is optional.
-  # If provided then this command will be executed on remote host.
-  _getdeployconf DEPLOY_SSH_REMOTE_CMD
-  _debug2 DEPLOY_SSH_REMOTE_CMD "$DEPLOY_SSH_REMOTE_CMD"
   if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then
-    Le_Deploy_ssh_remote_cmd="$DEPLOY_SSH_REMOTE_CMD"
-    _savedeployconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"
-  fi
-  if [ -n "$Le_Deploy_ssh_remote_cmd" ]; then
-    _cmdstr="$_cmdstr $Le_Deploy_ssh_remote_cmd;"
-    _info "Will execute remote command $Le_Deploy_ssh_remote_cmd"
-    if [ "$Le_Deploy_ssh_multi_call" = "yes" ]; then
+    _cmdstr="$_cmdstr $DEPLOY_SSH_REMOTE_CMD;"
+    _info "Will execute remote command $DEPLOY_SSH_REMOTE_CMD"
+    if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
       if ! _ssh_remote_cmd "$_cmdstr"; then
         return $_err_code
       fi
@@ -445,10 +407,11 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 _ssh_remote_cmd() {
   _cmd="$1"
   _secure_debug "Remote commands to execute: $_cmd"
-  _info "Submitting sequence of commands to remote server by ssh"
+  _info "Submitting sequence of commands to remote server by $DEPLOY_SSH_CMD"
+
   # quotations in bash cmd below intended.  Squash travis spellcheck error
   # shellcheck disable=SC2029
-  $Le_Deploy_ssh_cmd "$Le_Deploy_ssh_user@$Le_Deploy_ssh_server" sh -c "'$_cmd'"
+  $DEPLOY_SSH_CMD "$DEPLOY_SSH_USER@$DEPLOY_SSH_SERVER" sh -c "'$_cmd'"
   _err_code="$?"
 
   if [ "$_err_code" != "0" ]; then
@@ -460,9 +423,12 @@ _ssh_remote_cmd() {
 
 # cmd scp
 _scp_remote_cmd() {
-  _secure_debug "Remote scp source $1 and destination $2 using : $Le_Deploy_ssh_scp_cmd"
-  _info "Submitting secure copy command : $Le_Deploy_ssh_scp_cmd"
-  $Le_Deploy_ssh_scp_cmd "$1" "$Le_Deploy_ssh_user"@"$Le_Deploy_ssh_server":"$2"
+  _src=$1
+  _dest=$2
+  _secure_debug "Remote copy source $_src to destination $_dest using: $DEPLOY_SSH_SCP_CMD"
+  _info "Submitting secure copy command: $DEPLOY_SSH_SCP_CMD"
+
+  $DEPLOY_SSH_SCP_CMD "$_src" "$DEPLOY_SSH_USER"@"$DEPLOY_SSH_SERVER":"$_dest"
   _err_code="$?"
 
   if [ "$_err_code" != "0" ]; then

From c8929ca0cb13abb2213cd5da7abd9bd1b140af9a Mon Sep 17 00:00:00 2001
From: PM Extra <pm@jubeat.net>
Date: Sat, 14 May 2022 22:29:19 +0800
Subject: [PATCH 07/11] support specifying port for each host

---
 deploy/ssh.sh | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 73d71597..2de0d325 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -14,7 +14,7 @@
 # The following examples are for QNAP NAS running QTS 4.2
 # export DEPLOY_SSH_CMD=""  # defaults to "ssh -T"
 # export DEPLOY_SSH_USER="admin"  # required
-# export DEPLOY_SSH_SERVER="qnap"  # defaults to domain name
+# export DEPLOY_SSH_SERVER="qnap"  # defaults to domain name, support multiple servers with optional port (eg. "host1 host2:8022")
 # export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
 # export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
 # export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"
@@ -185,7 +185,12 @@ _ssh_deploy() {
   _local_ca_file=""
   _local_full_file=""
 
-  _info "Deploy certificates to remote server $DEPLOY_SSH_USER@$DEPLOY_SSH_SERVER"
+  case $DEPLOY_SSH_SERVER in
+    (*:*) _host=${DEPLOY_SSH_SERVER%:*} _port=${DEPLOY_SSH_SERVER##*:};;
+    (*)   _host=$DEPLOY_SSH_SERVER      _port=;;
+  esac
+
+  _info "Deploy certificates to remote server $DEPLOY_SSH_USER@$_host:$_port"
 
   if [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
     _backupprefix="$DEPLOY_SSH_BACKUP_PATH/$_cdomain-backup"
@@ -406,12 +411,18 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 #cmd
 _ssh_remote_cmd() {
   _cmd="$1"
+
+  _ssh_cmd="$DEPLOY_SSH_CMD"
+  if [ -n "$_port" ]; then
+    _ssh_cmd="$_ssh_cmd -p $_port"
+  fi
+
   _secure_debug "Remote commands to execute: $_cmd"
-  _info "Submitting sequence of commands to remote server by $DEPLOY_SSH_CMD"
+  _info "Submitting sequence of commands to remote server by $_ssh_cmd"
 
   # quotations in bash cmd below intended.  Squash travis spellcheck error
   # shellcheck disable=SC2029
-  $DEPLOY_SSH_CMD "$DEPLOY_SSH_USER@$DEPLOY_SSH_SERVER" sh -c "'$_cmd'"
+  $_ssh_cmd "$DEPLOY_SSH_USER@$_host" sh -c "'$_cmd'"
   _err_code="$?"
 
   if [ "$_err_code" != "0" ]; then
@@ -425,10 +436,16 @@ _ssh_remote_cmd() {
 _scp_remote_cmd() {
   _src=$1
   _dest=$2
-  _secure_debug "Remote copy source $_src to destination $_dest using: $DEPLOY_SSH_SCP_CMD"
-  _info "Submitting secure copy command: $DEPLOY_SSH_SCP_CMD"
 
-  $DEPLOY_SSH_SCP_CMD "$_src" "$DEPLOY_SSH_USER"@"$DEPLOY_SSH_SERVER":"$_dest"
+  _scp_cmd="$DEPLOY_SSH_SCP_CMD"
+  if [ -n "$_port" ]; then
+    _scp_cmd="$_scp_cmd -P $_port"
+  fi
+
+  _secure_debug "Remote copy source $_src to destination $_dest"
+  _info "Submitting secure copy by $_scp_cmd"
+
+  $_scp_cmd "$_src" "$DEPLOY_SSH_USER"@"$_host":"$_dest"
   _err_code="$?"
 
   if [ "$_err_code" != "0" ]; then

From f90cbb636a101625b118fbdb57b64f7d4d0bdabb Mon Sep 17 00:00:00 2001
From: PM Extra <pm@jubeat.net>
Date: Sat, 14 May 2022 22:41:59 +0800
Subject: [PATCH 08/11] fix format

---
 acme.sh       |  2 +-
 deploy/ssh.sh | 20 ++++++++++----------
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/acme.sh b/acme.sh
index 37c625d2..4366501b 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2349,7 +2349,7 @@ _migratedomainconf() {
 #_migratedeployconf   oldkey  newkey  base64encode
 _migratedeployconf() {
   _migratedomainconf "$1" "SAVED_$2" "$3" ||
-  _migratedomainconf "SAVED_$1" "SAVED_$2" "$3" # try only when oldkey itself is not found
+    _migratedomainconf "SAVED_$1" "SAVED_$2" "$3" # try only when oldkey itself is not found
 }
 
 #key  value  base64encode
diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 2de0d325..d40bba43 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -186,8 +186,8 @@ _ssh_deploy() {
   _local_full_file=""
 
   case $DEPLOY_SSH_SERVER in
-    (*:*) _host=${DEPLOY_SSH_SERVER%:*} _port=${DEPLOY_SSH_SERVER##*:};;
-    (*)   _host=$DEPLOY_SSH_SERVER      _port=;;
+  *:*) _host=${DEPLOY_SSH_SERVER%:*} _port=${DEPLOY_SSH_SERVER##*:};;
+  *)   _host=$DEPLOY_SSH_SERVER      _port=;;
   esac
 
   _info "Deploy certificates to remote server $DEPLOY_SSH_USER@$_host:$_port"
@@ -265,9 +265,9 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # scp the file
       _local_cert_file=$(_mktemp)
       if [ "$DEPLOY_SSH_CERTFILE" = "$DEPLOY_SSH_KEYFILE" ]; then
-        cat "$_ckey" >> "$_local_cert_file"
+        cat "$_ckey" >>"$_local_cert_file"
       fi
-      cat "$_ccert" >> "$_local_cert_file"
+      cat "$_ccert" >>"$_local_cert_file"
       if ! _scp_remote_cmd "$_local_cert_file" "$DEPLOY_SSH_CERTFILE"; then
         return $_err_code
       fi
@@ -306,10 +306,10 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # scp the file
       _local_ca_file=$(_mktemp)
       if [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_KEYFILE" ]; then
-        cat "$_ckey" >> "$_local_ca_file"
+        cat "$_ckey" >>"$_local_ca_file"
       fi
       if [ "$DEPLOY_SSH_CAFILE" = "$DEPLOY_SSH_CERTFILE" ]; then
-        cat "$_ccert" >> "$_local_ca_file"
+        cat "$_ccert" >>"$_local_ca_file"
       fi
       cat "$_cca" >>"$_local_ca_file"
       if ! _scp_remote_cmd "$_local_ca_file" "$DEPLOY_SSH_CAFILE"; then
@@ -351,15 +351,15 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
       # scp the file
       _local_full_file=$(_mktemp)
       if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_KEYFILE" ]; then
-        cat "$_ckey" >> "$_local_full_file"
+        cat "$_ckey" >>"$_local_full_file"
       fi
       if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CERTFILE" ]; then
-        cat "$_ccert" >> "$_local_full_file"
+        cat "$_ccert" >>"$_local_full_file"
       fi
       if [ "$DEPLOY_SSH_FULLCHAIN" = "$DEPLOY_SSH_CAFILE" ]; then
-        cat "$_cca" >> "$_local_full_file"
+        cat "$_cca" >>"$_local_full_file"
       fi
-      cat "$_cfullchain" >> "$_local_full_file"
+      cat "$_cfullchain" >>"$_local_full_file"
       if ! _scp_remote_cmd "$_local_full_file" "$DEPLOY_SSH_FULLCHAIN"; then
         return $_err_code
       fi

From 74f28021e701c53665774c4861d68863775bb206 Mon Sep 17 00:00:00 2001
From: PM Extra <pm@jubeat.net>
Date: Sat, 14 May 2022 22:49:40 +0800
Subject: [PATCH 09/11] fix format again

---
 deploy/ssh.sh | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index d40bba43..074af84f 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -186,8 +186,14 @@ _ssh_deploy() {
   _local_full_file=""
 
   case $DEPLOY_SSH_SERVER in
-  *:*) _host=${DEPLOY_SSH_SERVER%:*} _port=${DEPLOY_SSH_SERVER##*:};;
-  *)   _host=$DEPLOY_SSH_SERVER      _port=;;
+  *:*)
+    _host=${DEPLOY_SSH_SERVER%:*}
+    _port=${DEPLOY_SSH_SERVER##*:}
+    ;;
+  *)
+    _host=$DEPLOY_SSH_SERVER
+    _port=
+    ;;
   esac
 
   _info "Deploy certificates to remote server $DEPLOY_SSH_USER@$_host:$_port"

From 3ce7d410c8ee18d4ed1049ccdc500a6624613df7 Mon Sep 17 00:00:00 2001
From: PM Extra <pm@jubeat.net>
Date: Sat, 14 May 2022 22:59:02 +0800
Subject: [PATCH 10/11] improve doc comments

---
 deploy/ssh.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 074af84f..1aed7d3e 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -14,7 +14,7 @@
 # The following examples are for QNAP NAS running QTS 4.2
 # export DEPLOY_SSH_CMD=""  # defaults to "ssh -T"
 # export DEPLOY_SSH_USER="admin"  # required
-# export DEPLOY_SSH_SERVER="qnap"  # defaults to domain name, support multiple servers with optional port (eg. "host1 host2:8022")
+# export DEPLOY_SSH_SERVER="host1 host2:8022 192.168.0.1:9022"  # defaults to domain name, support multiple servers with optional port
 # export DEPLOY_SSH_KEYFILE="/etc/stunnel/stunnel.pem"
 # export DEPLOY_SSH_CERTFILE="/etc/stunnel/stunnel.pem"
 # export DEPLOY_SSH_CAFILE="/etc/stunnel/uca.pem"

From d2a9d731edbc5d6dcfc434560ba605bef9039ed2 Mon Sep 17 00:00:00 2001
From: neil <github@neilpang.com>
Date: Tue, 24 May 2022 22:25:44 +0800
Subject: [PATCH 11/11] Update ssh.sh

---
 deploy/ssh.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 1aed7d3e..c66e2e19 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -170,7 +170,7 @@ ssh_deploy() {
     _info "Required commands batched and sent in single call to remote host"
   fi
 
-  _deploy_ssh_servers=$DEPLOY_SSH_SERVER
+  _deploy_ssh_servers="$DEPLOY_SSH_SERVER"
   for DEPLOY_SSH_SERVER in $_deploy_ssh_servers; do
     _ssh_deploy
   done