From eb8290ee9ad8764c3ae88beff7b1204073c102ad Mon Sep 17 00:00:00 2001
From: Colin 't Hart <colinthart@gmail.com>
Date: Tue, 15 May 2018 11:33:47 +0200
Subject: [PATCH 01/93] Update getssl

Grammar fixes.
---
 getssl | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/getssl b/getssl
index 7f3713e..967cd05 100755
--- a/getssl
+++ b/getssl
@@ -173,7 +173,7 @@
 # 2016-12-28 tidied up upgrade tmpfile handling (1.95)
 # 2017-01-01 update comments
 # 2017-01-01 create stable release 2.0 (2.00)
-# 2017-01-02 Added option to limit amount of old versions to keep (2.01)
+# 2017-01-02 Added option to limit number of old versions to keep (2.01)
 # 2017-01-03 Created check_config function to list all obvious config issues (2.02)
 # 2017-01-10 force renew if FORCE_RENEWAL file exists (2.03)
 # 2017-01-12 added drill, dig or host as alternatives to nslookup (2.04)
@@ -463,7 +463,7 @@ check_getssl_upgrade() { # check if a more recent version of code is available a
         shopt -s -o noglob
         IFS=$'\n' getssl_versions=($(sort <<< "${getssl_versions[*]}"))
         shopt -u -o noglob
-        # Remove entries until given amount of old versions to keep is reached
+        # Remove entries until given number of old versions to keep is reached
         while [[ ${#getssl_versions[@]} -gt $_KEEP_VERSIONS ]]; do
           debug "removing old version ${getssl_versions[0]}"
           rm "${getssl_versions[0]}"
@@ -937,15 +937,15 @@ help_message() { # print out the help message
 
 	Options:
 	  -a, --all          Check all certificates
-	  -d, --debug        Outputs debug information
+	  -d, --debug        Output debug information
 	  -c, --create       Create default config files
 	  -f, --force        Force renewal of cert (overrides expiry checks)
 	  -h, --help         Display this help message and exit
 	  -q, --quiet        Quiet mode (only outputs on error, success of new cert, or getssl was upgraded)
-	  -Q, --mute         Like -q, but mutes notification about successful upgrade
+	  -Q, --mute         Like -q, but also mute notification about successful upgrade
 	  -r, --revoke   "cert" "key" [CA_server] Revoke a certificate (the cert and key are required)
 	  -u, --upgrade      Upgrade getssl if a more recent version is available
-	  -k, --keep     "#" Maximum amount of old getssl versions to keep when upgrading
+	  -k, --keep     "#" Maximum number of old getssl versions to keep when upgrading
 	  -U, --nocheck      Do not check if a more recent version is available
 	  -w working_dir "Working directory"
 

From 398d1df99d3f413716fc046d27f9b29009529ac1 Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:44:08 +0000
Subject: [PATCH 02/93] spelling: acme

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 7f3713e..7df04fc 100755
--- a/getssl
+++ b/getssl
@@ -50,7 +50,7 @@
 # 2016-05-04 Improve check for if DNS_DEL_COMMAND is blank. (0.31)
 # 2016-05-06 Setting umask to 077 for security of private keys etc. (0.32)
 # 2016-05-20 update to reflect changes in staging ACME server json (0.33)
-# 2016-05-20 tidying up checking of json following AMCE changes. (0.34)
+# 2016-05-20 tidying up checking of json following ACME changes. (0.34)
 # 2016-05-21 added AUTH_DNS_SERVER to getssl.cfg as optional definition of authoritative DNS server (0.35)
 # 2016-05-21 added DNS_WAIT to getssl.cfg as (default = 10 seconds as before) (0.36)
 # 2016-05-21 added PUBLIC_DNS_SERVER option, for forcing use of an external DNS server (0.37)

From 11f652dd63e76ae741169f6f74d26e62acee93ab Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:43:56 +0000
Subject: [PATCH 03/93] spelling: allow

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 7df04fc..6edf753 100755
--- a/getssl
+++ b/getssl
@@ -121,7 +121,7 @@
 # 2016-10-05 improved the check for CSR with domain in subject (1.54)
 # 2016-10-06 prints update info on what was included in latest updates (1.55)
 # 2016-10-06 when using -a flag, ignore folders in working directory which aren't domains (1.56)
-# 2016-10-12 alllow multiple tokens in DNS challenge (1.57)
+# 2016-10-12 allow multiple tokens in DNS challenge (1.57)
 # 2016-10-14 added CHECK_ALL_AUTH_DNS option to check all DNS servres, not just one primary server (1.58)
 # 2016-10-14 added archive of chain and private key for each cert, and purge old archives (1.59)
 # 2016-10-17 updated info comment on failed cert due to rate limits. (1.60)

From 401ba2e305fcecf76e7f15d9a25289e5437d2265 Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:43:46 +0000
Subject: [PATCH 04/93] spelling: archive

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 6edf753..56a92e8 100755
--- a/getssl
+++ b/getssl
@@ -245,7 +245,7 @@ ORIGCMD="$0 $*"
 # Define all functions (in alphabetical order)
 
 cert_archive() {  # Archive certificate file by copying files to dated archive dir.
-  debug "creating an achive copy of current new certs"
+  debug "creating an archive copy of current new certs"
   date_time=$(date +%Y_%m_%d_%H_%M)
   mkdir -p "${DOMAIN_DIR}/archive/${date_time}"
   umask 077

From 71cbde40d88d4f36d35017241bd4c953b6bd77ba Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:35:18 +0000
Subject: [PATCH 05/93] spelling: macos

---
 README.md | 2 +-
 getssl    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 879d8f3..484b1ec 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 Obtain SSL certificates from the letsencrypt.org ACME server.  Suitable for automating the process on remote servers.
 
 ## Features
-* **Bash** - It runs on virtually all unix machines, including BSD, most Linux distributions, MAC OSX.
+* **Bash** - It runs on virtually all unix machines, including BSD, most Linux distributions, macOS.
 * **Get certificates for remote servers** - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, e.g. if it's a shared server.
 * **Runs as a daily cron** - so certificates will be automatically renewed when required.
 * **Automatic certificate renewals**
diff --git a/getssl b/getssl
index 56a92e8..b5d41e0 100755
--- a/getssl
+++ b/getssl
@@ -676,7 +676,7 @@ date_epoc() { # convert the date into epoch time
 date_fmt() { # format date from epoc time to YYYY-MM-DD
   if [[ "$os" == "bsd" ]]; then #uses older style date function.
     date -j -f "%s" "$1" +%F
-  elif [[ "$os" == "mac" ]]; then # MAC OSX uses older BSD style date.
+  elif [[ "$os" == "mac" ]]; then # macOS uses older BSD style date.
     date -j -f "%s" "$1" +%F
   else
     date -d "@$1" +%F

From 7b8f1b831fc66b24e4fdc00c12e9cd0933c5ada1 Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:45:54 +0000
Subject: [PATCH 06/93] spelling: mac os x

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index b5d41e0..246f5c8 100755
--- a/getssl
+++ b/getssl
@@ -114,7 +114,7 @@
 # 2016-09-27 added additional debug info issue #119 (1.47)
 # 2016-09-27 removed IPv6 switch in favour of checking both IPv4 and IPv6 (1.48)
 # 2016-09-28 Add -Q, or --mute, switch to mute notifications about successfully upgrading getssl (1.49)
-# 2016-09-30 improved portability to work natively on FreeBSD, Slackware and OSX (1.50)
+# 2016-09-30 improved portability to work natively on FreeBSD, Slackware and Mac OS X (1.50)
 # 2016-09-30 comment out PRIVATE_KEY_ALG from the domain template Issue #125 (1.51)
 # 2016-10-03 check remote certificate for right domain before saving to local (1.52)
 # 2016-10-04 allow existing CSR with domain name in subject (1.53)

From bf96cb6d028dcbb9b910b41ba499e8c6a5d20407 Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:46:21 +0000
Subject: [PATCH 07/93] spelling: permission

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 246f5c8..944d44c 100755
--- a/getssl
+++ b/getssl
@@ -127,7 +127,7 @@
 # 2016-10-17 updated info comment on failed cert due to rate limits. (1.60)
 # 2016-10-17 fix error messages when using 1.0.1e-fips  (1.61)
 # 2016-10-20 set secure permissions when generating account key (1.62)
-# 2016-10-20 set permsissions to 700 for getssl script during upgrade (1.63)
+# 2016-10-20 set permissions to 700 for getssl script during upgrade (1.63)
 # 2016-10-20 add option to revoke a certificate (1.64)
 # 2016-10-21 set revocation server default to acme-v01.api.letsencrypt.org (1.65)
 # 2016-10-21 bug fix for revocation on different servers. (1.66)

From 8ce75abc3d168d97e0d2248b8fe540e5db7663df Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:46:34 +0000
Subject: [PATCH 08/93] spelling: private

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 944d44c..53aba49 100755
--- a/getssl
+++ b/getssl
@@ -1736,7 +1736,7 @@ else
   create_key "$ACCOUNT_KEY_TYPE" "$ACCOUNT_KEY" "$ACCOUNT_KEY_LENGTH"
 fi
 
-# if not reusing priavte key, then remove the old keys
+# if not reusing private key, then remove the old keys
 if [[ "$REUSE_PRIVATE_KEY" != "true" ]]; then
   if [[ -s "$DOMAIN_DIR/${DOMAIN}.key" ]]; then
    rm -f "$DOMAIN_DIR/${DOMAIN}.key"

From a07e2a9757ee5bb118932b2d2277167e99fa17d9 Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:46:57 +0000
Subject: [PATCH 09/93] spelling: secure

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 53aba49..42e2290 100755
--- a/getssl
+++ b/getssl
@@ -527,7 +527,7 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
       fi
     elif [[ "${to:0:4}" == "ftp:" ]] ; then
       if [[ "$cert" != "challenge token" ]] ; then
-        error_exit "ftp is not a sercure method for copying certificates or keys"
+        error_exit "ftp is not a secure method for copying certificates or keys"
       fi
       debug "using ftp to copy the file from $from"
       ftpuser=$(echo "$to"| awk -F: '{print $2}')

From 76b8897e9c59564bca6bfbe095fd8223526449bb Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:47:09 +0000
Subject: [PATCH 10/93] spelling: server

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 42e2290..9bf8ce7 100755
--- a/getssl
+++ b/getssl
@@ -122,7 +122,7 @@
 # 2016-10-06 prints update info on what was included in latest updates (1.55)
 # 2016-10-06 when using -a flag, ignore folders in working directory which aren't domains (1.56)
 # 2016-10-12 allow multiple tokens in DNS challenge (1.57)
-# 2016-10-14 added CHECK_ALL_AUTH_DNS option to check all DNS servres, not just one primary server (1.58)
+# 2016-10-14 added CHECK_ALL_AUTH_DNS option to check all DNS servers, not just one primary server (1.58)
 # 2016-10-14 added archive of chain and private key for each cert, and purge old archives (1.59)
 # 2016-10-17 updated info comment on failed cert due to rate limits. (1.60)
 # 2016-10-17 fix error messages when using 1.0.1e-fips  (1.61)

From 84f87b54dbe81f1df1292b90cbd2d6538fa7b32a Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:47:52 +0000
Subject: [PATCH 11/93] spelling: upgrading

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 9bf8ce7..692448f 100755
--- a/getssl
+++ b/getssl
@@ -1709,7 +1709,7 @@ if [[ -s "$CERT_FILE" ]]; then
     if [[ $(date_renew) -lt "$enddate_s" ]] && [[ $_FORCE_RENEW -ne 1 ]]; then
       issuer=$(openssl x509 -in "$CERT_FILE" -noout -issuer 2>/dev/null)
       if [[ "$issuer" == *"Fake LE Intermediate"* ]] && [[ "$CA" == "https://acme-v01.api.letsencrypt.org" ]]; then
-        debug "upgradeing from fake cert to real"
+        debug "upgrading from fake cert to real"
       else
         info "${DOMAIN}: certificate is valid for more than $RENEW_ALLOW days (until $enddate)"
         # everything is OK, so exit.

From 1ff407bd2d387f75faa9ecf3709db47310daa4cc Mon Sep 17 00:00:00 2001
From: Josh Soref <jsoref@users.noreply.github.com>
Date: Thu, 9 Aug 2018 04:48:07 +0000
Subject: [PATCH 12/93] spelling: verifying

---
 README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 484b1ec..42c7cdd 100644
--- a/README.md
+++ b/README.md
@@ -85,9 +85,9 @@ and it should run, providing output like;
 ```
 Registering account
 Verify each domain
-Verifing yourdomain.com
+Verifying yourdomain.com
 Verified yourdomain.com
-Verifing www.yourdomain.com
+Verifying www.yourdomain.com
 Verified www.yourdomain.com
 Verification completed, obtaining certificate.
 Certificate saved in /home/user/.getssl/yourdomain.com/yourdomain.com.crt

From 0f9e831b3a5cefdaa54685ee39a5ca10729f9701 Mon Sep 17 00:00:00 2001
From: In/Progress <admin@inprogress-bs.net>
Date: Sun, 2 Dec 2018 19:29:17 +0000
Subject: [PATCH 13/93] Allow file copying via davs (WebDAV over HTTPS)

---
 getssl | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/getssl b/getssl
index 7f3713e..2c7d4a8 100755
--- a/getssl
+++ b/getssl
@@ -564,6 +564,20 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
 			lcd $fromdir
 			put $fromfile
 			_EOF
+    elif [[ "${to:0:5}" == "davs:" ]] ; then
+      debug "using davs to copy the file from $from"
+      davsuser=$(echo "$to"| awk -F: '{print $2}')
+      davspass=$(echo "$to"| awk -F: '{print $3}')
+      davshost=$(echo "$to"| awk -F: '{print $4}')
+      davsport=$(echo "$to"| awk -F: '{print $5}')
+      davslocn=$(echo "$to"| awk -F: '{print $6}')
+      davsdirn=$(dirname "$davslocn")
+      davsfile=$(basename "$davslocn")
+      fromdir=$(dirname "$from")
+      fromfile=$(basename "$from")
+      debug "davs user=$davsuser - pass=$davspass - host=$davshost port=$davsport dir=$davsdirn file=$davsfile"
+      debug "from dir=$fromdir  file=$fromfile"
+      curl -u "${davsuser}:${davspass}" -T "${fromdir}/${fromfile}" "https://${davshost}:${davsport}${davsdirn}/${davsfile}"
     else
       if ! mkdir -p "$(dirname "$to")" ; then
         error_exit "cannot create ACL directory $(basename "$to")"

From f7324f35d711c4479fb286381d97b41585e142e1 Mon Sep 17 00:00:00 2001
From: In/Progress <admin@inprogress-bs.net>
Date: Sun, 2 Dec 2018 20:08:40 +0000
Subject: [PATCH 14/93] Add documentation for ACL transfer via davs

---
 getssl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 2c7d4a8..70878d7 100755
--- a/getssl
+++ b/getssl
@@ -1313,10 +1313,13 @@ write_domain_template() { # write out a template file for a domain.
 	# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
 	# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
 	# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
+        # You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
+        # password, host, port (explicitly needed even if using default port 443) and path on the server.
 	#ACL=('/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:sshuserid@server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
-	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge')
+	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge'
+        #      'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
 
 	#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
 	#USE_SINGLE_ACL="false"

From 3a379ecebb875e37f73318768db6227d068b5cf7 Mon Sep 17 00:00:00 2001
From: In/Progress <admin@inprogress-bs.net>
Date: Sun, 2 Dec 2018 20:19:46 +0000
Subject: [PATCH 15/93] Update Revision history as contribution guidelines
 suggest

---
 getssl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 70878d7..46764ca 100755
--- a/getssl
+++ b/getssl
@@ -184,10 +184,11 @@
 # 2017-01-30 issue #243 compatibility with bash 3.0 (2.08)
 # 2017-01-30 issue #243 additional compatibility with bash 3.0 (2.09)
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
+# 2018-12-02 allow file transfer using WebDAV over HTTPS (2.11)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.10"
+VERSION="2.11"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096

From 5343070654fdde11d3993a768b0ee4c8104eb120 Mon Sep 17 00:00:00 2001
From: Andy - Serverco <47356093+serverco-a@users.noreply.github.com>
Date: Wed, 20 Mar 2019 18:18:16 +0000
Subject: [PATCH 16/93] Update issue templates

---
 .github/ISSUE_TEMPLATE/bug_report.md      | 28 +++++++++++++++++++++++
 .github/ISSUE_TEMPLATE/feature_request.md | 20 ++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 .github/ISSUE_TEMPLATE/bug_report.md
 create mode 100644 .github/ISSUE_TEMPLATE/feature_request.md

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
new file mode 100644
index 0000000..116d2a5
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -0,0 +1,28 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Operating system (please complete the following information):**
+ - OS: [e.g. Debian 9, Ubuntu 18.04, freeBSD ]
+ - Bash Version [e.g. GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)]
+
+**Additional context**
+Add any other context about the problem here.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.md b/.github/ISSUE_TEMPLATE/feature_request.md
new file mode 100644
index 0000000..425aacb
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.md
@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is.  [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

From d62800b454bd4ddd00804625244c257a5025a745 Mon Sep 17 00:00:00 2001
From: Emily Karisch <e.karisch@pixelart.at>
Date: Wed, 5 Sep 2018 11:20:46 +0200
Subject: [PATCH 17/93] Make a stricter comparison for matching against zone
 names

This adds a dot in front of the fqdn and the zone name, so the
comparison will only check against full DNS parts of the fqdn and the
zone name. This will prevent to match a fqdn against an unrelated zone
name which overlaps with the wanted zone in the naming.

Fixes #398
---
 dns_scripts/dns_route53.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dns_scripts/dns_route53.py b/dns_scripts/dns_route53.py
index 8805269..a972dfa 100755
--- a/dns_scripts/dns_route53.py
+++ b/dns_scripts/dns_route53.py
@@ -32,7 +32,7 @@ for zone in response['HostedZones']:
         zone_list[zone['Name']] = zone['Id']
 
 for key in sorted(zone_list.iterkeys(), key=len, reverse=True):
-    if key in "{z}.".format(z=fqdn):
+    if ".{z}".format(z=key) in ".{z}.".format(z=fqdn):
        zone_id = zone_list[key]
 
 if zone_id == "":
@@ -84,4 +84,4 @@ if action == 'UPSERT':
             print("Didn't find {f} entry yet, sleeping... ({w}s)".format(f=challenge_fqdn,
                                                                          w=waiting))
             time.sleep(10)
-            pass
\ No newline at end of file
+            pass

From a31e4fafd94b240324898348e3e7f898b62e1db2 Mon Sep 17 00:00:00 2001
From: Emily Karisch <e.karisch@pixelart.at>
Date: Mon, 30 Sep 2019 14:54:34 +0200
Subject: [PATCH 18/93] Use HTTP 1.1 as workaround atm

Fixes #423
---
 getssl | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 7f3713e..45a3a8e 100755
--- a/getssl
+++ b/getssl
@@ -184,10 +184,11 @@
 # 2017-01-30 issue #243 compatibility with bash 3.0 (2.08)
 # 2017-01-30 issue #243 additional compatibility with bash 3.0 (2.09)
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
+# 2017-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.10"
+VERSION="2.11"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -1135,7 +1136,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
 
   CURL_HEADER="$TEMP_DIR/curl.header"
   dp="$TEMP_DIR/curl.dump"
-  CURL="curl --silent --dump-header $CURL_HEADER "
+  CURL="curl --http1.1 --silent --dump-header $CURL_HEADER "
   if [[ ${_USE_DEBUG} -eq 1 ]]; then
     CURL="$CURL --trace-ascii $dp "
   fi

From 3f0b749e2b5a67b00312ad4fd91cbfbeba38d355 Mon Sep 17 00:00:00 2001
From: Emily Karisch <e.karisch@pixelart.at>
Date: Tue, 1 Oct 2019 13:22:09 +0200
Subject: [PATCH 19/93] Check curl version if it supports the --http1.1 flag

Co-authored-by: Robert Eden <rmeden@yahoo.com>
---
 getssl | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 45a3a8e..1a42c78 100755
--- a/getssl
+++ b/getssl
@@ -1136,7 +1136,14 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
 
   CURL_HEADER="$TEMP_DIR/curl.header"
   dp="$TEMP_DIR/curl.dump"
-  CURL="curl --http1.1 --silent --dump-header $CURL_HEADER "
+
+  CURL="curl "
+  if [[ "$($CURL -V | head -1 | cut -d' ' -f2 )" > "7.33" ]]; then
+    CURL="$CURL --http1.1 "
+  fi
+
+  CURL="$CURL --silent --dump-header $CURL_HEADER "
+
   if [[ ${_USE_DEBUG} -eq 1 ]]; then
     CURL="$CURL --trace-ascii $dp "
   fi

From 4e7e13ca6c42984af2475d164f211a5cc271d606 Mon Sep 17 00:00:00 2001
From: Robbie Mckennie <rob.t.mckennie@gmail.com>
Date: Wed, 2 Oct 2019 21:19:02 +1300
Subject: [PATCH 20/93] Nsupdate one-liner (#393)

Pipe the commands to nsupdate
---
 dns_scripts/dns_add_nsupdate | 8 +-------
 dns_scripts/dns_del_nsupdate | 8 +-------
 2 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 9e8ebfe..891614e 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -7,10 +7,4 @@ dnskeyfile="path/to/bla.key"
 fulldomain="$1"
 token="$2"
 
-updatefile=$(mktemp)
-
-printf "update add _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" > "${updatefile}"
-
-nsupdate -k "${dnskeyfile}" -v "${updatefile}"
-
-rm -f "${updatefile}"
+printf "update add _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" | nsupdate -k "${dnskeyfile}" -v
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index 62291b7..808b21c 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -6,10 +6,4 @@ dnskeyfile="path/to/bla.key"
 fulldomain="$1"
 token="$2"
 
-updatefile=$(mktemp)
-
-printf "update delete _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" > "${updatefile}"
-
-nsupdate -k "${dnskeyfile}" -v "${updatefile}"
-
-rm -f "${updatefile}"
+printf "update delete _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" | nsupdate -k "${dnskeyfile}" -v

From 867ae36e962beca8a2e83a622822e6d431a8550f Mon Sep 17 00:00:00 2001
From: Emily Karisch <e.karisch@pixelart.at>
Date: Wed, 2 Oct 2019 10:56:42 +0200
Subject: [PATCH 21/93] Fix changelog date

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index d415ddf..2269070 100755
--- a/getssl
+++ b/getssl
@@ -184,7 +184,7 @@
 # 2017-01-30 issue #243 compatibility with bash 3.0 (2.08)
 # 2017-01-30 issue #243 additional compatibility with bash 3.0 (2.09)
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
-# 2017-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
+# 2019-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}

From 70f5443a163ca7224399efeaf760e7c53c388233 Mon Sep 17 00:00:00 2001
From: Emily Karisch <e.karisch@pixelart.at>
Date: Wed, 2 Oct 2019 10:51:25 +0200
Subject: [PATCH 22/93] Case insensitive processing of agreement url because of
 HTTP/2

Fixes #425
---
 getssl | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 2269070..274fe6a 100755
--- a/getssl
+++ b/getssl
@@ -185,10 +185,11 @@
 # 2017-01-30 issue #243 additional compatibility with bash 3.0 (2.09)
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
 # 2019-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
+# 2019-10-02 issue #425 Case insensitive processing of agreement url because of HTTP/2 (2.12)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.11"
+VERSION="2.12"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -1483,7 +1484,7 @@ if [[ $_REVOKE -eq 1 ]]; then
 fi
 
 # get latest agreement from CA (as default)
-AGREEMENT=$(curl -I "${CA}/terms" 2>/dev/null | awk '$1 ~ "Location:" {print $2}'|tr -d '\r')
+AGREEMENT=$(curl -I "${CA}/terms" 2>/dev/null | awk 'tolower($1) ~ "location:" {print $2}'|tr -d '\r')
 
 # if nothing in command line, print help and exit.
 if [[ -z "$DOMAIN" ]] && [[ ${_CHECK_ALL} -ne 1 ]]; then

From 358244c9e945ad3ecbcce1e29062023ba0a00c49 Mon Sep 17 00:00:00 2001
From: "Paul B. Henson" <henson@acm.org>
Date: Wed, 5 Dec 2018 16:08:14 -0800
Subject: [PATCH 23/93] Allow dns checks to deal with CNAME records

Some environments might delegate dns validation to a subzone by using CNAME records. These changes allow getssl to validate dns updates when the verification name is a CNAME to the TXT record rather than a TXT record itself.
---
 getssl | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/getssl b/getssl
index 274fe6a..5549200 100755
--- a/getssl
+++ b/getssl
@@ -186,10 +186,11 @@
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
 # 2019-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
 # 2019-10-02 issue #425 Case insensitive processing of agreement url because of HTTP/2 (2.12)
+# 2019-10-07 update DNS checks to allow use of CNAMEs (2.13)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.12"
+VERSION="2.13"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -1990,13 +1991,13 @@ if [[ $VALIDATE_VIA_DNS == "true" ]]; then
                            | grep '"'|awk -F'"' '{ print $2}')
           elif [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
             check_result=$($DNS_CHECK_FUNC TXT "_acme-challenge.${d}" "@${ns}" \
-                           | grep ^_acme|awk -F'"' '{ print $2}')
+                           | grep '300 IN TXT'|awk -F'"' '{ print $2}')
           elif [[ "$DNS_CHECK_FUNC" == "host" ]]; then
             check_result=$($DNS_CHECK_FUNC -t TXT "_acme-challenge.${d}" "${ns}" \
-                           | grep ^_acme|awk -F'"' '{ print $2}')
+                           | grep 'descriptive text'|awk -F'"' '{ print $2}')
           else
             check_result=$(nslookup -type=txt "_acme-challenge.${d}" "${ns}" \
-                           | grep ^_acme|awk -F'"' '{ print $2}')
+                           | grep 'text ='|awk -F'"' '{ print $2}')
           fi
           debug "expecting  $auth_key"
           debug "${ns} gave ... $check_result"

From 394a350496e33f1591e8f9c649d7f8783c554bd2 Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Thu, 4 Jan 2018 07:08:35 +0000
Subject: [PATCH 24/93] draft version to work with APIv2

---
 getssl | 587 ++++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 455 insertions(+), 132 deletions(-)

diff --git a/getssl b/getssl
index f5bf77e..e0235a4 100755
--- a/getssl
+++ b/getssl
@@ -184,6 +184,7 @@
 # 2017-01-30 issue #243 compatibility with bash 3.0 (2.08)
 # 2017-01-30 issue #243 additional compatibility with bash 3.0 (2.09)
 # 2017-02-18 add OCSP Must-Staple to the domain csr generation (2.10)
+# 2018-01-04 updating to use the updated letsencrypt APIv2
 # 2019-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
 # 2019-10-02 issue #425 Case insensitive processing of agreement url because of HTTP/2 (2.12)
 # 2019-10-07 update DNS checks to allow use of CNAMEs (2.13)
@@ -241,6 +242,7 @@ _UPGRADE_CHECK=1
 _USE_DEBUG=0
 config_errors="false"
 LANG=C
+API=1
 
 # store copy of original command in case of upgrading script and re-running
 ORIGCMD="$0 $*"
@@ -278,8 +280,14 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
   send_signed_request "$uri" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
 
   # check response from our request to perform challenge
-  if [[ ! -z "$code" ]] && [[ ! "$code" == '202' ]] ; then
-    error_exit "$domain:Challenge error: $code"
+  if [[ $API -eq 1 ]]; then
+    if [[ ! -z "$code" ]] && [[ ! "$code" == '202' ]] ; then
+      error_exit "$domain:Challenge error: $code"
+    fi
+  else # APIv2
+    if [[ ! -z "$code" ]] && [[ ! "$code" == '200' ]] ; then
+      error_exit "$domain:Challenge error: $code"
+    fi
   fi
 
   # loop "forever" to keep checking for a response from the ACME server.
@@ -807,36 +815,45 @@ get_certificate() { # get certificate for csr, if all domains validated.
 
   der=$(openssl req -in "$gc_csr" -outform DER | urlbase64)
   debug "der $der"
-  send_signed_request "$URL_new_cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
-
-  # convert certificate information into correct format and save to file.
-  CertData=$(awk ' $1 ~ "^Location" {print $2}' "$CURL_HEADER" |tr -d '\r')
-  debug "certdata location = $CertData"
-  if [[ "$CertData" ]] ; then
-    echo -----BEGIN CERTIFICATE----- > "$gc_certfile"
-    curl --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
-    echo -----END CERTIFICATE-----  >> "$gc_certfile"
-    info "Certificate saved in $CERT_FILE"
-  fi
+  if [[ $API -eq 1 ]]; then
+    send_signed_request "$URL_new_cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
+    # convert certificate information into correct format and save to file.
+    CertData=$(awk ' $1 ~ "^Location" {print $2}' "$CURL_HEADER" |tr -d '\r')
+    debug "certdata location = $CertData"
+    if [[ "$CertData" ]] ; then
+      echo -----BEGIN CERTIFICATE----- > "$gc_certfile"
+      curl --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
+      echo -----END CERTIFICATE-----  >> "$gc_certfile"
+      info "Certificate saved in $CERT_FILE"
+    fi
 
-  # If certificate wasn't a valid certificate, error exit.
-  if [[ -z "$CertData" ]] ; then
-    response2=$(echo "$response" | fold -w64 |openssl base64 -d)
-    debug "response was $response"
-    error_exit "Sign failed: $(echo "$response2" | grep "detail")"
-  fi
+    # If certificate wasn't a valid certificate, error exit.
+    if [[ -z "$CertData" ]] ; then
+      response2=$(echo "$response" | fold -w64 |openssl base64 -d)
+      debug "response was $response"
+      error_exit "Sign failed: $(echo "$response2" | grep "detail")"
+    fi
 
-  # get a copy of the CA certificate.
-  IssuerData=$(grep -i '^Link' "$CURL_HEADER" \
-               | cut -d " " -f 2\
-               | cut -d ';' -f 1 \
-               | sed 's/<//g' \
-               | sed 's/>//g')
-  if [[ "$IssuerData" ]] ; then
-    echo -----BEGIN CERTIFICATE----- > "$gc_cafile"
-    curl --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
-    echo -----END CERTIFICATE-----  >> "$gc_cafile"
-    info "The intermediate CA cert is in $gc_cafile"
+    # get a copy of the CA certificate.
+    IssuerData=$(grep -i '^Link' "$CURL_HEADER" \
+                | cut -d " " -f 2\
+                | cut -d ';' -f 1 \
+                | sed 's/<//g' \
+                | sed 's/>//g')
+    if [[ "$IssuerData" ]] ; then
+      echo -----BEGIN CERTIFICATE----- > "$gc_cafile"
+      curl --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
+      echo -----END CERTIFICATE-----  >> "$gc_cafile"
+      info "The intermediate CA cert is in $gc_cafile"
+    fi
+  else # APIv2
+    send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
+    debug "order link was $OrderLink"
+    cd=$(curl --silent $OrderLink)
+    CertData=$(json_get "$cd" "certificate")
+    debug "CertData is at $CertData"
+    curl --silent "$CertData" > "$CERT_FILE"
+    info "Certificate saved in $CERT_FILE"
   fi
 }
 
@@ -966,28 +983,206 @@ info() { # write out info as long as the quiet flag has not been set.
   fi
 }
 
-json_get() { # get the value corresponding to $2 in the JSON passed as $1.
-  # remove newlines, so it's a single chunk of JSON
-  json_data=$( echo "$1" | tr '\n' ' ')
-  # if $3 is defined, this is the section which the item is in.
-  if [[ ! -z "$3" ]]; then
-    jg_section=$(echo "$json_data" | awk -F"[}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${3}"'\"/){print $i}}}')
-    if [[ "$2" == "uri" ]]; then
-      jg_subsect=$(echo "$jg_section" | awk -F"[,]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i)}}}')
-      jg_result=$(echo "$jg_subsect" | awk -F'"' '{print $4}')
+json_awk() {
+echo $1 | awk '
+{
+  tokenize($0) # while(get_token()) {print TOKEN}
+  if (0 == parse()) {
+    apply(JPATHS, NJPATHS)
+  }
+}
+
+function apply (ary,size,i) {
+  for (i=1; i<size; i++)
+    print ary[i]
+}
+
+function get_token() {
+  TOKEN = TOKENS[++ITOKENS] # for internal tokenize()
+  return ITOKENS < NTOKENS
+}
+
+function parse_array(a1,idx,ary,ret) {
+  idx=0
+  ary=""
+  get_token()
+  if (TOKEN != "]") {
+    while (1) {
+      if (ret = parse_value(a1, idx)) {
+        return ret
+      }
+      idx=idx+1
+      ary=ary VALUE
+      get_token()
+      if (TOKEN == "]") {
+        break
+      } else if (TOKEN == ",") {
+        ary = ary ","
+      } else {
+        report(", or ]", TOKEN ? TOKEN : "EOF")
+        return 2
+      }
+      get_token()
+    }
+  }
+  VALUE=""
+  return 0
+}
+
+function parse_object(a1,key,obj) {
+  obj=""
+  get_token()
+  if (TOKEN != "}") {
+    while (1) {
+      if (TOKEN ~ /^".*"$/) {
+        key=TOKEN
+      } else {
+        report("string", TOKEN ? TOKEN : "EOF")
+        return 3
+      }
+      get_token()
+      if (TOKEN != ":") {
+        report(":", TOKEN ? TOKEN : "EOF")
+        return 4
+      }
+      get_token()
+      if (parse_value(a1, key)) {
+        return 5
+      }
+      obj=obj key ":" VALUE
+      get_token()
+      if (TOKEN == "}") {
+        break
+      } else if (TOKEN == ",") {
+        obj=obj ","
+      } else {
+        report(", or }", TOKEN ? TOKEN : "EOF")
+        return 6
+      }
+      get_token()
+    }
+  }
+  VALUE=""
+  return 0
+}
+
+
+function parse_value(a1, a2,   jpath,ret,x) {
+  jpath=(a1!="" ? a1 "," : "") a2 # "${1:+$1,}$2"
+  if (TOKEN == "{") {
+    if (parse_object(jpath)) {
+      return 7
+    }
+  } else if (TOKEN == "[") {
+    if (ret = parse_array(jpath)) {
+      return ret
+    }
+  } else if (TOKEN == "") { #test case 20150410 #4
+    report("value", "EOF")
+    return 9
+  } else if (TOKEN ~ /^([^0-9])$/) {
+    # At this point, the only valid single-character tokens are digits.
+    report("value", TOKEN)
+    return 9
+  } else {
+    VALUE=TOKEN
+  }
+  if (! ("" == jpath || "" == VALUE)) {
+    x=sprintf("[%s]\t%s", jpath, VALUE)
+    print x
+  }
+  return 0
+}
+
+function parse(   ret) {
+  get_token()
+  if (ret = parse_value()) {
+    return ret
+  }
+  if (get_token()) {
+    report("EOF", TOKEN)
+    return 11
+  }
+  return 0
+}
+
+function report(expected, got,   i,from,to,context) {
+  from = ITOKENS - 10; if (from < 1) from = 1
+  to = ITOKENS + 10; if (to > NTOKENS) to = NTOKENS
+  for (i = from; i < ITOKENS; i++)
+    context = context sprintf("%s ", TOKENS[i])
+  context = context "<<" got ">> "
+  for (i = ITOKENS + 1; i <= to; i++)
+    context = context sprintf("%s ", TOKENS[i])
+  scream("json_awk expected <" expected "> but got <" got "> at input token " ITOKENS "\n" context)
+}
+
+function reset() {
+  TOKEN=""; delete TOKENS; NTOKENS=ITOKENS=0
+  delete JPATHS; NJPATHS=0
+  VALUE=""
+}
+
+function scream(msg) {
+  FAILS[FILENAME] = FAILS[FILENAME] (FAILS[FILENAME]!="" ? "\n" : "") msg
+  msg = FILENAME ": " msg
+  print msg >"/dev/stderr"
+}
+
+function tokenize(a1,pq,pb,ESCAPE,CHAR,STRING,NUMBER,KEYWORD,SPACE) {
+  SPACE="[[:space:]]+"
+  gsub(/\"[^[:cntrl:]\"\\]*((\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})[^[:cntrl:]\"\\]*)*\"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[[:space:]]+|./, "\n&", a1)
+  gsub("\n" SPACE, "\n", a1)
+  sub(/^\n/, "", a1)
+  ITOKENS=0 # get_token() helper
+  return NTOKENS = split(a1, TOKENS, /\n/)
+}'
+}
+
+json_get() { # get values from json
+  if [[ -z "$1" ]] || [[ "$1" == "null" ]]; then
+    echo "json was blank"
+    return
+  fi
+  if [[ $API = 1 ]]; then
+    # remove newlines, so it's a single chunk of JSON
+    json_data=$( echo "$1" | tr '\n' ' ')
+    # if $3 is defined, this is the section which the item is in.
+    if [[ ! -z "$3" ]]; then
+      jg_section=$(echo "$json_data" | awk -F"[}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${3}"'\"/){print $i}}}')
+      if [[ "$2" == "uri" ]]; then
+        jg_subsect=$(echo "$jg_section" | awk -F"[,]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i)}}}')
+        jg_result=$(echo "$jg_subsect" | awk -F'"' '{print $4}')
+      else
+        jg_result=$(echo "$jg_section" | awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+      fi
     else
-      jg_result=$(echo "$jg_section" | awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+      jg_result=$(echo "$json_data" |awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+    fi
+    # check number of quotes
+    jg_q=${jg_result//[^\"]/}
+    # if 2 quotes, assume it's a quoted variable and just return the data within the quotes.
+    if [[ ${#jg_q} -eq 2 ]]; then
+      echo "$jg_result" | awk -F'"' '{print $2}'
+    else
+      echo "$jg_result"
     fi
   else
-    jg_result=$(echo "$json_data" |awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
-  fi
-  # check number of quotes
-  jg_q=${jg_result//[^\"]/}
-  # if 2 quotes, assume it's a quoted variable and just return the data within the quotes.
-  if [[ ${#jg_q} -eq 2 ]]; then
-    echo "$jg_result" | awk -F'"' '{print $2}'
-  else
-    echo "$jg_result"
+    if [[ ! -z "$6" ]]; then
+      full=$(json_awk "$1")
+      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
+      echo "$full" | grep "^..${5}\",$section" | awk '{print $2}' | tr -d '"'
+    elif [[ ! -z "$5" ]]; then
+      full=$(json_awk "$1")
+      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
+      echo "$full" | grep "^..${2}\",$section" | grep "$5" | awk '{print $2}' | tr -d '"'
+    elif [[ ! -z "$3" ]]; then
+      json_awk "$1" | grep "^..${2}...${3}" | awk '{print $2}' | tr -d '"'
+    elif [[ ! -z "$2" ]]; then
+      json_awk "$1" | grep "^..${2}" | awk '{print $2}' | tr -d '"'
+    else
+      json_awk "$1"
+    fi
   fi
 }
 
@@ -1134,7 +1329,6 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
   needbase64=$3
 
   debug url "$url"
-  debug payload "$payload"
 
   CURL_HEADER="$TEMP_DIR/curl.header"
   dp="$TEMP_DIR/curl.dump"
@@ -1152,57 +1346,100 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
 
   # convert payload to url base 64
   payload64="$(printf '%s' "${payload}" | urlbase64)"
-  debug payload64 "$payload64"
 
   # get nonce from ACME server
-  nonceurl="$CA/directory"
-  nonce=$($CURL -I $nonceurl | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
-
-  debug nonce "$nonce"
-
-  # Build header with just our public key and algorithm information
-  header='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"'}'
-
-  # Build another header which also contains the previously received nonce and encode it as urlbase64
-  protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
-  protected64="$(printf '%s' "${protected}" | urlbase64)"
-  debug protected "$protected"
-
-  # Sign header with nonce and our payload with our private key and encode signature as urlbase64
-  sign_string "$(printf '%s' "${protected64}.${payload64}")"  "${ACCOUNT_KEY}" "$signalg"
-
-  # Send header + extended header + payload + signature to the acme-server
-  body="{\"header\": ${header},"
-  body="${body}\"protected\": \"${protected64}\","
-  body="${body}\"payload\": \"${payload64}\","
-  body="${body}\"signature\": \"${signed64}\"}"
-  debug "header, payload and signature = $body"
-
-  code="500"
-  loop_limit=5
-  while [[ "$code" -eq 500 ]]; do
-    if [[ "$needbase64" ]] ; then
-      response=$($CURL -X POST --data "$body" "$url" | urlbase64)
+  if [[ $API -eq 1 ]]; then
+    nonceurl="$CA/directory"
+    nonce=$($CURL -I $nonceurl | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
+  else # APIv2
+    nonce=$($CURL -I "$URL_newNonce" | grep "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
+  fi
+
+  nonceproblem="true"
+  while [[ "$nonceproblem" == "true" ]]; do
+
+    debug nonce "$nonce"
+
+    # Build header with just our public key and algorithm information
+    header='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"'}'
+
+    # Build another header which also contains the previously received nonce and encode it as urlbase64
+    if [[ $API -eq 1 ]]; then
+    protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
+    protected64="$(printf '%s' "${protected}" | urlbase64)"
+    else # APIv2
+      if [[ -z "$KID" ]]; then
+        debug "KID is blank, so using jwk"
+        protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
+        protected64="$(printf '%s' "${protected}" | urlbase64)"
+      else
+        debug "using KID=${KID}"
+        protected="{\"alg\": \"$jwkalg\", \"kid\": \"$KID\",\"nonce\": \"${nonce}\", \"url\": \"${url}\"}"
+        debug "protected = $protected"
+        protected64="$(printf '%s' "${protected}" | urlbase64)"
+      fi
+    fi
+
+    # Sign header with nonce and our payload with our private key and encode signature as urlbase64
+    sign_string "$(printf '%s' "${protected64}.${payload64}")"  "${ACCOUNT_KEY}" "$signalg"
+
+    # Send header + extended header + payload + signature to the acme-server
+    if [[ $API -eq 1 ]]; then
+      debug "header = $header"
+      debug "protected = $protected"
+      debug "payload = $payload"
+      body="{\"header\": ${header},"
+      body="${body}\"protected\": \"${protected64}\","
+      body="${body}\"payload\": \"${payload64}\","
+      body="${body}\"signature\": \"${signed64}\"}"
+      debug "header, payload and signature = $body"
     else
-      response=$($CURL -X POST --data "$body" "$url")
+      debug "protected = $protected"
+      debug "payload = $payload"
+      body="{"
+      body="${body}\"protected\": \"${protected64}\","
+      body="${body}\"payload\": \"${payload64}\","
+      body="${body}\"signature\": \"${signed64}\"}"
+      debug "header, payload and signature = $body"
     fi
+  
+    code="500"
+    loop_limit=5
+    while [[ "$code" -eq 500 ]]; do
+      if [[ "$needbase64" ]] ; then
+        response=$($CURL -X POST --data "$body" "$url" | urlbase64)
+      else
+        response=$($CURL -X POST --data "$body" "$url")
+      fi
 
-    responseHeaders=$(cat "$CURL_HEADER")
-    debug responseHeaders "$responseHeaders"
-    debug response  "$response"
-    code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
-    debug code "$code"
-    response_status=$(json_get "$response" status \
-                      | head -1| awk -F'"' '{print $2}')
-    debug "response status = $response_status"
-
-    if [[ "$code" -eq 500 ]]; then
-      info "error on acme server - trying again ...."
-      sleep 2
-      loop_limit=$((loop_limit - 1))
-      if [[ $loop_limit -lt 1 ]]; then
-        error_exit "500 error from ACME server:  $response"
+      responseHeaders=$(cat "$CURL_HEADER")
+      debug responseHeaders "$responseHeaders"
+      debug response  "$response"
+      code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
+      debug code "$code"
+      if [[ $API -eq 1 ]]; then
+        response_status=$(json_get "$response" status \
+                        | head -1| awk -F'"' '{print $2}')
+      else # APIv2
+        response_status=$(json_get "$response" status)
       fi
+      debug "response status = $response_status"
+      if [[ "$code" -eq 500 ]]; then
+        info "error on acme server - trying again ...."
+        debug "loop_limit = $loop_limit"
+        sleep 5
+        loop_limit=$((loop_limit - 1))
+        if [[ $loop_limit -lt 1 ]]; then
+          error_exit "500 error from ACME server:  $response"
+        fi
+      fi
+    done
+    if [[ $response == *"error:badNonce"* ]]; then
+      debug "bad nonce"
+      nonce=$(echo "$responseHeaders" | grep "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
+      debug "trying new nonce $nonce"
+    else
+      nonceproblem="false"
     fi
   done
 }
@@ -1319,11 +1556,11 @@ write_domain_template() { # write out a template file for a domain.
 
 	# Location for all your certs, these can either be on the server (full path name)
 	# or using ssh /sftp as for the ACL
-	#DOMAIN_CERT_LOCATION="/etc/ssl/${DOMAIN}.crt"
-	#DOMAIN_KEY_LOCATION="/etc/ssl/${DOMAIN}.key"
-	#CA_CERT_LOCATION="/etc/ssl/chain.crt"
+	#DOMAIN_CERT_LOCATION="/etc/ssl/${DOMAIN}.crt" # this is domain cert
+	#DOMAIN_KEY_LOCATION="/etc/ssl/${DOMAIN}.key" # this is domain key
+	#CA_CERT_LOCATION="/etc/ssl/chain.crt" # this is CA cert
 	#DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
-	#DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+	#DOMAIN_PEM_LOCATION="" # this is the domain key, domain cert and CA cert
 
 	# The command needed to reload apache / nginx or whatever you use
 	#RELOAD_CMD=""
@@ -1630,11 +1867,31 @@ if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
   info "${DOMAIN}: forcing renewal (due to FORCE_RENEWAL file)"
 fi
 
+echo "testing with API1"
 # Obtain CA resource locations
-ca_all_loc=$(curl "${CA}/directory" 2>/dev/null)
-URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
-URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
-URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
+if [[ $API -eq 1 ]]; then
+  ca_all_loc=$(curl "${CA}/directory" 2>/dev/null)
+  debug "ca_all_loc from ${CA}/dir gives $ca_all_loc"
+  URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
+  URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
+  URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
+  if [[ -z "$URL_new_reg" ]]; then
+    API=2
+    debug "API=1 failed, setting API=2"
+  fi
+fi
+echo "testing with api2"
+if [[ $API -eq 2 ]]; then
+  ca_all_loc=$(curl "${CA}/dir" 2>/dev/null)
+  debug "ca_all_loc from ${CA}/dir gives $ca_all_loc"
+  URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
+  URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
+  URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
+  if [[ -z "$ca_all_loc" ]]; then
+    debug "unknown API type $API"
+    graceful_exit
+  fi
+fi
 
 # if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
 if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
@@ -1786,23 +2043,40 @@ fi
 # currently the code registers every time, and gets an "already registered" back if it has been.
 get_signing_params "$ACCOUNT_KEY"
 
-if [[ "$ACCOUNT_EMAIL" ]] ; then
-  regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
-else
-  regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
-fi
-
 info "Registering account"
 # send the request to the ACME server.
-send_signed_request   "$URL_new_reg"  "$regjson"
+if [[ $API -eq 1 ]]; then 
+  if [[ "$ACCOUNT_EMAIL" ]] ; then
+	regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
+  else
+	regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
+  fi
+  send_signed_request "$URL_new_reg"  "$regjson"
+elif [[ $API -eq 2 ]]; then
+  if [[ "$ACCOUNT_EMAIL" ]] ; then
+	regjson='{"termsOfServiceAgreed": true, "contact": ["mailto: '$ACCOUNT_EMAIL'"]}'
+  else
+	regjson='{"termsOfServiceAgreed": true}'
+  fi
+  send_signed_request "$URL_newAccount"  "$regjson"
+else
+	debug "cant determine account API"
+	graceful_exit
+fi 
 
 if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
   info "Registered"
+  KID=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  debug "KID=_$KID}_"
   echo "$response" > "$TEMP_DIR/account.json"
 elif [[ "$code" == '409' ]] ; then
   debug "Already registered"
+elif [[ "$code" == '200' ]] ; then
+  KID=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  debug responseHeaders "$responseHeaders"
+  debug "Already registered account, KID=_${KID}_"
 else
-  error_exit "Error registering account ... $(json_get "$response" detail)"
+  error_exit "Error registering account ...$responseHeaders ... $(json_get "$response" detail)"
 fi
 # end of registering account with CA
 
@@ -1811,10 +2085,33 @@ info "Verify each domain"
 
 # loop through domains for cert ( from SANS list)
 if [[ "$IGNORE_DIRECTORY_DOMAIN" == "true" ]]; then
-    alldomains=${SANS//,/ }
+  alldomains=${SANS//,/ }
 else
   alldomains=$(echo "$DOMAIN,$SANS" | sed "s/,/ /g")
 fi
+
+if [[ $API -eq 2 ]]; then
+  dstring="["
+  for d in $alldomains; do
+    dstring="${dstring}{\"type\":\"dns\",\"value\":\"$d\"},"
+  done
+  dstring="${dstring: : -1}]"
+  #new URL_newOrder
+  request="{\"identifiers\": $dstring}"
+  send_signed_request "$URL_newOrder" "$request"
+  OrderLink=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  debug "Order link $OrderLink"
+  FinalizeLink=$(json_get "$response" "finalize")
+  debug "finalise link $FinalizeLink"
+  dn=0
+  for d in $alldomains; do
+    # get authorizations link
+    AuthLink[$dn]=$(json_get "$response" "identifiers" "value" "$d" "authorizations" "x")
+    debug "authorizations link for $d - ${AuthLink[$dn]}"
+    ((dn++))
+  done
+fi
+
 dn=0
 for d in $alldomains; do
   # $d is domain in current loop, which is number $dn for ACL
@@ -1826,13 +2123,17 @@ for d in $alldomains; do
   fi
 
   # request a challenge token from ACME server
-  request="{\"resource\":\"new-authz\",\"identifier\":{\"type\":\"dns\",\"value\":\"$d\"}}"
-  send_signed_request "$URL_new_authz" "$request"
-
-  debug "completed send_signed_request"
-  # check if we got a valid response and token, if not then error exit
-  if [[ ! -z "$code" ]] && [[ ! "$code" == '201' ]] ; then
-    error_exit "new-authz error: $response"
+  if [[ $API -eq 1 ]]; then
+    request="{\"resource\":\"new-authz\",\"identifier\":{\"type\":\"dns\",\"value\":\"$d\"}}"
+    send_signed_request "$URL_new_authz" "$request"
+    debug "completed send_signed_request"
+
+    # check if we got a valid response and token, if not then error exit
+    if [[ ! -z "$code" ]] && [[ ! "$code" == '201' ]] ; then
+      error_exit "new-authz error: $response"
+    fi
+  else
+    response_status=""
   fi
 
   if [[ $response_status == "valid" ]]; then
@@ -1848,13 +2149,24 @@ for d in $alldomains; do
   else
     PREVIOUSLY_VALIDATED="false"
     if [[ $VALIDATE_VIA_DNS == "true" ]]; then # set up the correct DNS token for verification
-      # get the dns component of the ACME response
-      # get the token from the dns component
-      token=$(json_get "$response" "token" "dns-01")
-      debug token "$token"
-      # get the uri from the dns component
-      uri=$(json_get "$response" "uri" "dns-01")
-      debug uri "$uri"
+      if [[ $API -eq 1 ]]; then
+        # get the dns component of the ACME response
+        # get the token from the dns component
+        token=$(json_get "$response" "token" "dns-01")
+        debug token "$token"
+        # get the uri from the dns component
+        uri=$(json_get "$response" "uri" "dns-01")
+        debug uri "$uri"
+      else # APIv2
+        response=$(curl --silent ${AuthLink[$dn]} 2>/dev/null)
+        debug "authlink response = $response"
+        # get the token from the http-01 component
+        token=$(json_get "$response" "challenges" "type" "dns-01" "token")
+        debug token "$token"
+        # get the uri from the http component
+        uri=$(json_get "$response" "challenges" "type" "dns-01" "url")
+        debug uri "$uri"
+      fi
 
       keyauthorization="$token.$thumbprint"
       debug keyauthorization "$keyauthorization"
@@ -1895,12 +2207,23 @@ for d in $alldomains; do
 			_EOF_
 
     else      # set up the correct http token for verification
-      # get the token from the http component
-      token=$(json_get "$response" "token" "http-01")
-      debug token "$token"
-      # get the uri from the http component
-      uri=$(json_get "$response" "uri" "http-01")
-      debug uri "$uri"
+      if [[ $API -eq 1 ]]; then
+        # get the token from the http component
+        token=$(json_get "$response" "token" "http-01")
+        debug token "$token"
+        # get the uri from the http component
+        uri=$(json_get "$response" "uri" "http-01")
+        debug uri "$uri"
+      else # APIv2
+        response=$(curl --silent ${AuthLink[$dn]} 2>/dev/null)
+        debug "authlink response = $response"
+        # get the token from the http-01 component
+        token=$(json_get "$response" "challenges" "type" "http-01" "token")
+        debug token "$token"
+        # get the uri from the http component
+        uri=$(json_get "$response" "challenges" "type" "http-01" "url")
+        debug uri "$uri"
+      fi
 
       #create signed authorization key from token.
       keyauthorization="$token.$thumbprint"

From fb9c8703775e2a1cf549039583e0649a8e51817e Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Thu, 4 Jan 2018 10:42:38 +0000
Subject: [PATCH 25/93] updateing getssl for APIv2

---
 getssl | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/getssl b/getssl
index e0235a4..1fa8be0 100755
--- a/getssl
+++ b/getssl
@@ -849,7 +849,7 @@ get_certificate() { # get certificate for csr, if all domains validated.
   else # APIv2
     send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
     debug "order link was $OrderLink"
-    cd=$(curl --silent $OrderLink)
+    cd=$(curl --silent "$OrderLink")
     CertData=$(json_get "$cd" "certificate")
     debug "CertData is at $CertData"
     curl --silent "$CertData" > "$CERT_FILE"
@@ -983,7 +983,8 @@ info() { # write out info as long as the quiet flag has not been set.
   fi
 }
 
-json_awk() {
+json_awk() { # AWK json converter used for API2 - needs tidying up ;)
+# shellcheck disable=SC2086
 echo $1 | awk '
 {
   tokenize($0) # while(get_token()) {print TOKEN}
@@ -1421,7 +1422,12 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
         response_status=$(json_get "$response" status \
                         | head -1| awk -F'"' '{print $2}')
       else # APIv2
-        response_status=$(json_get "$response" status)
+        if [[ ${response##*()} == "{"* ]]; then
+          response_status=$(json_get "$response" status)
+        else
+          debug "response not in json format"
+          debug "$response"
+        fi
       fi
       debug "response status = $response_status"
       if [[ "$code" -eq 500 ]]; then
@@ -2158,7 +2164,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "dns-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --silent ${AuthLink[$dn]} 2>/dev/null)
+        response=$(curl --silent "${AuthLink[$dn]}" 2>/dev/null)
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "dns-01" "token")
@@ -2215,7 +2221,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "http-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --silent ${AuthLink[$dn]} 2>/dev/null)
+        response=$(curl --silent "${AuthLink[$dn]}" 2>/dev/null)
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "http-01" "token")

From 034ce548504a317e4c4f0ef6ccf854658a2ebc4d Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Thu, 4 Jan 2018 11:30:33 +0000
Subject: [PATCH 26/93] modifying debugs

---
 getssl | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/getssl b/getssl
index 1fa8be0..57e9296 100755
--- a/getssl
+++ b/getssl
@@ -1873,7 +1873,6 @@ if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
   info "${DOMAIN}: forcing renewal (due to FORCE_RENEWAL file)"
 fi
 
-echo "testing with API1"
 # Obtain CA resource locations
 if [[ $API -eq 1 ]]; then
   ca_all_loc=$(curl "${CA}/directory" 2>/dev/null)
@@ -1886,7 +1885,6 @@ if [[ $API -eq 1 ]]; then
     debug "API=1 failed, setting API=2"
   fi
 fi
-echo "testing with api2"
 if [[ $API -eq 2 ]]; then
   ca_all_loc=$(curl "${CA}/dir" 2>/dev/null)
   debug "ca_all_loc from ${CA}/dir gives $ca_all_loc"
@@ -1894,7 +1892,7 @@ if [[ $API -eq 2 ]]; then
   URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
   URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
   if [[ -z "$ca_all_loc" ]]; then
-    debug "unknown API type $API"
+    debug "unknown API type"
     graceful_exit
   fi
 fi

From 692920eec75e80ae3215caf05fcf5100cfb61a9e Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Fri, 5 Jan 2018 08:56:18 +0000
Subject: [PATCH 27/93] completed initial testing on
 acme-staging-v02.api.letsencrypt.org

---
 getssl | 51 ++++++++++++++++++++++++++++++++-------------------
 1 file changed, 32 insertions(+), 19 deletions(-)

diff --git a/getssl b/getssl
index 57e9296..2ac3fc7 100755
--- a/getssl
+++ b/getssl
@@ -1353,7 +1353,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     nonceurl="$CA/directory"
     nonce=$($CURL -I $nonceurl | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
   else # APIv2
-    nonce=$($CURL -I "$URL_newNonce" | grep "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
+    nonce=$($CURL -I "$URL_newNonce" | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
   fi
 
   nonceproblem="true"
@@ -1874,27 +1874,36 @@ if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
 fi
 
 # Obtain CA resource locations
-if [[ $API -eq 1 ]]; then
+ca_all_loc=$(curl "${CA}" 2>/dev/null)
+debug "ca_all_loc from ${CA} gives $ca_all_loc"
+# APIv1
+URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
+URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
+URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
+#API v2
+URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
+URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
+URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
+if [[ -z "$URL_new_reg" ]]  && [[ -z "$URL_newAccount" ]]; then
   ca_all_loc=$(curl "${CA}/directory" 2>/dev/null)
-  debug "ca_all_loc from ${CA}/dir gives $ca_all_loc"
+  debug "ca_all_loc from ${CA}/directory gives $ca_all_loc"
+  # APIv1
   URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
   URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
   URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
-  if [[ -z "$URL_new_reg" ]]; then
-    API=2
-    debug "API=1 failed, setting API=2"
-  fi
-fi
-if [[ $API -eq 2 ]]; then
-  ca_all_loc=$(curl "${CA}/dir" 2>/dev/null)
-  debug "ca_all_loc from ${CA}/dir gives $ca_all_loc"
+  #API v2
   URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
   URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
   URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
-  if [[ -z "$ca_all_loc" ]]; then
-    debug "unknown API type"
-    graceful_exit
-  fi
+fi
+
+if [[ ! -z "$URL_new_reg" ]]; then
+  API=1
+elif [[ ! -z "$URL_newAccount" ]]; then
+  API=2
+else
+  info "unknown API version"
+  graceful_exit
 fi
 
 # if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
@@ -2074,11 +2083,13 @@ if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
   debug "KID=_$KID}_"
   echo "$response" > "$TEMP_DIR/account.json"
 elif [[ "$code" == '409' ]] ; then
-  debug "Already registered"
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
+  debug responseHeaders "$responseHeaders"
+  debug "Already registered KID=$KID"
 elif [[ "$code" == '200' ]] ; then
-  KID=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
   debug responseHeaders "$responseHeaders"
-  debug "Already registered account, KID=_${KID}_"
+  debug "Already registered account, KID=${KID}"
 else
   error_exit "Error registering account ...$responseHeaders ... $(json_get "$response" detail)"
 fi
@@ -2100,7 +2111,9 @@ if [[ $API -eq 2 ]]; then
     dstring="${dstring}{\"type\":\"dns\",\"value\":\"$d\"},"
   done
   dstring="${dstring: : -1}]"
-  #new URL_newOrder
+  # request NewOrder currently seems to ignore the dates ....
+  #  dstring="${dstring},\"notBefore\": \"$(date -d "-1 hour" --utc +%FT%TZ)\""
+  #  dstring="${dstring},\"notAfter\": \"$(date -d "2 days" --utc +%FT%TZ)\""
   request="{\"identifiers\": $dstring}"
   send_signed_request "$URL_newOrder" "$request"
   OrderLink=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')

From a1b322fdec949a2a794059584654418b043ef855 Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Fri, 5 Jan 2018 09:16:03 +0000
Subject: [PATCH 28/93] adding Torsten's joker.com API

---
 dns_scripts/dns_add_joker    | 44 ++++++++++++++++++++++++++++++++++++
 dns_scripts/dns_add_nsupdate | 11 +++++++--
 dns_scripts/dns_del_joker    | 44 ++++++++++++++++++++++++++++++++++++
 dns_scripts/dns_del_nsupdate | 11 ++++++++-
 4 files changed, 107 insertions(+), 3 deletions(-)
 create mode 100644 dns_scripts/dns_add_joker
 create mode 100644 dns_scripts/dns_del_joker

diff --git a/dns_scripts/dns_add_joker b/dns_scripts/dns_add_joker
new file mode 100644
index 0000000..c345a52
--- /dev/null
+++ b/dns_scripts/dns_add_joker
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+FULLDOMAIN=$1
+TOKEN=$2
+TMPFILE=$(mktemp /tmp/dns_add_joker.XXXXXXX)
+
+USERNAME="youruser"
+PASSWORD="yourpassword"
+
+# Verify that required parameters are set
+if [[ -z "${FULLDOMAIN}" ]]; then
+  echo "DNS script requires full domain name as first parameter"
+  exit 1
+fi
+
+if [[ -z "${TOKEN}" ]]; then
+  echo "DNS script requires challenge token as second parameter"
+  exit 1
+fi
+
+DOMAIN_ROOT=$(echo "${FULLDOMAIN}" | awk -F\. '{print $(NF-1) FS $NF}')
+
+SID=$(curl --silent -X POST https://dmapi.joker.com/request/login \
+	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
+	-H "application/x-www-form-urlencoded" -d "username=${USERNAME}&password=${PASSWORD}" \
+	-i -k 2>/dev/null | grep Auth-Sid | awk '{ print $2 }')
+
+## put zone data in tempfile
+curl --silent -X POST https://dmapi.joker.com/request/dns-zone-get \
+	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
+	-H "application/x-www-form-urlencoded" -d "domain=${DOMAIN_ROOT}&auth-sid=${SID}" | \
+	tail -n +7 >${TMPFILE}
+
+## add txt record
+printf "_acme-challenge.%s. TXT 0  \"%s \" 300\n\n" "${FULLDOMAIN}" "${TOKEN}" >>${TMPFILE}
+
+## generate encoded url data
+URLDATA=$(cat ${TMPFILE} | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
+
+## write new zonefile to joker
+curl --silent --output /dev/null "https://dmapi.joker.com/request/dns-zone-put?domain=${DOMAIN_ROOT}&zone=${URLDATA}&auth-sid=${SID}" 2>&1
+
+## remove tempfile
+rm -f ${TMPFILE}
diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 891614e..14896d8 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -3,8 +3,15 @@
 # example of script to add token to local dns using nsupdate
 
 dnskeyfile="path/to/bla.key"
-
+server="localhost"
 fulldomain="$1"
 token="$2"
 
-printf "update add _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" | nsupdate -k "${dnskeyfile}" -v
+updatefile=$(mktemp)
+
+printf "server ${server}\n" > "${updatefile}"
+printf "update add _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" >> "${updatefile}"
+
+nsupdate -k "${dnskeyfile}" -v "${updatefile}"
+
+rm -f "${updatefile}"
diff --git a/dns_scripts/dns_del_joker b/dns_scripts/dns_del_joker
new file mode 100644
index 0000000..f1869c8
--- /dev/null
+++ b/dns_scripts/dns_del_joker
@@ -0,0 +1,44 @@
+#!/bin/bash
+
+FULLDOMAIN=$1
+TOKEN=$2
+TMPFILE=$(mktemp /tmp/dns_add_joker.XXXXXXX)
+
+USERNAME="youruser"
+PASSWORD="yourpassword"
+
+# Verify that required parameters are set
+if [[ -z "${FULLDOMAIN}" ]]; then
+  echo "DNS script requires full domain name as first parameter"
+  exit 1
+fi
+
+if [[ -z "${TOKEN}" ]]; then
+  echo "DNS script requires challenge token as second parameter"
+  exit 1
+fi
+
+DOMAIN_ROOT=$(echo "${FULLDOMAIN}" | awk -F\. '{print $(NF-1) FS $NF}')
+
+SID=$(curl --silent -X POST https://dmapi.joker.com/request/login \
+	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
+	-H "application/x-www-form-urlencoded" -d "username=${USERNAME}&password=${PASSWORD}" \
+	-i -k 2>/dev/null | grep Auth-Sid | awk '{ print $2 }')
+
+## put zone data in tempfile
+curl --silent -X POST https://dmapi.joker.com/request/dns-zone-get \
+	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
+	-H "application/x-www-form-urlencoded" -d "domain=${DOMAIN_ROOT}&auth-sid=${SID}" | \
+	tail -n +7 >${TMPFILE}
+
+## remove txt record
+sed -i "/_acme-challenge.${FULLDOMAIN}.*${TOKEN}.*/d" ${TMPFILE}
+
+## generate encoded url data
+URLDATA=$(cat ${TMPFILE} | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
+
+## write new zonefile to joker
+curl --silent --output /dev/null "https://dmapi.joker.com/request/dns-zone-put?domain=${DOMAIN_ROOT}&zone=${URLDATA}&auth-sid=${SID}" 2>&1
+
+## remove tempfile
+rm -f ${TMPFILE}
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index 808b21c..be41a7b 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -3,7 +3,16 @@
 # example of script to add token to local dns using nsupdate
 
 dnskeyfile="path/to/bla.key"
+server="localhost"
+
 fulldomain="$1"
 token="$2"
 
-printf "update delete _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" | nsupdate -k "${dnskeyfile}" -v
+updatefile=$(mktemp)
+
+printf "server ${server}\n" > "${updatefile}"
+printf "update delete _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" >> "${updatefile}"
+
+nsupdate -k "${dnskeyfile}" -v "${updatefile}"
+
+rm -f "${updatefile}"

From c946d42a127c145691b29515eb4eb20e2c33242d Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Fri, 5 Jan 2018 11:49:41 +0000
Subject: [PATCH 29/93] adding SSH_OPTS as requested

---
 README.md |  1 +
 getssl    | 18 +++++++++---------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 42c7cdd..8549bda 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ Obtain SSL certificates from the letsencrypt.org ACME server.  Suitable for auto
 * **Simple and easy to use**
 * **Detailed debug info** - Whilst it shouldn't be needed, detailed debug information is available.
 * **Reload services** - After a new certificate is obtained then the relevant services (e.g. apache/nginx/postfix) can be reloaded.
+* **ACME v1 and V2** - Supports both ACME versions 1 and 2
 
 ## Installation
 Since the script is only one file, you can use the following command for a quick installation of GetSSL only:
diff --git a/getssl b/getssl
index 2ac3fc7..17668d1 100755
--- a/getssl
+++ b/getssl
@@ -196,7 +196,7 @@ VERSION="2.13"
 # defaults
 ACCOUNT_KEY_LENGTH=4096
 ACCOUNT_KEY_TYPE="rsa"
-CA="https://acme-staging.api.letsencrypt.org"
+CA="https://acme-staging-v02.api.letsencrypt.org/directory"
 CA_CERT_LOCATION=""
 CHALLENGE_CHECK_TYPE="http"
 CHECK_ALL_AUTH_DNS="false"
@@ -534,7 +534,7 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
         debug "servername $servername"
         debug "file $tofile"
         # shellcheck disable=SC2029
-        ssh "$servername" "chown $TOKEN_USER_ID $tofile"
+        ssh "$SSH_OPTS" "$servername" "chown $TOKEN_USER_ID $tofile"
       fi
     elif [[ "${to:0:4}" == "ftp:" ]] ; then
       if [[ "$cert" != "challenge token" ]] ; then
@@ -1229,9 +1229,9 @@ reload_service() {  # Runs a command to reload services ( via ssh if needed)
       sshhost=$(echo "$RELOAD_CMD"| awk -F: '{print $2}')
       command=${RELOAD_CMD:(( ${#sshhost} + 5))}
       debug "running following command to reload cert"
-      debug "ssh $sshhost ${command}"
+      debug "ssh $SSH_OPTS $sshhost ${command}"
       # shellcheck disable=SC2029
-      ssh "$sshhost" "${command}" 1>/dev/null 2>&1
+      ssh "$SSH_OPTS" "$sshhost" "${command}" 1>/dev/null 2>&1
       # allow 2 seconds for services to restart
       sleep 2
     else
@@ -1442,7 +1442,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     done
     if [[ $response == *"error:badNonce"* ]]; then
       debug "bad nonce"
-      nonce=$(echo "$responseHeaders" | grep "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
+      nonce=$(echo "$responseHeaders" | grep -i "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
       debug "trying new nonce $nonce"
     else
       nonceproblem="false"
@@ -1534,7 +1534,7 @@ write_domain_template() { # write out a template file for a domain.
 	# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
 	#
 	# The staging server is best for testing
-	#CA="https://acme-staging.api.letsencrypt.org"
+	#CA="https://acme-staging-v02.api.letsencrypt.org/directory"
 	# This server issues full certificates, however has rate limits
 	#CA="https://acme-v01.api.letsencrypt.org"
 
@@ -1586,7 +1586,7 @@ write_getssl_template() { # write out the main template file
 	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
 	#
 	# The staging server is best for testing (hence set as default)
-	CA="https://acme-staging.api.letsencrypt.org"
+	CA="https://acme-staging-v02.api.letsencrypt.org/directory"
 	# This server issues full certificates, however has rate limits
 	#CA="https://acme-v01.api.letsencrypt.org"
 
@@ -2283,9 +2283,9 @@ for d in $alldomains; do
           sshhost=$(echo "${t_loc}"| awk -F: '{print $2}')
           command="rm -f ${t_loc:(( ${#sshhost} + 5))}/${token:?}"
           debug "running following command to remove token"
-          debug "ssh $sshhost ${command}"
+          debug "ssh $SSH_OPTS $sshhost ${command}"
           # shellcheck disable=SC2029
-          ssh "$sshhost" "${command}" 1>/dev/null 2>&1
+          ssh "$SSH_OPTS" "$sshhost" "${command}" 1>/dev/null 2>&1
           rm -f "${TEMP_DIR:?}/${token:?}"
         elif [[ "${t_loc:0:4}" == "ftp:" ]] ; then
           debug "using ftp to remove token file"

From a41fa6bad864b6d9ecae7862777890017923ad3d Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Fri, 5 Jan 2018 12:59:15 +0000
Subject: [PATCH 30/93] adding godaddy dns scripts and related updates

---
 dns_scripts/GoDaddy-README.txt |  60 +++++
 dns_scripts/dns_add_godaddy    |  40 ++++
 dns_scripts/dns_add_joker      |   8 +-
 dns_scripts/dns_add_nsupdate   |  36 ++-
 dns_scripts/dns_add_ovh        |  66 +++---
 dns_scripts/dns_del_godaddy    |  38 +++
 dns_scripts/dns_del_joker      |   8 +-
 dns_scripts/dns_del_nsupdate   |  39 ++-
 dns_scripts/dns_del_ovh        |  70 +++---
 dns_scripts/dns_godaddy        | 418 +++++++++++++++++++++++++++++++++
 10 files changed, 691 insertions(+), 92 deletions(-)
 create mode 100644 dns_scripts/GoDaddy-README.txt
 create mode 100755 dns_scripts/dns_add_godaddy
 mode change 100644 => 100755 dns_scripts/dns_add_joker
 mode change 100644 => 100755 dns_scripts/dns_add_ovh
 create mode 100755 dns_scripts/dns_del_godaddy
 mode change 100644 => 100755 dns_scripts/dns_del_joker
 mode change 100644 => 100755 dns_scripts/dns_del_ovh
 create mode 100644 dns_scripts/dns_godaddy

diff --git a/dns_scripts/GoDaddy-README.txt b/dns_scripts/GoDaddy-README.txt
new file mode 100644
index 0000000..d58ba73
--- /dev/null
+++ b/dns_scripts/GoDaddy-README.txt
@@ -0,0 +1,60 @@
+Using GoDaddy DNS for LetsEncrypt domain validation.
+
+Quick guide to setting up getssl for domain validation of
+GoDaddy DNS domains.
+
+There are two prerequisites to using getssl with GoDaddy DNS:
+
+1) Obtain an API access key from developer.godaddy.com
+   At first sign-up, you will be required to take a "test" key.
+   This is NOT what you need.  Accept it, then get a "Production"
+   key.  At this writing, there is no charge - but you must have
+   a GoDaddy customer account.
+
+   You must get the API key for the account which owns the domain
+   that you want to get certificates for.  If the domains that you
+   manage are owned by more than one account, get a key for each.
+
+   The access key consists of a "Key" and a "Secret".  You need
+   both.
+
+2) Obtain JSON.sh - https://github.com/dominictarr/JSON.sh
+
+With those in hand, the installation procedure is:
+
+1) Put JSON.sh in the getssl DNS scripts directory 
+   Default: /usr/share/getssl/dns_scripts
+
+2) Open your config file (the global file in ~/.getssl/getssl.cfg
+   or the per-account file in ~/.getssl/example.net/getssl.cfg
+
+3) Set the following options:
+   VALIDATE_VIA_DNS="true"
+   DNS_ADD_COMMAND="/usr/share/getssl/dns_scripts/dns_add_godaddy"
+   DNS_DEL_COMMAND="/usr/share/getssl/dns_scripts/dns_del_godaddy"
+   # The API key for your account/this domain
+   export GODADDY_KEY="..." GODADDY_SECRET="..."
+
+ 4) Set any other options that you wish (per the standard
+   directions.)  Use the test CA to make sure that
+   everything is setup correctly.
+
+That's it.  getssl example.net will now validate with DNS.
+
+To trace record additions and removals, run getssl as
+GODADDY_TRACE=Y getssl example.net
+
+There are additional options, which are documented in the
+*godaddy" files and dns_godaddy -h.
+
+Copyright (2017) Timothe Litt  litt at acm _dot org
+
+This sofware may be freely used providing this notice is included with
+all copies.  The name of the author may not be used to endorse
+any other product or derivative work.  No warranty is provided
+and the user assumes all responsibility for use of this software.
+
+Report any issues to https://github.com/tlhackque/getssl/issues.
+
+Enjoy.
+
diff --git a/dns_scripts/dns_add_godaddy b/dns_scripts/dns_add_godaddy
new file mode 100755
index 0000000..dfd3b3b
--- /dev/null
+++ b/dns_scripts/dns_add_godaddy
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+# Copyright (2017) Timothe Litt  litt at acm _dot org
+
+# Add token to GoDaddy dns using dns_godaddy
+
+# You do not have to customize this script.
+#
+# Obtain the Key and Secret from https://developer.godaddy.com/getstarted
+# You must obtain a "Production" key - NOT the "Test" key you're required
+# to get first.
+#
+# Obtain JSON.sh from https://github.com/dominictarr/JSON.sh
+# Place it in (or softlink it to) the same directory as $GODADDY_SCRIPT,
+# or specify its location with GODADDY_JSON  The default is
+# /usr/share/getssl/dns_scripts/
+#
+# Define GODADDY_KEY and GO_DADDY_SECRET in your account or domain getssl.cfg
+#
+# See GoDaddy-README.txt for complete instructions.
+
+fulldomain="$1"
+token="$2"
+
+[ -z "$GODADDY_SCRIPT" ] && GODADDY_SCRIPT="/usr/share/getssl/dns_scripts/dns_godaddy"
+[[ "$GODADDY_SCRIPT" =~ ^~ ]] && \
+    eval 'GODADDY_SCRIPT=`readlink -nf ' $GODADDY_SCRIPT '`'
+
+if [ ! -x "$GODADDY_SCRIPT" ]; then
+    echo "$GODADDY_SCRIPT: not found.  Please install, softlink or set GODADDY_SCRIPT to its full path"
+    echo "See GoDaddy-README.txt for complete instructions."
+    exit 3
+fi
+
+# JSON.sh is not (currently) used by add
+
+export GODADDY_KEY
+export GODADDY_SECRET
+
+$GODADDY_SCRIPT -q add "${fulldomain}" "_acme-challenge.${fulldomain}." "${token}"
diff --git a/dns_scripts/dns_add_joker b/dns_scripts/dns_add_joker
old mode 100644
new mode 100755
index c345a52..c100886
--- a/dns_scripts/dns_add_joker
+++ b/dns_scripts/dns_add_joker
@@ -29,16 +29,16 @@ SID=$(curl --silent -X POST https://dmapi.joker.com/request/login \
 curl --silent -X POST https://dmapi.joker.com/request/dns-zone-get \
 	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
 	-H "application/x-www-form-urlencoded" -d "domain=${DOMAIN_ROOT}&auth-sid=${SID}" | \
-	tail -n +7 >${TMPFILE}
+	tail -n +7 >"${TMPFILE}"
 
 ## add txt record
-printf "_acme-challenge.%s. TXT 0  \"%s \" 300\n\n" "${FULLDOMAIN}" "${TOKEN}" >>${TMPFILE}
+printf "_acme-challenge.%s. TXT 0  \"%s \" 300\n\n" "${FULLDOMAIN}" "${TOKEN}" >>"${TMPFILE}"
 
 ## generate encoded url data
-URLDATA=$(cat ${TMPFILE} | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
+URLDATA=$(cat "${TMPFILE}" | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
 
 ## write new zonefile to joker
 curl --silent --output /dev/null "https://dmapi.joker.com/request/dns-zone-put?domain=${DOMAIN_ROOT}&zone=${URLDATA}&auth-sid=${SID}" 2>&1
 
 ## remove tempfile
-rm -f ${TMPFILE}
+rm -f "${TMPFILE}"
diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 14896d8..13b0fc9 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -2,16 +2,38 @@
 
 # example of script to add token to local dns using nsupdate
 
-dnskeyfile="path/to/bla.key"
-server="localhost"
 fulldomain="$1"
 token="$2"
 
-updatefile=$(mktemp)
+# VARIABLES:
+#
+# DNS_NSUPDATE_KEYFILE - path to a TSIG key file, if required
+# DNS_NSUPDATE_GETKEY  - command to execute if access to the key file requires
+#                        some special action: mounting a disk, decrypting a file..
+#                        Called with the operation 'add' and action 'open" / 'close'
 
-printf "server ${server}\n" > "${updatefile}"
-printf "update add _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" >> "${updatefile}"
 
-nsupdate -k "${dnskeyfile}" -v "${updatefile}"
+if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
+    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'open' "${fulldomain}" ; then
+        exit $(( $? + 128 ))
+    fi
 
-rm -f "${updatefile}"
+    options="-k ${DNS_NSUPDATE_KEYFILE}"
+fi
+
+# Note that blank line is a "send" command to nsupdate
+
+nsupdate "${options}" -v <<EOF
+update add  _acme-challenge.${fulldomain}. 300 in TXT "${token}"
+
+EOF
+
+sts=$?
+
+if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
+    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'close'  "${fulldomain}"; then
+        exit $(( sts + ( $? * 10 ) ))
+    fi
+fi
+
+exit ${sts}
diff --git a/dns_scripts/dns_add_ovh b/dns_scripts/dns_add_ovh
old mode 100644
new mode 100755
index c748a72..6c062a7
--- a/dns_scripts/dns_add_ovh
+++ b/dns_scripts/dns_add_ovh
@@ -1,33 +1,33 @@
-#!/bin/bash
-
-domains=($(echo "$1"|sed -e 's/^\(\([a-zA-Z0-9.-]*\?\)\.\)*\([a-zA-Z0-9-]\+\.[a-zA-Z-]\+\)$/"\1" _acme-challenge.\2 \3/g'))
-challenge="$2"
-
-# Please, do not forget to ask for your credentials at https://eu.api.ovh.com/createToken/
-# permissions needed are /domain/zone/* in GET,POST,DELETE
-applicationKey="YourAK"
-applicationSecret="YourAS"
-consumerKey="YourCK"
-
-topDomain=${domains[2]}
-subDomain=${domains[1]%%.}
-
-function send
-{
-        method=$1
-        url=$2
-        body=$3
-        ts=$(date +%s)
-
-        sign=\$1\$$(echo -n "${applicationSecret}+${consumerKey}+${method}+https://eu.api.ovh.com/1.0${url}+${body}+${ts}"|sha1sum|cut -d" " -f1)
-        curl -X ${method} -H "Content-Type: application/json" -H "X-Ovh-Application: ${applicationKey}" -H "X-Ovh-Timestamp: ${ts}" -H "X-Ovh-Signature: ${sign}" -H "X-Ovh-Consumer: ${consumerKey}" -d "${body}" https://eu.api.ovh.com/1.0${url}
-}
-
-# Creation request
-send POST /domain/zone/${topDomain}/record "{\"fieldType\":\"TXT\",\"subDomain\":\"$subDomain\",\"ttl\":60,\"target\":\"$challenge\"}"
-
-# Refresh request
-send POST /domain/zone/${topDomain}/refresh ""
-
-# Pause for 10 seconds, for DNS propagation
-sleep 10
+#!/bin/bash
+
+domains=($(echo "$1"|sed -e 's/^\(\([a-zA-Z0-9.-]*\?\)\.\)*\([a-zA-Z0-9-]\+\.[a-zA-Z-]\+\)$/"\1" _acme-challenge.\2 \3/g'))
+challenge="$2"
+
+# Please, do not forget to ask for your credentials at https://eu.api.ovh.com/createToken/
+# permissions needed are /domain/zone/* in GET,POST,DELETE
+applicationKey="YourAK"
+applicationSecret="YourAS"
+consumerKey="YourCK"
+
+topDomain=${domains[2]}
+subDomain=${domains[1]%%.}
+
+function send
+{
+        method=$1
+        url=$2
+        body=$3
+        ts=$(date +%s)
+
+        sign=\$1\$$(echo -n "${applicationSecret}+${consumerKey}+${method}+https://eu.api.ovh.com/1.0${url}+${body}+${ts}"|sha1sum|cut -d" " -f1)
+        curl -X "${method}" -H "Content-Type: application/json" -H "X-Ovh-Application: ${applicationKey}" -H "X-Ovh-Timestamp: ${ts}" -H "X-Ovh-Signature: ${sign}" -H "X-Ovh-Consumer: ${consumerKey}" -d "${body}" "https://eu.api.ovh.com/1.0${url}"
+}
+
+# Creation request
+send POST "/domain/zone/${topDomain}/record" "{\"fieldType\":\"TXT\",\"subDomain\":\"$subDomain\",\"ttl\":60,\"target\":\"$challenge\"}"
+
+# Refresh request
+send POST "/domain/zone/${topDomain}/refresh" ""
+
+# Pause for 10 seconds, for DNS propagation
+sleep 10
diff --git a/dns_scripts/dns_del_godaddy b/dns_scripts/dns_del_godaddy
new file mode 100755
index 0000000..1f17c35
--- /dev/null
+++ b/dns_scripts/dns_del_godaddy
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+# Copyright (2017) Timothe Litt  litt at acm _dot org
+
+# Remove token from GoDaddy dns using dns_godaddy
+
+# You do not have to customize this script.
+#
+# Obtain the Key and Secret from https://developer.godaddy.com/getstarted
+# You must obtain a "Production" key - NOT the "Test" key you're required
+# to get first.
+#
+# Obtain JSON.sh from https://github.com/dominictarr/JSON.sh
+# Place it in (or softlink it to) the same directory as $GODADDY_SCRIPT,
+# or specify its location with GODADDY_JSON  The default is
+# /usr/share/getssl/dns_scripts/
+#
+# Define GODADDY_KEY and GO_DADDY_SECRET in your account or domain getssl.cfg
+#
+# See GoDaddy-README.txt for complete instructions.
+
+fulldomain="$1"
+token="$2"
+
+[ -z "$GODADDY_SCRIPT" ] && GODADDY_SCRIPT="/usr/share/getssl/dns_scripts/dns_godaddy"
+[[ "$GODADDY_SCRIPT" =~ ^~ ]] && \
+    eval 'GODADDY_SCRIPT=`readlink -nf ' "$GODADDY_SCRIPT" '`'
+
+if ! [ -x "$GODADDY_SCRIPT" ]; then
+    echo "$GODADDY_SCRIPT: not found.  Please install, softlink or set GODADDY_SCRIPT to its full path"
+    echo "See GoDaddy-README.txt for complete instructions."
+    exit 3
+fi
+
+export GODADDY_KEY
+export GODADDY_SECRET
+
+$GODADDY_SCRIPT -q del "${fulldomain}" "_acme-challenge.${fulldomain}." "${token}"
diff --git a/dns_scripts/dns_del_joker b/dns_scripts/dns_del_joker
old mode 100644
new mode 100755
index f1869c8..d8bfbb0
--- a/dns_scripts/dns_del_joker
+++ b/dns_scripts/dns_del_joker
@@ -29,16 +29,16 @@ SID=$(curl --silent -X POST https://dmapi.joker.com/request/login \
 curl --silent -X POST https://dmapi.joker.com/request/dns-zone-get \
 	-H "Accept: application/json" -H "User-Agent: getssl/0.1" \
 	-H "application/x-www-form-urlencoded" -d "domain=${DOMAIN_ROOT}&auth-sid=${SID}" | \
-	tail -n +7 >${TMPFILE}
+	tail -n +7 >"${TMPFILE}"
 
 ## remove txt record
-sed -i "/_acme-challenge.${FULLDOMAIN}.*${TOKEN}.*/d" ${TMPFILE}
+sed -i "/_acme-challenge.${FULLDOMAIN}.*${TOKEN}.*/d" "${TMPFILE}"
 
 ## generate encoded url data
-URLDATA=$(cat ${TMPFILE} | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
+URLDATA=$(cat "${TMPFILE}" | sed 's/ /%20/g' | sed 's/"/%22/g' | sed ':a;N;$!ba;s/\n/%0A/g')
 
 ## write new zonefile to joker
 curl --silent --output /dev/null "https://dmapi.joker.com/request/dns-zone-put?domain=${DOMAIN_ROOT}&zone=${URLDATA}&auth-sid=${SID}" 2>&1
 
 ## remove tempfile
-rm -f ${TMPFILE}
+rm -f "${TMPFILE}"
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index be41a7b..e8442e3 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -1,18 +1,39 @@
 #!/bin/bash
 
-# example of script to add token to local dns using nsupdate
-
-dnskeyfile="path/to/bla.key"
-server="localhost"
+# example of script to remove token from local dns using nsupdate
 
 fulldomain="$1"
 token="$2"
 
-updatefile=$(mktemp)
+# VARIABLES:
+#
+# DNS_NSUPDATE_KEYFILE - path to a TSIG key file, if required
+# DNS_NSUPDATE_GETKEY  - command to execute if access to the key file requires
+#                        some special action: dismounting a disk, encrypting a
+#                         file... Called with the operation 'del' and action
+#                          'open" / 'close'
+
+if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
+    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'open' "${fulldomain}" ; then
+        exit $(( $? + 128 ))
+    fi
+
+    options="-k ${DNS_NSUPDATE_KEYFILE}"
+fi
+
+# Note that blank line is a "send" command to nsupdate
+
+nsupdate "${options}" -v <<EOF
+update delete  "_acme-challenge.${fulldomain}." 300 in TXT "${token}"
+
+EOF
 
-printf "server ${server}\n" > "${updatefile}"
-printf "update delete _acme-challenge.%s. 300 in TXT \"%s\"\n\n" "${fulldomain}" "${token}" >> "${updatefile}"
+sts=$?
 
-nsupdate -k "${dnskeyfile}" -v "${updatefile}"
+if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
+    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'close'  "${fulldomain}" ; then
+        exit $(( sts + ( $? * 10 ) ))
+    fi
+fi
 
-rm -f "${updatefile}"
+exit ${sts}
diff --git a/dns_scripts/dns_del_ovh b/dns_scripts/dns_del_ovh
old mode 100644
new mode 100755
index c242de0..bf7fe09
--- a/dns_scripts/dns_del_ovh
+++ b/dns_scripts/dns_del_ovh
@@ -1,35 +1,35 @@
-#!/bin/bash
-
-domains=($(echo "$1"|sed -e 's/^\(\([a-zA-Z0-9.-]*\?\)\.\)*\([a-zA-Z0-9-]\+\.[a-zA-Z-]\+\)$/"\1" _acme-challenge.\2 \3/g'))
-challenge="$2"
-
-# Please, do not forget to ask for your credentials at https://eu.api.ovh.com/createToken/
-# permissions needed are /domain/zone/* in GET,POST,DELETE
-applicationKey="YourAK"
-applicationSecret="YourAS"
-consumerKey="YourCK"
-
-topDomain=${domains[2]}
-subDomain=${domains[1]%%.}
-
-function send
-{
-        method=$1
-        url=$2
-        body=$3
-        ts=$(date +%s)
-
-        sign=\$1\$$(echo -n "${applicationSecret}+${consumerKey}+${method}+https://eu.api.ovh.com/1.0${url}+${body}+${ts}"|sha1sum|cut -d" " -f1)
-        curl -X ${method} -H "Content-Type: application/json" -H "X-Ovh-Application: ${applicationKey}" -H "X-Ovh-Timestamp: ${ts}" -H "X-Ovh-Signature: ${sign}" -H "X-Ovh-Consumer: ${consumerKey}" -d "${body}" https://eu.api.ovh.com/1.0${url}
-}
-
-# Creation request
-oldResult=$(send GET "/domain/zone/${topDomain}/record?fieldType=TXT&subDomain=${subDomain}" ""|sed -e 's/\[//' -e 's/\]//')
-
-for num in ${oldResult//,/ }
-do
-        send DELETE "/domain/zone/${topDomain}/record/${num}" ""
-done
-
-# Refresh request
-send POST /domain/zone/${topDomain}/refresh ""
+#!/bin/bash
+
+domains=($(echo "$1"|sed -e 's/^\(\([a-zA-Z0-9.-]*\?\)\.\)*\([a-zA-Z0-9-]\+\.[a-zA-Z-]\+\)$/"\1" _acme-challenge.\2 \3/g'))
+#challenge="$2"
+
+# Please, do not forget to ask for your credentials at https://eu.api.ovh.com/createToken/
+# permissions needed are /domain/zone/* in GET,POST,DELETE
+applicationKey="YourAK"
+applicationSecret="YourAS"
+consumerKey="YourCK"
+
+topDomain=${domains[2]}
+subDomain=${domains[1]%%.}
+
+function send
+{
+        method=$1
+        url=$2
+        body=$3
+        ts=$(date +%s)
+
+        sign=\$1\$$(echo -n "${applicationSecret}+${consumerKey}+${method}+https://eu.api.ovh.com/1.0${url}+${body}+${ts}"|sha1sum|cut -d" " -f1)
+        curl -X "${method}" -H "Content-Type: application/json" -H "X-Ovh-Application: ${applicationKey}" -H "X-Ovh-Timestamp: ${ts}" -H "X-Ovh-Signature: ${sign}" -H "X-Ovh-Consumer: ${consumerKey}" -d "${body}" "https://eu.api.ovh.com/1.0${url}"
+}
+
+# Creation request
+oldResult=$(send GET "/domain/zone/${topDomain}/record?fieldType=TXT&subDomain=${subDomain}" ""|sed -e 's/\[//' -e 's/\]//')
+
+for num in ${oldResult//,/ }
+do
+        send DELETE "/domain/zone/${topDomain}/record/${num}" ""
+done
+
+# Refresh request
+send POST "/domain/zone/${topDomain}/refresh" ""
diff --git a/dns_scripts/dns_godaddy b/dns_scripts/dns_godaddy
new file mode 100644
index 0000000..4443bd4
--- /dev/null
+++ b/dns_scripts/dns_godaddy
@@ -0,0 +1,418 @@
+#!/bin/bash
+
+# Copyright (2017) Timothe Litt  litt at acm _dot org
+
+VERSION="1.0.1"
+PROG="`basename $0`"
+
+# This script is used to update TXT records in GoDaddy DNS server
+# It depends on JSON.sh from https://github.com/dominictarr/JSON.sh
+# Place it in (or softlink it to) the same directory as this script,
+# or specify its location with GODADDY_JSON
+#
+# See the usage text below, 00GoDaddy-README.txt, dns_add_godaddy
+# and dns_del_godaddy for additional information.
+#
+# It may be freely used providing this notice is included with
+# all copies.  The name of the author may not be used to endorse
+# any other product or derivative work.  No warranty is provided
+# and the user assumes all responsibility for use of this software.
+#
+# Bug reports are welcome at https://github.com/tlhackque/getssl/issues.
+
+API='https://api.godaddy.com/v1/domains'
+APISIGNUP='https://developer.godaddy.com/getstarted'
+GETJSON='https://github.com/dominictarr/JSON.sh'
+
+VERB="y"
+DEBUG="$GODADDY_DEBUG"
+[ -z "$JSON" ] && JSON="$GODADDY_JSON"
+[ -z "$JSON" ] && JSON="`dirname $0`/JSON.sh"
+
+while getopts 'dhj:k:s:t:qv' opt; do
+    case $opt in
+        d) DEBUG="Y"                                   ;;
+        j) JSON="$OPTARG"                              ;;
+        k) GODADDY_KEY="$OPTARG"                       ;;
+        s) GODADDY_SECRET="$OPTARG"                    ;;
+        t) TRACE="$OPTARG"                             ;;
+        q) VERB=                                       ;;
+        v) echo "dns_godaddy version $VERSION"; exit 0 ;;
+        *)
+            cat <<EOF
+Usage
+    $PROG [-dt -h -j JSON -k:KEY -s:SECRET -q] add domain name data [ttl]
+    $PROG [-dt -h -j JSON -k:KEY -s:SECRET -q] del domain name data
+
+Add or delete TXT records from GoDaddy DNS
+
+Obtain the Key and Secret from $APISIGNUP
+You must obtain a "Production" key - NOT the "Test" key you're required
+to get first.
+
+With getssl, this script is called from the dns_add_godaddy and
+dns_del_godaddy wrapper scripts.
+
+Arguments:
+    add - add the specified record to the domain
+
+    del - remove the specified record from the domain
+
+    domain is the domain name, e.g. example.org
+
+    name is the DNS record name to add, e.g. _acme-challenge.example.org.
+         Note that trailing '.' is significant in DNS.
+
+    data is the record data, e.g. "myverificationtoken"
+
+    ttl is optional, and defaults to the GoDaddy minimum of 600.
+
+    If it is necessary to turn on debugging externally, define
+    GODADDY_DEBUG="y" (any non-null string will do).
+    For minimal trace output (to override -q), define GODADDY_TRACE="y".
+
+Options
+    -d    Provide debugging output - all requests and responses
+    -h    This help.
+    -j:   Location of JSON.sh Default `dirname $0`/JSON.sh, or
+          the GODADDY_JSON variable.
+    -k:   The GoDaddy API key    Default from GODADDY_KEY
+    -s:   The GoDaddy API secret Default from GODADDY_SECRET
+    -t:   Detailed protocol trace data is appended to specified file
+    -q    Quiet - omit normal success messages,
+
+    All output, except for this help text, is to stderr.
+
+Environment variables
+    GODADDY_JSON    location of the JSOH.sh script
+    GODADDY_KEY     default API key
+    GODADDY_SCRIPT  location of this script, default location of JSON.sh
+    GODADDY_SECRET  default API secret
+    GODADDY_TRACE   forces -q off if true
+    GODADDY_TFILE   appends protocol trace to file. Overrides -t
+
+BUGS
+    Due to a limitation of the gOdADDY API, deleting the last TXT record
+    would be too risky for my taste.  So in that case, I replace it with
+    _dummy.record_.domain.  TXT "Ihis record is not used".  This record is
+    not automatically deleted by this script, though it's perfectly OK to
+    do so manually. (Via another mechanism, or if it's no longer the last.)
+
+    This really shouldn't happen often, since most domains have at least
+    one TXT record - for SPF, tracking APIs, etc.
+
+    Report any issues to https://github.com/tlhackque/getssl/issues
+EOF
+            exit 0
+            ;;
+    esac
+done
+shift $((OPTIND-1))
+
+# Check for JSON -- required for delete, but if records are added,
+# we assume they'll be deleted later & don't want to strand them.
+
+[[ "$JSON" =~ ^~ ]] && \
+    eval 'JSON=`readlink -nf ' $JSON '`'
+if [ ! -x "$JSON" ]; then
+    cat <<EOF >&2
+$0: requires JSON.sh as "$JSON"
+
+The full path to JSON.sh can be specified with -j, or the
+GODADDY_JSON environment variable.
+
+You can obtain a copy from $GETJSON
+
+Then place or softlink it to $JSON or set GODADDY_JSON.
+EOF
+    exit 2
+fi
+
+if [ -z "$GODADDY_KEY" ] || [ -z "$GODADDY_SECRET" ]; then
+    echo "GODADDY_KEY and GODADDY secret must be defined" >&2
+    exit 3
+fi
+
+[ -n "$DEBUG" ] && VERB="y"
+[ -n "$GODADDY_TRACE" ] && VERB="Y"
+[ -n "$GODADDY_TFILE" ] && TRACE="$GODADDY_TFILE"
+
+# Get parameters & validate
+
+op="$1"
+if ! [[ "$op" =~ ^(add|del)$ ]]; then
+    echo "Operation must be \"add\" or \"del\"" >&2
+    exit 3
+fi
+domain="$2"
+domain="${domain%'.'}"
+if [ -z "$domain" ]; then
+    echo "'domain' parameter is required, see -h" >&2
+    exit 3
+fi
+name="$3"
+if [ -z "$name" ]; then
+    echo "'name' parameter is required, see -h" >&2
+    exit 3
+fi
+! [[ "$name" =~ [.]$ ]] && name="${name}.${domain}."
+data="$4"
+if [ -z "$data" ]; then
+    echo "'data' parameter is required, see -h" >&2
+    exit 3
+fi
+
+if [ "$op" = 'del' ]; then
+    ttl=
+elif [ -z "$5" ]; then
+    ttl="600"  # GoDaddy minimum TTL is 600
+elif ! [[ "$5" =~ ^[0-9]+$ ]]; then
+    echo "TTL $5 is not numeric" >&2
+    exit 3
+elif [ $5 -lt 600 ]; then
+    [ -n "$VERB" ] && \
+        echo "$5 is less than GoDaddy minimum of 600; increased to 600" >&2
+    ttl="600"
+else
+    ttl="$5"
+fi
+
+# --- Done with parameters
+
+[ -n "$DEBUG" ] && \
+    echo "$PROG: $op $domain $name \"$data\" $ttl" >&2
+
+# Authorization header has secret and key
+
+authhdr="Authorization: sso-key $GODADDY_KEY:$GODADDY_SECRET"
+
+if [ -n "$TRACE" ]; then
+    function timestamp { local tm="`LC_TIME=C date '+%T.%N'`"
+        local class="$1"; shift
+        echo "${tm:0:15} ** ${class}: $*" >>"$TRACE"
+    }
+    timestamp 'Info' "$PROG" "V$VERSION" 'Starting new protocol trace'
+    timestamp 'Args' "$@"
+    curl --help | grep -q -- --trace-time && CURL_TFLAGS="--trace-time" # 7.14.0
+    function curl {
+        command curl ${CURL_TFLAGS} --trace-ascii % "$@" 2>>"$TRACE"
+    }
+    [ -n "$VERB" ] && echo "Appending protocol trace to $TRACE"
+fi
+
+[ -n "$DEBUG" ] &&  echo "$authhdr" >&2
+
+if [ "$op" = "add" ]; then
+    # May need to retry due to zone cuts
+
+    while [[ "$domain" =~ [^.]+\.[^.]+ ]]; do
+
+        url="$API/$domain/records/TXT/$name"
+
+        request='{"data":"'$data'","ttl":'$ttl'}'
+        [ -n "$DEBUG" ] && cat >&2 <<EOF
+Add request to: $url
+--------
+$request"
+--------
+EOF
+
+        result="$(curl -i -s -X PUT -d "$request" --config - "$url" <<EOF
+                       header = "Content-Type: application/json" 
+                       header = "$authhdr"
+EOF
+)"
+        sts=$?
+        [ -n "$DEBUG" ] && cat >&2 <<EOF
+
+Result:
+curl status = $sts
+--------
+$result
+--------
+EOF
+        if [ $sts -ne 0 ]; then
+            echo "curl error $sts adding record" >&2
+            exit $sts
+        fi
+        if ! echo "$result" | grep -q '^HTTP/.* 200 '; then
+            code="`echo "$result" | grep '"code":' | sed -e's/^.*"code":"//; s/\".*$//'`"
+            msg="`echo "$result" | grep '"message":' | sed -e's/^.*"message":"//; s/\".*$//'`"
+            if [ "$code" = "DUPLICATE_RECORD" ]; then
+                if [ -n "$VERB" ]; then
+                    echo "$msg in $domain" >&2
+                fi
+                exit 0 # Duplicate record is still success
+            fi
+            if [ "$code" = 'UNKNOWN_DOMAIN' ]; then
+                if [[ "$domain" =~ ^([^.]+)\.([^.]+\.[^.]+.*) ]]; then
+                    [ -n "$DEBUG" ] && \
+                        echo "$domain unknown, trying ${BASH_REMATCH[2]}" >&2
+                    domain="${BASH_REMATCH[2]}"
+                    continue;
+                fi
+            fi
+            echo "Request failed $msg" >&2
+            exit 1
+        fi
+        [ -n "$VERB" ] && echo "$domain: added $name $ttl TXT \"$data\"" >&2
+        exit 0
+    done
+fi
+
+
+# ----- Delete
+
+# There is no delete API
+# But, it is possible to replace all TXT records.
+#
+# So, first query for all TXT records
+
+# May need to retry due to zone cuts
+
+while [[ "$domain" =~ [^.]+\.[^.]+ ]]; do
+
+    url="$API/$domain/records/TXT"
+    [ -n "$DEBUG" ] && echo "Query for TXT records to: $url" >&2
+
+    current="$(curl -i -s -X GET --config - "$url" <<EOF
+                        header = "$authhdr" 
+EOF
+)"
+    sts=$?
+    if [ $sts -ne 0 ]; then
+        echo "curl error $sts for query" >&2
+        exit $sts
+    fi
+    [ -n "$DEBUG" ] && cat >&2 <<EOF
+
+Response
+--------
+$current
+--------
+EOF
+    if ! echo "$current" | grep -q '^HTTP/.* 200 '; then
+        code="`echo "$current" | grep '"code":' | sed -e's/^.*"code":"//; s/\".*$//'`"
+        msg="`echo "$current" | grep '"message":' | sed -e's/^.*"message":"//; s/\".*$//'`"
+        if [ "$code" = "UNKNOWN_DOMAIN" ]; then
+            if [[ "$domain" =~ ^([^.]+)\.([^.]+\.[^.]+.*) ]]; then
+                [ -n "$DEBUG" ] && echo \
+                     "$domain unknown, trying ${BASH_REMATCH[2]}" >&2
+                domain="${BASH_REMATCH[2]}"
+                continue;
+            fi
+        fi
+        echo "Request failed $msg" >&2
+        exit 1
+    fi
+    # Remove headers
+
+    current="$(echo "$current" | sed -e'0,/^\r*$/d')"
+    break
+done
+
+    # The zone cut is known, so the replace can't fail due to UNKNOWN domain
+
+if [ "$current" = '[]' ]; then # No TXT records in zone
+    [ -n "$VERB" ] && echo "$domain: $name TXT \"$data\" does not exist" >&2
+    [ -n "$DEBUG" ] && echo "No TXT records in $domain" >&2
+    exit 1  # Intent was to change, so error status
+fi
+
+[ -n "$DEBUG" ] && echo "Response is valid"
+
+# Prepare request to replace TXT RRSET
+
+# Parse JSON and select only the record structures, which are [index] { ...}
+
+current="$(echo "$current" | $JSON | sed -n -e'/^\[[0-9][0-9]*\]/{ s/^\[[0-9][0-9]*\]//; p}')"
+base="$current"
+
+[ -n "$DEBUG" ] && cat >&2 <<EOF
+Old TXT RRSET:
+$current
+EOF
+
+# Remove the desired record.  The name must be relative.
+
+eval 'name="$''{name%'"'.$domain.'}"'"'
+
+match="$(printf '"name":"%s","data":"%s","ttl":' "$name" "$data")"
+cmd="$(printf 'echo %s%s%s | grep -v %s%s%s' "'" "$current" "'" "'" "$match" "'")"
+eval 'new="$('"$cmd"')"'
+
+if [ "$new" = "$base" ]; then
+    [ -n "$VERB" ] && echo "$domain: $name TXT \"$data\" does not exist" >&2
+    exit 1 # Intent was to change DNS, so this is an error
+fi
+
+# Remove whitespace and insert needed commmas
+#
+fmtnew="$new"
+new=$(echo "$new" | sed -e"s/}/},/g; \$s/},/}/;" | tr -d '\t\n')
+
+if [ -z "$new" ]; then
+    [ -n "$VERB" ] && echo "Replacing last TXT record with a dummy (see -h)" >&2
+    new='{"type":"TXT","name":"_dummy.record_","data":"_This record is not used_","ttl":601}'
+    dummy="t"
+    TAB=$'\t'
+    fmtnew="${TAB}$new"
+    if [ "$fmtnew" = "$base" ]; then
+        [ -n "$VERB" ] && echo "This tool can't delete a placeholder when it is the only TXT record" >&2
+        exit 0 # Not really success, but retrying won't help.
+    fi
+fi
+
+request="[$new]"
+
+[ -n "$DEBUG" ] && cat >&2 <<EOF
+New TXT RRSET will be
+$fmtnew
+
+EOF
+
+url="$API/$domain/records/TXT"
+
+[ -n "$DEBUG" ] && cat >&2 <<EOF
+Replace (delete) request to: $url
+--------
+$request
+--------
+EOF
+
+result="$(curl -i -s -X PUT -d  "$request" --config - "$url" <<EOF
+               header = "Content-Type: application/json"
+               header = "$authhdr"
+EOF
+)"
+sts=$?
+[ -n "$DEBUG" ] && cat >&2 <<EOF
+
+Result:
+curl status = $sts
+--------
+$result
+--------
+EOF
+
+if [ $sts -ne 0 ]; then
+    echo "curl error $sts deleting record" >&2
+    exit $sts
+fi
+if ! echo "$result" | grep -q '^HTTP/.* 200 '; then
+    result="$(echo "$result" | sed -e'0,/^\r*$/d')"
+    code="`echo "$result" | grep '"code":' | sed -e's/^.*"code":"//; s/\".*$//'`"
+    msg="`echo "$result" | grep '"message":' | sed -e's/^.*"message":"//; s/\".*$//'`"
+    echo "Request failed $msg" >&2
+    exit 1
+fi
+
+if [ -n "$VERB" ]; then
+    if [ -n "$dummy" ]; then
+        echo "$domain: replaced $name TXT \"$data\" with a placeholder" >&2
+    else
+        echo "$domain: deleted $name TXT \"$data\"" >&2
+    fi
+fi
+exit 0
+

From 051eb8d105690b2c6e187902f8756496572d2267 Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Fri, 5 Jan 2018 13:09:49 +0000
Subject: [PATCH 31/93] adding SSH_OPTS (shellcheck)

---
 getssl | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/getssl b/getssl
index 17668d1..23781d7 100755
--- a/getssl
+++ b/getssl
@@ -534,7 +534,8 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
         debug "servername $servername"
         debug "file $tofile"
         # shellcheck disable=SC2029
-        ssh "$SSH_OPTS" "$servername" "chown $TOKEN_USER_ID $tofile"
+        # shellcheck disable=SC2086
+        ssh $SSH_OPTS "$servername" "chown $TOKEN_USER_ID $tofile"
       fi
     elif [[ "${to:0:4}" == "ftp:" ]] ; then
       if [[ "$cert" != "challenge token" ]] ; then
@@ -1231,7 +1232,8 @@ reload_service() {  # Runs a command to reload services ( via ssh if needed)
       debug "running following command to reload cert"
       debug "ssh $SSH_OPTS $sshhost ${command}"
       # shellcheck disable=SC2029
-      ssh "$SSH_OPTS" "$sshhost" "${command}" 1>/dev/null 2>&1
+      # shellcheck disable=SC2086
+      ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
       # allow 2 seconds for services to restart
       sleep 2
     else
@@ -2285,7 +2287,8 @@ for d in $alldomains; do
           debug "running following command to remove token"
           debug "ssh $SSH_OPTS $sshhost ${command}"
           # shellcheck disable=SC2029
-          ssh "$SSH_OPTS" "$sshhost" "${command}" 1>/dev/null 2>&1
+          # shellcheck disable=SC2086
+          ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
           rm -f "${TEMP_DIR:?}/${token:?}"
         elif [[ "${t_loc:0:4}" == "ftp:" ]] ; then
           debug "using ftp to remove token file"

From 13be6817b375c36e50ae5b03a5e3723da0c7390d Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Sun, 7 Jan 2018 10:48:12 +0000
Subject: [PATCH 32/93] adding various updates / from issues to beta

---
 getssl | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/getssl b/getssl
index 23781d7..79ab8da 100755
--- a/getssl
+++ b/getssl
@@ -378,7 +378,7 @@ check_config() { # check the config files for all obvious errors
   fi
 
   dn=0
-  tmplist=$(mktemp)
+  tmplist=$(mktemp 2>/dev/null || mktemp -t getssl)
   for d in $alldomains; do # loop over domains (dn is domain number)
     debug "checking domain $d"
     if [[ "$(grep "^${d}$" "$tmplist")" = "$d" ]]; then
@@ -401,7 +401,7 @@ check_config() { # check the config files for all obvious errors
       fi
       # check domain exist
       if [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
-        if [[ "$($DNS_CHECK_FUNC "${d}" SOA|grep -c "^${d}")" -ge 1 ]]; then
+        if [[ "$($DNS_CHECK_FUNC "${d}" |grep -c "${d}")" -ge 1 ]]; then
           debug "found IP for ${d}"
         else
           info "${DOMAIN}: DNS lookup failed for ${d}"
@@ -436,7 +436,7 @@ check_config() { # check the config files for all obvious errors
 }
 
 check_getssl_upgrade() { # check if a more recent version of code is available available
-  TEMP_UPGRADE_FILE="$(mktemp)"
+  TEMP_UPGRADE_FILE="$(mktemp 2>/dev/null || mktemp -t getssl)"
   curl --silent "$CODE_LOCATION" --output "$TEMP_UPGRADE_FILE"
   errcode=$?
   if [[ $errcode -eq 60 ]]; then
@@ -631,7 +631,7 @@ create_csr() { # create a csr using a given key (if it doesn't already exist)
   if [[ ! -s "$csr_file" ]] || [[ "$_RECREATE_CSR" == "1" ]]; then
     info "creating domain csr - $csr_file"
     # create a temporary config file, for portability.
-    tmp_conf=$(mktemp)
+    tmp_conf=$(mktemp 2>/dev/null || mktemp -t getssl)
     cat "$SSLCONF" > "$tmp_conf"
     printf "[SAN]\n%s" "$SANLIST" >> "$tmp_conf"
     # add OCSP Must-Staple to the domain csr
@@ -1251,7 +1251,7 @@ revoke_certificate() { # revoke a certificate
   ACCOUNT_KEY="$REVOKE_KEY"
   # need to set the revoke key as "account_key" since it's used in send_signed_request.
   get_signing_params "$REVOKE_KEY"
-  TEMP_DIR=$(mktemp -d)
+  TEMP_DIR=$(mktemp -d 2>/dev/null || mktemp -d -t getssl)
   debug "revoking from $CA"
   rcertdata=$(openssl x509 -in "$REVOKE_CERT" -inform PEM -outform DER | urlbase64)
   send_signed_request "$URL_revoke" "{\"resource\": \"revoke-cert\", \"certificate\": \"$rcertdata\"}"
@@ -1579,6 +1579,7 @@ write_domain_template() { # write out a template file for a domain.
 	# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
 	#SERVER_TYPE="https"
 	#CHECK_REMOTE="true"
+	#CHECK_REMOTE_WAIT="2" # wait 2 seconds before checking the remote server
 	_EOF_domain_
 }
 
@@ -2406,6 +2407,7 @@ cert_archive
 debug "Certificates obtained and archived locally, will now copy to specified locations"
 
 # copy certs to the correct location (creating concatenated files as required)
+umask 077
 
 copy_file_to_location "domain certificate" "$CERT_FILE" "$DOMAIN_CERT_LOCATION"
 copy_file_to_location "private key" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LOCATION"
@@ -2471,7 +2473,7 @@ if [[ ! -z "$DOMAIN_PEM_LOCATION" ]]; then
   fi
 fi
 # end of copying certs.
-
+umask "$ORIG_UMASK"
 # Run reload command to restart apache / nginx or whatever system
 reload_service
 

From ad1f76cdec41cab44303d2f5ceb0671f740928a2 Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Sun, 7 Jan 2018 14:49:54 +0000
Subject: [PATCH 33/93] correct bug for cert order location

---
 getssl | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/getssl b/getssl
index 79ab8da..3fedb65 100755
--- a/getssl
+++ b/getssl
@@ -260,11 +260,11 @@ cert_archive() {  # Archive certificate file by copying files to dated archive d
   cp "$CA_CERT" "${DOMAIN_DIR}/archive/${date_time}/chain.crt"
   cat "$CERT_FILE" "$CA_CERT" > "${DOMAIN_DIR}/archive/${date_time}/fullchain.crt"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-    cp "${CERT_FILE::-4}.ec.crt" "${DOMAIN_DIR}/archive/${date_time}/${DOMAIN}.ec.crt"
+    cp "${CERT_FILE%.*}.ec.crt" "${DOMAIN_DIR}/archive/${date_time}/${DOMAIN}.ec.crt"
     cp "$DOMAIN_DIR/${DOMAIN}.ec.csr" "${DOMAIN_DIR}/archive/${date_time}/${DOMAIN}.ec.csr"
     cp "$DOMAIN_DIR/${DOMAIN}.ec.key" "${DOMAIN_DIR}/archive/${date_time}/${DOMAIN}.ec.key"
-    cp "${CA_CERT::-4}.ec.crt" "${DOMAIN_DIR}/archive/${date_time}/chain.ec.crt"
-    cat "${CERT_FILE::-4}.ec.crt" "${CA_CERT::-4}.ec.crt" > "${DOMAIN_DIR}/archive/${date_time}/fullchain.ec.crt"
+    cp "${CA_CERT%.*}.ec.crt" "${DOMAIN_DIR}/archive/${date_time}/chain.ec.crt"
+    cat "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "${DOMAIN_DIR}/archive/${date_time}/fullchain.ec.crt"
   fi
   umask "$ORIG_UMASK"
   debug "purging old GetSSL archives"
@@ -665,8 +665,8 @@ create_key() { # create a domain key (if it doesn't already exist)
     esac
     umask "$ORIG_UMASK"
     # remove csr on generation of new domain key
-    if [[ -e "${key_loc::-4}.csr" ]]; then
-      rm -f "${key_loc::-4}.csr"
+    if [[ -e "${key_loc%.*}.csr" ]]; then
+      rm -f "${key_loc%.*}.csr"
     fi
   fi
 }
@@ -2119,7 +2119,7 @@ if [[ $API -eq 2 ]]; then
   #  dstring="${dstring},\"notAfter\": \"$(date -d "2 days" --utc +%FT%TZ)\""
   request="{\"identifiers\": $dstring}"
   send_signed_request "$URL_newOrder" "$request"
-  OrderLink=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  OrderLink=$(echo "$responseHeaders" | grep -i location | awk '{print $2}'| tr -d '\r\n ')
   debug "Order link $OrderLink"
   FinalizeLink=$(json_get "$response" "finalize")
   debug "finalise link $FinalizeLink"
@@ -2397,8 +2397,8 @@ get_certificate "$DOMAIN_DIR/${DOMAIN}.csr" \
                 "$CA_CERT"
 if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
   get_certificate "$DOMAIN_DIR/${DOMAIN}.ec.csr" \
-                  "${CERT_FILE::-4}.ec.crt" \
-                  "${CA_CERT::-4}.ec.crt"
+                  "${CERT_FILE%.*}.ec.crt" \
+                  "${CA_CERT%.*}.ec.crt"
 fi
 
 # create Archive of new certs and keys.
@@ -2415,18 +2415,18 @@ copy_file_to_location "CA certificate" "$CA_CERT" "$CA_CERT_LOCATION"
 if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
   if [[ ! -z "$DOMAIN_CERT_LOCATION" ]]; then
     copy_file_to_location "ec domain certificate" \
-                          "${CERT_FILE::-4}.ec.crt" \
-                          "${DOMAIN_CERT_LOCATION::-4}.ec.crt"
+                          "${CERT_FILE%.*}.ec.crt" \
+                          "${DOMAIN_CERT_LOCATION%.*}.ec.crt"
   fi
   if [[ ! -z "$DOMAIN_KEY_LOCATION" ]]; then
   copy_file_to_location "ec private key" \
                         "$DOMAIN_DIR/${DOMAIN}.ec.key" \
-                        "${DOMAIN_KEY_LOCATION::-4}.ec.key"
+                        "${DOMAIN_KEY_LOCATION%.*}.ec.key"
   fi
   if [[ ! -z "$CA_CERT_LOCATION" ]]; then
   copy_file_to_location "ec CA certificate" \
-                        "${CA_CERT::-4}.ec.crt" \
-                        "${CA_CERT_LOCATION::-4}.ec.crt"
+                        "${CA_CERT%.*}.ec.crt" \
+                        "${CA_CERT_LOCATION%.*}.ec.crt"
   fi
 fi
 
@@ -2440,7 +2440,7 @@ if [[ ! -z "$DOMAIN_CHAIN_LOCATION" ]]; then
   cat "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}_chain.pem"
   copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-    cat "${CERT_FILE::-4}.ec.crt" "${CA_CERT::-4}.ec.crt" > "$TEMP_DIR/${DOMAIN}_chain.pem.ec"
+    cat "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_chain.pem.ec"
     copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem.ec"  "${to_location}.ec"
   fi
 fi
@@ -2454,7 +2454,7 @@ if [[ ! -z "$DOMAIN_KEY_CERT_LOCATION" ]]; then
   cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" > "$TEMP_DIR/${DOMAIN}_K_C.pem"
   copy_file_to_location "private key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-  cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE::-4}.ec.crt" > "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"
+  cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"
   copy_file_to_location "private ec key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"  "${to_location}.ec"
   fi
 fi
@@ -2468,7 +2468,7 @@ if [[ ! -z "$DOMAIN_PEM_LOCATION" ]]; then
   cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}.pem"
   copy_file_to_location "full key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-    cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE::-4}.ec.crt" "${CA_CERT::-4}.ec.crt" > "$TEMP_DIR/${DOMAIN}.pem.ec"
+    cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}.pem.ec"
     copy_file_to_location "full ec key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem.ec"  "${to_location}.ec"
   fi
 fi

From c3fe2d5214607184c6c6b82b316f89475eb1f472 Mon Sep 17 00:00:00 2001
From: Damir Mitrovic <damir@mitrovic.com.au>
Date: Mon, 18 Nov 2019 17:54:35 +1000
Subject: [PATCH 34/93] Fixes 374

---
 getssl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 3fedb65..e346cc1 100755
--- a/getssl
+++ b/getssl
@@ -1410,9 +1410,9 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     loop_limit=5
     while [[ "$code" -eq 500 ]]; do
       if [[ "$needbase64" ]] ; then
-        response=$($CURL -X POST --data "$body" "$url" | urlbase64)
+        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" | urlbase64)
       else
-        response=$($CURL -X POST --data "$body" "$url")
+        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url")
       fi
 
       responseHeaders=$(cat "$CURL_HEADER")

From 1fcac20db1ce62368f652e0f14049ed4c204befb Mon Sep 17 00:00:00 2001
From: Damir Mitrovic <damir@mitrovic.com.au>
Date: Mon, 18 Nov 2019 18:04:52 +1000
Subject: [PATCH 35/93] Updated version history and increment version counter

---
 getssl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index e346cc1..e6191e1 100755
--- a/getssl
+++ b/getssl
@@ -188,10 +188,11 @@
 # 2019-09-30 issue #423 Use HTTP 1.1 as workaround atm (2.11)
 # 2019-10-02 issue #425 Case insensitive processing of agreement url because of HTTP/2 (2.12)
 # 2019-10-07 update DNS checks to allow use of CNAMEs (2.13)
+# 2019-11-18 Rebased master onto APIv2 and added Content-Type: application/jose+json (2.14)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.13"
+VERSION="2.14"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096

From 1c169ba60369742ffb4787213c501f801769a5da Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 20 Nov 2019 15:34:03 +0000
Subject: [PATCH 36/93] Ignore case finding location in responseHeaders

---
 getssl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/getssl b/getssl
index e6191e1..456da38 100755
--- a/getssl
+++ b/getssl
@@ -1406,7 +1406,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
       body="${body}\"signature\": \"${signed64}\"}"
       debug "header, payload and signature = $body"
     fi
-  
+
     code="500"
     loop_limit=5
     while [[ "$code" -eq 500 ]]; do
@@ -2062,7 +2062,7 @@ get_signing_params "$ACCOUNT_KEY"
 
 info "Registering account"
 # send the request to the ACME server.
-if [[ $API -eq 1 ]]; then 
+if [[ $API -eq 1 ]]; then
   if [[ "$ACCOUNT_EMAIL" ]] ; then
 	regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
   else
@@ -2079,11 +2079,11 @@ elif [[ $API -eq 2 ]]; then
 else
 	debug "cant determine account API"
 	graceful_exit
-fi 
+fi
 
 if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
   info "Registered"
-  KID=$(echo "$responseHeaders" | grep location | awk '{print $2}'| tr -d '\r\n ')
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
   debug "KID=_$KID}_"
   echo "$response" > "$TEMP_DIR/account.json"
 elif [[ "$code" == '409' ]] ; then

From a3af231a15a09099fb87978e9ef0295156929b30 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 20 Nov 2019 16:02:43 +0000
Subject: [PATCH 37/93] Add User-Agent header (fixes #453)

---
 getssl | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/getssl b/getssl
index 456da38..f3e60a4 100755
--- a/getssl
+++ b/getssl
@@ -205,6 +205,7 @@ CHECK_REMOTE="true"
 CHECK_REMOTE_WAIT=0
 CODE_LOCATION="https://raw.githubusercontent.com/srvrco/getssl/master/getssl"
 CSR_SUBJECT="/"
+CURL_USERAGENT="${PROGNAME}/${VERSION}"
 DEACTIVATE_AUTH="false"
 DEFAULT_REVOKE_CA="https://acme-v01.api.letsencrypt.org"
 DNS_EXTRA_WAIT=""
@@ -438,7 +439,7 @@ check_config() { # check the config files for all obvious errors
 
 check_getssl_upgrade() { # check if a more recent version of code is available available
   TEMP_UPGRADE_FILE="$(mktemp 2>/dev/null || mktemp -t getssl)"
-  curl --silent "$CODE_LOCATION" --output "$TEMP_UPGRADE_FILE"
+  curl --user-agent "$CURL_USERAGENT" --silent "$CODE_LOCATION" --output "$TEMP_UPGRADE_FILE"
   errcode=$?
   if [[ $errcode -eq 60 ]]; then
     error_exit "curl needs updating, your version does not support SNI (multiple SSL domains on a single IP)"
@@ -824,7 +825,7 @@ get_certificate() { # get certificate for csr, if all domains validated.
     debug "certdata location = $CertData"
     if [[ "$CertData" ]] ; then
       echo -----BEGIN CERTIFICATE----- > "$gc_certfile"
-      curl --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
+      curl --user-agent "$CURL_USERAGENT" --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
       echo -----END CERTIFICATE-----  >> "$gc_certfile"
       info "Certificate saved in $CERT_FILE"
     fi
@@ -844,17 +845,17 @@ get_certificate() { # get certificate for csr, if all domains validated.
                 | sed 's/>//g')
     if [[ "$IssuerData" ]] ; then
       echo -----BEGIN CERTIFICATE----- > "$gc_cafile"
-      curl --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
+      curl --user-agent "$CURL_USERAGENT" --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
       echo -----END CERTIFICATE-----  >> "$gc_cafile"
       info "The intermediate CA cert is in $gc_cafile"
     fi
   else # APIv2
     send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
     debug "order link was $OrderLink"
-    cd=$(curl --silent "$OrderLink")
+    cd=$(curl --user-agent "$CURL_USERAGENT" --silent "$OrderLink")
     CertData=$(json_get "$cd" "certificate")
     debug "CertData is at $CertData"
-    curl --silent "$CertData" > "$CERT_FILE"
+    curl --user-agent "$CURL_USERAGENT" --silent "$CertData" > "$CERT_FILE"
     info "Certificate saved in $CERT_FILE"
   fi
 }
@@ -862,7 +863,7 @@ get_certificate() { # get certificate for csr, if all domains validated.
 get_cr() { # get curl response
   url="$1"
   debug url "$url"
-  response=$(curl --silent "$url")
+  response=$(curl --user-agent "$CURL_USERAGENT" --silent "$url")
   ret=$?
   debug response  "$response"
   code=$(json_get "$response" status)
@@ -1342,7 +1343,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     CURL="$CURL --http1.1 "
   fi
 
-  CURL="$CURL --silent --dump-header $CURL_HEADER "
+  CURL="$CURL --user-agent $CURL_USERAGENT --silent --dump-header $CURL_HEADER "
 
   if [[ ${_USE_DEBUG} -eq 1 ]]; then
     CURL="$CURL --trace-ascii $dp "
@@ -1726,13 +1727,13 @@ if [[ $_REVOKE -eq 1 ]]; then
   else
     CA=$REVOKE_CA
   fi
-  URL_revoke=$(curl "${CA}/directory" 2>/dev/null | grep "revoke-cert" | awk -F'"' '{print $4}')
+  URL_revoke=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null | grep "revoke-cert" | awk -F'"' '{print $4}')
   revoke_certificate
   graceful_exit
 fi
 
 # get latest agreement from CA (as default)
-AGREEMENT=$(curl -I "${CA}/terms" 2>/dev/null | awk 'tolower($1) ~ "location:" {print $2}'|tr -d '\r')
+AGREEMENT=$(curl --user-agent "$CURL_USERAGENT" -I "${CA}/terms" 2>/dev/null | awk 'tolower($1) ~ "location:" {print $2}'|tr -d '\r')
 
 # if nothing in command line, print help and exit.
 if [[ -z "$DOMAIN" ]] && [[ ${_CHECK_ALL} -ne 1 ]]; then
@@ -1878,7 +1879,7 @@ if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
 fi
 
 # Obtain CA resource locations
-ca_all_loc=$(curl "${CA}" 2>/dev/null)
+ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}" 2>/dev/null)
 debug "ca_all_loc from ${CA} gives $ca_all_loc"
 # APIv1
 URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
@@ -1889,7 +1890,7 @@ URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}'
 URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
 URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
 if [[ -z "$URL_new_reg" ]]  && [[ -z "$URL_newAccount" ]]; then
-  ca_all_loc=$(curl "${CA}/directory" 2>/dev/null)
+  ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null)
   debug "ca_all_loc from ${CA}/directory gives $ca_all_loc"
   # APIv1
   URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
@@ -2179,7 +2180,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "dns-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --silent "${AuthLink[$dn]}" 2>/dev/null)
+        response=$(curl --user-agent "$CURL_USERAGENT" --silent "${AuthLink[$dn]}" 2>/dev/null)
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "dns-01" "token")
@@ -2236,7 +2237,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "http-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --silent "${AuthLink[$dn]}" 2>/dev/null)
+        response=$(curl --user-agent "$CURL_USERAGENT" --silent "${AuthLink[$dn]}" 2>/dev/null)
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "http-01" "token")
@@ -2273,7 +2274,7 @@ for d in $alldomains; do
       else
         sleep "$HTTP_TOKEN_CHECK_WAIT"
         # check that we can reach the challenge ourselves, if not, then error
-        if [[ ! "$(curl -k --silent --location "$wellknown_url")" == "$keyauthorization" ]]; then
+        if [[ ! "$(curl --user-agent "$CURL_USERAGENT" -k --silent --location "$wellknown_url")" == "$keyauthorization" ]]; then
           error_exit "for some reason could not reach $wellknown_url - please check it manually"
         fi
       fi
@@ -2482,7 +2483,7 @@ reload_service
 if [[ "$DEACTIVATE_AUTH" == "true" ]]; then
   debug "in deactivate list is $deactivate_url_list"
   for deactivate_url in $deactivate_url_list; do
-    resp=$(curl "$deactivate_url" 2>/dev/null)
+    resp=$(curl --user-agent "$CURL_USERAGENT" "$deactivate_url" 2>/dev/null)
     d=$(json_get "$resp" "hostname")
     info "deactivating domain $d"
     debug "deactivating  $deactivate_url"

From 564410d371fc2ee6841c2df20115001348e2df90 Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Thu, 21 Nov 2019 15:38:48 +0100
Subject: [PATCH 38/93] * fix shellcheck issues

---
 getssl | 72 ++++++++++++++++++++++++++++++----------------------------
 1 file changed, 37 insertions(+), 35 deletions(-)

diff --git a/getssl b/getssl
index f3e60a4..3a6b5c2 100755
--- a/getssl
+++ b/getssl
@@ -283,11 +283,11 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
 
   # check response from our request to perform challenge
   if [[ $API -eq 1 ]]; then
-    if [[ ! -z "$code" ]] && [[ ! "$code" == '202' ]] ; then
+    if [[ -n "$code" ]] && [[ ! "$code" == '202' ]] ; then
       error_exit "$domain:Challenge error: $code"
     fi
   else # APIv2
-    if [[ ! -z "$code" ]] && [[ ! "$code" == '200' ]] ; then
+    if [[ -n "$code" ]] && [[ ! "$code" == '200' ]] ; then
       error_exit "$domain:Challenge error: $code"
     fi
   fi
@@ -468,12 +468,13 @@ check_getssl_upgrade() { # check if a more recent version of code is available a
         # Obtain all locally stored old versions in getssl_versions
         declare -a getssl_versions
         shopt -s nullglob
-        for getssl_version in $0.v*; do
+        for getssl_version in "$0".v*; do
           getssl_versions[${#getssl_versions[@]}]="$getssl_version"
         done
         shopt -u nullglob
         # Explicitly sort the getssl_versions array to make sure
         shopt -s -o noglob
+        # shellcheck disable=SC2207
         IFS=$'\n' getssl_versions=($(sort <<< "${getssl_versions[*]}"))
         shopt -u -o noglob
         # Remove entries until given number of old versions to keep is reached
@@ -499,7 +500,7 @@ clean_up() { # Perform pre-exit housekeeping
   if [[ $VALIDATE_VIA_DNS == "true" ]]; then
     # Tidy up DNS entries if things failed part way though.
     shopt -s nullglob
-    for dnsfile in $TEMP_DIR/dns_verify/*; do
+    for dnsfile in "$TEMP_DIR"/dns_verify/*; do
       # shellcheck source=/dev/null
       . "$dnsfile"
       debug "attempting to clean up DNS entry for $d"
@@ -507,10 +508,10 @@ clean_up() { # Perform pre-exit housekeeping
     done
     shopt -u nullglob
   fi
-  if [[ ! -z "$DOMAIN_DIR" ]]; then
+  if [[ -n "$DOMAIN_DIR" ]]; then
     rm -rf "${TEMP_DIR:?}"
   fi
-  if [[ ! -z "$TEMP_UPGRADE_FILE" ]] && [[ -f "$TEMP_UPGRADE_FILE" ]]; then
+  if [[ -n "$TEMP_UPGRADE_FILE" ]] && [[ -f "$TEMP_UPGRADE_FILE" ]]; then
     rm -f "$TEMP_UPGRADE_FILE"
   fi
 }
@@ -530,7 +531,7 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
         scp $from ${to:4}"
       fi
       debug "userid $TOKEN_USER_ID"
-      if [[ "$cert" == "challenge token" ]] && [[ ! -z "$TOKEN_USER_ID" ]]; then
+      if [[ "$cert" == "challenge token" ]] && [[ -n "$TOKEN_USER_ID" ]]; then
         servername=$(echo "$to" | awk -F":" '{print $2}')
         tofile=$(echo "$to" | awk -F":" '{print $3}')
         debug "servername $servername"
@@ -591,7 +592,7 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
           error_exit "cannot copy $from to $to"
         fi
       fi
-      if [[ "$cert" == "challenge token" ]] && [[ ! -z "$TOKEN_USER_ID" ]]; then
+      if [[ "$cert" == "challenge token" ]] && [[ -n "$TOKEN_USER_ID" ]]; then
         chown "$TOKEN_USER_ID" "$to"
       fi
     fi
@@ -736,7 +737,7 @@ get_auth_dns() { # get the authoritative dns server for a domain (sets primary_n
     else
       res=$($DNS_CHECK_FUNC CNAME "$gad_d" "@$gad_s"| grep "^$gad_d")
     fi
-    if [[ ! -z "$res" ]]; then # domain is a CNAME so get main domain
+    if [[ -n "$res" ]]; then # domain is a CNAME so get main domain
       gad_d=$(echo "$res"| awk '{print $5}' |sed 's/\.$//g')
     fi
     if [[ -z "$gad_s" ]]; then #checking for CNAMEs
@@ -1152,7 +1153,7 @@ json_get() { # get values from json
     # remove newlines, so it's a single chunk of JSON
     json_data=$( echo "$1" | tr '\n' ' ')
     # if $3 is defined, this is the section which the item is in.
-    if [[ ! -z "$3" ]]; then
+    if [[ -n "$3" ]]; then
       jg_section=$(echo "$json_data" | awk -F"[}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${3}"'\"/){print $i}}}')
       if [[ "$2" == "uri" ]]; then
         jg_subsect=$(echo "$jg_section" | awk -F"[,]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i)}}}')
@@ -1172,17 +1173,17 @@ json_get() { # get values from json
       echo "$jg_result"
     fi
   else
-    if [[ ! -z "$6" ]]; then
+    if [[ -n "$6" ]]; then
       full=$(json_awk "$1")
       section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
       echo "$full" | grep "^..${5}\",$section" | awk '{print $2}' | tr -d '"'
-    elif [[ ! -z "$5" ]]; then
+    elif [[ -n "$5" ]]; then
       full=$(json_awk "$1")
       section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
       echo "$full" | grep "^..${2}\",$section" | grep "$5" | awk '{print $2}' | tr -d '"'
-    elif [[ ! -z "$3" ]]; then
+    elif [[ -n "$3" ]]; then
       json_awk "$1" | grep "^..${2}...${3}" | awk '{print $2}' | tr -d '"'
-    elif [[ ! -z "$2" ]]; then
+    elif [[ -n "$2" ]]; then
       json_awk "$1" | grep "^..${2}" | awk '{print $2}' | tr -d '"'
     else
       json_awk "$1"
@@ -1203,7 +1204,7 @@ os_esed() { # Use different sed version for different os types (extended regex)
 purge_archive() { # purge archive of old, invalid, certificates
   arcdir="$1/archive"
   debug "purging archives in ${arcdir}/"
-  for padir in $arcdir/????_??_??_??_??; do
+  for padir in "$arcdir"/????_??_??_??_??; do
     # check each directory
     if [[ -d "$padir" ]]; then
       tstamp=$(basename "$padir"| awk -F"_" '{print $1"-"$2"-"$3" "$4":"$5}')
@@ -1226,7 +1227,7 @@ purge_archive() { # purge archive of old, invalid, certificates
 }
 
 reload_service() {  # Runs a command to reload services ( via ssh if needed)
-  if [[ ! -z "$RELOAD_CMD" ]]; then
+  if [[ -n "$RELOAD_CMD" ]]; then
     info "reloading SSL services"
     if [[ "${RELOAD_CMD:0:4}" == "ssh:" ]] ; then
       sshhost=$(echo "$RELOAD_CMD"| awk -F: '{print $2}')
@@ -1270,16 +1271,16 @@ requires() { # check if required function is available
       if [[ "$i" == "${!#}" ]]; then # if on last variable then exit as not found
         error_exit "this script requires one of: ${*:1:$(($#-1))}"
       fi
-      res=$(which "$i" 2>/dev/null)
+      res=$(command -v "$i" 2>/dev/null)
       debug "checking for $i ... $res"
-      if [[ ! -z "$res" ]]; then # if function found, then set variable to function and return
+      if [[ -n "$res" ]]; then # if function found, then set variable to function and return
         debug "function $i found at $res  - setting ${!#} to $i"
         eval "${!#}=\$i"
         return
       fi
     done
   else # only one value, so check it.
-    result=$(which "$1" 2>/dev/null)
+    result=$(command -v "$1" 2>/dev/null)
     debug "checking for required $1 ... $result"
     if [[ -z "$result" ]]; then
       error_exit "This script requires $1 installed"
@@ -1339,6 +1340,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
   dp="$TEMP_DIR/curl.dump"
 
   CURL="curl "
+  # shellcheck disable=SC2072
   if [[ "$($CURL -V | head -1 | cut -d' ' -f2 )" > "7.33" ]]; then
     CURL="$CURL --http1.1 "
   fi
@@ -1672,11 +1674,11 @@ while [[ -n ${1+defined} ]]; do
       _UPGRADE_CHECK=0 ;;
     -w)
       shift; WORKING_DIR="$1" ;;
-    -* | --*)
+    -*)
       usage
       error_exit "Unknown option $1" ;;
     *)
-      if [[ ! -z $DOMAIN ]]; then
+      if [[ -n $DOMAIN ]]; then
         error_exit "invalid command line $DOMAIN - it appears to contain more than one domain"
       fi
       DOMAIN="$1"
@@ -1784,7 +1786,7 @@ if [[ ${_CHECK_ALL} -eq 1 ]]; then
     error_exit "DOMAIN_STORAGE not found  - $DOMAIN_STORAGE"
   fi
 
-  for dir in ${DOMAIN_STORAGE}/*; do
+  for dir in "${DOMAIN_STORAGE}"/*; do
     if [[ -d "$dir" ]]; then
       debug "Checking $dir"
       cmd="$0 -U" # No update checks when calling recursively
@@ -1832,7 +1834,7 @@ if [[ ${_CREATE_CONFIG} -eq 1 ]]; then
       | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:443" 2>/dev/null \
       | openssl x509 2>/dev/null)
     EX_SANS="www.${DOMAIN}"
-    if [[ ! -z "${EX_CERT}" ]]; then
+    if [[ -n "${EX_CERT}" ]]; then
       EX_SANS=$(echo "$EX_CERT" \
         | openssl x509 -noout -text 2>/dev/null| grep "Subject Alternative Name" -A2 \
         | grep -Eo "DNS:[a-zA-Z 0-9.-]*" | sed "s@DNS:$DOMAIN@@g" | grep -v '^$' | cut -c 5-)
@@ -1902,9 +1904,9 @@ if [[ -z "$URL_new_reg" ]]  && [[ -z "$URL_newAccount" ]]; then
   URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
 fi
 
-if [[ ! -z "$URL_new_reg" ]]; then
+if [[ -n "$URL_new_reg" ]]; then
   API=1
-elif [[ ! -z "$URL_newAccount" ]]; then
+elif [[ -n "$URL_newAccount" ]]; then
   API=2
 else
   info "unknown API version"
@@ -1918,7 +1920,7 @@ if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
   EX_CERT=$(echo \
     | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
     | openssl x509 2>/dev/null)
-  if [[ ! -z "$EX_CERT" ]]; then # if obtained a cert
+  if [[ -n "$EX_CERT" ]]; then # if obtained a cert
     if [[ -s "$CERT_FILE" ]]; then # if local exists
       CERT_LOCAL=$(openssl x509 -noout -fingerprint < "$CERT_FILE" 2>/dev/null)
     else # since local doesn't exist leave empty so that the domain validation will happen
@@ -2151,7 +2153,7 @@ for d in $alldomains; do
     debug "completed send_signed_request"
 
     # check if we got a valid response and token, if not then error exit
-    if [[ ! -z "$code" ]] && [[ ! "$code" == '201' ]] ; then
+    if [[ -n "$code" ]] && [[ ! "$code" == '201' ]] ; then
       error_exit "new-authz error: $response"
     fi
   else
@@ -2319,7 +2321,7 @@ done # end of ... loop through domains for cert ( from SANS list)
 # perform validation if via DNS challenge
 if [[ $VALIDATE_VIA_DNS == "true" ]]; then
   # loop through dns-variable files to check if dns has been changed
-  for dnsfile in $TEMP_DIR/dns_verify/*; do
+  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
     if [[ -e "$dnsfile" ]]; then
       debug "loading DNSfile: $dnsfile"
       # shellcheck source=/dev/null
@@ -2372,7 +2374,7 @@ if [[ $VALIDATE_VIA_DNS == "true" ]]; then
   fi
 
   # loop through dns-variable files to let the ACME server check the challenges
-  for dnsfile in $TEMP_DIR/dns_verify/*; do
+  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
     if [[ -e "$dnsfile" ]]; then
       debug "loading DNSfile: $dnsfile"
       # shellcheck source=/dev/null
@@ -2415,17 +2417,17 @@ copy_file_to_location "domain certificate" "$CERT_FILE" "$DOMAIN_CERT_LOCATION"
 copy_file_to_location "private key" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LOCATION"
 copy_file_to_location "CA certificate" "$CA_CERT" "$CA_CERT_LOCATION"
 if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-  if [[ ! -z "$DOMAIN_CERT_LOCATION" ]]; then
+  if [[ -n "$DOMAIN_CERT_LOCATION" ]]; then
     copy_file_to_location "ec domain certificate" \
                           "${CERT_FILE%.*}.ec.crt" \
                           "${DOMAIN_CERT_LOCATION%.*}.ec.crt"
   fi
-  if [[ ! -z "$DOMAIN_KEY_LOCATION" ]]; then
+  if [[ -n "$DOMAIN_KEY_LOCATION" ]]; then
   copy_file_to_location "ec private key" \
                         "$DOMAIN_DIR/${DOMAIN}.ec.key" \
                         "${DOMAIN_KEY_LOCATION%.*}.ec.key"
   fi
-  if [[ ! -z "$CA_CERT_LOCATION" ]]; then
+  if [[ -n "$CA_CERT_LOCATION" ]]; then
   copy_file_to_location "ec CA certificate" \
                         "${CA_CERT%.*}.ec.crt" \
                         "${CA_CERT_LOCATION%.*}.ec.crt"
@@ -2433,7 +2435,7 @@ if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
 fi
 
 # if DOMAIN_CHAIN_LOCATION is not blank, then create and copy file.
-if [[ ! -z "$DOMAIN_CHAIN_LOCATION" ]]; then
+if [[ -n "$DOMAIN_CHAIN_LOCATION" ]]; then
   if [[ "$(dirname "$DOMAIN_CHAIN_LOCATION")" == "." ]]; then
     to_location="${DOMAIN_DIR}/${DOMAIN_CHAIN_LOCATION}"
   else
@@ -2447,7 +2449,7 @@ if [[ ! -z "$DOMAIN_CHAIN_LOCATION" ]]; then
   fi
 fi
 # if DOMAIN_KEY_CERT_LOCATION is not blank, then create and copy file.
-if [[ ! -z "$DOMAIN_KEY_CERT_LOCATION" ]]; then
+if [[ -n "$DOMAIN_KEY_CERT_LOCATION" ]]; then
   if [[ "$(dirname "$DOMAIN_KEY_CERT_LOCATION")" == "." ]]; then
     to_location="${DOMAIN_DIR}/${DOMAIN_KEY_CERT_LOCATION}"
   else
@@ -2461,7 +2463,7 @@ if [[ ! -z "$DOMAIN_KEY_CERT_LOCATION" ]]; then
   fi
 fi
 # if DOMAIN_PEM_LOCATION is not blank, then create and copy file.
-if [[ ! -z "$DOMAIN_PEM_LOCATION" ]]; then
+if [[ -n "$DOMAIN_PEM_LOCATION" ]]; then
   if [[ "$(dirname "$DOMAIN_PEM_LOCATION")" == "." ]]; then
     to_location="${DOMAIN_DIR}/${DOMAIN_PEM_LOCATION}"
   else

From d9669d240f67d4f5023b4d58ffeab86577671450 Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Thu, 21 Nov 2019 16:05:37 +0100
Subject: [PATCH 39/93] * add IGNORE_PERIOD_CHECK flag

---
 getssl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index f3e60a4..9d39c9e 100755
--- a/getssl
+++ b/getssl
@@ -226,6 +226,7 @@ SERVER_TYPE="https"
 SKIP_HTTP_TOKEN_CHECK="false"
 SSLCONF="$(openssl version -d 2>/dev/null| cut -d\" -f2)/openssl.cnf"
 OCSP_MUST_STAPLE="false"
+IGNORE_PERIOD_CHECK="false"
 TEMP_UPGRADE_FILE=""
 TOKEN_USER_ID=""
 USE_SINGLE_ACL="false"
@@ -1795,7 +1796,7 @@ if [[ ${_CHECK_ALL} -eq 1 ]]; then
         cmd="$cmd -q"
       fi
       # check if $dir looks like a domain name (contains a period)
-      if [[ $(basename "$dir") == *.* ]]; then
+      if [[ $(basename "$dir") == *.* || "$IGNORE_PERIOD_CHECK" == "true" ]]; then
         cmd="$cmd -w $WORKING_DIR $(basename "$dir")"
         debug "CMD: $cmd"
         eval "$cmd"

From dec01f1810fea2287bb2294909f1f2356cead487 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 22 Nov 2019 18:39:36 +0000
Subject: [PATCH 40/93] Split fullchain into cert and ca cert

---
 getssl | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index f3e60a4..e7646ba 100755
--- a/getssl
+++ b/getssl
@@ -855,7 +855,9 @@ get_certificate() { # get certificate for csr, if all domains validated.
     cd=$(curl --user-agent "$CURL_USERAGENT" --silent "$OrderLink")
     CertData=$(json_get "$cd" "certificate")
     debug "CertData is at $CertData"
-    curl --user-agent "$CURL_USERAGENT" --silent "$CertData" > "$CERT_FILE"
+    curl --user-agent "$CURL_USERAGENT" --silent "$CertData" > "$FULL_CHAIN"
+    info "Full certificate saved in $FULL_CHAIN"
+    awk -v CERT_FILE="$CERT_FILE" -v CA_CERT="$CA_CERT" 'BEGIN {outfile=CERT_FILE} split_after==1 {outfile=CA_CERT;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > outfile}' "$FULL_CHAIN"
     info "Certificate saved in $CERT_FILE"
   fi
 }
@@ -1759,6 +1761,7 @@ ACCOUNT_KEY="${ACCOUNT_KEY:=$WORKING_DIR/account.key}"
 DOMAIN_STORAGE="${DOMAIN_STORAGE:=$WORKING_DIR}"
 DOMAIN_DIR="$DOMAIN_STORAGE/$DOMAIN"
 CERT_FILE="$DOMAIN_DIR/${DOMAIN}.crt"
+FULL_CHAIN="$DOMAIN_DIR/fullchain.crt"
 CA_CERT="$DOMAIN_DIR/chain.crt"
 TEMP_DIR="$DOMAIN_DIR/tmp"
 if [[ "$os" == "mingw" ]]; then

From bd0e674b1253535da688b98dabebd21e15b3dc25 Mon Sep 17 00:00:00 2001
From: Ian Driver <driver@hotmail.co.uk>
Date: Sat, 14 Dec 2019 16:21:54 +0000
Subject: [PATCH 41/93] Only select first URL returned from acme-v02

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index ab560eb..2d3b69d 100755
--- a/getssl
+++ b/getssl
@@ -2248,7 +2248,7 @@ for d in $alldomains; do
         token=$(json_get "$response" "challenges" "type" "http-01" "token")
         debug token "$token"
         # get the uri from the http component
-        uri=$(json_get "$response" "challenges" "type" "http-01" "url")
+        uri=$(json_get "$response" "challenges" "type" "http-01" "url" | head -n1)
         debug uri "$uri"
       fi
 

From e85b4655ccf79114b2a78867ceff049dbaf67fa9 Mon Sep 17 00:00:00 2001
From: Lomanic <Lomanic@users.noreply.github.com>
Date: Wed, 18 Dec 2019 18:08:11 +0100
Subject: [PATCH 42/93] Fix #462 use POST-as-GET requests on ACMEv2 endpoints

Ref https://community.letsencrypt.org/t/acme-v2-scheduled-deprecation-of-unauthenticated-resource-gets/74380
---
 getssl | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/getssl b/getssl
index ab560eb..78c10a3 100755
--- a/getssl
+++ b/getssl
@@ -2185,7 +2185,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "dns-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --user-agent "$CURL_USERAGENT" --silent "${AuthLink[$dn]}" 2>/dev/null)
+        send_signed_request "${AuthLink[$dn]}" ""
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "dns-01" "token")
@@ -2242,7 +2242,7 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "http-01")
         debug uri "$uri"
       else # APIv2
-        response=$(curl --user-agent "$CURL_USERAGENT" --silent "${AuthLink[$dn]}" 2>/dev/null)
+        send_signed_request "${AuthLink[$dn]}" ""
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "http-01" "token")
@@ -2488,8 +2488,8 @@ reload_service
 if [[ "$DEACTIVATE_AUTH" == "true" ]]; then
   debug "in deactivate list is $deactivate_url_list"
   for deactivate_url in $deactivate_url_list; do
-    resp=$(curl --user-agent "$CURL_USERAGENT" "$deactivate_url" 2>/dev/null)
-    d=$(json_get "$resp" "hostname")
+    send_signed_request "$deactivate_url" ""
+    d=$(json_get "$response" "hostname")
     info "deactivating domain $d"
     debug "deactivating  $deactivate_url"
     send_signed_request "$deactivate_url" "{\"resource\": \"authz\", \"status\": \"deactivated\"}"

From 7f1b94c6e2a9c1964461ae243681148b5694f631 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Mon, 30 Dec 2019 15:59:58 +0000
Subject: [PATCH 43/93] Fixes for HTTP-01 challenge for POST-as-GET

---
 getssl | 43 +++++++++++++++++++++++++++++--------------
 1 file changed, 29 insertions(+), 14 deletions(-)

diff --git a/getssl b/getssl
index 78c10a3..80730c6 100755
--- a/getssl
+++ b/getssl
@@ -279,7 +279,7 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
   keyauthorization=$3
 
   debug "sending request to ACME server saying we're ready for challenge"
-  send_signed_request "$uri" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
+  send_signed_request "$uri" "{}"
 
   # check response from our request to perform challenge
   if [[ $API -eq 1 ]]; then
@@ -294,10 +294,8 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
 
   # loop "forever" to keep checking for a response from the ACME server.
   while true ; do
-    debug "checking"
-    if ! get_cr "$uri" ; then
-      error_exit "$domain:Verify error:$code"
-    fi
+    debug "checking if challenge is complete"
+    send_signed_request "$uri" ""
 
     status=$(json_get "$response" status)
 
@@ -853,10 +851,10 @@ get_certificate() { # get certificate for csr, if all domains validated.
   else # APIv2
     send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
     debug "order link was $OrderLink"
-    cd=$(curl --user-agent "$CURL_USERAGENT" --silent "$OrderLink")
-    CertData=$(json_get "$cd" "certificate")
+    send_signed_request "$OrderLink" ""
+    CertData=$(json_get "$response" "certificate")
     debug "CertData is at $CertData"
-    curl --user-agent "$CURL_USERAGENT" --silent "$CertData" > "$FULL_CHAIN"
+    send_signed_request "$CertData" "" "" "$FULL_CHAIN"
     info "Full certificate saved in $FULL_CHAIN"
     awk -v CERT_FILE="$CERT_FILE" -v CA_CERT="$CA_CERT" 'BEGIN {outfile=CERT_FILE} split_after==1 {outfile=CA_CERT;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > outfile}' "$FULL_CHAIN"
     info "Certificate saved in $CERT_FILE"
@@ -1325,6 +1323,7 @@ set_server_type() { # uses SERVER_TYPE to set REMOTE_PORT and REMOTE_EXTRA
     REMOTE_PORT=636
   elif [[ ${SERVER_TYPE} =~ ^[0-9]+$ ]]; then
     REMOTE_PORT=${SERVER_TYPE}
+    REMOTE_EXTRA="CUSTOM-HTTP-PORT"
   else
     info "${DOMAIN}: unknown server type \"$SERVER_TYPE\" in SERVER_TYPE"
     config_errors=true
@@ -1335,6 +1334,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
   url=$1
   payload=$2
   needbase64=$3
+  outfile=$4 # save response into this file (certificate data)
 
   debug url "$url"
 
@@ -1374,8 +1374,8 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
 
     # Build another header which also contains the previously received nonce and encode it as urlbase64
     if [[ $API -eq 1 ]]; then
-    protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
-    protected64="$(printf '%s' "${protected}" | urlbase64)"
+      protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
+      protected64="$(printf '%s' "${protected}" | urlbase64)"
     else # APIv2
       if [[ -z "$KID" ]]; then
         debug "KID is blank, so using jwk"
@@ -1384,7 +1384,6 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
       else
         debug "using KID=${KID}"
         protected="{\"alg\": \"$jwkalg\", \"kid\": \"$KID\",\"nonce\": \"${nonce}\", \"url\": \"${url}\"}"
-        debug "protected = $protected"
         protected64="$(printf '%s' "${protected}" | urlbase64)"
       fi
     fi
@@ -1415,13 +1414,22 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     code="500"
     loop_limit=5
     while [[ "$code" -eq 500 ]]; do
-      if [[ "$needbase64" ]] ; then
+      if [[ "$outfile" ]] ; then
+        $CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > $outfile
+        response=$(cat "$outfile")
+      elif [[ "$needbase64" ]] ; then
         response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" | urlbase64)
       else
         response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url")
       fi
 
       responseHeaders=$(cat "$CURL_HEADER")
+      if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
+        # response is in base64 too, decode
+        #!FIXME need to use openssl base64 decoder if it exists
+        response=$(echo "$response" | base64 -d)
+      fi
+
       debug responseHeaders "$responseHeaders"
       debug response  "$response"
       code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
@@ -1430,7 +1438,9 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
         response_status=$(json_get "$response" status \
                         | head -1| awk -F'"' '{print $2}')
       else # APIv2
-        if [[ ${response##*()} == "{"* ]]; then
+        if [[ "$output" && "$response" ]]; then
+          debug "response written to $outfile"
+        elif [[ ${response##*()} == "{"* ]]; then
           response_status=$(json_get "$response" status)
         else
           debug "response not in json format"
@@ -1915,6 +1925,7 @@ else
   info "unknown API version"
   graceful_exit
 fi
+debug "Using API v$API"
 
 # if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
 if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
@@ -2271,7 +2282,11 @@ for d in $alldomains; do
       done
       umask "$ORIG_UMASK"
 
-      wellknown_url="${CHALLENGE_CHECK_TYPE}://$d/.well-known/acme-challenge/$token"
+      if [[ "$REMOTE_EXTRA" = "CUSTOM-HTTP-PORT" ]]; then
+        wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}:${REMOTE_PORT}/.well-known/acme-challenge/$token"
+      else
+        wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
+      fi
       debug wellknown_url "$wellknown_url"
 
       if [[ "$SKIP_HTTP_TOKEN_CHECK" == "true" ]]; then

From 5df6026c1bf9b9e6bd769e798568b9f171d8a2cd Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Mon, 30 Dec 2019 16:00:32 +0000
Subject: [PATCH 44/93] Test using pebble and docker

---
 docker-compose.yml                            | 33 +++++++
 test/Dockerfile                               | 30 +++++++
 test/run-test.sh                              |  9 ++
 test/test-config/getssl-ubuntu.cfg            | 49 +++++++++++
 .../nginx-ubuntu-sites-enabled-default        | 88 +++++++++++++++++++
 5 files changed, 209 insertions(+)
 create mode 100644 docker-compose.yml
 create mode 100644 test/Dockerfile
 create mode 100644 test/run-test.sh
 create mode 100644 test/test-config/getssl-ubuntu.cfg
 create mode 100644 test/test-config/nginx-ubuntu-sites-enabled-default

diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..67e21a6
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,33 @@
+version: '3'
+services:
+  pebble:
+    image: letsencrypt/pebble:latest
+    # TODO enable -strict
+    command: pebble -config /test/config/pebble-config.json
+    environment:
+      # with Go 1.13.x which defaults TLS 1.3 to on
+      GODEBUG: "tls13=1"
+    ports:
+      - 14000:14000  # HTTPS ACME API
+      - 15000:15000  # HTTPS Management API
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.2
+  getssl:
+    build:
+      context: .
+      dockerfile: test/Dockerfile
+    container_name: getssl
+    volumes:
+      - .:/getssl
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.4
+
+networks:
+  acmenet:
+    driver: bridge
+    ipam:
+      driver: default
+      config:
+        - subnet: 10.30.50.0/24
diff --git a/test/Dockerfile b/test/Dockerfile
new file mode 100644
index 0000000..419d4d0
--- /dev/null
+++ b/test/Dockerfile
@@ -0,0 +1,30 @@
+FROM ubuntu:bionic
+# bionic = latest 18 version
+
+# Update and install required software
+RUN apt-get update
+# TODO work out why default version of awk fails
+RUN apt-get install -y git curl dnsutils wget linux-libc-dev make gcc binutils nginx-light gawk
+RUN apt-get install -y vim dos2unix # for debugging
+# TODO test with drill, dig, host
+
+WORKDIR /root
+RUN mkdir /etc/nginx/pki
+RUN mkdir /etc/nginx/pki/private
+COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
+
+# BATS (Bash Automated Testings)
+# RUN git clone https://github.com/bats-core/bats-core.git
+# RUN bats-core/install.sh /usr/local
+
+COPY test/test-config/getssl-ubuntu.cfg getssl.cfg
+
+EXPOSE 80 443
+
+# Run eternal loop - for testing
+CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
+
+# with Pebble
+# docker-compose -f "test\docker-compose.yml" up -d --build
+# docker exec -it test_getssl /bin/bash
+# /getssl/test/run-test.sh
diff --git a/test/run-test.sh b/test/run-test.sh
new file mode 100644
index 0000000..5e0ba8d
--- /dev/null
+++ b/test/run-test.sh
@@ -0,0 +1,9 @@
+#! /bin/sh
+
+wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem
+export CURL_CA_BUNDLE=/root/pebble.minica.pem
+
+service nginx start
+/getssl/getssl -c getssl
+cp getssl.cfg /root/.getssl/getssl
+/getssl/getssl getssl
diff --git a/test/test-config/getssl-ubuntu.cfg b/test/test-config/getssl-ubuntu.cfg
new file mode 100644
index 0000000..a4db20f
--- /dev/null
+++ b/test/test-config/getssl-ubuntu.cfg
@@ -0,0 +1,49 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+# The staging server is best for testing
+#CA="https://acme-staging.api.letsencrypt.org"
+# This server issues full certificates, however has rate limits
+#CA="https://acme-v01.api.letsencrypt.org"
+CA="https://pebble:14000/dir"
+SERVER_TYPE="5002"
+#PRIVATE_KEY_ALG="rsa"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+# Note: this is Additional domains - so should not include the primary domain.
+SANS=""
+
+# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
+# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
+# An ssh key will be needed to provide you with access to the remote server.
+# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
+# If left blank, the username on the local server will be used to authenticate against the remote server.
+# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
+# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
+# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
+ACL=('/var/www/html/.well-known/acme-challenge')
+#     'ssh:server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
+#     'ssh:sshuserid@server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
+#     'ftp:ftpuserid:ftppassword:getssltest.hopto.org:/web/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="service nginx restart"
+
+# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
+# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
+# will be checked for certificate expiry and also will be checked after
+# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
+#SERVER_TYPE="https"
+#CHECK_REMOTE="true"
diff --git a/test/test-config/nginx-ubuntu-sites-enabled-default b/test/test-config/nginx-ubuntu-sites-enabled-default
new file mode 100644
index 0000000..fe02c8d
--- /dev/null
+++ b/test/test-config/nginx-ubuntu-sites-enabled-default
@@ -0,0 +1,88 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# http://wiki.nginx.org/Pitfalls
+# http://wiki.nginx.org/QuickStart
+# http://wiki.nginx.org/Configuration
+#
+# Generally, you will want to move this file somewhere, and start with a clean
+# file but keep this around for reference. Or just disable in sites-enabled.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 5002 default_server;
+	listen [::]:5002 default_server;
+
+	# SSL configuration
+	#
+	listen 5001 ssl default_server;
+	listen [::]:5001 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+    # ssl_certificate /etc/nginx/pki/server.crt;
+    # ssl_certificate_key /etc/nginx/pki/private/server.key;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php7.0-cgi alone:
+	#	fastcgi_pass 127.0.0.1:9000;
+	#	# With php7.0-fpm:
+	#	fastcgi_pass unix:/run/php/php7.0-fpm.sock;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

From 5e3d377342c36e7ba391c329539f515b93ce7269 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Mon, 30 Dec 2019 16:41:13 +0000
Subject: [PATCH 45/93] Fix a typo and shellcheck warning

---
 getssl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 80730c6..02340b0 100755
--- a/getssl
+++ b/getssl
@@ -1415,7 +1415,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
     loop_limit=5
     while [[ "$code" -eq 500 ]]; do
       if [[ "$outfile" ]] ; then
-        $CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > $outfile
+        $CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > "$outfile"
         response=$(cat "$outfile")
       elif [[ "$needbase64" ]] ; then
         response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" | urlbase64)
@@ -1438,7 +1438,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
         response_status=$(json_get "$response" status \
                         | head -1| awk -F'"' '{print $2}')
       else # APIv2
-        if [[ "$output" && "$response" ]]; then
+        if [[ "$outfile" && "$response" ]]; then
           debug "response written to $outfile"
         elif [[ ${response##*()} == "{"* ]]; then
           response_status=$(json_get "$response" status)

From 813276ee80df41d934a462ea6a89340d6215e108 Mon Sep 17 00:00:00 2001
From: Tsaukpaetra <htwiz2002@gmail.com>
Date: Tue, 31 Dec 2019 02:53:02 -0700
Subject: [PATCH 46/93] Create dns_freedns.sh

Should probably be fixed up, I've only hacked up @dkerr64's version for acme.sh to work on my local instance. It assumes you're using curl, I didn't bother stealing acme.sh's whole library of functions.

DNS_ADD_COMMAND="~/.getssl/dns_freedns.sh add"
DNS_DEL_COMMAND="~/.getssl/dns_freedns.sh rm"
---
 dns_scripts/dns_freedns.sh | 702 +++++++++++++++++++++++++++++++++++++
 1 file changed, 702 insertions(+)
 create mode 100644 dns_scripts/dns_freedns.sh

diff --git a/dns_scripts/dns_freedns.sh b/dns_scripts/dns_freedns.sh
new file mode 100644
index 0000000..a6571e1
--- /dev/null
+++ b/dns_scripts/dns_freedns.sh
@@ -0,0 +1,702 @@
+#!/usr/bin/env sh
+
+#This file name is "dns_freedns.sh"
+#So, here must be a method dns_freedns_add()
+#Which will be called by acme.sh to add the txt record to your api system.
+#returns 0 means success, otherwise error.
+#
+#Author: David Kerr
+#Report Bugs here: https://github.com/dkerr64/acme.sh
+#or here... https://github.com/Neilpang/acme.sh/issues/2305
+#
+########  Public functions #####################
+
+# Export FreeDNS userid and password in following variables...
+#  FREEDNS_User=username
+#  FREEDNS_Password=password
+# login cookie is saved in acme account config file so userid / pw
+# need to be set only when changed.
+
+#Usage: dns_freedns_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_freedns_add() {
+  fulldomain="_acme-challenge.$1"
+  txtvalue="$2"
+  FREEDNS_COOKIE="$(cat $(dirname "$(readlink -f "$0")")/freednscookie.dat)"
+
+  echo "Info: Add TXT record using FreeDNS"
+  #echo "Debug: fulldomain: $fulldomain"
+  #echo "Debug: txtvalue: $txtvalue"
+
+  if [ -z "$FREEDNS_User" ] || [ -z "$FREEDNS_Password" ]; then
+    FREEDNS_User=""
+    FREEDNS_Password=""
+    if [ -z "$FREEDNS_COOKIE" ]; then
+      echo "ERROR: You did not specify the FreeDNS username and password yet."
+      echo "ERROR: Please export as FREEDNS_User / FREEDNS_Password and try again."
+      return 1
+    fi
+    using_cached_cookies="true"
+  else
+    FREEDNS_COOKIE="$(_freedns_login "$FREEDNS_User" "$FREEDNS_Password")"
+    if [ -z "$FREEDNS_COOKIE" ]; then
+      return 1
+    fi
+    using_cached_cookies="false"
+  fi
+
+  #echo "Debug: FreeDNS login cookies: $FREEDNS_COOKIE (cached = $using_cached_cookies)"
+
+  echo "$FREEDNS_COOKIE">$(dirname "$(readlink -f "$0")")/freednscookie.dat
+
+  # We may have to cycle through the domain name to find the
+  # TLD that we own...
+  i=1
+  wmax="$(echo "$fulldomain" | tr '.' ' ' | wc -w)"
+  while [ "$i" -lt "$wmax" ]; do
+    # split our full domain name into two parts...
+    sub_domain="$(echo "$fulldomain" | cut -d. -f -"$i")"
+    i="$(_math "$i" + 1)"
+    top_domain="$(echo "$fulldomain" | cut -d. -f "$i"-100)"
+    #echo "Debug: sub_domain: $sub_domain"
+    #echo "Debug: top_domain: $top_domain"
+
+    DNSdomainid="$(_freedns_domain_id "$top_domain")"
+    if [ "$?" = "0" ]; then
+      echo "Info:Domain $top_domain found at FreeDNS, domain_id $DNSdomainid"
+      break
+    else
+      echo "Info:Domain $top_domain not found at FreeDNS, try with next level of TLD"
+    fi
+  done
+
+  if [ -z "$DNSdomainid" ]; then
+    # If domain ID is empty then something went wrong (top level
+    # domain not found at FreeDNS).
+    echo "ERROR: Domain $top_domain not found at FreeDNS"
+    return 1
+  fi
+
+  # Add in new TXT record with the value provided
+  #echo "Debug: Adding TXT record for $fulldomain, $txtvalue"
+  _freedns_add_txt_record "$FREEDNS_COOKIE" "$DNSdomainid" "$sub_domain" "$txtvalue"
+  return $?
+}
+
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_freedns_rm() {
+  fulldomain="_acme-challenge.$1"
+  txtvalue="$2"
+
+  echo "Info:Delete TXT record using FreeDNS"
+  #echo "Debug: fulldomain: $fulldomain"
+  #echo "Debug: txtvalue: $txtvalue"
+
+  # Need to read cookie from conf file again in case new value set
+  # during login to FreeDNS when TXT record was created.
+  FREEDNS_COOKIE="$(cat $(dirname "$(readlink -f "$0")")/freednscookie.dat)"
+  #echo "Debug: FreeDNS login cookies: $FREEDNS_COOKIE"
+
+  TXTdataid="$(_freedns_data_id "$fulldomain" "TXT")"
+  if [ "$?" != "0" ]; then
+    echo "Info:Cannot delete TXT record for $fulldomain, record does not exist at FreeDNS"
+    return 1
+  fi
+  #echo "Debug: Data ID's found, $TXTdataid"
+
+  # now we have one (or more) TXT record data ID's. Load the page
+  # for that record and search for the record txt value.  If match
+  # then we can delete it.
+  lines="$(echo "$TXTdataid" | wc -l)"
+  #echo "Debug: Found $lines TXT data records for $fulldomain"
+  i=0
+  while [ "$i" -lt "$lines" ]; do
+    i="$(_math "$i" + 1)"
+    dataid="$(echo "$TXTdataid" | sed -n "${i}p")"
+    #echo "Debug: $dataid"
+
+    htmlpage="$(_freedns_retrieve_data_page "$FREEDNS_COOKIE" "$dataid")"
+    if [ "$?" != "0" ]; then
+      if [ "$using_cached_cookies" = "true" ]; then
+        echo "ERROR: Has your FreeDNS username and password changed?  If so..."
+        echo "ERROR: Please export as FREEDNS_User / FREEDNS_Password and try again."
+      fi
+      return 1
+    fi
+
+    echo "$htmlpage" | grep "value=\"&quot;$txtvalue&quot;\"" >/dev/null
+    if [ "$?" = "0" ]; then
+      # Found a match... delete the record and return
+      echo "Info:Deleting TXT record for $fulldomain, $txtvalue"
+      _freedns_delete_txt_record "$FREEDNS_COOKIE" "$dataid"
+      return $?
+    fi
+  done
+
+  # If we get this far we did not find a match
+  # Not necessarily an error, but log anyway.
+  echo "Info:Cannot delete TXT record for $fulldomain, $txtvalue. Does not exist at FreeDNS"
+  return 0
+}
+
+####################  Private functions below ##################################
+
+# usage: _freedns_login username password
+# print string "cookie=value" etc.
+# returns 0 success
+_freedns_login() {
+  export _H1="Accept-Language:en-US"
+  username="$1"
+  password="$2"
+  url="https://freedns.afraid.org/zc.php?step=2"
+
+  #echo "Debug: Login to FreeDNS as user $username"
+  data="username=$(printf '%s' "$username" | _url_encode)&password=$(printf '%s' "$password" | _url_encode)&submit=Login&action=auth"
+  #echo "$data"
+
+  if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
+    HTTP_HEADER="$(_mktemp)"
+  fi
+  htmlpage="$(curl -L --silent --dump-header $HTTP_HEADER -X POST -H "$_H1" -H "$_H2"  --data "$data" "$url")"
+
+  if [ "$?" != "0" ]; then
+    echo "ERROR: FreeDNS login failed for user $username bad RC from _post"
+    return 1
+  fi
+
+  cookies="$(grep -i '^Set-Cookie.*dns_cookie.*$' "$HTTP_HEADER" | _head_n 1 | tr -d "\r\n" | cut -d " " -f 2)"
+
+  # if cookies is not empty then logon successful
+  if [ -z "$cookies" ]; then
+    #echo "Debug3: htmlpage: $htmlpage"
+    echo "ERROR: FreeDNS login failed for user $username. Check $HTTP_HEADER file"
+    return 1
+  fi
+
+  printf "%s" "$cookies"
+  return 0
+}
+
+# usage _freedns_retrieve_subdomain_page login_cookies
+# echo page retrieved (html)
+# returns 0 success
+_freedns_retrieve_subdomain_page() {
+  export _H1="Cookie:$1"
+  export _H2="Accept-Language:en-US"
+  url="https://freedns.afraid.org/subdomain/"
+
+  #echo "Debug: Retrieve subdomain page from FreeDNS"
+
+  htmlpage="$(curl -L --silent -H "$_H1" -H "$_H2" "$url")"
+
+  if [ "$?" != "0" ]; then
+    echo "ERROR: FreeDNS retrieve subdomains failed bad RC from _get"
+    return 1
+  elif [ -z "$htmlpage" ]; then
+    echo "ERROR: FreeDNS returned empty subdomain page"
+    return 1
+  fi
+
+  #echo "Debug3: htmlpage: $htmlpage"
+
+  printf "%s" "$htmlpage"
+  return 0
+}
+
+# usage _freedns_retrieve_data_page login_cookies data_id
+# echo page retrieved (html)
+# returns 0 success
+_freedns_retrieve_data_page() {
+  export _H1="Cookie:$1"
+  export _H2="Accept-Language:en-US"
+  data_id="$2"
+  url="https://freedns.afraid.org/subdomain/edit.php?data_id=$2"
+
+  #echo "Debug: Retrieve data page for ID $data_id from FreeDNS"
+
+  htmlpage="$(curl -L --silent -H "$_H1" -H "$_H2" "$url")"
+
+  if [ "$?" != "0" ]; then
+    echo "ERROR: FreeDNS retrieve data page failed bad RC from _get"
+    return 1
+  elif [ -z "$htmlpage" ]; then
+    echo "ERROR: FreeDNS returned empty data page"
+    return 1
+  fi
+
+  #echo "Debug3: htmlpage: $htmlpage"
+
+  printf "%s" "$htmlpage"
+  return 0
+}
+
+# usage _freedns_add_txt_record login_cookies domain_id subdomain value
+# returns 0 success
+_freedns_add_txt_record() {
+  export _H1="Cookie:$1"
+  export _H2="Accept-Language:en-US"
+  domain_id="$2"
+  subdomain="$3"
+  value="$(printf '%s' "$4" | _url_encode)"
+  url="https://freedns.afraid.org/subdomain/save.php?step=2"
+
+  if [ -z "$HTTP_HEADER" ] || ! touch "$HTTP_HEADER"; then
+    HTTP_HEADER="$(_mktemp)"
+  fi
+  htmlpage="$(curl -L --silent --dump-header $HTTP_HEADER -X POST -H "$_H1" -H "$_H2"  --data "type=TXT&domain_id=$domain_id&subdomain=$subdomain&address=%22$value%22&send=Save%21" "$url")"
+
+  if [ "$?" != "0" ]; then
+    echo "ERROR: FreeDNS failed to add TXT record for $subdomain bad RC from _post"
+    return 1
+  elif ! grep "200 OK" "$HTTP_HEADER" >/dev/null; then
+    #echo "Debug3: htmlpage: $(cat $HTTP_HEADER)"
+    echo "ERROR: FreeDNS failed to add TXT record for $subdomain. Check $HTTP_HEADER file"
+    return 1
+  elif _contains "$htmlpage" "security code was incorrect"; then
+    #echo "Debug3: htmlpage: $htmlpage"
+    echo "ERROR: FreeDNS failed to add TXT record for $subdomain as FreeDNS requested security code"
+    echo "ERROR: Note that you cannot use automatic DNS validation for FreeDNS public domains"
+    return 1
+  fi
+
+  #echo "Debug3: htmlpage: $htmlpage"
+  echo "Info:Added acme challenge TXT record for $fulldomain at FreeDNS"
+  return 0
+}
+
+# usage _freedns_delete_txt_record login_cookies data_id
+# returns 0 success
+_freedns_delete_txt_record() {
+  export _H1="Cookie:$1"
+  export _H2="Accept-Language:en-US"
+  data_id="$2"
+  url="https://freedns.afraid.org/subdomain/delete2.php"
+
+  htmlheader="$(curl -L --silent -I -H "$_H1" -H "$_H2" "$url?data_id%5B%5D=$data_id&submit=delete+selected")"
+
+  if [ "$?" != "0" ]; then
+    echo "ERROR: FreeDNS failed to delete TXT record for $data_id bad RC from _get"
+    return 1
+  elif ! _contains "$htmlheader" "200 OK"; then
+    #echo "Debug2: htmlheader: $htmlheader"
+    echo "ERROR: FreeDNS failed to delete TXT record $data_id"
+    return 1
+  fi
+
+  echo "Info:Deleted acme challenge TXT record for $fulldomain at FreeDNS"
+  return 0
+}
+
+# usage _freedns_domain_id domain_name
+# echo the domain_id if found
+# return 0 success
+_freedns_domain_id() {
+  # Start by escaping the dots in the domain name
+  search_domain="$(echo "$1" | sed 's/\./\\./g')"
+
+  # Sometimes FreeDNS does not return the subdomain page but rather
+  # returns a page regarding becoming a premium member.  This usually
+  # happens after a period of inactivity.  Immediately trying again
+  # returns the correct subdomain page.  So, we will try twice to
+  # load the page and obtain our domain ID
+  attempts=2
+  while [ "$attempts" -gt "0" ]; do
+    attempts="$(_math "$attempts" - 1)"
+
+    htmlpage="$(_freedns_retrieve_subdomain_page "$FREEDNS_COOKIE")"
+    if [ "$?" != "0" ]; then
+      if [ "$using_cached_cookies" = "true" ]; then
+        echo "ERROR: Has your FreeDNS username and password changed?  If so..."
+        echo "ERROR: Please export as FREEDNS_User / FREEDNS_Password and try again."
+      fi
+      return 1
+    fi
+
+    domain_id="$(echo "$htmlpage" | tr -d " \t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+      | grep "<td>$search_domain</td>\|<td>$search_domain(.*)</td>" \
+      | sed -n 's/.*\(edit\.php?edit_domain_id=[0-9a-zA-Z]*\).*/\1/p' \
+      | cut -d = -f 2)"
+    # The above beauty extracts domain ID from the html page...
+    # strip out all blank space and new lines. Then insert newlines
+    # before each table row <tr>
+    # search for the domain within each row (which may or may not have
+    # a text string in brackets (.*) after it.
+    # And finally extract the domain ID.
+    if [ -n "$domain_id" ]; then
+      printf "%s" "$domain_id"
+      return 0
+    fi
+    #echo "Debug:Domain $search_domain not found. Retry loading subdomain page ($attempts attempts remaining)"
+  done
+  #echo "Debug:Domain $search_domain not found after retry"
+  return 1
+}
+
+# usage _freedns_data_id domain_name record_type
+# echo the data_id(s) if found
+# return 0 success
+_freedns_data_id() {
+  # Start by escaping the dots in the domain name
+  search_domain="$(echo "$1" | sed 's/\./\\./g')"
+  record_type="$2"
+
+  # Sometimes FreeDNS does not return the subdomain page but rather
+  # returns a page regarding becoming a premium member.  This usually
+  # happens after a period of inactivity.  Immediately trying again
+  # returns the correct subdomain page.  So, we will try twice to
+  # load the page and obtain our domain ID
+  attempts=2
+  while [ "$attempts" -gt "0" ]; do
+    attempts="$(_math "$attempts" - 1)"
+
+    htmlpage="$(_freedns_retrieve_subdomain_page "$FREEDNS_COOKIE")"
+    if [ "$?" != "0" ]; then
+      if [ "$using_cached_cookies" = "true" ]; then
+        echo "ERROR: Has your FreeDNS username and password changed?  If so..."
+        echo "ERROR: Please export as FREEDNS_User / FREEDNS_Password and try again."
+      fi
+      return 1
+    fi
+
+    data_id="$(echo "$htmlpage" | tr -d " \t\r\n\v\f" | sed 's/<tr>/@<tr>/g' | tr '@' '\n' \
+      | grep "<td[a-zA-Z=#]*>$record_type</td>" \
+      | grep "<ahref.*>$search_domain</a>" \
+      | sed -n 's/.*\(edit\.php?data_id=[0-9a-zA-Z]*\).*/\1/p' \
+      | cut -d = -f 2)"
+    # The above beauty extracts data ID from the html page...
+    # strip out all blank space and new lines. Then insert newlines
+    # before each table row <tr>
+    # search for the record type withing each row (e.g. TXT)
+    # search for the domain within each row (which is within a <a..>
+    # </a> anchor. And finally extract the domain ID.
+    if [ -n "$data_id" ]; then
+      printf "%s" "$data_id"
+      return 0
+    fi
+    #echo "Debug:Domain $search_domain not found. Retry loading subdomain page ($attempts attempts remaining)"
+  done
+  #echo "Debug:Domain $search_domain not found after retry"
+  return 1
+}
+
+#### BEGIN things shamefully ripped from https://github.com/Neilpang/acme.sh/blob/master/acme.sh
+
+#_ascii_hex str
+#this can only process ascii chars, should only be used when od command is missing as a backup way.
+_ascii_hex() {
+  _debug2 "Using _ascii_hex"
+  _str="$1"
+  _str_len=${#_str}
+  _h_i=1
+  while [ "$_h_i" -le "$_str_len" ]; do
+    _str_c="$(printf "%s" "$_str" | cut -c "$_h_i")"
+    printf " %02x" "'$_str_c"
+    _h_i="$(_math "$_h_i" + 1)"
+  done
+}
+
+#stdin  output hexstr splited by one space
+#input:"abc"
+#output: " 61 62 63"
+_hex_dump() {
+  if _exists od; then
+    od -A n -v -t x1 | tr -s " " | sed 's/ $//' | tr -d "\r\t\n"
+  elif _exists hexdump; then
+    hexdump -v -e '/1 ""' -e '/1 " %02x" ""'
+  elif _exists xxd; then
+    xxd -ps -c 20 -i | sed "s/ 0x/ /g" | tr -d ",\n" | tr -s " "
+  else
+    str=$(cat)
+    _ascii_hex "$str"
+  fi
+}
+
+#url encode, no-preserved chars
+#A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z
+#41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f 50 51 52 53 54 55 56 57 58 59 5a
+
+#a  b  c  d  e  f  g  h  i  j  k  l  m  n  o  p  q  r  s  t  u  v  w  x  y  z
+#61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f 70 71 72 73 74 75 76 77 78 79 7a
+
+#0  1  2  3  4  5  6  7  8  9  -  _  .  ~
+#30 31 32 33 34 35 36 37 38 39 2d 5f 2e 7e
+
+#stdin stdout
+_url_encode() {
+  _hex_str=$(_hex_dump)
+  for _hex_code in $_hex_str; do
+    #upper case
+    case "${_hex_code}" in
+      "41")
+        printf "%s" "A"
+        ;;
+      "42")
+        printf "%s" "B"
+        ;;
+      "43")
+        printf "%s" "C"
+        ;;
+      "44")
+        printf "%s" "D"
+        ;;
+      "45")
+        printf "%s" "E"
+        ;;
+      "46")
+        printf "%s" "F"
+        ;;
+      "47")
+        printf "%s" "G"
+        ;;
+      "48")
+        printf "%s" "H"
+        ;;
+      "49")
+        printf "%s" "I"
+        ;;
+      "4a")
+        printf "%s" "J"
+        ;;
+      "4b")
+        printf "%s" "K"
+        ;;
+      "4c")
+        printf "%s" "L"
+        ;;
+      "4d")
+        printf "%s" "M"
+        ;;
+      "4e")
+        printf "%s" "N"
+        ;;
+      "4f")
+        printf "%s" "O"
+        ;;
+      "50")
+        printf "%s" "P"
+        ;;
+      "51")
+        printf "%s" "Q"
+        ;;
+      "52")
+        printf "%s" "R"
+        ;;
+      "53")
+        printf "%s" "S"
+        ;;
+      "54")
+        printf "%s" "T"
+        ;;
+      "55")
+        printf "%s" "U"
+        ;;
+      "56")
+        printf "%s" "V"
+        ;;
+      "57")
+        printf "%s" "W"
+        ;;
+      "58")
+        printf "%s" "X"
+        ;;
+      "59")
+        printf "%s" "Y"
+        ;;
+      "5a")
+        printf "%s" "Z"
+        ;;
+
+      #lower case
+      "61")
+        printf "%s" "a"
+        ;;
+      "62")
+        printf "%s" "b"
+        ;;
+      "63")
+        printf "%s" "c"
+        ;;
+      "64")
+        printf "%s" "d"
+        ;;
+      "65")
+        printf "%s" "e"
+        ;;
+      "66")
+        printf "%s" "f"
+        ;;
+      "67")
+        printf "%s" "g"
+        ;;
+      "68")
+        printf "%s" "h"
+        ;;
+      "69")
+        printf "%s" "i"
+        ;;
+      "6a")
+        printf "%s" "j"
+        ;;
+      "6b")
+        printf "%s" "k"
+        ;;
+      "6c")
+        printf "%s" "l"
+        ;;
+      "6d")
+        printf "%s" "m"
+        ;;
+      "6e")
+        printf "%s" "n"
+        ;;
+      "6f")
+        printf "%s" "o"
+        ;;
+      "70")
+        printf "%s" "p"
+        ;;
+      "71")
+        printf "%s" "q"
+        ;;
+      "72")
+        printf "%s" "r"
+        ;;
+      "73")
+        printf "%s" "s"
+        ;;
+      "74")
+        printf "%s" "t"
+        ;;
+      "75")
+        printf "%s" "u"
+        ;;
+      "76")
+        printf "%s" "v"
+        ;;
+      "77")
+        printf "%s" "w"
+        ;;
+      "78")
+        printf "%s" "x"
+        ;;
+      "79")
+        printf "%s" "y"
+        ;;
+      "7a")
+        printf "%s" "z"
+        ;;
+      #numbers
+      "30")
+        printf "%s" "0"
+        ;;
+      "31")
+        printf "%s" "1"
+        ;;
+      "32")
+        printf "%s" "2"
+        ;;
+      "33")
+        printf "%s" "3"
+        ;;
+      "34")
+        printf "%s" "4"
+        ;;
+      "35")
+        printf "%s" "5"
+        ;;
+      "36")
+        printf "%s" "6"
+        ;;
+      "37")
+        printf "%s" "7"
+        ;;
+      "38")
+        printf "%s" "8"
+        ;;
+      "39")
+        printf "%s" "9"
+        ;;
+      "2d")
+        printf "%s" "-"
+        ;;
+      "5f")
+        printf "%s" "_"
+        ;;
+      "2e")
+        printf "%s" "."
+        ;;
+      "7e")
+        printf "%s" "~"
+        ;;
+      #other hex
+      *)
+        printf '%%%s' "$_hex_code"
+        ;;
+    esac
+  done
+}
+
+_exists() {
+  cmd="$1"
+  if [ -z "$cmd" ]; then
+    _usage "Usage: _exists cmd"
+    return 1
+  fi
+
+  if eval type type >/dev/null 2>&1; then
+    eval type "$cmd" >/dev/null 2>&1
+  elif command >/dev/null 2>&1; then
+    command -v "$cmd" >/dev/null 2>&1
+  else
+    which "$cmd" >/dev/null 2>&1
+  fi
+  ret="$?"
+  #echo "Debug3: $cmd exists=$ret"
+  return $ret
+}
+
+_head_n() {
+  head -n "$1"
+}
+
+_mktemp() {
+  if _exists mktemp; then
+    if mktemp 2>/dev/null; then
+      return 0
+    elif _contains "$(mktemp 2>&1)" "-t prefix" && mktemp -t "$PROJECT_NAME" 2>/dev/null; then
+      #for Mac osx
+      return 0
+    fi
+  fi
+  if [ -d "/tmp" ]; then
+    echo "/tmp/${PROJECT_NAME}wefADf24sf.$(_time).tmp"
+    return 0
+  elif [ "$LE_TEMP_DIR" ] && mkdir -p "$LE_TEMP_DIR"; then
+    echo "/$LE_TEMP_DIR/wefADf24sf.$(_time).tmp"
+    return 0
+  fi
+  _err "Can not create temp file."
+}
+
+#a + b
+_math() {
+  _m_opts="$@"
+  printf "%s" "$(($_m_opts))"
+}
+
+_contains() {
+  _str="$1"
+  _sub="$2"
+  echo "$_str" | grep -- "$_sub" >/dev/null 2>&1
+}
+
+##Now actually do something with that function
+case "$1" in
+
+  add)
+    dns_freedns_add $2 $3
+    ;;
+  rm)
+    dns_freedns_rm $2  $3
+    ;;
+esac

From 5296a0716f4f3ebbca141785cbb55abdc4bdcb38 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sat, 4 Jan 2020 10:20:52 +0000
Subject: [PATCH 47/93] Fix for RHEL6

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 02340b0..0f1ef47 100755
--- a/getssl
+++ b/getssl
@@ -2131,7 +2131,7 @@ if [[ $API -eq 2 ]]; then
   for d in $alldomains; do
     dstring="${dstring}{\"type\":\"dns\",\"value\":\"$d\"},"
   done
-  dstring="${dstring: : -1}]"
+  dstring="${dstring::${#dstring}-1}]"
   # request NewOrder currently seems to ignore the dates ....
   #  dstring="${dstring},\"notBefore\": \"$(date -d "-1 hour" --utc +%FT%TZ)\""
   #  dstring="${dstring},\"notAfter\": \"$(date -d "2 days" --utc +%FT%TZ)\""

From 2f3e5da3e81f18d95994120586b1d3c199b579e2 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Tue, 7 Jan 2020 13:02:45 +0000
Subject: [PATCH 48/93] Improved test script (http01 and dns01)

---
 dns_scripts/dns_add_challtestsrv              |  7 ++
 dns_scripts/dns_del_challtestsrv              |  6 ++
 docker-compose.yml                            | 12 ++-
 getssl                                        | 14 +--
 test/Dockerfile-rhel6                         | 27 ++++++
 test/{Dockerfile => Dockerfile-ubuntu}        | 12 +--
 test/run-test.sh                              | 46 +++++++++-
 test/test-config/getssl-dns01.cfg             | 54 +++++++++++
 .../{getssl-ubuntu.cfg => getssl-http01.cfg}  |  8 +-
 ...es-enabled-default => nginx-ubuntu-no-ssl} |  9 +-
 test/test-config/nginx-ubuntu-ssl             | 92 +++++++++++++++++++
 11 files changed, 263 insertions(+), 24 deletions(-)
 create mode 100644 dns_scripts/dns_add_challtestsrv
 create mode 100644 dns_scripts/dns_del_challtestsrv
 create mode 100644 test/Dockerfile-rhel6
 rename test/{Dockerfile => Dockerfile-ubuntu} (61%)
 create mode 100644 test/test-config/getssl-dns01.cfg
 rename test/test-config/{getssl-ubuntu.cfg => getssl-http01.cfg} (91%)
 rename test/test-config/{nginx-ubuntu-sites-enabled-default => nginx-ubuntu-no-ssl} (93%)
 create mode 100644 test/test-config/nginx-ubuntu-ssl

diff --git a/dns_scripts/dns_add_challtestsrv b/dns_scripts/dns_add_challtestsrv
new file mode 100644
index 0000000..601bcfc
--- /dev/null
+++ b/dns_scripts/dns_add_challtestsrv
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Simple script to update the challtestserv mock DNS server when testing DNS responses
+
+fulldomain="${1}"
+token="${2}"
+
+curl -X POST -d "{\"host\":\"_acme-challenge.${fulldomain}.\", \"value\": \"${token}\"}" http://10.30.50.3:8055/set-txt
diff --git a/dns_scripts/dns_del_challtestsrv b/dns_scripts/dns_del_challtestsrv
new file mode 100644
index 0000000..832b136
--- /dev/null
+++ b/dns_scripts/dns_del_challtestsrv
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+# Simple script to update the challtestserv mock DNS server when testing DNS responses
+
+fulldomain="${1}"
+
+curl -X POST -d "{\"host\":\"_acme-challenge.${fulldomain}.\"}" http://10.30.50.3:8055/clear-txt
diff --git a/docker-compose.yml b/docker-compose.yml
index 67e21a6..b770b44 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,7 +3,7 @@ services:
   pebble:
     image: letsencrypt/pebble:latest
     # TODO enable -strict
-    command: pebble -config /test/config/pebble-config.json
+    command: pebble -config /test/config/pebble-config.json -dnsserver 10.30.50.3:8053
     environment:
       # with Go 1.13.x which defaults TLS 1.3 to on
       GODEBUG: "tls13=1"
@@ -13,10 +13,18 @@ services:
     networks:
       acmenet:
         ipv4_address: 10.30.50.2
+  challtestsrv:
+    image: letsencrypt/pebble-challtestsrv:latest
+    command: pebble-challtestsrv -defaultIPv6 "" -defaultIPv4 10.30.50.3
+    ports:
+      - 8055:8055  # HTTP Management API
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.3
   getssl:
     build:
       context: .
-      dockerfile: test/Dockerfile
+      dockerfile: test/Dockerfile-ubuntu
     container_name: getssl
     volumes:
       - .:/getssl
diff --git a/getssl b/getssl
index 0f1ef47..991f6d8 100755
--- a/getssl
+++ b/getssl
@@ -288,7 +288,8 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
     fi
   else # APIv2
     if [[ -n "$code" ]] && [[ ! "$code" == '200' ]] ; then
-      error_exit "$domain:Challenge error: $code"
+      detail=$(json_get "$response" detail)
+      error_exit "$domain:Challenge error: $code:Detail: $detail"
     fi
   fi
 
@@ -1323,7 +1324,6 @@ set_server_type() { # uses SERVER_TYPE to set REMOTE_PORT and REMOTE_EXTRA
     REMOTE_PORT=636
   elif [[ ${SERVER_TYPE} =~ ^[0-9]+$ ]]; then
     REMOTE_PORT=${SERVER_TYPE}
-    REMOTE_EXTRA="CUSTOM-HTTP-PORT"
   else
     info "${DOMAIN}: unknown server type \"$SERVER_TYPE\" in SERVER_TYPE"
     config_errors=true
@@ -2282,11 +2282,7 @@ for d in $alldomains; do
       done
       umask "$ORIG_UMASK"
 
-      if [[ "$REMOTE_EXTRA" = "CUSTOM-HTTP-PORT" ]]; then
-        wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}:${REMOTE_PORT}/.well-known/acme-challenge/$token"
-      else
-        wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
-      fi
+      wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
       debug wellknown_url "$wellknown_url"
 
       if [[ "$SKIP_HTTP_TOKEN_CHECK" == "true" ]]; then
@@ -2522,6 +2518,8 @@ fi
 if [[ ${CHECK_REMOTE} == "true" ]]; then
   sleep "$CHECK_REMOTE_WAIT"
   # shellcheck disable=SC2086
+  debug openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA}
+
   CERT_REMOTE=$(echo \
     | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
     | openssl x509 -noout -fingerprint 2>/dev/null)
@@ -2529,6 +2527,8 @@ if [[ ${CHECK_REMOTE} == "true" ]]; then
   if [[ "$CERT_LOCAL" == "$CERT_REMOTE" ]]; then
     info "${DOMAIN} - certificate installed OK on server"
   else
+    debug Fingerprint on server ${CERT_REMOTE}
+    debug Fingerprint in file ${CERT_LOCAL}
     error_exit "${DOMAIN} - certificate obtained but certificate on server is different from the new certificate"
   fi
 fi
diff --git a/test/Dockerfile-rhel6 b/test/Dockerfile-rhel6
new file mode 100644
index 0000000..5ebb278
--- /dev/null
+++ b/test/Dockerfile-rhel6
@@ -0,0 +1,27 @@
+FROM roboxes/rhel6
+# FROM centos:centos6
+# bionic = latest 18 version
+
+# Update and install required software
+RUN yum -y update
+RUN yum -y install epel-release
+RUN yum -y install git curl dnsutils wget # nginx-light
+
+WORKDIR /root
+#RUN mkdir /etc/nginx/pki
+#RUN mkdir /etc/nginx/pki/private
+#COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
+
+# BATS (Bash Automated Testings)
+# RUN git clone https://github.com/bats-core/bats-core.git
+# RUN bats-core/install.sh /usr/local
+
+EXPOSE 80 443
+
+# Run eternal loop - for testing
+CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
+
+# with Pebble
+# docker-compose -f "docker-compose.yml" up -d --build
+# docker exec -it getssl /bin/bash
+# /getssl/test/run-test.sh
diff --git a/test/Dockerfile b/test/Dockerfile-ubuntu
similarity index 61%
rename from test/Dockerfile
rename to test/Dockerfile-ubuntu
index 419d4d0..7f1a8e5 100644
--- a/test/Dockerfile
+++ b/test/Dockerfile-ubuntu
@@ -1,30 +1,28 @@
-FROM ubuntu:bionic
+FROM ubuntu:xenial
 # bionic = latest 18 version
 
 # Update and install required software
 RUN apt-get update
 # TODO work out why default version of awk fails
-RUN apt-get install -y git curl dnsutils wget linux-libc-dev make gcc binutils nginx-light gawk
+RUN apt-get install -y git curl dnsutils wget gawk nginx-light # linux-libc-dev make gcc binutils
 RUN apt-get install -y vim dos2unix # for debugging
 # TODO test with drill, dig, host
 
 WORKDIR /root
 RUN mkdir /etc/nginx/pki
 RUN mkdir /etc/nginx/pki/private
-COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
+COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
 
 # BATS (Bash Automated Testings)
 # RUN git clone https://github.com/bats-core/bats-core.git
 # RUN bats-core/install.sh /usr/local
 
-COPY test/test-config/getssl-ubuntu.cfg getssl.cfg
-
 EXPOSE 80 443
 
 # Run eternal loop - for testing
 CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
 
 # with Pebble
-# docker-compose -f "test\docker-compose.yml" up -d --build
-# docker exec -it test_getssl /bin/bash
+# docker-compose -f "docker-compose.yml" up -d --build
+# docker exec -it getssl /bin/bash
 # /getssl/test/run-test.sh
diff --git a/test/run-test.sh b/test/run-test.sh
index 5e0ba8d..e93ae89 100644
--- a/test/run-test.sh
+++ b/test/run-test.sh
@@ -1,9 +1,47 @@
-#! /bin/sh
+#! /bin/bash
+
+set -e
+
+# Test setup
+rm -r /root/.getssl
 
 wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem
-export CURL_CA_BUNDLE=/root/pebble.minica.pem
+# cat /etc/pki/tls/certs/ca-bundle.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
+cat /etc/ssl/certs/ca-certificates.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
+export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+
+curl -X POST -d '{"host":"getssl", "addresses":["10.30.50.4"]}' http://10.30.50.3:8055/add-a
+
+# Test #1 - http-01 verification
+echo Test \#1 - http-01 verification
 
-service nginx start
+cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
+service nginx restart
 /getssl/getssl -c getssl
-cp getssl.cfg /root/.getssl/getssl
+cp /getssl/test/test-config/getssl-http01.cfg /root/.getssl/getssl/getssl.cfg
+/getssl/getssl -f getssl
+
+# Test #2 - http-01 forced renewal
+echo Test \#2 - http-01 forced renewal
+
+sleep 5  # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+/getssl/getssl getssl -f
+
+# Test cleanup
+
+rm -r /root/.getssl
+
+# Test #3 - dns-01 verification
+echo Test \#3 - dns-01 verification
+
+cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
+service nginx restart
+/getssl/getssl -c getssl
+cp /getssl/test/test-config/getssl-dns01.cfg /root/.getssl/getssl/getssl.cfg
 /getssl/getssl getssl
+
+# Test #4 - dns-01 forced renewal
+echo Test \#4 - dns-01 forced renewal
+
+sleep 5  # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+/getssl/getssl getssl -f
diff --git a/test/test-config/getssl-dns01.cfg b/test/test-config/getssl-dns01.cfg
new file mode 100644
index 0000000..49c58b5
--- /dev/null
+++ b/test/test-config/getssl-dns01.cfg
@@ -0,0 +1,54 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+# The staging server is best for testing
+#CA="https://acme-staging.api.letsencrypt.org"
+# This server issues full certificates, however has rate limits
+#CA="https://acme-v01.api.letsencrypt.org"
+CA="https://pebble:14000/dir"
+
+VALIDATE_VIA_DNS=true
+DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
+DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
+# AUTH_DNS_SERVER=10.30.50.3
+
+#PRIVATE_KEY_ALG="rsa"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+# Note: this is Additional domains - so should not include the primary domain.
+SANS=""
+
+# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
+# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
+# An ssh key will be needed to provide you with access to the remote server.
+# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
+# If left blank, the username on the local server will be used to authenticate against the remote server.
+# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
+# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
+# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
+ACL=('/var/www/html/.well-known/acme-challenge')
+#     'ssh:server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
+#     'ssh:sshuserid@server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
+#     'ftp:ftpuserid:ftppassword:getssltest.hopto.org:/web/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
+
+# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
+# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
+# will be checked for certificate expiry and also will be checked after
+# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
+#SERVER_TYPE="https"
+#CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-ubuntu.cfg b/test/test-config/getssl-http01.cfg
similarity index 91%
rename from test/test-config/getssl-ubuntu.cfg
rename to test/test-config/getssl-http01.cfg
index a4db20f..f3dc5ad 100644
--- a/test/test-config/getssl-ubuntu.cfg
+++ b/test/test-config/getssl-http01.cfg
@@ -7,7 +7,11 @@
 # This server issues full certificates, however has rate limits
 #CA="https://acme-v01.api.letsencrypt.org"
 CA="https://pebble:14000/dir"
-SERVER_TYPE="5002"
+
+#VALIDATE_VIA_DNS=true
+#DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
+#DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
+
 #PRIVATE_KEY_ALG="rsa"
 
 # Additional domains - this could be multiple domains / subdomains in a comma separated list
@@ -39,7 +43,7 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="service nginx restart"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
 
 # Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
 # smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
diff --git a/test/test-config/nginx-ubuntu-sites-enabled-default b/test/test-config/nginx-ubuntu-no-ssl
similarity index 93%
rename from test/test-config/nginx-ubuntu-sites-enabled-default
rename to test/test-config/nginx-ubuntu-no-ssl
index fe02c8d..c78d646 100644
--- a/test/test-config/nginx-ubuntu-sites-enabled-default
+++ b/test/test-config/nginx-ubuntu-no-ssl
@@ -14,13 +14,18 @@
 # Default server configuration
 #
 server {
+	listen 80 default_server;
 	listen 5002 default_server;
 	listen [::]:5002 default_server;
 
 	# SSL configuration
 	#
-	listen 5001 ssl default_server;
-	listen [::]:5001 ssl default_server;
+	listen 443 default_server;
+	listen [::]:443 default_server;
+
+	listen 5001 default_server;
+	listen [::]:5001 default_server;
+
 	#
 	# Note: You should disable gzip for SSL traffic.
 	# See: https://bugs.debian.org/773332
diff --git a/test/test-config/nginx-ubuntu-ssl b/test/test-config/nginx-ubuntu-ssl
new file mode 100644
index 0000000..9f79407
--- /dev/null
+++ b/test/test-config/nginx-ubuntu-ssl
@@ -0,0 +1,92 @@
+##
+# You should look at the following URL's in order to grasp a solid understanding
+# of Nginx configuration files in order to fully unleash the power of Nginx.
+# http://wiki.nginx.org/Pitfalls
+# http://wiki.nginx.org/QuickStart
+# http://wiki.nginx.org/Configuration
+#
+# Generally, you will want to move this file somewhere, and start with a clean
+# file but keep this around for reference. Or just disable in sites-enabled.
+#
+# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
+##
+
+# Default server configuration
+#
+server {
+	listen 80 default_server;
+	listen 5002 default_server;
+	listen [::]:5002 default_server;
+
+	# SSL configuration
+	#
+    listen 443 ssl default_server;
+	listen [::]:443 ssl default_server;
+
+	listen 5001 ssl default_server;
+	listen [::]:5001 ssl default_server;
+	#
+	# Note: You should disable gzip for SSL traffic.
+	# See: https://bugs.debian.org/773332
+	#
+	# Read up on ssl_ciphers to ensure a secure configuration.
+	# See: https://bugs.debian.org/765782
+	#
+	# Self signed certs generated by the ssl-cert package
+	# Don't use them in a production server!
+	#
+	# include snippets/snakeoil.conf;
+
+	root /var/www/html;
+
+	# Add index.php to the list if you are using PHP
+	index index.html index.htm index.nginx-debian.html;
+
+	server_name _;
+    ssl_certificate /etc/nginx/pki/server.crt;
+    ssl_certificate_key /etc/nginx/pki/private/server.key;
+
+	location / {
+		# First attempt to serve request as file, then
+		# as directory, then fall back to displaying a 404.
+		try_files $uri $uri/ =404;
+	}
+
+	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
+	#
+	#location ~ \.php$ {
+	#	include snippets/fastcgi-php.conf;
+	#
+	#	# With php7.0-cgi alone:
+	#	fastcgi_pass 127.0.0.1:9000;
+	#	# With php7.0-fpm:
+	#	fastcgi_pass unix:/run/php/php7.0-fpm.sock;
+	#}
+
+	# deny access to .htaccess files, if Apache's document root
+	# concurs with nginx's one
+	#
+	#location ~ /\.ht {
+	#	deny all;
+	#}
+}
+
+
+# Virtual Host configuration for example.com
+#
+# You can move that to a different file under sites-available/ and symlink that
+# to sites-enabled/ to enable it.
+#
+#server {
+#	listen 80;
+#	listen [::]:80;
+#
+#	server_name example.com;
+#
+#	root /var/www/example.com;
+#	index index.html;
+#
+#	location / {
+#		try_files $uri $uri/ =404;
+#	}
+#}

From 3075c30faa4ba3df905ea5df7913c0ff555257b6 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Tue, 7 Jan 2020 13:10:57 +0000
Subject: [PATCH 49/93] Update revision history

---
 getssl | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/getssl b/getssl
index 991f6d8..5808f42 100755
--- a/getssl
+++ b/getssl
@@ -189,6 +189,11 @@
 # 2019-10-02 issue #425 Case insensitive processing of agreement url because of HTTP/2 (2.12)
 # 2019-10-07 update DNS checks to allow use of CNAMEs (2.13)
 # 2019-11-18 Rebased master onto APIv2 and added Content-Type: application/jose+json (2.14)
+# 2019-11-20 #453 and #454 Add User-Agent to all curl requests
+# 2019-11-22 #456 Fix shellcheck issues
+# 2019-11-23 #459 Fix missing chain.crt
+# 2019-12-18 #462 Use POST-as-GET for ACMEv2 endpoints
+# 2020-01-07 #464 and #486 "json was blank" (change all curl request to use POST-as-GET) (2.15)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
@@ -2518,8 +2523,6 @@ fi
 if [[ ${CHECK_REMOTE} == "true" ]]; then
   sleep "$CHECK_REMOTE_WAIT"
   # shellcheck disable=SC2086
-  debug openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA}
-
   CERT_REMOTE=$(echo \
     | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
     | openssl x509 -noout -fingerprint 2>/dev/null)
@@ -2527,8 +2530,6 @@ if [[ ${CHECK_REMOTE} == "true" ]]; then
   if [[ "$CERT_LOCAL" == "$CERT_REMOTE" ]]; then
     info "${DOMAIN} - certificate installed OK on server"
   else
-    debug Fingerprint on server ${CERT_REMOTE}
-    debug Fingerprint in file ${CERT_LOCAL}
     error_exit "${DOMAIN} - certificate obtained but certificate on server is different from the new certificate"
   fi
 fi

From a5313f4f31d20165eaf0e7b2d41c91f26b316b62 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 8 Jan 2020 21:51:07 +0000
Subject: [PATCH 50/93] error_exit if rate limited and exit if curl returns
 nothing

---
 getssl | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index fbfabaa..f0b31f5 100755
--- a/getssl
+++ b/getssl
@@ -293,7 +293,7 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
     fi
   else # APIv2
     if [[ -n "$code" ]] && [[ ! "$code" == '200' ]] ; then
-      detail=$(json_get "$response" detail)
+      detail=$(echo "$response" | grep "detail" | awk -F\" '{print $4}')
       error_exit "$domain:Challenge error: $code:Detail: $detail"
     fi
   fi
@@ -1428,6 +1428,10 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
         response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url")
       fi
 
+      if [[ "$response" == "" ]]; then
+        error_exit "ERROR curl \"$url\" returned nothing"
+      fi
+
       responseHeaders=$(cat "$CURL_HEADER")
       if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
         # response is in base64 too, decode
@@ -1462,6 +1466,9 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
           error_exit "500 error from ACME server:  $response"
         fi
       fi
+      if [[ "$code" -eq 429 ]]; then
+        error_exit "429 rate limited error from ACME server"
+      fi
     done
     if [[ $response == *"error:badNonce"* ]]; then
       debug "bad nonce"

From 2dbaf3e14d1d65dca263dc49ec235334bab4c022 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 10 Jan 2020 19:24:57 +0000
Subject: [PATCH 51/93] Update templates, clean up test code

---
 getssl                 | 12 +++++++-----
 test/Dockerfile-rhel6  |  5 -----
 test/Dockerfile-ubuntu |  5 -----
 test/README.md         | 20 ++++++++++++++++++++
 test/run-test.sh       | 14 ++++++++++----
 5 files changed, 37 insertions(+), 19 deletions(-)
 create mode 100644 test/README.md

diff --git a/getssl b/getssl
index f0b31f5..5d46286 100755
--- a/getssl
+++ b/getssl
@@ -193,7 +193,9 @@
 # 2019-11-22 #456 Fix shellcheck issues
 # 2019-11-23 #459 Fix missing chain.crt
 # 2019-12-18 #462 Use POST-as-GET for ACMEv2 endpoints
-# 2020-01-07 #464 and #486 "json was blank" (change all curl request to use POST-as-GET) (2.15)
+# 2020-01-07 #464 and #486 "json was blank" (change all curl request to use POST-as-GET)
+# 2020-01-08 Error and exit if rate limited, exit if curl returns nothing
+# 2020-01-10 Change domain and getssl templates to v2 (2.15)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
@@ -212,7 +214,7 @@ CODE_LOCATION="https://raw.githubusercontent.com/srvrco/getssl/master/getssl"
 CSR_SUBJECT="/"
 CURL_USERAGENT="${PROGNAME}/${VERSION}"
 DEACTIVATE_AUTH="false"
-DEFAULT_REVOKE_CA="https://acme-v01.api.letsencrypt.org"
+DEFAULT_REVOKE_CA="https://acme-v02.api.letsencrypt.org"
 DNS_EXTRA_WAIT=""
 DNS_WAIT=10
 DOMAIN_KEY_LENGTH=4096
@@ -1566,7 +1568,7 @@ write_domain_template() { # write out a template file for a domain.
 	# The staging server is best for testing
 	#CA="https://acme-staging-v02.api.letsencrypt.org/directory"
 	# This server issues full certificates, however has rate limits
-	#CA="https://acme-v01.api.letsencrypt.org"
+	#CA="https://acme-v02.api.letsencrypt.org"
 
 	#PRIVATE_KEY_ALG="rsa"
 
@@ -1619,7 +1621,7 @@ write_getssl_template() { # write out the main template file
 	# The staging server is best for testing (hence set as default)
 	CA="https://acme-staging-v02.api.letsencrypt.org/directory"
 	# This server issues full certificates, however has rate limits
-	#CA="https://acme-v01.api.letsencrypt.org"
+	#CA="https://acme-v02.api.letsencrypt.org"
 
 	#AGREEMENT="$AGREEMENT"
 
@@ -2021,7 +2023,7 @@ if [[ -s "$CERT_FILE" ]]; then
     enddate_s=$(date_epoc "$enddate")
     if [[ $(date_renew) -lt "$enddate_s" ]] && [[ $_FORCE_RENEW -ne 1 ]]; then
       issuer=$(openssl x509 -in "$CERT_FILE" -noout -issuer 2>/dev/null)
-      if [[ "$issuer" == *"Fake LE Intermediate"* ]] && [[ "$CA" == "https://acme-v01.api.letsencrypt.org" ]]; then
+      if [[ "$issuer" == *"Fake LE Intermediate"* ]] && [[ "$CA" == "https://acme-v02.api.letsencrypt.org" ]]; then
         debug "upgrading from fake cert to real"
       else
         info "${DOMAIN}: certificate is valid for more than $RENEW_ALLOW days (until $enddate)"
diff --git a/test/Dockerfile-rhel6 b/test/Dockerfile-rhel6
index 5ebb278..019da84 100644
--- a/test/Dockerfile-rhel6
+++ b/test/Dockerfile-rhel6
@@ -20,8 +20,3 @@ EXPOSE 80 443
 
 # Run eternal loop - for testing
 CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
-
-# with Pebble
-# docker-compose -f "docker-compose.yml" up -d --build
-# docker exec -it getssl /bin/bash
-# /getssl/test/run-test.sh
diff --git a/test/Dockerfile-ubuntu b/test/Dockerfile-ubuntu
index 7f1a8e5..b0f09f8 100644
--- a/test/Dockerfile-ubuntu
+++ b/test/Dockerfile-ubuntu
@@ -21,8 +21,3 @@ EXPOSE 80 443
 
 # Run eternal loop - for testing
 CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
-
-# with Pebble
-# docker-compose -f "docker-compose.yml" up -d --build
-# docker exec -it getssl /bin/bash
-# /getssl/test/run-test.sh
diff --git a/test/README.md b/test/README.md
new file mode 100644
index 0000000..9d0aedd
--- /dev/null
+++ b/test/README.md
@@ -0,0 +1,20 @@
+# Testing
+
+This directory contains a simple test script which tests creating certificates with Pebble (testing version of the LetsEncrypt server)
+
+Start up pebble, the challdnstest server for DNS challenges
+`docker-compose -f "docker-compose.yml" up -d --build`
+
+Run the tests
+`docker exec -it getssl /getssl/test/run-test.sh`
+
+Debug (need to set CURL_CA_BUNDLE as pebble uses a local certificate, otherwise you get a "unknown API version" error)
+`docker exec -it getssl /bin/bash`
+`export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt`
+`/getssl/getssl -d getssl`
+
+# TODO
+1. Move to BATS (bash automated testing) instead of run-test.sh
+2. Test RHEL6, Debian as well
+3. Test SSH, SFTP
+4. Test wildcards
diff --git a/test/run-test.sh b/test/run-test.sh
index e93ae89..b983899 100644
--- a/test/run-test.sh
+++ b/test/run-test.sh
@@ -3,7 +3,9 @@
 set -e
 
 # Test setup
-rm -r /root/.getssl
+if [[ -d /root/.getssl ]]; then
+    rm -r /root/.getssl
+fi
 
 wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem
 # cat /etc/pki/tls/certs/ca-bundle.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
@@ -24,11 +26,12 @@ cp /getssl/test/test-config/getssl-http01.cfg /root/.getssl/getssl/getssl.cfg
 # Test #2 - http-01 forced renewal
 echo Test \#2 - http-01 forced renewal
 
-sleep 5  # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+# There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+echo Sleeping 20s to allow previous validation to expire
+sleep 20
 /getssl/getssl getssl -f
 
 # Test cleanup
-
 rm -r /root/.getssl
 
 # Test #3 - dns-01 verification
@@ -43,5 +46,8 @@ cp /getssl/test/test-config/getssl-dns01.cfg /root/.getssl/getssl/getssl.cfg
 # Test #4 - dns-01 forced renewal
 echo Test \#4 - dns-01 forced renewal
 
-sleep 5  # There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+# There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
+echo Sleeping 30s to allow previous validation to expire
+sleep 30
+
 /getssl/getssl getssl -f

From 9895a211d83beb39bfabffde1f034cfaac7b190c Mon Sep 17 00:00:00 2001
From: srvrco <andy@serverco.com>
Date: Mon, 13 Jan 2020 09:28:03 +0000
Subject: [PATCH 52/93] correcting version number

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 5d46286..e52b3d0 100755
--- a/getssl
+++ b/getssl
@@ -199,7 +199,7 @@
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.14"
+VERSION="2.15"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096

From 8203c38b364e28e42dd6951286a70a0df63111d8 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Thu, 16 Jan 2020 11:48:02 +0000
Subject: [PATCH 53/93] Disable auth reuse to fix force-renew tests

---
 docker-compose.yml |  2 ++
 test/run-test.sh   | 10 ----------
 2 files changed, 2 insertions(+), 10 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index b770b44..f4b3567 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,6 +7,8 @@ services:
     environment:
       # with Go 1.13.x which defaults TLS 1.3 to on
       GODEBUG: "tls13=1"
+      # don't reuse authorizations (breaks testing force renew)
+      PEBBLE_AUTHZREUSE: 0
     ports:
       - 14000:14000  # HTTPS ACME API
       - 15000:15000  # HTTPS Management API
diff --git a/test/run-test.sh b/test/run-test.sh
index b983899..8051922 100644
--- a/test/run-test.sh
+++ b/test/run-test.sh
@@ -25,10 +25,6 @@ cp /getssl/test/test-config/getssl-http01.cfg /root/.getssl/getssl/getssl.cfg
 
 # Test #2 - http-01 forced renewal
 echo Test \#2 - http-01 forced renewal
-
-# There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
-echo Sleeping 20s to allow previous validation to expire
-sleep 20
 /getssl/getssl getssl -f
 
 # Test cleanup
@@ -36,7 +32,6 @@ rm -r /root/.getssl
 
 # Test #3 - dns-01 verification
 echo Test \#3 - dns-01 verification
-
 cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
 service nginx restart
 /getssl/getssl -c getssl
@@ -45,9 +40,4 @@ cp /getssl/test/test-config/getssl-dns01.cfg /root/.getssl/getssl/getssl.cfg
 
 # Test #4 - dns-01 forced renewal
 echo Test \#4 - dns-01 forced renewal
-
-# There's a race condition if renew too soon (authlink returns "valid" instead of "pending")
-echo Sleeping 30s to allow previous validation to expire
-sleep 30
-
 /getssl/getssl getssl -f

From f17590af52c0db97fd3105cd66aa187e5240c2ce Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Thu, 16 Jan 2020 11:50:55 +0000
Subject: [PATCH 54/93] Revert ready for challenge for ACME v1

---
 getssl | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index e52b3d0..5352e11 100755
--- a/getssl
+++ b/getssl
@@ -286,14 +286,15 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
   keyauthorization=$3
 
   debug "sending request to ACME server saying we're ready for challenge"
-  send_signed_request "$uri" "{}"
 
   # check response from our request to perform challenge
   if [[ $API -eq 1 ]]; then
+    send_signed_request "$uri" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
     if [[ -n "$code" ]] && [[ ! "$code" == '202' ]] ; then
       error_exit "$domain:Challenge error: $code"
     fi
   else # APIv2
+    send_signed_request "$uri" "{}"
     if [[ -n "$code" ]] && [[ ! "$code" == '200' ]] ; then
       detail=$(echo "$response" | grep "detail" | awk -F\" '{print $4}')
       error_exit "$domain:Challenge error: $code:Detail: $detail"
@@ -303,7 +304,13 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
   # loop "forever" to keep checking for a response from the ACME server.
   while true ; do
     debug "checking if challenge is complete"
-    send_signed_request "$uri" ""
+    if [[ $API -eq 1 ]]; then
+      if ! get_cr "$uri" ; then
+        error_exit "$domain:Verify error:$code"
+      fi
+    else # APIv2
+      send_signed_request "$uri" ""
+    fi
 
     status=$(json_get "$response" status)
 

From 770277c7ad72b7c78ebcfdec8ba5a7ac4a5089c8 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Thu, 16 Jan 2020 18:27:11 +0100
Subject: [PATCH 55/93] Add support for CloudDNS

---
 dns_scripts/dns_add_clouddns |  94 ++++++++++++++++++++++++++++++++
 dns_scripts/dns_del_clouddns | 101 +++++++++++++++++++++++++++++++++++
 2 files changed, 195 insertions(+)
 create mode 100755 dns_scripts/dns_add_clouddns
 create mode 100755 dns_scripts/dns_del_clouddns

diff --git a/dns_scripts/dns_add_clouddns b/dns_scripts/dns_add_clouddns
new file mode 100755
index 0000000..5236269
--- /dev/null
+++ b/dns_scripts/dns_add_clouddns
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Need to add your email address and API key to clouddns below or set as env variables
+email=${CLOUDDNS_EMAIL:-''}
+password=${CLOUDDNS_PASSWORD:-''}
+client=${CLOUDDNS_CLIENT:-''}
+
+# This script adds a token to clouddns DNS for the ACME challenge
+# usage dns_add_clouddns "domain name" "token"
+# return codes are;
+# 0 - success
+# 1 - error in input
+# 2 - error within internal processing
+# 3 - error in result ( domain not found in clouddns etc)
+
+fulldomain="${1}"
+token="${2}"
+API='https://admin.vshosting.cloud/clouddns'
+LOGIN_API='https://admin.vshosting.cloud/api/public/auth/login'
+
+# Check initial parameters
+if [[ -z "$fulldomain" ]]; then
+  echo "DNS script requires full domain name as first parameter"
+  exit 1
+fi
+if [[ -z "$token" ]]; then
+  echo "DNS script requires challenge token as second parameter"
+  exit 1
+fi
+if [[ -z "$email" ]]; then
+  echo "CLOUDDNS_EMAIL (email) parameter not set"
+  exit 1
+fi
+if [[ -z "$password" ]]; then
+  echo "CLOUDDNS_PASSWORD (password) parameter not set"
+  exit 1
+fi
+if [[ -z "$client" ]]; then
+  echo "CLOUDDNS_CLIENT (id) parameter not set"
+  exit 1
+fi
+
+# Login to clouddns to get accessToken
+resp=$(curl --silent -X POST -H 'Content-Type: application/json' "$LOGIN_API" \
+  --data "{\"email\": \"$email\", \"password\": \"$password\"}")
+re='"accessToken":"([^,]*)",' # Match access token
+if [[ "${resp// }" =~ $re ]]; then
+  access_token="${BASH_REMATCH[1]}"
+fi
+if [[ -z "$access_token" ]]; then
+  echo 'Could not get access token; check your credentials'
+  exit 3
+fi
+curl_params=( -H "Authorization: Bearer $access_token" -H 'Content-Type: application/json' )
+
+# Get main domain
+domain_root=$(echo "$fulldomain" | awk -F\. '{print $(NF-1) FS $NF}')
+
+# Get domain id
+resp=$(curl --silent "${curl_params[@]}" -X POST "$API/domain/search" \
+  --data "{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$client\"}, {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}")
+re='domainType":"[^"]*","id":"([^,]*)",' # Match domain id
+if [[ "${resp//[$'\t\r\n ']}" =~ $re ]]; then
+  domain_id="${BASH_REMATCH[1]}"
+fi
+
+if [[ -z "$domain_id" ]]; then
+  echo 'Domain name not found on your CloudDNS account'
+  exit 3
+fi
+
+# Add challenge record
+txt_record="_acme-challenge.$domain_root."
+resp=$(curl --silent "${curl_params[@]}" -X POST "$API/record-txt" \
+  --data "{\"type\":\"TXT\",\"name\":\"$txt_record\",\"value\":\"$token\",\"domainId\":\"$domain_id\"}")
+
+# If adding record failed (error:) then print error message
+if [[ "${resp// }" == *'"error"'* ]]; then
+  if [[ "${resp// }" == *'"code":4136'* ]]; then
+    echo "DNS challenge token already exists"
+    exit
+  fi
+  re='"message":"([^"]+)"'
+  if [[ "$resp" =~ $re ]]; then
+    echo "Error: DNS challenge not added: ${BASH_REMATCH[1]}"
+    exit 3
+  else
+    echo "Error: DNS challenge not added: unknown error - ${resp}"
+    exit 3
+  fi
+fi
+
+# Publish challenge record
+resp=$(curl --silent "${curl_params[@]}" -X PUT "$API/domain/$domain_id/publish" \
+  --data "{\"soaTtl\":300}")
diff --git a/dns_scripts/dns_del_clouddns b/dns_scripts/dns_del_clouddns
new file mode 100755
index 0000000..ddac2b6
--- /dev/null
+++ b/dns_scripts/dns_del_clouddns
@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+# Need to add your email address and API key to clouddns below or set as env variables
+email=${CLOUDDNS_EMAIL:-''}
+password=${CLOUDDNS_PASSWORD:-''}
+client=${CLOUDDNS_CLIENT:-''}
+
+# This script adds a token to clouddns DNS for the ACME challenge
+# usage dns_add_clouddns "domain name" "token"
+# return codes are;
+# 0 - success
+# 1 - error in input
+# 2 - error within internal processing
+# 3 - error in result ( domain not found in clouddns etc)
+
+fulldomain="${1}"
+token="${2}"
+API='https://admin.vshosting.cloud/clouddns'
+LOGIN_API='https://admin.vshosting.cloud/api/public/auth/login'
+
+# Check initial parameters
+if [[ -z "$fulldomain" ]]; then
+  echo "DNS script requires full domain name as first parameter"
+  exit 1
+fi
+if [[ -z "$token" ]]; then
+  echo "DNS script requires challenge token as second parameter"
+  exit 1
+fi
+if [[ -z "$email" ]]; then
+  echo "CLOUDDNS_EMAIL (email) parameter not set"
+  exit 1
+fi
+if [[ -z "$password" ]]; then
+  echo "CLOUDDNS_PASSWORD (password) parameter not set"
+  exit 1
+fi
+if [[ -z "$client" ]]; then
+  echo "CLOUDDNS_CLIENT (id) parameter not set"
+  exit 1
+fi
+
+# Login to clouddns to get accessToken
+resp=$(curl --silent -X POST -H 'Content-Type: application/json' "$LOGIN_API" \
+  --data "{\"email\": \"$email\", \"password\": \"$password\"}")
+re='"accessToken":"([^,]*)",' # Match access token
+if [[ "${resp// }" =~ $re ]]; then
+  access_token="${BASH_REMATCH[1]}"
+fi
+if [[ -z "$access_token" ]]; then
+  echo 'Could not get access token; check your credentials'
+  exit 3
+fi
+curl_params=( -H "Authorization: Bearer $access_token" -H 'Content-Type: application/json' )
+
+# Get main domain and challenge record
+domain_root=$(echo "$fulldomain" | awk -F\. '{print $(NF-1) FS $NF}')
+txt_record="_acme-challenge.$domain_root."
+
+# Get domain id
+curl_domainid_body="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$client\"}, {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"
+resp=$(curl --silent "${curl_params[@]}" -X POST -d "$curl_domainid_body" "$API/domain/search")
+re='domainType":"[^"]*","id":"([^,]*)",' # Find result section
+if [[ "${resp//[$'\t\r\n ']}" =~ $re ]]; then
+  domain_id="${BASH_REMATCH[1]}"
+fi
+
+if [[ -z "$domain_id" ]]; then
+  echo 'Domain name not found on your CloudDNS account'
+  exit 3
+fi
+
+# Get challenge record ID
+resp=$(curl --silent "${curl_params[@]}" -X GET "$API/domain/$domain_id" )
+re="\"lastDomainRecordList\".*\"id\":\"([^,]*)\"[^}]*\"name\":\"$txt_record\"," # Match domain id
+if [[ "${resp//[$'\t\r\n ']}" =~ $re ]]; then
+  record_id="${BASH_REMATCH[1]}"
+fi
+
+if [[ -z "$record_id" ]]; then
+  echo 'Challenge record does not exist'
+  exit 3
+fi
+
+# Remove challenge record
+resp=$(curl --silent "${curl_params[@]}" -X DELETE "$API/record/$record_id")
+
+# If removing record failed (error:) then print error message
+if [[ "${resp// }" == *'"error"'* ]]; then
+  re='"message":"([^"]+)"'
+  if [[ "$resp" =~ $re ]]; then
+    echo "Error: DNS challenge not removed: ${BASH_REMATCH[1]}"
+    exit 3
+  else
+    echo "Error: DNS challenge not removed: unknown error - ${resp}"
+    exit 3
+  fi
+fi
+
+# Publish challenge record deletion
+resp=$(curl --silent "${curl_params[@]}" -X PUT "$API/domain/$domain_id/publish" \
+  --data "{\"soaTtl\":300}")

From 6c9f0e7655beb760b33a764f60b4ebd5c49ee445 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Thu, 16 Jan 2020 18:30:24 +0100
Subject: [PATCH 56/93] Update changelog

---
 getssl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/getssl b/getssl
index e52b3d0..f1e2989 100755
--- a/getssl
+++ b/getssl
@@ -196,6 +196,7 @@
 # 2020-01-07 #464 and #486 "json was blank" (change all curl request to use POST-as-GET)
 # 2020-01-08 Error and exit if rate limited, exit if curl returns nothing
 # 2020-01-10 Change domain and getssl templates to v2 (2.15)
+# 2020-01-16 Add support for CloudDNS
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}

From b8b70f7ceea852bc6194a32cb9959d68c81efeb1 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Thu, 16 Jan 2020 18:49:08 +0100
Subject: [PATCH 57/93] Support certificates with SANs

---
 dns_scripts/dns_add_clouddns | 2 +-
 dns_scripts/dns_del_clouddns | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dns_scripts/dns_add_clouddns b/dns_scripts/dns_add_clouddns
index 5236269..a4e3f81 100755
--- a/dns_scripts/dns_add_clouddns
+++ b/dns_scripts/dns_add_clouddns
@@ -69,7 +69,7 @@ if [[ -z "$domain_id" ]]; then
 fi
 
 # Add challenge record
-txt_record="_acme-challenge.$domain_root."
+txt_record="_acme-challenge.$fulldomain."
 resp=$(curl --silent "${curl_params[@]}" -X POST "$API/record-txt" \
   --data "{\"type\":\"TXT\",\"name\":\"$txt_record\",\"value\":\"$token\",\"domainId\":\"$domain_id\"}")
 
diff --git a/dns_scripts/dns_del_clouddns b/dns_scripts/dns_del_clouddns
index ddac2b6..ec22c91 100755
--- a/dns_scripts/dns_del_clouddns
+++ b/dns_scripts/dns_del_clouddns
@@ -54,7 +54,7 @@ curl_params=( -H "Authorization: Bearer $access_token" -H 'Content-Type: applica
 
 # Get main domain and challenge record
 domain_root=$(echo "$fulldomain" | awk -F\. '{print $(NF-1) FS $NF}')
-txt_record="_acme-challenge.$domain_root."
+txt_record="_acme-challenge.$fulldomain."
 
 # Get domain id
 curl_domainid_body="{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$client\"}, {\"name\": \"domainName\", \"operator\": \"eq\", \"value\": \"$domain_root.\"}]}"

From 197c5f8faa86d146ec69666a58f9f00e0f7ed149 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 17 Jan 2020 20:34:14 +0000
Subject: [PATCH 58/93] Ignore base64 errors

---
 getssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/getssl b/getssl
index 5352e11..8269195 100755
--- a/getssl
+++ b/getssl
@@ -196,10 +196,11 @@
 # 2020-01-07 #464 and #486 "json was blank" (change all curl request to use POST-as-GET)
 # 2020-01-08 Error and exit if rate limited, exit if curl returns nothing
 # 2020-01-10 Change domain and getssl templates to v2 (2.15)
+# 2020-01-17 #473 and #477 Don't use POST-as-GET when sending ready for challenge for ACMEv1 (2.16)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.15"
+VERSION="2.16"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -1444,8 +1445,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
       responseHeaders=$(cat "$CURL_HEADER")
       if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
         # response is in base64 too, decode
-        #!FIXME need to use openssl base64 decoder if it exists
-        response=$(echo "$response" | base64 -d)
+        response=$(echo "$response" | base64 -d 2>&1)
       fi
 
       debug responseHeaders "$responseHeaders"

From 6138f4ab1f27908eca837e26f362f9e254a40f9e Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Tue, 21 Jan 2020 09:42:05 +0100
Subject: [PATCH 59/93] make markdownlint happy

---
 test/README.md | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/test/README.md b/test/README.md
index 9d0aedd..086c58a 100644
--- a/test/README.md
+++ b/test/README.md
@@ -1,19 +1,31 @@
 # Testing
 
-This directory contains a simple test script which tests creating certificates with Pebble (testing version of the LetsEncrypt server)
+This directory contains a simple test script which tests creating
+certificates with Pebble (testing version of the LetsEncrypt server)
 
 Start up pebble, the challdnstest server for DNS challenges
-`docker-compose -f "docker-compose.yml" up -d --build`
+
+```sh
+docker-compose -f "docker-compose.yml" up -d --build
+```
 
 Run the tests
-`docker exec -it getssl /getssl/test/run-test.sh`
 
-Debug (need to set CURL_CA_BUNDLE as pebble uses a local certificate, otherwise you get a "unknown API version" error)
-`docker exec -it getssl /bin/bash`
-`export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt`
-`/getssl/getssl -d getssl`
+```sh
+docker exec -it getssl /getssl/test/run-test.sh
+```
+
+Debug (need to set `CURL_CA_BUNDLE` as pebble uses a local certificate,
+otherwise you get a "unknown API version" error)
+
+```sh
+docker exec -it getssl /bin/bash
+export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+/getssl/getssl -d getssl
+```
+
+## TODO
 
-# TODO
 1. Move to BATS (bash automated testing) instead of run-test.sh
 2. Test RHEL6, Debian as well
 3. Test SSH, SFTP

From 8db7744b3ee20c1b204057b5bc1df3b7742817c3 Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Tue, 21 Jan 2020 09:48:34 +0100
Subject: [PATCH 60/93] implement the suggested fix in #277

---
 getssl | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/getssl b/getssl
index 939b351..78e9df3 100755
--- a/getssl
+++ b/getssl
@@ -234,7 +234,6 @@ SERVER_TYPE="https"
 SKIP_HTTP_TOKEN_CHECK="false"
 SSLCONF="$(openssl version -d 2>/dev/null| cut -d\" -f2)/openssl.cnf"
 OCSP_MUST_STAPLE="false"
-IGNORE_PERIOD_CHECK="false"
 TEMP_UPGRADE_FILE=""
 TOKEN_USER_ID=""
 USE_SINGLE_ACL="false"
@@ -1831,8 +1830,8 @@ if [[ ${_CHECK_ALL} -eq 1 ]]; then
       if [[ ${_QUIET} -eq 1 ]]; then
         cmd="$cmd -q"
       fi
-      # check if $dir looks like a domain name (contains a period)
-      if [[ $(basename "$dir") == *.* || "$IGNORE_PERIOD_CHECK" == "true" ]]; then
+      # check if $dir is a directory with a getssl.cfg in it
+      if [[ -f "$dir/getssl.cfg" ]]; then
         cmd="$cmd -w $WORKING_DIR $(basename "$dir")"
         debug "CMD: $cmd"
         eval "$cmd"

From 8c7cd703b583e4095c5e41f338388743e8b88c63 Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Tue, 21 Jan 2020 10:06:47 +0100
Subject: [PATCH 61/93] lint CONTRIBUTING.md

---
 CONTRIBUTING.md | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 482a7aa..3c8242c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,24 +1,31 @@
 # How to contribute
 
-If you are happy writing in bash, please create a PR for any changes you'd like to see included (or bug fixes).  
+If you are happy writing in bash, please create a PR for any changes
+you'd like to see included (or bug fixes).
 
-If you aren't happy writing in bash, please open an issue with as much detail as possible about the issue or what you'd like to see added / improved.
+If you aren't happy writing in bash, please open an issue with as much
+detail as possible about the issue or what you'd like to see added /
+improved.
 
 ## Submitting changes
 
-Please update the 'revision history' and version number at the top of the code (without this I can't easily do a merge)
+Please update the 'revision history' and version number at the top of
+the code (without this I can't easily do a merge)
 
-Please update just one issue per PR.   If there are multiple issues, please provide separate PR's one per issue. 
+Please update just one issue per PR. If there are multiple issues,
+please provide separate PR's one per issue.
 
 ## Coding conventions
 
-Please see the guidelines at https://github.com/srvrco/getssl/wiki/Bash-Style-guide
+Please see the guidelines at <https://github.com/srvrco/getssl/wiki/Bash-Style-guide>
 
 ## Testing
 
-Please test with [shellcheck](https://github.com/koalaman/shellcheck), although this will also be tested on github ( via travis) on all PRs. 
+Please test with [shellcheck](https://github.com/koalaman/shellcheck),
+although this will also be tested on github (via travis) on all PRs.
 
-Please remember that the system is used across a wide range of platforms, so if you have access to multiple operating systems, please test on all.
+Please remember that the system is used across a wide range of
+platforms, so if you have access to multiple operating systems, please
+test on all.
 
-
-Thanks :) 
+Thanks :)

From 2c1a894224ec57b674d367c5cbd5f0ee3ef70ab7 Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Tue, 21 Jan 2020 10:07:08 +0100
Subject: [PATCH 62/93] lint bug_report.md

---
 .github/ISSUE_TEMPLATE/bug_report.md | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index 116d2a5..135ea05 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -12,6 +12,7 @@ A clear and concise description of what the bug is.
 
 **To Reproduce**
 Steps to reproduce the behavior:
+
 1. Go to '...'
 2. Click on '....'
 3. Scroll down to '....'
@@ -21,8 +22,9 @@ Steps to reproduce the behavior:
 A clear and concise description of what you expected to happen.
 
 **Operating system (please complete the following information):**
- - OS: [e.g. Debian 9, Ubuntu 18.04, freeBSD ]
- - Bash Version [e.g. GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)]
+
+- OS: [e.g. Debian 9, Ubuntu 18.04, freeBSD ]
+- Bash Version [e.g. GNU bash, version 4.4.12(1)-release (x86_64-pc-linux-gnu)]
 
 **Additional context**
 Add any other context about the problem here.

From 0891d37372bbb86677108aae019c4e454ecf6e7f Mon Sep 17 00:00:00 2001
From: Yannic Haupenthal <yhaupenthal@posteo.de>
Date: Tue, 21 Jan 2020 10:07:18 +0100
Subject: [PATCH 63/93] lint README.md (and fix some punctuation)

---
 README.md | 170 ++++++++++++++++++++++++++++++++++++++----------------
 1 file changed, 121 insertions(+), 49 deletions(-)

diff --git a/README.md b/README.md
index 8549bda..1d0d3fc 100644
--- a/README.md
+++ b/README.md
@@ -1,44 +1,76 @@
 # getssl
-Obtain SSL certificates from the letsencrypt.org ACME server.  Suitable for automating the process on remote servers.
+
+Obtain SSL certificates from the letsencrypt.org ACME server. Suitable
+for automating the process on remote servers.
 
 ## Features
-* **Bash** - It runs on virtually all unix machines, including BSD, most Linux distributions, macOS.
-* **Get certificates for remote servers** - The tokens used to provide validation of domain ownership, and the certificates themselves can be automatically copied to remote servers (via ssh, sftp or ftp for tokens). The script doesn't need to run on the server itself. This can be useful if you don't have access to run such scripts on the server itself, e.g. if it's a shared server.
-* **Runs as a daily cron** - so certificates will be automatically renewed when required.
+
+* **Bash** - It runs on virtually all unix machines, including BSD, most
+  Linux distributions, macOS.
+* **Get certificates for remote servers** - The tokens used to provide
+  validation of domain ownership, and the certificates themselves can be
+  automatically copied to remote servers (via ssh, sftp or ftp for
+  tokens). The script doesn't need to run on the server itself. This can
+  be useful if you don't have access to run such scripts on the server
+  itself, e.g. if it's a shared server.
+* **Runs as a daily cron** - so certificates will be automatically
+  renewed when required.
 * **Automatic certificate renewals**
-* **Checks certificates are correctly loaded**. After installation of a new certificate it will test the port specified ( see [Server-Types](#server-types) for options ) that the certificate is actually being used correctly.
-* **Automatically updates** - The script can automatically update itself with bug fixes etc if required.
-* **Extensively configurable** - With a simple configuration file for each certificate it is possible to configure it exactly for your needs, whether a simple single domain or multiple domains across multiple servers on the same certificate.
+* **Checks certificates are correctly loaded** - After installation of a
+  new certificate it will test the port specified ( see
+  [Server-Types](#server-types) for options ) that the certificate is
+  actually being used correctly.
+* **Automatically updates** - The script can automatically update itself
+  with bug fixes etc if required.
+* **Extensively configurable** - With a simple configuration file for
+  each certificate it is possible to configure it exactly for your
+  needs, whether a simple single domain or multiple domains across
+  multiple servers on the same certificate.
 * **Supports http and dns challenges** - Full ACME implementation
 * **Simple and easy to use**
-* **Detailed debug info** - Whilst it shouldn't be needed, detailed debug information is available.
-* **Reload services** - After a new certificate is obtained then the relevant services (e.g. apache/nginx/postfix) can be reloaded.
+* **Detailed debug info** - Whilst it shouldn't be needed, detailed
+  debug information is available.
+* **Reload services** - After a new certificate is obtained then the
+  relevant services (e.g. apache/nginx/postfix) can be reloaded.
 * **ACME v1 and V2** - Supports both ACME versions 1 and 2
 
 ## Installation
-Since the script is only one file, you can use the following command for a quick installation of GetSSL only:
-```
+
+Since the script is only one file, you can use the following command for
+a quick installation of GetSSL only:
+
+```sh
 curl --silent https://raw.githubusercontent.com/srvrco/getssl/master/getssl > getssl ; chmod 700 getssl
 ```
-This will copy the getssl Bash script to the current location and change the permissions to make it executable for you.
 
-For a more comprehensive installation (e.g. install also helper scripts) use the provided Makefile with each release tarball. Use the `install` target.
+This will copy the getssl Bash script to the current location and change
+the permissions to make it executable for you.
+
+For a more comprehensive installation (e.g. install also helper scripts)
+use the provided Makefile with each release tarball. Use the `install`
+target.
 
 You'll find the latest version in the git repository:
 
-```
+```sh
 git clone https://github.com/srvrco/getssl.git
 ```
 
-For Arch Linux there are packages in the AUR, see [here](https://aur.archlinux.org/packages/getssl/) and [there](https://aur.archlinux.org/packages/getssl-git/).
+For Arch Linux there are packages in the AUR, see
+[here](https://aur.archlinux.org/packages/getssl/) and
+[there](https://aur.archlinux.org/packages/getssl-git/).
 
-If you use puppet, there is a [GetSSL Puppet module](https://github.com/dthielking/puppet_getssl) by dthielking
+If you use puppet, there is a [GetSSL Puppet
+module](https://github.com/dthielking/puppet_getssl) by dthielking
 
 ## Overview
 
-GetSSL was written in standard bash ( so it can be run on a server,  a desktop computer, or even a virtualbox) and add the checks, and certificates to a remote server ( providing you have a ssh with key, sftp or ftp access to the remote server).
+GetSSL was written in standard bash ( so it can be run on a server, a
+desktop computer, or even a virtualbox) and add the checks, and
+certificates to a remote server ( providing you have a ssh with key,
+sftp or ftp access to the remote server).
 
-```
+```getssl
 getssl ver. 2.02
 Obtain SSL certificates from the letsencrypt.org ACME server
 
@@ -63,27 +95,36 @@ Options:
 
 Once you have obtained the script (see Installation above), the next step is to use
 
-```./getssl -c yourdomain.com```
+```sh
+./getssl -c yourdomain.com
+```
 
-where yourdomain.com is the primary domain name that you want to create a certificate for.   This will create the following folders and files.
+where yourdomain.com is the primary domain name that you want to create
+a certificate for. This will create the following folders and files.
 
-```
+```sh
 ~/.getssl
 ~/.getssl/getssl.cfg
 ~/.getssl/yourdomain.com
 ~/.getssl/yourdomain.com/getssl.cfg
 ```
 
-You can then edit ~/.getssl/getssl.cfg to set the values you want as the default for the majority of your certificates.
-
-Then edit ~/.getssl/yourdomain.com/getssl.cfg to have the values you want for this specific domain (make sure to uncomment and specify correct `ACL` option, since it is required).
+You can then edit `~/.getssl/getssl.cfg` to set the values you want as the
+default for the majority of your certificates.
 
-You can then just run;
+Then edit `~/.getssl/yourdomain.com/getssl.cfg` to have the values you
+want for this specific domain (make sure to uncomment and specify
+correct `ACL` option, since it is required).
 
-```getssl yourdomain.com ```
+You can then just run:
 
-and it should run, providing output like;
+```sh
+getssl yourdomain.com
 ```
+
+and it should run, providing output like:
+
+```sh
 Registering account
 Verify each domain
 Verifying yourdomain.com
@@ -98,30 +139,41 @@ copying private key to ssh:server5:/home/yourdomain/ssl/domain.key
 copying CA certificate to ssh:server5:/home/yourdomain/ssl/chain.crt
 reloading SSL services
 ```
-**This will (by default) use the staging server, so should give you a certificate that isn't trusted ( Fake Let's Encrypt).**
+
+**This will (by default) use the staging server, so should give you a
+certificate that isn't trusted ( Fake Let's Encrypt).**
 Change the server in your config file to get a fully valid certificate.
 
-**Note:**   Verification is done via port 80 (http), port 443 (https) or dns.  The certificate can be used (and checked with getssl) on alternate ports.
+**Note:** Verification is done via port 80 (http), port 443 (https) or
+dns. The certificate can be used (and checked with getssl) on alternate
+ports.
 
 ## Automating updates
 
 I use the following cron
-```
+
+```cron
 23  5 * * * /root/scripts/getssl -u -a -q
 ```
-The cron will automatically update getssl and  renew any certificates, only giving output if there are issues / errors.
+
+The cron will automatically update getssl and renew any certificates,
+only giving output if there are issues / errors.
 
 * The -u flag updates getssl if there is a more recent version available.
 * The -a flag automatically renews any certificates that are due for renewal.
-* The -q flag is "quiet" so that it only outputs and emails me if there was an error / issue.
+* The -q flag is "quiet" so that it only outputs and emails me if there
+  was an error / issue.
 
 ## Structure
 
-The design aim was to provide flexibility in running the code.  The default working directory is ~/.getssl ( which can be modified via the command line)
+The design aim was to provide flexibility in running the code. The
+default working directory is `~/.getssl` (which can be modified via the
+command line).
 
-Within the **working directory** is a config file, getssl.cfg which is a simple bash file containing variables, an example of which is
+Within the **working directory** is a config file `getssl.cfg` which is a
+simple bash file containing variables, an example of which is:
 
-```
+```getssl
 # Uncomment and modify any variables you need
 # The staging server is best for testing (hence set as default)
 CA="https://acme-staging.api.letsencrypt.org"
@@ -143,9 +195,11 @@ RENEW_ALLOW="30"
 SSLCONF="/usr/lib/ssl/openssl.cnf"
 ```
 
-then, within the **working directory** there will be a folder for each certificate (based on its domain name). Within that folder will be a config file (again called getssl.cfg).  An example of which is;
+then, within the **working directory** there will be a folder for each
+certificate (based on its domain name). Within that folder will be a
+config file (again called `getssl.cfg`). An example of which is:
 
-```
+```getssl
 # Uncomment and modify any variables you need
 # see https://github.com/srvrco/getssl/wiki/Config-variables for details
 # see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
@@ -195,19 +249,27 @@ RELOAD_CMD="service apache2 reload"
 #CHECK_REMOTE="true"
 ```
 
-If a location for a file starts with ssh:  it is assumed the next part of the file is the hostname, followed by a colon, and then the path.
-Files will be securely copied using scp, and it assumes that you have a key on the server ( for passwordless access).  You can set the user, port etc for the server in your .ssh/config file
+If a location for a file starts with `ssh:` it is assumed the next part
+of the file is the hostname, followed by a colon, and then the path.
+Files will be securely copied using scp, and it assumes that you have a
+key on the server (for passwordless access). You can set the user,
+port etc for the server in your `.ssh/config` file.
 
-If an ACL starts with ftp: or sftp: it as assumed that the line is in the format "ftp:UserID:Password:servername:/path/to/acme-challenge". sftp requires sshpass.
-Note:  FTP can be used for copying tokens only and can **not** be used for uploading private key or certificates as it's not a secure method of transfer.
+If an ACL starts with `ftp:` or `sftp:` it as assumed that the line is
+in the format "ftp:UserID:Password:servername:/path/to/acme-challenge".
+sftp requires sshpass.
+Note: FTP can be used for copying tokens only
+and can **not** be used for uploading private key or certificates as
+it's not a secure method of transfer.
 
 ssh can also be used for the reload command if using on remote servers.
 
 Multiple locations can be defined for a file by separating the locations with a semi-colon.
 
+A typical config file for `example.com` and `www.example.com` on the
+same server would be:
 
-A typical config file for example.com and www.example.com on the same server would be
-```
+```getssl
 # uncomment and modify any variables you need
 # The staging server is best for testing
 CA="https://acme-staging.api.letsencrypt.org"
@@ -231,6 +293,7 @@ RELOAD_CMD="service apache2 reload"
 ```
 
 ## Server-Types
+
 OpenSSL has built-in support for getting the certificate from a number of SSL services
 these are available in getssl to check if the certificate is installed correctly
 
@@ -252,23 +315,32 @@ these are available in getssl to check if the certificate is installed correctly
 | ldaps            | 636  |              |
 | port number      |      |              |
 
-
 ## Revoke a certificate
 
 In general revoking a certificate is not required.
 
 Usage: `getssl -r path/to/cert path/to/key [CA_server]`
 
-You need to specify both the certificate you want to revoke, and the account or private domain key which was used to sign / obtain the original certificate.  The CA_server is an optional parameter and defaults to Let's Encrypt ( "https://acme-v01.api.letsencrypt.org" ) as that is currently the only Certificate Authority using the ACME protocol.
-
+You need to specify both the certificate you want to revoke, and the
+account or private domain key which was used to sign / obtain the
+original certificate. The `CA_server` is an optional parameter and
+defaults to Let's Encrypt ("<https://acme-v01.api.letsencrypt.org>") as
+that is currently the only Certificate Authority using the ACME
+protocol.
 
 ## Elliptic curve keys
-You can use Elliptic curve keys for both the account key and the domain key (different of course, don't use the same key for both). prime256v1 (NIST P-256) and secp384r1 (NIST P-384) are both fully supported.  secp521r1 (NIST P-521) is included in the code, but not currently supported by Let's Encrypt).
 
+You can use Elliptic curve keys for both the account key and the domain
+key (different of course, don't use the same key for both). prime256v1
+(NIST P-256) and secp384r1 (NIST P-384) are both fully supported.
+secp521r1 (NIST P-521) is included in the code, but not currently
+supported by Let's Encrypt).
 
 ## Issues / problems / help
-If you have any issues, please log them at https://github.com/srvrco/getssl/issues
+
+If you have any issues, please log them at <https://github.com/srvrco/getssl/issues>
 
 There are additional help pages on the [wiki](https://github.com/srvrco/getssl/wiki)
 
-If you have any suggestions for improvements then pull requests are welcomed, or raise an issue.
+If you have any suggestions for improvements then pull requests are
+welcomed, or raise an issue.

From b1e177f45ea50e84be5f979cad967d823c37a637 Mon Sep 17 00:00:00 2001
From: Radek SPRTA <sprta@vshosting.cz>
Date: Wed, 22 Jan 2020 05:26:01 +0100
Subject: [PATCH 64/93] Handle domains of .co.uk type

---
 dns_scripts/dns_add_clouddns | 11 ++++++++++-
 dns_scripts/dns_del_clouddns | 11 ++++++++++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/dns_scripts/dns_add_clouddns b/dns_scripts/dns_add_clouddns
index a4e3f81..f20d1ab 100755
--- a/dns_scripts/dns_add_clouddns
+++ b/dns_scripts/dns_add_clouddns
@@ -53,7 +53,16 @@ fi
 curl_params=( -H "Authorization: Bearer $access_token" -H 'Content-Type: application/json' )
 
 # Get main domain
-domain_root=$(echo "$fulldomain" | awk -F\. '{print $(NF-1) FS $NF}')
+resp=$(curl --silent "${curl_params[@]}" -X POST "$API/domain/search" \
+  --data "{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$client\"}]}")
+domain_slice="$fulldomain"
+while [[ -z "$domain_root" ]]; do
+  if [[ "${resp// }" =~ domainName\":\"$domain_slice ]]; then
+    domain_root="$domain_slice"
+    _debug domain_root "$domain_root"
+  fi
+  domain_slice="${domain_slice#[^\.]*.}"
+done
 
 # Get domain id
 resp=$(curl --silent "${curl_params[@]}" -X POST "$API/domain/search" \
diff --git a/dns_scripts/dns_del_clouddns b/dns_scripts/dns_del_clouddns
index ec22c91..0b25121 100755
--- a/dns_scripts/dns_del_clouddns
+++ b/dns_scripts/dns_del_clouddns
@@ -53,7 +53,16 @@ fi
 curl_params=( -H "Authorization: Bearer $access_token" -H 'Content-Type: application/json' )
 
 # Get main domain and challenge record
-domain_root=$(echo "$fulldomain" | awk -F\. '{print $(NF-1) FS $NF}')
+resp=$(curl --silent "${curl_params[@]}" -X POST "$API/domain/search" \
+  --data "{\"search\": [{\"name\": \"clientId\", \"operator\": \"eq\", \"value\": \"$client\"}]}")
+domain_slice="$fulldomain"
+while [[ -z "$domain_root" ]]; do
+  if [[ "${resp// }" =~ domainName\":\"$domain_slice ]]; then
+    domain_root="$domain_slice"
+    _debug domain_root "$domain_root"
+  fi
+  domain_slice="${domain_slice#[^\.]*.}"
+done
 txt_record="_acme-challenge.$fulldomain."
 
 # Get domain id

From 25ab41135d550c6e7313838a008dad850057807d Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 22 Jan 2020 22:38:45 +0000
Subject: [PATCH 65/93] Fix json_get for 6 parameters when >9 domains

---
 getssl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 8269195..0646ce4 100755
--- a/getssl
+++ b/getssl
@@ -1192,7 +1192,7 @@ json_get() { # get values from json
     if [[ -n "$6" ]]; then
       full=$(json_awk "$1")
       section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
-      echo "$full" | grep "^..${5}\",$section" | awk '{print $2}' | tr -d '"'
+      echo "$full" | grep "^..${5}\",$section\]" | awk '{print $2}' | tr -d '"'
     elif [[ -n "$5" ]]; then
       full=$(json_awk "$1")
       section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')

From 839209d5285e1b87093b934128cf9449095a4ec6 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 24 Jan 2020 18:58:20 +0000
Subject: [PATCH 66/93] Use urlbase64_decode instead of base64 -d

---
 getssl | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 8269195..48b2655 100755
--- a/getssl
+++ b/getssl
@@ -1445,7 +1445,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
       responseHeaders=$(cat "$CURL_HEADER")
       if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
         # response is in base64 too, decode
-        response=$(echo "$response" | base64 -d 2>&1)
+        response=$(urlbase64_decode "$response")
       fi
 
       debug responseHeaders "$responseHeaders"
@@ -1561,6 +1561,18 @@ urlbase64() { # urlbase64: base64 encoded string with '+' replaced with '-' and
   openssl base64 -e | tr -d '\n\r' | os_esed -e 's:=*$::g' -e 'y:+/:-_:'
 }
 
+# base64url decode
+# From: https://gist.github.com/alvis/89007e96f7958f2686036d4276d28e47
+urlbase64_decode() {
+  INPUT=$1 # $(if [ -z "$1" ]; then echo -n $(cat -); else echo -n "$1"; fi)
+  MOD=$(($(echo -n "$INPUT" | wc -c) % 4))
+  PADDING=$(if [ $MOD -eq 2 ]; then echo -n '=='; elif [ $MOD -eq 3 ]; then echo -n '=' ; fi)
+  echo -n "$INPUT$PADDING" |
+    sed s/-/+/g |
+    sed s/_/\\//g |
+    openssl base64 -d -A
+}
+
 usage() { # echos out the program usage
   echo "Usage: $PROGNAME [-h|--help] [-d|--debug] [-c|--create] [-f|--force] [-a|--all] [-q|--quiet]"\
        "[-Q|--mute] [-u|--upgrade] [-k|--keep #] [-U|--nocheck] [-r|--revoke cert key] [-w working_dir] domain"

From 0040d84d22b4b6832c51855a96a78d6642377729 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 24 Jan 2020 19:05:18 +0000
Subject: [PATCH 67/93] Update revision history

---
 getssl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/getssl b/getssl
index 0646ce4..32df8d1 100755
--- a/getssl
+++ b/getssl
@@ -197,6 +197,7 @@
 # 2020-01-08 Error and exit if rate limited, exit if curl returns nothing
 # 2020-01-10 Change domain and getssl templates to v2 (2.15)
 # 2020-01-17 #473 and #477 Don't use POST-as-GET when sending ready for challenge for ACMEv1 (2.16)
+# 2020-01-22 #475 and #483 Fix grep regex for >9 subdomains in json_get
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}

From 52883615229334216d00507b0346fd04efba1310 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 24 Jan 2020 20:17:15 +0000
Subject: [PATCH 68/93] Test using BATS

---
 docker-compose.yml                            | 54 ++++++++++++++--
 test/1-simple-http01.bats                     | 28 +++++++++
 test/2-simple-dns01.bats                      | 28 +++++++++
 test/4-more-than-10-hosts.bats                | 39 ++++++++++++
 test/Dockerfile-centos6                       | 22 +++++++
 test/Dockerfile-rhel6                         | 22 -------
 ...{Dockerfile-ubuntu => Dockerfile-ubuntu18} | 10 +--
 test/README.md                                | 26 +++++---
 test/run-test.sh                              | 47 +++-----------
 test/test-config/getssl-dns01.cfg             |  2 +-
 test/test-config/getssl-http01-10-hosts.cfg   | 28 +++++++++
 test/test-config/getssl-http01.cfg            |  6 +-
 test/test-config/nginx-ubuntu-no-ssl          | 63 -------------------
 test/test_helper.bash                         | 44 +++++++++++++
 14 files changed, 274 insertions(+), 145 deletions(-)
 create mode 100644 test/1-simple-http01.bats
 create mode 100644 test/2-simple-dns01.bats
 create mode 100644 test/4-more-than-10-hosts.bats
 create mode 100644 test/Dockerfile-centos6
 delete mode 100644 test/Dockerfile-rhel6
 rename test/{Dockerfile-ubuntu => Dockerfile-ubuntu18} (66%)
 create mode 100644 test/test-config/getssl-http01-10-hosts.cfg
 create mode 100644 test/test_helper.bash

diff --git a/docker-compose.yml b/docker-compose.yml
index f4b3567..cbe52e2 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,8 +7,8 @@ services:
     environment:
       # with Go 1.13.x which defaults TLS 1.3 to on
       GODEBUG: "tls13=1"
-      # don't reuse authorizations (breaks testing force renew)
-      PEBBLE_AUTHZREUSE: 0
+      # Don't re-use authorisations (breaks force renew test scripts)
+      # PEBBLE_AUTHZREUSE: "0"
     ports:
       - 14000:14000  # HTTPS ACME API
       - 15000:15000  # HTTPS Management API
@@ -23,16 +23,60 @@ services:
     networks:
       acmenet:
         ipv4_address: 10.30.50.3
-  getssl:
+  getssl-ubuntu18:
     build:
       context: .
-      dockerfile: test/Dockerfile-ubuntu
-    container_name: getssl
+      dockerfile: test/Dockerfile-ubuntu18
+    container_name: getssl-ubuntu18
     volumes:
       - .:/getssl
+    environment:
+      GETSSL_HOST: ubuntu18.getssl.test
+      GETSSL_IP: 10.30.50.4
+      NGINX_CONFIG: /etc/nginx/sites-enabled/default
     networks:
       acmenet:
         ipv4_address: 10.30.50.4
+        aliases:
+          - ubuntu18.getssl.test
+          - a.ubuntu18.getssl.test
+          - b.ubuntu18.getssl.test
+          - c.ubuntu18.getssl.test
+          - d.ubuntu18.getssl.test
+          - e.ubuntu18.getssl.test
+          - f.ubuntu18.getssl.test
+          - g.ubuntu18.getssl.test
+          - h.ubuntu18.getssl.test
+          - i.ubuntu18.getssl.test
+          - j.ubuntu18.getssl.test
+          - k.ubuntu18.getssl.test
+  getssl-centos6:
+    build:
+      context: .
+      dockerfile: test/Dockerfile-centos6
+    container_name: getssl-centos6
+    volumes:
+      - .:/getssl
+    environment:
+      GETSSL_HOST: centos6.getssl.test
+      GETSSL_IP: 10.30.50.5
+      NGINX_CONFIG: /etc/nginx/conf.d/default.conf
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.5
+        aliases:
+          -   centos6.getssl.test
+          - a.centos6.getssl.test
+          - b.centos6.getssl.test
+          - c.centos6.getssl.test
+          - d.centos6.getssl.test
+          - e.centos6.getssl.test
+          - f.centos6.getssl.test
+          - g.centos6.getssl.test
+          - h.centos6.getssl.test
+          - i.centos6.getssl.test
+          - j.centos6.getssl.test
+          - k.centos6.getssl.test
 
 networks:
   acmenet:
diff --git a/test/1-simple-http01.bats b/test/1-simple-http01.bats
new file mode 100644
index 0000000..40416b2
--- /dev/null
+++ b/test/1-simple-http01.bats
@@ -0,0 +1,28 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Create new certificate using HTTP-01 verification" {
+    CONFIG_FILE="getssl-http01.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of certificate using HTTP-01" {
+    #!FIXME test certificate has been updated
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    cleanup_environment
+}
diff --git a/test/2-simple-dns01.bats b/test/2-simple-dns01.bats
new file mode 100644
index 0000000..e1a37ec
--- /dev/null
+++ b/test/2-simple-dns01.bats
@@ -0,0 +1,28 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Create new certificate using DNS-01 verification" {
+    CONFIG_FILE="getssl-dns01.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of certificate using DNS-01" {
+    #!FIXME test certificate has been updated
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    cleanup_environment
+}
diff --git a/test/4-more-than-10-hosts.bats b/test/4-more-than-10-hosts.bats
new file mode 100644
index 0000000..0493197
--- /dev/null
+++ b/test/4-more-than-10-hosts.bats
@@ -0,0 +1,39 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Create certificates for more than 10 hosts using HTTP-01 verification" {
+    CONFIG_FILE="getssl-http01-10-hosts.cfg"
+    setup_environment
+
+    # Add 11 hosts to DNS (also need to be added as aliases in docker-compose.yml)
+    for prefix in a b c d e f g h i j k; do
+        curl -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
+    done
+
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of more than 10 certificates using HTTP-01" {
+    #!FIXME test certificate has been updated
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+
+    # Remove all the dns aliases
+    cleanup_environment
+    for prefix in a b c d e f g h i j k; do
+        curl -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+    done
+}
diff --git a/test/Dockerfile-centos6 b/test/Dockerfile-centos6
new file mode 100644
index 0000000..f370a0b
--- /dev/null
+++ b/test/Dockerfile-centos6
@@ -0,0 +1,22 @@
+FROM centos:centos6
+
+# Update and install required software
+RUN yum -y update
+RUN yum -y install epel-release
+RUN yum -y install git curl dnsutils wget nginx
+
+WORKDIR /root
+RUN mkdir /etc/nginx/pki
+RUN mkdir /etc/nginx/pki/private
+COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/conf.d/default.conf
+
+# BATS (Bash Automated Testings)
+RUN git clone https://github.com/bats-core/bats-core.git /bats-core
+RUN git clone https://github.com/jasonkarns/bats-support /bats-support
+RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
+RUN /bats-core/install.sh /usr/local
+
+EXPOSE 80 443
+
+# Run eternal loop - for testing
+CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
diff --git a/test/Dockerfile-rhel6 b/test/Dockerfile-rhel6
deleted file mode 100644
index 019da84..0000000
--- a/test/Dockerfile-rhel6
+++ /dev/null
@@ -1,22 +0,0 @@
-FROM roboxes/rhel6
-# FROM centos:centos6
-# bionic = latest 18 version
-
-# Update and install required software
-RUN yum -y update
-RUN yum -y install epel-release
-RUN yum -y install git curl dnsutils wget # nginx-light
-
-WORKDIR /root
-#RUN mkdir /etc/nginx/pki
-#RUN mkdir /etc/nginx/pki/private
-#COPY ./test/test-config/nginx-ubuntu-sites-enabled-default /etc/nginx/sites-enabled/default
-
-# BATS (Bash Automated Testings)
-# RUN git clone https://github.com/bats-core/bats-core.git
-# RUN bats-core/install.sh /usr/local
-
-EXPOSE 80 443
-
-# Run eternal loop - for testing
-CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
diff --git a/test/Dockerfile-ubuntu b/test/Dockerfile-ubuntu18
similarity index 66%
rename from test/Dockerfile-ubuntu
rename to test/Dockerfile-ubuntu18
index b0f09f8..6dd92c6 100644
--- a/test/Dockerfile-ubuntu
+++ b/test/Dockerfile-ubuntu18
@@ -1,8 +1,8 @@
-FROM ubuntu:xenial
+FROM ubuntu:bionic
 # bionic = latest 18 version
 
 # Update and install required software
-RUN apt-get update
+RUN apt-get update --fix-missing
 # TODO work out why default version of awk fails
 RUN apt-get install -y git curl dnsutils wget gawk nginx-light # linux-libc-dev make gcc binutils
 RUN apt-get install -y vim dos2unix # for debugging
@@ -14,8 +14,10 @@ RUN mkdir /etc/nginx/pki/private
 COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
 
 # BATS (Bash Automated Testings)
-# RUN git clone https://github.com/bats-core/bats-core.git
-# RUN bats-core/install.sh /usr/local
+RUN git clone https://github.com/bats-core/bats-core.git /bats-core
+RUN git clone https://github.com/jasonkarns/bats-support /bats-support
+RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
+RUN /bats-core/install.sh /usr/local
 
 EXPOSE 80 443
 
diff --git a/test/README.md b/test/README.md
index 086c58a..9157aa8 100644
--- a/test/README.md
+++ b/test/README.md
@@ -12,21 +12,29 @@ docker-compose -f "docker-compose.yml" up -d --build
 Run the tests
 
 ```sh
-docker exec -it getssl /getssl/test/run-test.sh
+docker exec -it getssl bats /getssl/test
 ```
 
-Debug (need to set `CURL_CA_BUNDLE` as pebble uses a local certificate,
+Run individual test
+
+```sh
+docker exec -it getssl bats /getssl/test/<filename.bats>
+```
+
+Debug (uses helper script to set `CURL_CA_BUNDLE` as pebble uses a local certificate,
 otherwise you get a "unknown API version" error)
 
 ```sh
-docker exec -it getssl /bin/bash
-export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
-/getssl/getssl -d getssl
+docker exec -it getssl-<os> /getssl/test/run-test.sh <config-file>`
+
+eg.
+
+```sh
+docker exec -it getssl-ubuntu18 /getssl/test/run-test.sh getssl-http01.cfg
 ```
 
 ## TODO
 
-1. Move to BATS (bash automated testing) instead of run-test.sh
-2. Test RHEL6, Debian as well
-3. Test SSH, SFTP
-4. Test wildcards
+1. Test RHEL6, Debian as well
+2. Test SSH, SFTP
+3. Test wildcards
diff --git a/test/run-test.sh b/test/run-test.sh
index 8051922..b6f7c72 100644
--- a/test/run-test.sh
+++ b/test/run-test.sh
@@ -1,43 +1,14 @@
-#! /bin/bash
+#!/usr/bin/env bash
 
-set -e
+# This runs getssl outside of the BATS framework for debugging, etc, against pebble
+# Usage: /getssl/test/run-test.sh getssl-http01.cfg
 
-# Test setup
-if [[ -d /root/.getssl ]]; then
-    rm -r /root/.getssl
-fi
+CONFIG_FILE=$1
+source /getssl/test/test_helper.bash
 
-wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem
-# cat /etc/pki/tls/certs/ca-bundle.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
-cat /etc/ssl/certs/ca-certificates.crt /root/pebble.minica.pem > /root/pebble-ca-bundle.crt
+setup_environment 3>&1
 export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
 
-curl -X POST -d '{"host":"getssl", "addresses":["10.30.50.4"]}' http://10.30.50.3:8055/add-a
-
-# Test #1 - http-01 verification
-echo Test \#1 - http-01 verification
-
-cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
-service nginx restart
-/getssl/getssl -c getssl
-cp /getssl/test/test-config/getssl-http01.cfg /root/.getssl/getssl/getssl.cfg
-/getssl/getssl -f getssl
-
-# Test #2 - http-01 forced renewal
-echo Test \#2 - http-01 forced renewal
-/getssl/getssl getssl -f
-
-# Test cleanup
-rm -r /root/.getssl
-
-# Test #3 - dns-01 verification
-echo Test \#3 - dns-01 verification
-cp /getssl/test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
-service nginx restart
-/getssl/getssl -c getssl
-cp /getssl/test/test-config/getssl-dns01.cfg /root/.getssl/getssl/getssl.cfg
-/getssl/getssl getssl
-
-# Test #4 - dns-01 forced renewal
-echo Test \#4 - dns-01 forced renewal
-/getssl/getssl getssl -f
+"${CODE_DIR}/getssl" -c "$GETSSL_HOST" 3>&1
+cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+"${CODE_DIR}/getssl" -f -d "$GETSSL_HOST" 3>&1
diff --git a/test/test-config/getssl-dns01.cfg b/test/test-config/getssl-dns01.cfg
index 49c58b5..790dee2 100644
--- a/test/test-config/getssl-dns01.cfg
+++ b/test/test-config/getssl-dns01.cfg
@@ -44,7 +44,7 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && service nginx restart >&3-"
 
 # Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
 # smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
diff --git a/test/test-config/getssl-http01-10-hosts.cfg b/test/test-config/getssl-http01-10-hosts.cfg
new file mode 100644
index 0000000..f521d52
--- /dev/null
+++ b/test/test-config/getssl-http01-10-hosts.cfg
@@ -0,0 +1,28 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+
+CA="https://pebble:14000/dir"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+# Note: this is Additional domains - so should not include the primary domain.
+SANS="a.${GETSSL_HOST},b.${GETSSL_HOST},c.${GETSSL_HOST},d.${GETSSL_HOST},e.${GETSSL_HOST},f.${GETSSL_HOST},g.${GETSSL_HOST},h.${GETSSL_HOST},i.${GETSSL_HOST},j.${GETSSL_HOST},k.${GETSSL_HOST}"
+
+# Acme Challenge Location.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+# Use a single ACL for all checks
+USE_SINGLE_ACL="true"
+
+# Location for all your certs, these can either be on the server (full path name)
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG}  && service nginx restart >&3-"
+
+#SERVER_TYPE="https"
+#CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-http01.cfg b/test/test-config/getssl-http01.cfg
index f3dc5ad..305dd49 100644
--- a/test/test-config/getssl-http01.cfg
+++ b/test/test-config/getssl-http01.cfg
@@ -43,11 +43,11 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl /etc/nginx/sites-enabled/default && service nginx restart"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && service nginx restart >&3-"
 
 # Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
 # smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
 # will be checked for certificate expiry and also will be checked after
 # an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
-#SERVER_TYPE="https"
-#CHECK_REMOTE="true"
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test-config/nginx-ubuntu-no-ssl b/test/test-config/nginx-ubuntu-no-ssl
index c78d646..e7b046e 100644
--- a/test/test-config/nginx-ubuntu-no-ssl
+++ b/test/test-config/nginx-ubuntu-no-ssl
@@ -1,16 +1,3 @@
-##
-# You should look at the following URL's in order to grasp a solid understanding
-# of Nginx configuration files in order to fully unleash the power of Nginx.
-# http://wiki.nginx.org/Pitfalls
-# http://wiki.nginx.org/QuickStart
-# http://wiki.nginx.org/Configuration
-#
-# Generally, you will want to move this file somewhere, and start with a clean
-# file but keep this around for reference. Or just disable in sites-enabled.
-#
-# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples.
-##
-
 # Default server configuration
 #
 server {
@@ -26,18 +13,6 @@ server {
 	listen 5001 default_server;
 	listen [::]:5001 default_server;
 
-	#
-	# Note: You should disable gzip for SSL traffic.
-	# See: https://bugs.debian.org/773332
-	#
-	# Read up on ssl_ciphers to ensure a secure configuration.
-	# See: https://bugs.debian.org/765782
-	#
-	# Self signed certs generated by the ssl-cert package
-	# Don't use them in a production server!
-	#
-	# include snippets/snakeoil.conf;
-
 	root /var/www/html;
 
 	# Add index.php to the list if you are using PHP
@@ -52,42 +27,4 @@ server {
 		# as directory, then fall back to displaying a 404.
 		try_files $uri $uri/ =404;
 	}
-
-	# pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000
-	#
-	#location ~ \.php$ {
-	#	include snippets/fastcgi-php.conf;
-	#
-	#	# With php7.0-cgi alone:
-	#	fastcgi_pass 127.0.0.1:9000;
-	#	# With php7.0-fpm:
-	#	fastcgi_pass unix:/run/php/php7.0-fpm.sock;
-	#}
-
-	# deny access to .htaccess files, if Apache's document root
-	# concurs with nginx's one
-	#
-	#location ~ /\.ht {
-	#	deny all;
-	#}
 }
-
-
-# Virtual Host configuration for example.com
-#
-# You can move that to a different file under sites-available/ and symlink that
-# to sites-enabled/ to enable it.
-#
-#server {
-#	listen 80;
-#	listen [::]:80;
-#
-#	server_name example.com;
-#
-#	root /var/www/example.com;
-#	index index.html;
-#
-#	location / {
-#		try_files $uri $uri/ =404;
-#	}
-#}
diff --git a/test/test_helper.bash b/test/test_helper.bash
new file mode 100644
index 0000000..6f506fd
--- /dev/null
+++ b/test/test_helper.bash
@@ -0,0 +1,44 @@
+INSTALL_DIR=/root
+CODE_DIR=/getssl
+
+
+setup_environment() {
+    # One-off test setup
+    if [[ -d ${INSTALL_DIR}/.getssl ]]; then
+        rm -r ${INSTALL_DIR}/.getssl
+    fi
+
+    if [ ! -f ${INSTALL_DIR}/pebble.minica.pem ]; then
+        wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem 2>&1
+        CERT_FILE=/etc/ssl/certs/ca-certificates.crt
+        if [ ! -f $CERT_FILE ]; then
+            CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
+        fi
+        cat $CERT_FILE ${INSTALL_DIR}/pebble.minica.pem > ${INSTALL_DIR}/pebble-ca-bundle.crt
+    fi
+
+    curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/add-a
+    cp ${CODE_DIR}/test/test-config/nginx-ubuntu-no-ssl ${NGINX_CONFIG}
+    service nginx restart >&3-
+}
+
+
+cleanup_environment() {
+    curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/del-a
+}
+
+
+init_getssl() {
+    # Run initialisation (create account key, etc)
+    run ${CODE_DIR}/getssl -c "$GETSSL_HOST"
+    assert_success
+    [ -d "$INSTALL_DIR/.getssl" ]
+}
+
+
+create_certificate() {
+    # Create certificate
+    cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+    run ${CODE_DIR}/getssl "$GETSSL_HOST"
+    #!FIXME test certificate has been placed in the expected location
+}

From b3480db63b498798de9295c8d1153eb145c7dbd9 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 24 Jan 2020 20:17:52 +0000
Subject: [PATCH 69/93] Fix for "already verified" problem seen with ACMEv2
 during testing

---
 getssl | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/getssl b/getssl
index 622fcb1..a542c0b 100755
--- a/getssl
+++ b/getssl
@@ -1608,13 +1608,13 @@ write_domain_template() { # write out a template file for a domain.
 	# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
 	# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
 	# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
-        # You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
-        # password, host, port (explicitly needed even if using default port 443) and path on the server.
+    # You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
+    # password, host, port (explicitly needed even if using default port 443) and path on the server.
 	#ACL=('/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:sshuserid@server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge'
-        #      'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
+    #     'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
 
 	#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
 	#USE_SINGLE_ACL="false"
@@ -2212,7 +2212,7 @@ for d in $alldomains; do
       error_exit "new-authz error: $response"
     fi
   else
-    response_status=""
+    send_signed_request "${AuthLink[$dn]}" ""
   fi
 
   if [[ $response_status == "valid" ]]; then
@@ -2237,7 +2237,6 @@ for d in $alldomains; do
         uri=$(json_get "$response" "uri" "dns-01")
         debug uri "$uri"
       else # APIv2
-        send_signed_request "${AuthLink[$dn]}" ""
         debug "authlink response = $response"
         # get the token from the http-01 component
         token=$(json_get "$response" "challenges" "type" "dns-01" "token")

From 08a6485911c22d71adc561d9331f7008a98ee1a7 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sun, 26 Jan 2020 14:09:39 +0000
Subject: [PATCH 70/93] Update revision history

---
 getssl | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/getssl b/getssl
index 6c3870f..763677f 100755
--- a/getssl
+++ b/getssl
@@ -200,6 +200,8 @@
 # 2020-01-22 #475 and #483 Fix grep regex for >9 subdomains in json_get
 # 2020-01-24 Add support for CloudDNS
 # 2020-01-24 allow file transfer using WebDAV over HTTPS
+# 2020-01-26 Use urlbase64_decode() instead of base64 -d
+# 2020-01-26 Fix "already verified" error for ACMEv2
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}

From d8a0e4ca237545b6515d29beba193c9edf4d07c4 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Tue, 28 Jan 2020 19:47:15 +0100
Subject: [PATCH 71/93] Check output for "Error", "Failed" and "Warning"

---
 test/1-simple-http01.bats           | 6 ++++++
 test/2-simple-dns01.bats            | 6 ++++++
 test/4-more-than-10-hosts.bats      | 7 ++++++-
 test/Dockerfile-ubuntu18            | 3 +++
 test/README.md                      | 6 +++---
 test/{run-test.sh => debug-test.sh} | 4 ++--
 test/run-all-tests.sh               | 4 ++++
 7 files changed, 30 insertions(+), 6 deletions(-)
 rename test/{run-test.sh => debug-test.sh} (79%)
 create mode 100644 test/run-all-tests.sh

diff --git a/test/1-simple-http01.bats b/test/1-simple-http01.bats
index 40416b2..4c55304 100644
--- a/test/1-simple-http01.bats
+++ b/test/1-simple-http01.bats
@@ -17,6 +17,9 @@ setup() {
     init_getssl
     create_certificate
     assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
 }
 
 
@@ -24,5 +27,8 @@ setup() {
     #!FIXME test certificate has been updated
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
     cleanup_environment
 }
diff --git a/test/2-simple-dns01.bats b/test/2-simple-dns01.bats
index e1a37ec..9d9f44b 100644
--- a/test/2-simple-dns01.bats
+++ b/test/2-simple-dns01.bats
@@ -17,6 +17,9 @@ setup() {
     init_getssl
     create_certificate
     assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
 }
 
 
@@ -24,5 +27,8 @@ setup() {
     #!FIXME test certificate has been updated
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
     cleanup_environment
 }
diff --git a/test/4-more-than-10-hosts.bats b/test/4-more-than-10-hosts.bats
index 0493197..01e364d 100644
--- a/test/4-more-than-10-hosts.bats
+++ b/test/4-more-than-10-hosts.bats
@@ -23,6 +23,9 @@ setup() {
     init_getssl
     create_certificate
     assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
 }
 
 
@@ -30,7 +33,9 @@ setup() {
     #!FIXME test certificate has been updated
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
-
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
     # Remove all the dns aliases
     cleanup_environment
     for prefix in a b c d e f g h i j k; do
diff --git a/test/Dockerfile-ubuntu18 b/test/Dockerfile-ubuntu18
index 6dd92c6..1b3765c 100644
--- a/test/Dockerfile-ubuntu18
+++ b/test/Dockerfile-ubuntu18
@@ -13,6 +13,9 @@ RUN mkdir /etc/nginx/pki
 RUN mkdir /etc/nginx/pki/private
 COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
 
+# Prevent "Can't load /root/.rnd into RNG" error from openssl
+RUN touch /root/.rnd
+
 # BATS (Bash Automated Testings)
 RUN git clone https://github.com/bats-core/bats-core.git /bats-core
 RUN git clone https://github.com/jasonkarns/bats-support /bats-support
diff --git a/test/README.md b/test/README.md
index 9157aa8..98ff929 100644
--- a/test/README.md
+++ b/test/README.md
@@ -12,7 +12,7 @@ docker-compose -f "docker-compose.yml" up -d --build
 Run the tests
 
 ```sh
-docker exec -it getssl bats /getssl/test
+test/run-all-tests.sh
 ```
 
 Run individual test
@@ -25,12 +25,12 @@ Debug (uses helper script to set `CURL_CA_BUNDLE` as pebble uses a local certifi
 otherwise you get a "unknown API version" error)
 
 ```sh
-docker exec -it getssl-<os> /getssl/test/run-test.sh <config-file>`
+docker exec -it getssl-<os> /getssl/test/debug-test.sh <config-file>`
 
 eg.
 
 ```sh
-docker exec -it getssl-ubuntu18 /getssl/test/run-test.sh getssl-http01.cfg
+docker exec -it getssl-ubuntu18 /getssl/test/debug-test.sh getssl-http01.cfg
 ```
 
 ## TODO
diff --git a/test/run-test.sh b/test/debug-test.sh
similarity index 79%
rename from test/run-test.sh
rename to test/debug-test.sh
index b6f7c72..23d1983 100644
--- a/test/run-test.sh
+++ b/test/debug-test.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # This runs getssl outside of the BATS framework for debugging, etc, against pebble
-# Usage: /getssl/test/run-test.sh getssl-http01.cfg
+# Usage: /getssl/test/debug-test.sh getssl-http01.cfg
 
 CONFIG_FILE=$1
 source /getssl/test/test_helper.bash
@@ -11,4 +11,4 @@ export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
 
 "${CODE_DIR}/getssl" -c "$GETSSL_HOST" 3>&1
 cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
-"${CODE_DIR}/getssl" -f -d "$GETSSL_HOST" 3>&1
+"${CODE_DIR}/getssl" -f "$GETSSL_HOST" 3>&1
diff --git a/test/run-all-tests.sh b/test/run-all-tests.sh
new file mode 100644
index 0000000..d0749e1
--- /dev/null
+++ b/test/run-all-tests.sh
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+docker exec -it getssl-centos6 bats /getssl/test
+docker exec -it getssl-ubuntu18 bats /getssl/test

From 2a5824afeff449e35d513a457f0f1ea8560bd78c Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 29 Jan 2020 15:27:57 +0100
Subject: [PATCH 72/93] Show error message if awk doesn't support json_awk

---
 docker-compose.yml               | 16 ++++++++++++++++
 getssl                           | 11 +++++++++++
 test/5-old-awk-error.bats        | 25 +++++++++++++++++++++++++
 test/Dockerfile-ubuntu18-no-gawk | 17 +++++++++++++++++
 test/run-all-tests.sh            |  1 +
 5 files changed, 70 insertions(+)
 create mode 100644 test/5-old-awk-error.bats
 create mode 100644 test/Dockerfile-ubuntu18-no-gawk

diff --git a/docker-compose.yml b/docker-compose.yml
index cbe52e2..d031d30 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -77,6 +77,22 @@ services:
           - i.centos6.getssl.test
           - j.centos6.getssl.test
           - k.centos6.getssl.test
+  getssl-ubuntu18-no-gawk:
+    build:
+      context: .
+      dockerfile: test/Dockerfile-ubuntu18-no-gawk
+    container_name: getssl-ubuntu18-no-gawk
+    volumes:
+      - .:/getssl
+    environment:
+      GETSSL_HOST: ubuntu18-no-gawk.getssl.test
+      GETSSL_IP: 10.30.50.6
+      NGINX_CONFIG: /etc/nginx/sites-enabled/default
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.6
+        aliases:
+          - ubuntu18-no-gawk.getssl.test
 
 networks:
   acmenet:
diff --git a/getssl b/getssl
index 763677f..810a30a 100755
--- a/getssl
+++ b/getssl
@@ -15,6 +15,8 @@
 
 # For usage, run "getssl -h" or see https://github.com/srvrco/getssl
 
+# ACMEv2 process is documented at https://tools.ietf.org/html/rfc8555#section-7.4
+
 # Revision history:
 # 2016-01-08 Created (v0.1)
 # 2016-01-11 type correction and upload to github (v0.2)
@@ -202,6 +204,7 @@
 # 2020-01-24 allow file transfer using WebDAV over HTTPS
 # 2020-01-26 Use urlbase64_decode() instead of base64 -d
 # 2020-01-26 Fix "already verified" error for ACMEv2
+# 2020-01-29 Check awk new enough to support json_awk
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
@@ -1982,6 +1985,14 @@ else
 fi
 debug "Using API v$API"
 
+# Check if awk supports json_awk (required for ACMEv2)
+if [[ $API -eq 2 ]]; then
+    json_awk_test=$(json_awk '{ "test": "1" }' 2>/dev/null)
+    if [[ "${json_awk_test}" == "" ]]; then
+        error_exit "Your version of awk does not work with json_awk (see http://github.com/step-/JSON.awk/issues/6), please install a newer version of mawk or gawk"
+    fi
+fi
+
 # if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
 if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
   debug "getting certificate for $DOMAIN from remote server"
diff --git a/test/5-old-awk-error.bats b/test/5-old-awk-error.bats
new file mode 100644
index 0000000..4a00b31
--- /dev/null
+++ b/test/5-old-awk-error.bats
@@ -0,0 +1,25 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Check getssl fails if an old version of awk is installed" {
+    CONFIG_FILE="getssl-http01.cfg"
+    # Make sure this test only runs on an image running an old version of awk
+    awk_version=$(awk -V 2>/dev/null) || true
+    if [[ "$awk_version" == "" ]]; then
+        setup_environment
+        init_getssl
+        create_certificate
+        assert_failure
+        assert_output "getssl: Your version of awk does not work with json_awk (see http://github.com/step-/JSON.awk/issues/6), please install a newer version of mawk or gawk"
+    fi
+}
diff --git a/test/Dockerfile-ubuntu18-no-gawk b/test/Dockerfile-ubuntu18-no-gawk
new file mode 100644
index 0000000..809708a
--- /dev/null
+++ b/test/Dockerfile-ubuntu18-no-gawk
@@ -0,0 +1,17 @@
+FROM ubuntu:bionic
+# bionic = latest 18 version
+
+# Update and install required software
+RUN apt-get update --fix-missing
+RUN apt-get install -y git curl dnsutils wget nginx-light
+
+WORKDIR /root
+
+# BATS (Bash Automated Testings)
+RUN git clone https://github.com/bats-core/bats-core.git /bats-core
+RUN git clone https://github.com/jasonkarns/bats-support /bats-support
+RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
+RUN /bats-core/install.sh /usr/local
+
+# Run eternal loop - for testing
+CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
diff --git a/test/run-all-tests.sh b/test/run-all-tests.sh
index d0749e1..7372e5b 100644
--- a/test/run-all-tests.sh
+++ b/test/run-all-tests.sh
@@ -2,3 +2,4 @@
 
 docker exec -it getssl-centos6 bats /getssl/test
 docker exec -it getssl-ubuntu18 bats /getssl/test
+docker exec -it getssl-ubuntu18-no-gawk bats /getssl/test/5-old-awk-error.bats

From b785c42bab857d1f5f041dbe969cd443433b096f Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 29 Jan 2020 18:04:51 +0100
Subject: [PATCH 73/93] Less fragile way of deciding whether to run old awk
 test

---
 docker-compose.yml        | 1 +
 test/5-old-awk-error.bats | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker-compose.yml b/docker-compose.yml
index d031d30..97bb1e5 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -88,6 +88,7 @@ services:
       GETSSL_HOST: ubuntu18-no-gawk.getssl.test
       GETSSL_IP: 10.30.50.6
       NGINX_CONFIG: /etc/nginx/sites-enabled/default
+      TEST_AWK: "yes"
     networks:
       acmenet:
         ipv4_address: 10.30.50.6
diff --git a/test/5-old-awk-error.bats b/test/5-old-awk-error.bats
index 4a00b31..0f234a2 100644
--- a/test/5-old-awk-error.bats
+++ b/test/5-old-awk-error.bats
@@ -14,8 +14,7 @@ setup() {
 @test "Check getssl fails if an old version of awk is installed" {
     CONFIG_FILE="getssl-http01.cfg"
     # Make sure this test only runs on an image running an old version of awk
-    awk_version=$(awk -V 2>/dev/null) || true
-    if [[ "$awk_version" == "" ]]; then
+    if [[ "$TEST_AWK" != "" ]]; then
         setup_environment
         init_getssl
         create_certificate

From 410a3c9087b0c2ca01cf55a23c5875e66195c90f Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 5 Feb 2020 12:51:43 +0000
Subject: [PATCH 74/93] Fix epoch_date for busybox and json_awk for gawk v5

---
 getssl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 810a30a..c1bb890 100755
--- a/getssl
+++ b/getssl
@@ -716,7 +716,7 @@ date_epoc() { # convert the date into epoch time
   elif [[ "$os" == "mac" ]]; then
     date -j -f "%b %d %T %Y %Z" "$1" +%s
   elif [[ "$os" == "busybox" ]]; then
-    de_ld=$(echo "$1" | awk '{print $1 $2 $3 $4}')
+    de_ld=$(echo "$1" | awk '{print $1 " " $2 " " $3 " " $4}')
     date -D "%b %d %T %Y" -d "$de_ld" +%s
   else
     date -d "$1" +%s
@@ -1174,7 +1174,7 @@ function scream(msg) {
 
 function tokenize(a1,pq,pb,ESCAPE,CHAR,STRING,NUMBER,KEYWORD,SPACE) {
   SPACE="[[:space:]]+"
-  gsub(/\"[^[:cntrl:]\"\\]*((\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})[^[:cntrl:]\"\\]*)*\"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[[:space:]]+|./, "\n&", a1)
+  gsub(/"[^[:cntrl:]"\\]*((\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})[^[:cntrl:]"\\]*)*"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[[:space:]]+|./, "\n&", a1)
   gsub("\n" SPACE, "\n", a1)
   sub(/^\n/, "", a1)
   ITOKENS=0 # get_token() helper

From 886b456ae338a7bfa800ea27d697e68ce39ed6f7 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 5 Feb 2020 12:52:25 +0000
Subject: [PATCH 75/93] Test improvements and add Alpine Linux

---
 docker-compose.yml                          | 33 ++++++++++++++++++---
 test/Dockerfile-alpine                      | 20 +++++++++++++
 test/Dockerfile-centos6                     |  2 +-
 test/Dockerfile-ubuntu18                    |  2 +-
 test/Dockerfile-ubuntu18-no-gawk            |  2 +-
 test/alpine-supervisord.conf                | 14 +++++++++
 test/restart-nginx                          |  8 +++++
 test/test-config/getssl-dns01.cfg           | 29 +++---------------
 test/test-config/getssl-http01-10-hosts.cfg |  8 ++---
 test/test-config/getssl-http01.cfg          | 30 ++-----------------
 test/test_helper.bash                       |  3 +-
 11 files changed, 86 insertions(+), 65 deletions(-)
 create mode 100644 test/Dockerfile-alpine
 create mode 100644 test/alpine-supervisord.conf
 create mode 100644 test/restart-nginx

diff --git a/docker-compose.yml b/docker-compose.yml
index 97bb1e5..ebd5369 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -7,8 +7,6 @@ services:
     environment:
       # with Go 1.13.x which defaults TLS 1.3 to on
       GODEBUG: "tls13=1"
-      # Don't re-use authorisations (breaks force renew test scripts)
-      # PEBBLE_AUTHZREUSE: "0"
     ports:
       - 14000:14000  # HTTPS ACME API
       - 15000:15000  # HTTPS Management API
@@ -77,6 +75,33 @@ services:
           - i.centos6.getssl.test
           - j.centos6.getssl.test
           - k.centos6.getssl.test
+  getssl-alpine:
+    build:
+      context: .
+      dockerfile: test/Dockerfile-alpine
+    container_name: getssl-alpine
+    volumes:
+      - .:/getssl
+    environment:
+      GETSSL_HOST: alpine.getssl.test
+      GETSSL_IP: 10.30.50.6
+      NGINX_CONFIG: /etc/nginx/conf.d/default.conf
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.6
+        aliases:
+          -   alpine.getssl.test
+          - a.alpine.getssl.test
+          - b.alpine.getssl.test
+          - c.alpine.getssl.test
+          - d.alpine.getssl.test
+          - e.alpine.getssl.test
+          - f.alpine.getssl.test
+          - g.alpine.getssl.test
+          - h.alpine.getssl.test
+          - i.alpine.getssl.test
+          - j.alpine.getssl.test
+          - k.alpine.getssl.test
   getssl-ubuntu18-no-gawk:
     build:
       context: .
@@ -86,12 +111,12 @@ services:
       - .:/getssl
     environment:
       GETSSL_HOST: ubuntu18-no-gawk.getssl.test
-      GETSSL_IP: 10.30.50.6
+      GETSSL_IP: 10.30.50.7
       NGINX_CONFIG: /etc/nginx/sites-enabled/default
       TEST_AWK: "yes"
     networks:
       acmenet:
-        ipv4_address: 10.30.50.6
+        ipv4_address: 10.30.50.7
         aliases:
           - ubuntu18-no-gawk.getssl.test
 
diff --git a/test/Dockerfile-alpine b/test/Dockerfile-alpine
new file mode 100644
index 0000000..e9ee6c3
--- /dev/null
+++ b/test/Dockerfile-alpine
@@ -0,0 +1,20 @@
+FROM alpine:latest
+
+RUN apk --no-cache add supervisor openssl git curl bind-tools wget gawk nginx bash
+# RUN apk --no-cache add vim dos2unix # for debugging
+
+WORKDIR /root
+RUN mkdir /run/nginx
+RUN mkdir /etc/nginx/pki
+RUN mkdir /etc/nginx/pki/private
+COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
+COPY ./test/alpine-supervisord.conf /etc/supervisord.conf
+
+# BATS (Bash Automated Testings)
+RUN git clone https://github.com/bats-core/bats-core.git /bats-core
+RUN git clone https://github.com/jasonkarns/bats-support /bats-support
+RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
+RUN /bats-core/install.sh /usr/local
+
+# Use supervisord to run nginx in the background
+ENTRYPOINT /usr/bin/supervisord -c /etc/supervisord.conf
diff --git a/test/Dockerfile-centos6 b/test/Dockerfile-centos6
index f370a0b..a82bf1f 100644
--- a/test/Dockerfile-centos6
+++ b/test/Dockerfile-centos6
@@ -19,4 +19,4 @@ RUN /bats-core/install.sh /usr/local
 EXPOSE 80 443
 
 # Run eternal loop - for testing
-CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
+CMD tail -f /dev/null
diff --git a/test/Dockerfile-ubuntu18 b/test/Dockerfile-ubuntu18
index 1b3765c..31554cd 100644
--- a/test/Dockerfile-ubuntu18
+++ b/test/Dockerfile-ubuntu18
@@ -25,4 +25,4 @@ RUN /bats-core/install.sh /usr/local
 EXPOSE 80 443
 
 # Run eternal loop - for testing
-CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
+CMD tail -f /dev/null
diff --git a/test/Dockerfile-ubuntu18-no-gawk b/test/Dockerfile-ubuntu18-no-gawk
index 809708a..3eb9732 100644
--- a/test/Dockerfile-ubuntu18-no-gawk
+++ b/test/Dockerfile-ubuntu18-no-gawk
@@ -14,4 +14,4 @@ RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
 RUN /bats-core/install.sh /usr/local
 
 # Run eternal loop - for testing
-CMD ["/bin/bash", "-c", "while :; do sleep 10; done"]
+CMD tail -f /dev/null
diff --git a/test/alpine-supervisord.conf b/test/alpine-supervisord.conf
new file mode 100644
index 0000000..8eec585
--- /dev/null
+++ b/test/alpine-supervisord.conf
@@ -0,0 +1,14 @@
+[supervisord]
+nodaemon=true
+logfile=/tmp/supervisord.log
+childlogdir=/tmp
+pidfile = /tmp/supervisord.pid
+
+[program:nginx]
+command=nginx -g 'daemon off;'
+stdout_logfile=/dev/stdout
+stdout_logfile_maxbytes=0
+stderr_logfile=/dev/stderr
+stderr_logfile_maxbytes=0
+autorestart=false
+startretries=0
diff --git a/test/restart-nginx b/test/restart-nginx
new file mode 100644
index 0000000..d35f60f
--- /dev/null
+++ b/test/restart-nginx
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+if [ "$GETSSL_HOST" = "alpine.getssl.test" ]; then
+    killall -HUP nginx >&3-
+    sleep 5
+else
+    service nginx restart >&3-
+fi
diff --git a/test/test-config/getssl-dns01.cfg b/test/test-config/getssl-dns01.cfg
index 790dee2..98637b0 100644
--- a/test/test-config/getssl-dns01.cfg
+++ b/test/test-config/getssl-dns01.cfg
@@ -2,35 +2,17 @@
 # see https://github.com/srvrco/getssl/wiki/Config-variables for details
 # see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
 #
-# The staging server is best for testing
-#CA="https://acme-staging.api.letsencrypt.org"
-# This server issues full certificates, however has rate limits
-#CA="https://acme-v01.api.letsencrypt.org"
 CA="https://pebble:14000/dir"
 
 VALIDATE_VIA_DNS=true
 DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
 DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
-# AUTH_DNS_SERVER=10.30.50.3
-
-#PRIVATE_KEY_ALG="rsa"
 
 # Additional domains - this could be multiple domains / subdomains in a comma separated list
-# Note: this is Additional domains - so should not include the primary domain.
 SANS=""
 
 # Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
-# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
-# An ssh key will be needed to provide you with access to the remote server.
-# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
-# If left blank, the username on the local server will be used to authenticate against the remote server.
-# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
-# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
-# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
 ACL=('/var/www/html/.well-known/acme-challenge')
-#     'ssh:server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
-#     'ssh:sshuserid@server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
-#     'ftp:ftpuserid:ftppassword:getssltest.hopto.org:/web/.well-known/acme-challenge')
 
 #Set USE_SINGLE_ACL="true" to use a single ACL for all checks
 USE_SINGLE_ACL="false"
@@ -44,11 +26,8 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && service nginx restart >&3-"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
 
-# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
-# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
-# will be checked for certificate expiry and also will be checked after
-# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
-#SERVER_TYPE="https"
-#CHECK_REMOTE="true"
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-http01-10-hosts.cfg b/test/test-config/getssl-http01-10-hosts.cfg
index f521d52..d5c364e 100644
--- a/test/test-config/getssl-http01-10-hosts.cfg
+++ b/test/test-config/getssl-http01-10-hosts.cfg
@@ -5,7 +5,6 @@
 CA="https://pebble:14000/dir"
 
 # Additional domains - this could be multiple domains / subdomains in a comma separated list
-# Note: this is Additional domains - so should not include the primary domain.
 SANS="a.${GETSSL_HOST},b.${GETSSL_HOST},c.${GETSSL_HOST},d.${GETSSL_HOST},e.${GETSSL_HOST},f.${GETSSL_HOST},g.${GETSSL_HOST},h.${GETSSL_HOST},i.${GETSSL_HOST},j.${GETSSL_HOST},k.${GETSSL_HOST}"
 
 # Acme Challenge Location.
@@ -22,7 +21,8 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG}  && service nginx restart >&3-"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
 
-#SERVER_TYPE="https"
-#CHECK_REMOTE="true"
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-http01.cfg b/test/test-config/getssl-http01.cfg
index 305dd49..f7d75ea 100644
--- a/test/test-config/getssl-http01.cfg
+++ b/test/test-config/getssl-http01.cfg
@@ -2,34 +2,13 @@
 # see https://github.com/srvrco/getssl/wiki/Config-variables for details
 # see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
 #
-# The staging server is best for testing
-#CA="https://acme-staging.api.letsencrypt.org"
-# This server issues full certificates, however has rate limits
-#CA="https://acme-v01.api.letsencrypt.org"
 CA="https://pebble:14000/dir"
 
-#VALIDATE_VIA_DNS=true
-#DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
-#DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
-
-#PRIVATE_KEY_ALG="rsa"
-
 # Additional domains - this could be multiple domains / subdomains in a comma separated list
-# Note: this is Additional domains - so should not include the primary domain.
 SANS=""
 
-# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
-# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
-# An ssh key will be needed to provide you with access to the remote server.
-# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
-# If left blank, the username on the local server will be used to authenticate against the remote server.
-# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
-# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
-# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
+# Acme Challenge Location.
 ACL=('/var/www/html/.well-known/acme-challenge')
-#     'ssh:server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
-#     'ssh:sshuserid@server5:/var/www/getssltest.hopto.org/web/.well-known/acme-challenge'
-#     'ftp:ftpuserid:ftppassword:getssltest.hopto.org:/web/.well-known/acme-challenge')
 
 #Set USE_SINGLE_ACL="true" to use a single ACL for all checks
 USE_SINGLE_ACL="false"
@@ -43,11 +22,8 @@ DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
 DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
 
 # The command needed to reload apache / nginx or whatever you use
-RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && service nginx restart >&3-"
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
 
-# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
-# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
-# will be checked for certificate expiry and also will be checked after
-# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
+# Define the server type and confirm correct certificate is installed
 SERVER_TYPE="https"
 CHECK_REMOTE="true"
diff --git a/test/test_helper.bash b/test/test_helper.bash
index 6f506fd..0ac9a43 100644
--- a/test/test_helper.bash
+++ b/test/test_helper.bash
@@ -19,7 +19,7 @@ setup_environment() {
 
     curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/add-a
     cp ${CODE_DIR}/test/test-config/nginx-ubuntu-no-ssl ${NGINX_CONFIG}
-    service nginx restart >&3-
+    /getssl/test/restart-nginx
 }
 
 
@@ -40,5 +40,4 @@ create_certificate() {
     # Create certificate
     cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
     run ${CODE_DIR}/getssl "$GETSSL_HOST"
-    #!FIXME test certificate has been placed in the expected location
 }

From 978de4bda0a088478a447d80f802e3f48565d66e Mon Sep 17 00:00:00 2001
From: Robert de Bath <rdebath@tvisiontech.co.uk>
Date: Thu, 6 Feb 2020 06:30:34 +0000
Subject: [PATCH 76/93] Change -debug=1 to -debug for nslookup

Debian dnsutils 1:9.11.5.P4+dfsg-5.1 errors on -debug=1

Dnsutils version 1:9.10.3.dfsg.P4-12.3+deb9u4 and version 1:9.2.1-2.woody.2
(from 2003) accept both -debug=1 and -debug so I've changed this globally.
---
 getssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/getssl b/getssl
index c1bb890..2f1a26b 100755
--- a/getssl
+++ b/getssl
@@ -813,7 +813,7 @@ get_auth_dns() { # get the authoritative dns server for a domain (sets primary_n
     return
   fi
 
-  res=$(nslookup -debug=1 -type=soa -type=ns "$gad_d" ${gad_s})
+  res=$(nslookup -debug -type=soa -type=ns "$gad_d" ${gad_s})
 
   if [[ "$(echo "$res" | grep -c "Non-authoritative")" -gt 0 ]]; then
     # this is a Non-authoritative server, need to check for an authoritative one.
@@ -826,9 +826,9 @@ get_auth_dns() { # get the authoritative dns server for a domain (sets primary_n
   fi
 
   if [[ -z "$gad_s" ]]; then
-    res=$(nslookup -debug=1 -type=soa -type=ns "$gad_d")
+    res=$(nslookup -debug -type=soa -type=ns "$gad_d")
   else
-    res=$(nslookup -debug=1 -type=soa -type=ns "$gad_d" "${gad_s}")
+    res=$(nslookup -debug -type=soa -type=ns "$gad_d" "${gad_s}")
   fi
 
   if [[ "$(echo "$res" | grep -c "canonical name")" -gt 0 ]]; then

From 86e27920189e42ee41dcba1038541b4cb23e0c70 Mon Sep 17 00:00:00 2001
From: Robert de Bath <rdebath@tvisiontech.co.uk>
Date: Thu, 6 Feb 2020 14:13:10 +0000
Subject: [PATCH 77/93] Fix regex for non-gnu versions of awk.

Recent versions of gawk have upgraded the regex processing with l10n
based character classes. Replace use of these so other versions of awk
can be used.
---
 getssl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/getssl b/getssl
index 2f1a26b..b7b9094 100755
--- a/getssl
+++ b/getssl
@@ -1027,7 +1027,7 @@ info() { # write out info as long as the quiet flag has not been set.
 
 json_awk() { # AWK json converter used for API2 - needs tidying up ;)
 # shellcheck disable=SC2086
-echo $1 | awk '
+echo "$1" | tr -d '\n' | awk '
 {
   tokenize($0) # while(get_token()) {print TOKEN}
   if (0 == parse()) {
@@ -1173,8 +1173,8 @@ function scream(msg) {
 }
 
 function tokenize(a1,pq,pb,ESCAPE,CHAR,STRING,NUMBER,KEYWORD,SPACE) {
-  SPACE="[[:space:]]+"
-  gsub(/"[^[:cntrl:]"\\]*((\\[^u[:cntrl:]]|\\u[0-9a-fA-F]{4})[^[:cntrl:]"\\]*)*"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[[:space:]]+|./, "\n&", a1)
+  SPACE="[ \t\n]+"
+  gsub(/"[^\001-\037"\\]*((\\[^u\001-\037]|\\u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])[^\001-\037"\\]*)*"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[ \t\n]+|./, "\n&", a1)
   gsub("\n" SPACE, "\n", a1)
   sub(/^\n/, "", a1)
   ITOKENS=0 # get_token() helper

From 6b17701cdce2de30b8408b08d7d121271904943f Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Thu, 6 Feb 2020 17:25:30 +0000
Subject: [PATCH 78/93] Use default awk on most images, add debian:latest and
 ubuntu:latest

---
 docker-compose.yml                            | 135 +++++++++++-------
 test/5-old-awk-error.bats                     |  24 ----
 test/Dockerfile-alpine                        |  10 +-
 test/Dockerfile-centos6                       |   2 +
 ...ile-ubuntu18-no-gawk => Dockerfile-debian} |  10 +-
 test/Dockerfile-ubuntu                        |  23 +++
 test/Dockerfile-ubuntu18                      |   9 +-
 test/run-all-tests.sh                         |   4 +-
 test/test_helper.bash                         |   2 +-
 9 files changed, 134 insertions(+), 85 deletions(-)
 delete mode 100644 test/5-old-awk-error.bats
 rename test/{Dockerfile-ubuntu18-no-gawk => Dockerfile-debian} (71%)
 create mode 100644 test/Dockerfile-ubuntu

diff --git a/docker-compose.yml b/docker-compose.yml
index ebd5369..09a4264 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -21,33 +21,33 @@ services:
     networks:
       acmenet:
         ipv4_address: 10.30.50.3
-  getssl-ubuntu18:
+  getssl-alpine:
     build:
       context: .
-      dockerfile: test/Dockerfile-ubuntu18
-    container_name: getssl-ubuntu18
+      dockerfile: test/Dockerfile-alpine
+    container_name: getssl-alpine
     volumes:
       - .:/getssl
     environment:
-      GETSSL_HOST: ubuntu18.getssl.test
-      GETSSL_IP: 10.30.50.4
-      NGINX_CONFIG: /etc/nginx/sites-enabled/default
+      GETSSL_HOST: alpine.getssl.test
+      GETSSL_IP: 10.30.50.10
+      NGINX_CONFIG: /etc/nginx/conf.d/default.conf
     networks:
       acmenet:
-        ipv4_address: 10.30.50.4
+        ipv4_address: 10.30.50.10
         aliases:
-          - ubuntu18.getssl.test
-          - a.ubuntu18.getssl.test
-          - b.ubuntu18.getssl.test
-          - c.ubuntu18.getssl.test
-          - d.ubuntu18.getssl.test
-          - e.ubuntu18.getssl.test
-          - f.ubuntu18.getssl.test
-          - g.ubuntu18.getssl.test
-          - h.ubuntu18.getssl.test
-          - i.ubuntu18.getssl.test
-          - j.ubuntu18.getssl.test
-          - k.ubuntu18.getssl.test
+          -   alpine.getssl.test
+          - a.alpine.getssl.test
+          - b.alpine.getssl.test
+          - c.alpine.getssl.test
+          - d.alpine.getssl.test
+          - e.alpine.getssl.test
+          - f.alpine.getssl.test
+          - g.alpine.getssl.test
+          - h.alpine.getssl.test
+          - i.alpine.getssl.test
+          - j.alpine.getssl.test
+          - k.alpine.getssl.test
   getssl-centos6:
     build:
       context: .
@@ -57,11 +57,11 @@ services:
       - .:/getssl
     environment:
       GETSSL_HOST: centos6.getssl.test
-      GETSSL_IP: 10.30.50.5
+      GETSSL_IP: 10.30.50.11
       NGINX_CONFIG: /etc/nginx/conf.d/default.conf
     networks:
       acmenet:
-        ipv4_address: 10.30.50.5
+        ipv4_address: 10.30.50.11
         aliases:
           -   centos6.getssl.test
           - a.centos6.getssl.test
@@ -75,50 +75,89 @@ services:
           - i.centos6.getssl.test
           - j.centos6.getssl.test
           - k.centos6.getssl.test
-  getssl-alpine:
+  getssl-debian:
     build:
       context: .
-      dockerfile: test/Dockerfile-alpine
-    container_name: getssl-alpine
+      dockerfile: test/Dockerfile-debian
+    container_name: getssl-debian
     volumes:
       - .:/getssl
     environment:
-      GETSSL_HOST: alpine.getssl.test
-      GETSSL_IP: 10.30.50.6
-      NGINX_CONFIG: /etc/nginx/conf.d/default.conf
+      GETSSL_HOST: debian.getssl.test
+      GETSSL_IP: 10.30.50.12
+      NGINX_CONFIG: /etc/nginx/sites-enabled/default
     networks:
       acmenet:
-        ipv4_address: 10.30.50.6
+        ipv4_address: 10.30.50.12
         aliases:
-          -   alpine.getssl.test
-          - a.alpine.getssl.test
-          - b.alpine.getssl.test
-          - c.alpine.getssl.test
-          - d.alpine.getssl.test
-          - e.alpine.getssl.test
-          - f.alpine.getssl.test
-          - g.alpine.getssl.test
-          - h.alpine.getssl.test
-          - i.alpine.getssl.test
-          - j.alpine.getssl.test
-          - k.alpine.getssl.test
-  getssl-ubuntu18-no-gawk:
+          -   debian.getssl.test
+          - a.debian.getssl.test
+          - b.debian.getssl.test
+          - c.debian.getssl.test
+          - d.debian.getssl.test
+          - e.debian.getssl.test
+          - f.debian.getssl.test
+          - g.debian.getssl.test
+          - h.debian.getssl.test
+          - i.debian.getssl.test
+          - j.debian.getssl.test
+          - k.debian.getssl.test
+  getssl-ubuntu:
     build:
       context: .
-      dockerfile: test/Dockerfile-ubuntu18-no-gawk
-    container_name: getssl-ubuntu18-no-gawk
+      dockerfile: test/Dockerfile-ubuntu
+    container_name: getssl-ubuntu
     volumes:
       - .:/getssl
     environment:
-      GETSSL_HOST: ubuntu18-no-gawk.getssl.test
-      GETSSL_IP: 10.30.50.7
+      GETSSL_HOST: ubuntu.getssl.test
+      GETSSL_IP: 10.30.50.13
       NGINX_CONFIG: /etc/nginx/sites-enabled/default
-      TEST_AWK: "yes"
     networks:
       acmenet:
-        ipv4_address: 10.30.50.7
+        ipv4_address: 10.30.50.13
         aliases:
-          - ubuntu18-no-gawk.getssl.test
+          - ubuntu.getssl.test
+          - a.ubuntu.getssl.test
+          - b.ubuntu.getssl.test
+          - c.ubuntu.getssl.test
+          - d.ubuntu.getssl.test
+          - e.ubuntu.getssl.test
+          - f.ubuntu.getssl.test
+          - g.ubuntu.getssl.test
+          - h.ubuntu.getssl.test
+          - i.ubuntu.getssl.test
+          - j.ubuntu.getssl.test
+          - k.ubuntu.getssl.test
+  getssl-ubuntu18:
+    build:
+      context: .
+      dockerfile: test/Dockerfile-ubuntu18
+    container_name: getssl-ubuntu18
+    volumes:
+      - .:/getssl
+    environment:
+      GETSSL_HOST: ubuntu18.getssl.test
+      GETSSL_IP: 10.30.50.14
+      NGINX_CONFIG: /etc/nginx/sites-enabled/default
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.14
+        aliases:
+          - ubuntu18.getssl.test
+          - a.ubuntu18.getssl.test
+          - b.ubuntu18.getssl.test
+          - c.ubuntu18.getssl.test
+          - d.ubuntu18.getssl.test
+          - e.ubuntu18.getssl.test
+          - f.ubuntu18.getssl.test
+          - g.ubuntu18.getssl.test
+          - h.ubuntu18.getssl.test
+          - i.ubuntu18.getssl.test
+          - j.ubuntu18.getssl.test
+          - k.ubuntu18.getssl.test
+
+
 
 networks:
   acmenet:
diff --git a/test/5-old-awk-error.bats b/test/5-old-awk-error.bats
deleted file mode 100644
index 0f234a2..0000000
--- a/test/5-old-awk-error.bats
+++ /dev/null
@@ -1,24 +0,0 @@
-#! /usr/bin/env bats
-
-load '/bats-support/load.bash'
-load '/bats-assert/load.bash'
-load '/getssl/test/test_helper.bash'
-
-
-# This is run for every test
-setup() {
-    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
-}
-
-
-@test "Check getssl fails if an old version of awk is installed" {
-    CONFIG_FILE="getssl-http01.cfg"
-    # Make sure this test only runs on an image running an old version of awk
-    if [[ "$TEST_AWK" != "" ]]; then
-        setup_environment
-        init_getssl
-        create_certificate
-        assert_failure
-        assert_output "getssl: Your version of awk does not work with json_awk (see http://github.com/step-/JSON.awk/issues/6), please install a newer version of mawk or gawk"
-    fi
-}
diff --git a/test/Dockerfile-alpine b/test/Dockerfile-alpine
index e9ee6c3..ff69490 100644
--- a/test/Dockerfile-alpine
+++ b/test/Dockerfile-alpine
@@ -1,14 +1,15 @@
 FROM alpine:latest
 
-RUN apk --no-cache add supervisor openssl git curl bind-tools wget gawk nginx bash
-# RUN apk --no-cache add vim dos2unix # for debugging
+# Note this image uses busybox awk instead of gawk
+
+RUN apk --no-cache add supervisor openssl git curl bind-tools wget nginx bash
 
 WORKDIR /root
+
+# Create nginx directories in standard places
 RUN mkdir /run/nginx
 RUN mkdir /etc/nginx/pki
 RUN mkdir /etc/nginx/pki/private
-COPY ./test/test-config/nginx-ubuntu-no-ssl /etc/nginx/sites-enabled/default
-COPY ./test/alpine-supervisord.conf /etc/supervisord.conf
 
 # BATS (Bash Automated Testings)
 RUN git clone https://github.com/bats-core/bats-core.git /bats-core
@@ -17,4 +18,5 @@ RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
 RUN /bats-core/install.sh /usr/local
 
 # Use supervisord to run nginx in the background
+COPY ./test/alpine-supervisord.conf /etc/supervisord.conf
 ENTRYPOINT /usr/bin/supervisord -c /etc/supervisord.conf
diff --git a/test/Dockerfile-centos6 b/test/Dockerfile-centos6
index a82bf1f..9149dad 100644
--- a/test/Dockerfile-centos6
+++ b/test/Dockerfile-centos6
@@ -1,5 +1,7 @@
 FROM centos:centos6
 
+# Note this image uses gawk
+
 # Update and install required software
 RUN yum -y update
 RUN yum -y install epel-release
diff --git a/test/Dockerfile-ubuntu18-no-gawk b/test/Dockerfile-debian
similarity index 71%
rename from test/Dockerfile-ubuntu18-no-gawk
rename to test/Dockerfile-debian
index 3eb9732..c4c88a1 100644
--- a/test/Dockerfile-ubuntu18-no-gawk
+++ b/test/Dockerfile-debian
@@ -1,11 +1,17 @@
-FROM ubuntu:bionic
-# bionic = latest 18 version
+FROM debian:latest
+
+# Note this image uses mawk 1.3
 
 # Update and install required software
 RUN apt-get update --fix-missing
 RUN apt-get install -y git curl dnsutils wget nginx-light
 
 WORKDIR /root
+RUN mkdir /etc/nginx/pki
+RUN mkdir /etc/nginx/pki/private
+
+# Prevent "Can't load /root/.rnd into RNG" error from openssl
+# RUN touch /root/.rnd
 
 # BATS (Bash Automated Testings)
 RUN git clone https://github.com/bats-core/bats-core.git /bats-core
diff --git a/test/Dockerfile-ubuntu b/test/Dockerfile-ubuntu
new file mode 100644
index 0000000..290100d
--- /dev/null
+++ b/test/Dockerfile-ubuntu
@@ -0,0 +1,23 @@
+FROM ubuntu:latest
+
+# Note this image uses mawk1.3
+
+# Update and install required software
+RUN apt-get update --fix-missing
+RUN apt-get install -y git curl dnsutils wget nginx-light
+RUN apt-get install -y vim dos2unix # for debugging
+# TODO test with drill, dig, host
+
+WORKDIR /root
+
+# Prevent "Can't load /root/.rnd into RNG" error from openssl
+RUN touch /root/.rnd
+
+# BATS (Bash Automated Testings)
+RUN git clone https://github.com/bats-core/bats-core.git /bats-core
+RUN git clone https://github.com/jasonkarns/bats-support /bats-support
+RUN git clone https://github.com/jasonkarns/bats-assert-1 /bats-assert
+RUN /bats-core/install.sh /usr/local
+
+# Run eternal loop - for testing
+CMD tail -f /dev/null
diff --git a/test/Dockerfile-ubuntu18 b/test/Dockerfile-ubuntu18
index 31554cd..ebe7607 100644
--- a/test/Dockerfile-ubuntu18
+++ b/test/Dockerfile-ubuntu18
@@ -1,12 +1,11 @@
 FROM ubuntu:bionic
-# bionic = latest 18 version
+# bionic = 18 LTS (long term support)
+
+# Note this image uses gawk
 
 # Update and install required software
 RUN apt-get update --fix-missing
-# TODO work out why default version of awk fails
-RUN apt-get install -y git curl dnsutils wget gawk nginx-light # linux-libc-dev make gcc binutils
-RUN apt-get install -y vim dos2unix # for debugging
-# TODO test with drill, dig, host
+RUN apt-get install -y git curl dnsutils wget gawk nginx-light
 
 WORKDIR /root
 RUN mkdir /etc/nginx/pki
diff --git a/test/run-all-tests.sh b/test/run-all-tests.sh
index 7372e5b..b526c63 100644
--- a/test/run-all-tests.sh
+++ b/test/run-all-tests.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+docker exec -it getssl-alpine bats /getssl/test
 docker exec -it getssl-centos6 bats /getssl/test
+docker exec -it getssl-debian bats /getssl/test
+docker exec -it getssl-ubuntu bats /getssl/test
 docker exec -it getssl-ubuntu18 bats /getssl/test
-docker exec -it getssl-ubuntu18-no-gawk bats /getssl/test/5-old-awk-error.bats
diff --git a/test/test_helper.bash b/test/test_helper.bash
index 0ac9a43..b33ee0b 100644
--- a/test/test_helper.bash
+++ b/test/test_helper.bash
@@ -18,7 +18,7 @@ setup_environment() {
     fi
 
     curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/add-a
-    cp ${CODE_DIR}/test/test-config/nginx-ubuntu-no-ssl ${NGINX_CONFIG}
+    cp ${CODE_DIR}/test/test-config/nginx-ubuntu-no-ssl "${NGINX_CONFIG}"
     /getssl/test/restart-nginx
 }
 

From d42f08a97497ca7d1da834bc7949239a0b1f548e Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sun, 9 Feb 2020 17:32:40 +0000
Subject: [PATCH 79/93] Update release notes and version

---
 getssl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index b7b9094..de52ba3 100755
--- a/getssl
+++ b/getssl
@@ -205,10 +205,12 @@
 # 2020-01-26 Use urlbase64_decode() instead of base64 -d
 # 2020-01-26 Fix "already verified" error for ACMEv2
 # 2020-01-29 Check awk new enough to support json_awk
+# 2020-02-05 Fix epoch_date for busybox
+# 2020-02-06 Bugfixes for json_awk and nslookup to support old awk versions (2.17)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.16"
+VERSION="2.17"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096

From 19a9445811bbbdeba74afe393264545d73a28e48 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Tue, 11 Feb 2020 07:14:50 +0000
Subject: [PATCH 80/93] Add SCP_OPTS and SFTP_OPTS

---
 getssl | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/getssl b/getssl
index de52ba3..f048e6c 100755
--- a/getssl
+++ b/getssl
@@ -207,6 +207,7 @@
 # 2020-01-29 Check awk new enough to support json_awk
 # 2020-02-05 Fix epoch_date for busybox
 # 2020-02-06 Bugfixes for json_awk and nslookup to support old awk versions (2.17)
+# 2020-02-11 Add SCP_OPTS and SFTP_OPTS
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
@@ -549,8 +550,9 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
     info "copying $cert to $to"
     debug "copying from $from to $to"
     if [[ "${to:0:4}" == "ssh:" ]] ; then
-      debug "using scp scp -q $from ${to:4}"
-      if ! scp -q "$from" "${to:4}" >/dev/null 2>&1 ; then
+      debug "using scp -q $SCP_OPTS $from ${to:4}"
+      # shellcheck disable=SC2086
+      if ! scp -q $SCP_OPTS "$from" "${to:4}" >/dev/null 2>&1 ; then
         error_exit "problem copying file to the server using scp.
         scp $from ${to:4}"
       fi
@@ -596,9 +598,10 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
       ftpfile=$(basename "$ftplocn")
       fromdir=$(dirname "$from")
       fromfile=$(basename "$from")
-      debug "sftp user=$ftpuser - pass=$ftppass - host=$ftphost dir=$ftpdirn file=$ftpfile"
+      debug "sftp $SFTP_OPTS user=$ftpuser - pass=$ftppass - host=$ftphost dir=$ftpdirn file=$ftpfile"
       debug "from dir=$fromdir  file=$fromfile"
-      sshpass -p "$ftppass" sftp "$ftpuser@$ftphost" <<- _EOF
+      # shellcheck disable=SC2086
+      sshpass -p "$ftppass" sftp $SFTP_OPTS "$ftpuser@$ftphost" <<- _EOF
 			cd $ftpdirn
 			lcd $fromdir
 			put $fromfile

From dcb107ed7d599bd69420c6acf54daa852d4ae411 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Tue, 11 Feb 2020 07:42:11 +0000
Subject: [PATCH 81/93] Add SSH_OPTS to template

---
 getssl | 32 ++++++++++++++++++++++++++------
 1 file changed, 26 insertions(+), 6 deletions(-)

diff --git a/getssl b/getssl
index f048e6c..2c15739 100755
--- a/getssl
+++ b/getssl
@@ -1607,15 +1607,19 @@ usage() { # echos out the program usage
 
 write_domain_template() { # write out a template file for a domain.
   cat > "$1" <<- _EOF_domain_
+	# This file is read second (and per domain if running with the -a option)
+	# and overwrites any settings from the first file
+	#
 	# Uncomment and modify any variables you need
 	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
 	# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
 	#
 	# The staging server is best for testing
-	#CA="https://acme-staging-v02.api.letsencrypt.org/directory"
+	#CA="https://acme-staging-v02.api.letsencrypt.org/"
 	# This server issues full certificates, however has rate limits
 	#CA="https://acme-v02.api.letsencrypt.org"
 
+	# Private key types - can be rsa, prime256v1, secp384r1 or secp521r1
 	#PRIVATE_KEY_ALG="rsa"
 
 	# Additional domains - this could be multiple domains / subdomains in a comma separated list
@@ -1630,15 +1634,19 @@ write_domain_template() { # write out a template file for a domain.
 	# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
 	# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
 	# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
-    # You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
-    # password, host, port (explicitly needed even if using default port 443) and path on the server.
+	# You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
+	# password, host, port (explicitly needed even if using default port 443) and path on the server.
 	#ACL=('/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ssh:sshuserid@server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
 	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge'
-    #     'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
+	#     'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
+
+	# Specify SSH options, e.g. non standard port in SSH_OPTS
+	# (Can also use SCP_OPTS and SFTP_OPTS)
+	# SSH_OPTS=-p 12345
 
-	#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+	# Set USE_SINGLE_ACL="true" to use a single ACL for all checks
 	#USE_SINGLE_ACL="false"
 
 	# Location for all your certs, these can either be on the server (full path name)
@@ -1652,6 +1660,9 @@ write_domain_template() { # write out a template file for a domain.
 	# The command needed to reload apache / nginx or whatever you use
 	#RELOAD_CMD=""
 
+	# Uncomment the following line to prevent non-interactive renewals of certificates
+	#PREVENT_NON_INTERACTIVE_RENEWAL="true"
+
 	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
 	# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
 	# will be checked for certificate expiry and also will be checked after
@@ -1664,27 +1675,36 @@ write_domain_template() { # write out a template file for a domain.
 
 write_getssl_template() { # write out the main template file
   cat > "$1" <<- _EOF_getssl_
+	# This file is read first and is common to all domains
+	#
 	# Uncomment and modify any variables you need
 	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
 	#
 	# The staging server is best for testing (hence set as default)
-	CA="https://acme-staging-v02.api.letsencrypt.org/directory"
+	CA="https://acme-staging-v02.api.letsencrypt.org"
 	# This server issues full certificates, however has rate limits
 	#CA="https://acme-v02.api.letsencrypt.org"
 
+	# The agreement that must be signed with the CA, if not defined the default agreement will be used
 	#AGREEMENT="$AGREEMENT"
 
 	# Set an email address associated with your account - generally set at account level rather than domain.
 	#ACCOUNT_EMAIL="me@example.com"
 	ACCOUNT_KEY_LENGTH=4096
 	ACCOUNT_KEY="$WORKING_DIR/account.key"
+
+	# Account key and private key types - can be rsa, prime256v1, secp384r1 or secp521r1
+	#ACCOUNT_KEY_TYPE="rsa"
 	PRIVATE_KEY_ALG="rsa"
 	#REUSE_PRIVATE_KEY="true"
 
 	# The command needed to reload apache / nginx or whatever you use
 	#RELOAD_CMD=""
+
 	# The time period within which you want to allow renewal of a certificate
 	#  this prevents hitting some of the rate limits.
+	# Creating a file called FORCE_RENEWAL in the domain directory allows one-off overrides
+	# of this setting
 	RENEW_ALLOW="30"
 
 	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,

From 83de0e3910b7b708b377517a49bcff9582f77dc4 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 12 Feb 2020 14:21:04 +0000
Subject: [PATCH 82/93] Fix for DUAL_RSA_ECDSA not working with ACMEv2 (#334,
 #474, #502)

---
 getssl                                        | 3123 +++++++++--------
 test/3-dual-rsa-ecdsa.bats                    |   43 +
 test/Dockerfile-debian                        |    3 -
 test/README.md                                |    6 +-
 .../getssl-dns01-dual-rsa-ecdsa.cfg           |   37 +
 .../getssl-http01-dual-rsa-ecdsa.cfg          |   33 +
 6 files changed, 1681 insertions(+), 1564 deletions(-)
 create mode 100644 test/3-dual-rsa-ecdsa.bats
 create mode 100644 test/test-config/getssl-dns01-dual-rsa-ecdsa.cfg
 create mode 100644 test/test-config/getssl-http01-dual-rsa-ecdsa.cfg

diff --git a/getssl b/getssl
index 2c15739..0d593d7 100755
--- a/getssl
+++ b/getssl
@@ -297,11 +297,12 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
   domain=$2
   keyauthorization=$3
 
-  debug "sending request to ACME server saying we're ready for challenge"
+  info "sending request to ACME server saying we're ready for challenge"
 
   # check response from our request to perform challenge
   if [[ $API -eq 1 ]]; then
     send_signed_request "$uri" "{\"resource\": \"challenge\", \"keyAuthorization\": \"$keyauthorization\"}"
+
     if [[ -n "$code" ]] && [[ ! "$code" == '202' ]] ; then
       error_exit "$domain:Challenge error: $code"
     fi
@@ -315,7 +316,7 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
 
   # loop "forever" to keep checking for a response from the ACME server.
   while true ; do
-    debug "checking if challenge is complete"
+    info "checking if challenge is complete"
     if [[ $API -eq 1 ]]; then
       if ! get_cr "$uri" ; then
         error_exit "$domain:Verify error:$code"
@@ -548,7 +549,6 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
   IFS=\; read -r -a copy_locations <<<"$3"
   for to in "${copy_locations[@]}"; do
     info "copying $cert to $to"
-    debug "copying from $from to $to"
     if [[ "${to:0:4}" == "ssh:" ]] ; then
       debug "using scp -q $SCP_OPTS $from ${to:4}"
       # shellcheck disable=SC2086
@@ -715,6 +715,29 @@ create_key() { # create a domain key (if it doesn't already exist)
   fi
 }
 
+create_order() {
+  dstring="["
+  for d in $alldomains; do
+    dstring="${dstring}{\"type\":\"dns\",\"value\":\"$d\"},"
+  done
+  dstring="${dstring::${#dstring}-1}]"
+  # request NewOrder currently seems to ignore the dates ....
+  #  dstring="${dstring},\"notBefore\": \"$(date -d "-1 hour" --utc +%FT%TZ)\""
+  #  dstring="${dstring},\"notAfter\": \"$(date -d "2 days" --utc +%FT%TZ)\""
+  request="{\"identifiers\": $dstring}"
+  send_signed_request "$URL_newOrder" "$request"
+  OrderLink=$(echo "$responseHeaders" | grep -i location | awk '{print $2}'| tr -d '\r\n ')
+  debug "Order link $OrderLink"
+  FinalizeLink=$(json_get "$response" "finalize")
+  dn=0
+  for d in $alldomains; do
+    # get authorizations link
+    AuthLink[$dn]=$(json_get "$response" "identifiers" "value" "$d" "authorizations" "x")
+    debug "authorizations link for $d - ${AuthLink[$dn]}"
+    ((dn++))
+  done
+}
+
 date_epoc() { # convert the date into epoch time
   if [[ "$os" == "bsd" ]]; then
     date -j -f "%b %d %T %Y %Z" "$1" +%s
@@ -757,1746 +780,1724 @@ error_exit() { # give error message on error exit
   exit 1
 }
 
-get_auth_dns() { # get the authoritative dns server for a domain (sets primary_ns )
-  gad_d="$1" # domain name
-  gad_s="$PUBLIC_DNS_SERVER" # start with PUBLIC_DNS_SERVER
-
-  if [[ "$os" == "cygwin" ]]; then
-    all_auth_dns_servers=$(nslookup -type=soa "${d}" ${PUBLIC_DNS_SERVER} 2>/dev/null \
-                          | grep "primary name server" \
-                          | awk '{print $NF}')
-    if [[ -z "$all_auth_dns_servers" ]]; then
-      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
-    fi
-    primary_ns="$all_auth_dns_servers"
-    return
+fulfill_challenges() {
+dn=0
+for d in $alldomains; do
+  # $d is domain in current loop, which is number $dn for ACL
+  info "Verifying $d"
+  if [[ "$USE_SINGLE_ACL" == "true" ]]; then
+    DOMAIN_ACL="${ACL[0]}"
+  else
+    DOMAIN_ACL="${ACL[$dn]}"
   fi
 
-  if [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
-    if [[ -z "$gad_s" ]]; then #checking for CNAMEs
-      res=$($DNS_CHECK_FUNC CNAME "$gad_d"| grep "^$gad_d")
-    else
-      res=$($DNS_CHECK_FUNC CNAME "$gad_d" "@$gad_s"| grep "^$gad_d")
-    fi
-    if [[ -n "$res" ]]; then # domain is a CNAME so get main domain
-      gad_d=$(echo "$res"| awk '{print $5}' |sed 's/\.$//g')
-    fi
-    if [[ -z "$gad_s" ]]; then #checking for CNAMEs
-      res=$($DNS_CHECK_FUNC NS "$gad_d"| grep "^$gad_d")
-    else
-      res=$($DNS_CHECK_FUNC NS "$gad_d" "@$gad_s"| grep "^$gad_d")
-    fi
-    if [[ -z "$res" ]]; then
-      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
-    else
-      all_auth_dns_servers=$(echo "$res" | awk '$4 ~ "NS" {print $5}' | sed 's/\.$//g'|tr '\n' ' ')
-    fi
-    if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
-      primary_ns="$all_auth_dns_servers"
-    else
-      primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
-    fi
-    return
-  fi
+  # request a challenge token from ACME server
+  if [[ $API -eq 1 ]]; then
+    request="{\"resource\":\"new-authz\",\"identifier\":{\"type\":\"dns\",\"value\":\"$d\"}}"
+    send_signed_request "$URL_new_authz" "$request"
+    debug "completed send_signed_request"
 
-  if [[ "$DNS_CHECK_FUNC" == "host" ]]; then
-    if [[ -z "$gad_s" ]]; then
-      res=$($DNS_CHECK_FUNC -t NS "$gad_d"| grep "name server")
-    else
-      res=$($DNS_CHECK_FUNC -t NS "$gad_d" "$gad_s"| grep "name server")
-    fi
-    if [[ -z "$res" ]]; then
-      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
-    else
-      all_auth_dns_servers=$(echo "$res" | awk '{print $4}' | sed 's/\.$//g'|tr '\n' ' ')
-    fi
-    if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
-      primary_ns="$all_auth_dns_servers"
-    else
-      primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
+    # check if we got a valid response and token, if not then error exit
+    if [[ -n "$code" ]] && [[ ! "$code" == '201' ]] ; then
+      error_exit "new-authz error: $response"
     fi
-    return
+  else
+    send_signed_request "${AuthLink[$dn]}" ""
   fi
 
-  res=$(nslookup -debug -type=soa -type=ns "$gad_d" ${gad_s})
-
-  if [[ "$(echo "$res" | grep -c "Non-authoritative")" -gt 0 ]]; then
-    # this is a Non-authoritative server, need to check for an authoritative one.
-    gad_s=$(echo "$res" | awk '$2 ~ "nameserver" {print $4; exit }' |sed 's/\.$//g')
-    if [[ "$(echo "$res" | grep -c "an't find")" -gt 0 ]]; then
-      # if domain name doesn't exist, then find auth servers for next level up
-      gad_s=$(echo "$res" | awk '$1 ~ "origin" {print $3; exit }')
-      gad_d=$(echo "$res" | awk '$1 ~ "->" {print $2; exit}')
+  if [[ $response_status == "valid" ]]; then
+    info "$d is already validated"
+    if [[ "$DEACTIVATE_AUTH" == "true" ]]; then
+      deactivate_url="$(echo "$responseHeaders" | awk ' $1 ~ "^Location" {print $2}' | tr -d "\r")"
+      deactivate_url_list+=" $deactivate_url "
+      debug "url added to deactivate list ${deactivate_url}"
+      debug "deactivate list is now $deactivate_url_list"
     fi
-  fi
-
-  if [[ -z "$gad_s" ]]; then
-    res=$(nslookup -debug -type=soa -type=ns "$gad_d")
+    # increment domain-counter
+    ((dn++))
   else
-    res=$(nslookup -debug -type=soa -type=ns "$gad_d" "${gad_s}")
-  fi
+    PREVIOUSLY_VALIDATED="false"
+    if [[ $VALIDATE_VIA_DNS == "true" ]]; then # set up the correct DNS token for verification
+      if [[ $API -eq 1 ]]; then
+        # get the dns component of the ACME response
+        # get the token from the dns component
+        token=$(json_get "$response" "token" "dns-01")
+        # get the uri from the dns component
+        uri=$(json_get "$response" "uri" "dns-01")
+        debug uri "$uri"
+      else # APIv2
+        debug "authlink response = $response"
+        # get the token from the http-01 component
+        token=$(json_get "$response" "challenges" "type" "dns-01" "token")
+        # get the uri from the http component
+        uri=$(json_get "$response" "challenges" "type" "dns-01" "url")
+        debug uri "$uri"
+      fi
 
-  if [[ "$(echo "$res" | grep -c "canonical name")" -gt 0 ]]; then
-    gad_d=$(echo "$res" | awk ' $2 ~ "canonical" {print $5; exit }' |sed 's/\.$//g')
-  elif [[ "$(echo "$res" | grep -c "an't find")" -gt 0 ]]; then
-    gad_s=$(echo "$res" | awk ' $1 ~ "origin" {print $3; exit }')
-    gad_d=$(echo "$res"| awk '$1 ~ "->" {print $2; exit}')
-  fi
+      keyauthorization="$token.$thumbprint"
+      debug keyauthorization "$keyauthorization"
 
-  all_auth_dns_servers=$(nslookup -type=soa -type=ns "$gad_d" "$gad_s" \
-                        | awk ' $2 ~ "nameserver" {print $4}' \
-                        | sed 's/\.$//g'| tr '\n' ' ')
-  if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
-    primary_ns="$all_auth_dns_servers"
-  else
-    primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
-  fi
-}
+      #create signed authorization key from token.
+      auth_key=$(printf '%s' "$keyauthorization" | openssl dgst -sha256 -binary \
+                 | openssl base64 -e \
+                 | tr -d '\n\r' \
+                 | sed -e 's:=*$::g' -e 'y:+/:-_:')
+      debug auth_key "$auth_key"
 
-get_certificate() { # get certificate for csr, if all domains validated.
-  gc_csr=$1         # the csr file
-  gc_certfile=$2    # The filename for the certificate
-  gc_cafile=$3      # The filename for the CA certificate
+      debug "adding dns via command: $DNS_ADD_COMMAND $d $auth_key"
+      if ! eval "$DNS_ADD_COMMAND" "$d" "$auth_key" ; then
+        error_exit "DNS_ADD_COMMAND failed for domain $d"
+      fi
 
-  der=$(openssl req -in "$gc_csr" -outform DER | urlbase64)
-  debug "der $der"
-  if [[ $API -eq 1 ]]; then
-    send_signed_request "$URL_new_cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
-    # convert certificate information into correct format and save to file.
-    CertData=$(awk ' $1 ~ "^Location" {print $2}' "$CURL_HEADER" |tr -d '\r')
-    debug "certdata location = $CertData"
-    if [[ "$CertData" ]] ; then
-      echo -----BEGIN CERTIFICATE----- > "$gc_certfile"
-      curl --user-agent "$CURL_USERAGENT" --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
-      echo -----END CERTIFICATE-----  >> "$gc_certfile"
-      info "Certificate saved in $CERT_FILE"
-    fi
+      # find a primary / authoritative DNS server for the domain
+      if [[ -z "$AUTH_DNS_SERVER" ]]; then
+        get_auth_dns "$d"
+      else
+        primary_ns="$AUTH_DNS_SERVER"
+      fi
+      debug primary_ns "$primary_ns"
 
-    # If certificate wasn't a valid certificate, error exit.
-    if [[ -z "$CertData" ]] ; then
-      response2=$(echo "$response" | fold -w64 |openssl base64 -d)
-      debug "response was $response"
-      error_exit "Sign failed: $(echo "$response2" | grep "detail")"
-    fi
+      # make a directory to hold pending dns-challenges
+      if [[ ! -d "$TEMP_DIR/dns_verify" ]]; then
+        mkdir "$TEMP_DIR/dns_verify"
+      fi
 
-    # get a copy of the CA certificate.
-    IssuerData=$(grep -i '^Link' "$CURL_HEADER" \
-                | cut -d " " -f 2\
-                | cut -d ';' -f 1 \
-                | sed 's/<//g' \
-                | sed 's/>//g')
-    if [[ "$IssuerData" ]] ; then
-      echo -----BEGIN CERTIFICATE----- > "$gc_cafile"
-      curl --user-agent "$CURL_USERAGENT" --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
-      echo -----END CERTIFICATE-----  >> "$gc_cafile"
-      info "The intermediate CA cert is in $gc_cafile"
-    fi
-  else # APIv2
-    send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
-    debug "order link was $OrderLink"
-    send_signed_request "$OrderLink" ""
-    CertData=$(json_get "$response" "certificate")
-    debug "CertData is at $CertData"
-    send_signed_request "$CertData" "" "" "$FULL_CHAIN"
-    info "Full certificate saved in $FULL_CHAIN"
-    awk -v CERT_FILE="$CERT_FILE" -v CA_CERT="$CA_CERT" 'BEGIN {outfile=CERT_FILE} split_after==1 {outfile=CA_CERT;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > outfile}' "$FULL_CHAIN"
-    info "Certificate saved in $CERT_FILE"
-  fi
-}
+      # generate a file with the current variables for the dns-challenge
+      cat > "$TEMP_DIR/dns_verify/$d" <<- _EOF_
+			token="${token}"
+			uri="${uri}"
+			keyauthorization="${keyauthorization}"
+			d="${d}"
+			primary_ns="${primary_ns}"
+			auth_key="${auth_key}"
+			_EOF_
 
-get_cr() { # get curl response
-  url="$1"
-  debug url "$url"
-  response=$(curl --user-agent "$CURL_USERAGENT" --silent "$url")
-  ret=$?
-  debug response  "$response"
-  code=$(json_get "$response" status)
-  debug code "$code"
-  debug "get_cr return code $ret"
-  return $ret
-}
+    else      # set up the correct http token for verification
+      if [[ $API -eq 1 ]]; then
+        # get the token from the http component
+        token=$(json_get "$response" "token" "http-01")
+        # get the uri from the http component
+        uri=$(json_get "$response" "uri" "http-01")
+        debug uri "$uri"
+      else # APIv2
+        send_signed_request "${AuthLink[$dn]}" ""
+        debug "authlink response = $response"
+        # get the token from the http-01 component
+        token=$(json_get "$response" "challenges" "type" "http-01" "token")
+        # get the uri from the http component
+        uri=$(json_get "$response" "challenges" "type" "http-01" "url" | head -n1)
+        debug uri "$uri"
+      fi
 
-get_os() { # function to get the current Operating System
-  uname_res=$(uname -s)
-  if [[ $(date -h 2>&1 | grep -ic busybox) -gt 0 ]]; then
-    os="busybox"
-  elif [[ ${uname_res} == "Linux" ]]; then
-    os="linux"
-  elif [[ ${uname_res} == "FreeBSD" ]]; then
-    os="bsd"
-  elif [[ ${uname_res} == "Darwin" ]]; then
-    os="mac"
-  elif [[ ${uname_res:0:6} == "CYGWIN" ]]; then
-    os="cygwin"
-  elif [[ ${uname_res:0:5} == "MINGW" ]]; then
-    os="mingw"
-  else
-    os="unknown"
-  fi
-  debug "detected os type = $os"
-}
+      #create signed authorization key from token.
+      keyauthorization="$token.$thumbprint"
 
-get_signing_params() { # get signing parameters from key
-  skey=$1
-  if openssl rsa -in "${skey}" -noout 2>/dev/null ; then # RSA key
-    pub_exp64=$(openssl rsa -in "${skey}" -noout -text \
-                | grep publicExponent \
-                | grep -oE "0x[a-f0-9]+" \
-                | cut -d'x' -f2 \
-                | hex2bin \
-                | urlbase64)
-    pub_mod64=$(openssl rsa -in "${skey}" -noout -modulus \
-                | cut -d'=' -f2 \
-                | hex2bin \
-                | urlbase64)
+      # save variable into temporary file
+      echo -n "$keyauthorization" > "$TEMP_DIR/$token"
+      chmod 644 "$TEMP_DIR/$token"
 
-    jwk='{"e":"'"${pub_exp64}"'","kty":"RSA","n":"'"${pub_mod64}"'"}'
-    jwkalg="RS256"
-    signalg="sha256"
-  elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
-    crv="$(openssl ec -in  "$skey" -noout -text 2>/dev/null | awk '$2 ~ "CURVE:" {print $3}')"
-    if [[ -z "$crv" ]]; then
-      gsp_keytype="$(openssl ec -in  "$skey" -noout -text 2>/dev/null \
-                     | grep "^ASN1 OID:" \
-                     | awk '{print $3}')"
-      case "$gsp_keytype" in
-        prime256v1) crv="P-256" ;;
-        secp384r1) crv="P-384" ;;
-        secp521r1) crv="P-521" ;;
-        *) error_exit "invalid curve algorithm type $gsp_keytype";;
-      esac
-    fi
-    case "$crv" in
-      P-256) jwkalg="ES256" ; signalg="sha256" ;;
-      P-384) jwkalg="ES384" ; signalg="sha384" ;;
-      P-521) jwkalg="ES512" ; signalg="sha512" ;;
-      *) error_exit "invalid curve algorithm type $crv";;
-    esac
-    pubtext="$(openssl ec  -in "$skey"  -noout -text 2>/dev/null \
-               | awk '/^pub:/{p=1;next}/^ASN1 OID:/{p=0}p' \
-               | tr -d ": \n\r")"
-    mid=$(( (${#pubtext} -2) / 2 + 2 ))
-    debug "pubtext = $pubtext"
-    x64=$(echo "$pubtext" | cut -b 3-$mid | hex2bin | urlbase64)
-    y64=$(echo "$pubtext" | cut -b $((mid+1))-${#pubtext} | hex2bin | urlbase64)
-    jwk='{"crv":"'"$crv"'","kty":"EC","x":"'"$x64"'","y":"'"$y64"'"}'
-    debug "jwk $jwk"
-  else
-    error_exit "Invalid key file"
-  fi
-  thumbprint="$(printf "%s" "$jwk" | openssl dgst -sha256 -binary | urlbase64)"
-  debug "jwk alg = $jwkalg"
-  debug "jwk = $jwk"
-  debug "thumbprint $thumbprint"
-}
+      # copy to token to acme challenge location
+      umask 0022
+      IFS=\; read -r -a token_locations <<<"$DOMAIN_ACL"
+      for t_loc in "${token_locations[@]}"; do
+        debug "copying file from $TEMP_DIR/$token to ${t_loc}"
+        copy_file_to_location "challenge token" \
+                              "$TEMP_DIR/$token" \
+                              "${t_loc}/$token"
+      done
+      umask "$ORIG_UMASK"
 
-graceful_exit() { # normal exit function.
-  clean_up
-  exit
-}
+      wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
+      debug wellknown_url "$wellknown_url"
 
-help_message() { # print out the help message
-  cat <<- _EOF_
-	$PROGNAME ver. $VERSION
-	Obtain SSL certificates from the letsencrypt.org ACME server
+      if [[ "$SKIP_HTTP_TOKEN_CHECK" == "true" ]]; then
+        info "SKIP_HTTP_TOKEN_CHECK=true so not checking that token is working correctly"
+      else
+        sleep "$HTTP_TOKEN_CHECK_WAIT"
+        # check that we can reach the challenge ourselves, if not, then error
+        if [[ ! "$(curl --user-agent "$CURL_USERAGENT" -k --silent --location "$wellknown_url")" == "$keyauthorization" ]]; then
+          error_exit "for some reason could not reach $wellknown_url - please check it manually"
+        fi
+      fi
 
-	$(usage)
+      check_challenge_completion "$uri" "$d" "$keyauthorization"
 
-	Options:
-	  -a, --all          Check all certificates
-	  -d, --debug        Output debug information
-	  -c, --create       Create default config files
-	  -f, --force        Force renewal of cert (overrides expiry checks)
-	  -h, --help         Display this help message and exit
-	  -q, --quiet        Quiet mode (only outputs on error, success of new cert, or getssl was upgraded)
-	  -Q, --mute         Like -q, but also mute notification about successful upgrade
-	  -r, --revoke   "cert" "key" [CA_server] Revoke a certificate (the cert and key are required)
-	  -u, --upgrade      Upgrade getssl if a more recent version is available
-	  -k, --keep     "#" Maximum number of old getssl versions to keep when upgrading
-	  -U, --nocheck      Do not check if a more recent version is available
-	  -w working_dir "Working directory"
+      debug "remove token from ${DOMAIN_ACL}"
+      IFS=\; read -r -a token_locations <<<"$DOMAIN_ACL"
+      for t_loc in "${token_locations[@]}"; do
+        if [[ "${t_loc:0:4}" == "ssh:" ]] ; then
+          sshhost=$(echo "${t_loc}"| awk -F: '{print $2}')
+          command="rm -f ${t_loc:(( ${#sshhost} + 5))}/${token:?}"
+          debug "running following command to remove token"
+          debug "ssh $SSH_OPTS $sshhost ${command}"
+          # shellcheck disable=SC2029
+          # shellcheck disable=SC2086
+          ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
+          rm -f "${TEMP_DIR:?}/${token:?}"
+        elif [[ "${t_loc:0:4}" == "ftp:" ]] ; then
+          debug "using ftp to remove token file"
+          ftpuser=$(echo "${t_loc}"| awk -F: '{print $2}')
+          ftppass=$(echo "${t_loc}"| awk -F: '{print $3}')
+          ftphost=$(echo "${t_loc}"| awk -F: '{print $4}')
+          ftplocn=$(echo "${t_loc}"| awk -F: '{print $5}')
+          debug "ftp user=$ftpuser - pass=$ftppass - host=$ftphost location=$ftplocn"
+          ftp -n <<- EOF
+					open $ftphost
+					user $ftpuser $ftppass
+					cd $ftplocn
+					delete ${token:?}
+					EOF
+        else
+          rm -f "${t_loc:?}/${token:?}"
+        fi
+      done
+    fi
+    # increment domain-counter
+    ((dn++))
+  fi
+done # end of ... loop through domains for cert ( from SANS list)
 
-	_EOF_
-}
+# perform validation if via DNS challenge
+if [[ $VALIDATE_VIA_DNS == "true" ]]; then
+  # loop through dns-variable files to check if dns has been changed
+  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
+    if [[ -e "$dnsfile" ]]; then
+      debug "loading DNSfile: $dnsfile"
+      # shellcheck source=/dev/null
+      . "$dnsfile"
 
-hex2bin() { # Remove spaces, add leading zero, escape as hex string ensuring no trailing new line char
-#  printf -- "$(cat | os_esed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')"
-  echo -e -n "$(cat | os_esed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')"
-}
+      # check for token at public dns server, waiting for a valid response.
+      for ns in $primary_ns; do
+        debug "checking dns at $ns"
+        ntries=0
+        check_dns="fail"
+        while [[ "$check_dns" == "fail" ]]; do
+          if [[ "$os" == "cygwin" ]]; then
+            check_result=$(nslookup -type=txt "_acme-challenge.${d}" "${ns}" \
+                           | grep ^_acme -A2\
+                           | grep '"'|awk -F'"' '{ print $2}')
+          elif [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
+            check_result=$($DNS_CHECK_FUNC TXT "_acme-challenge.${d}" "@${ns}" \
+                           | grep '300 IN TXT'|awk -F'"' '{ print $2}')
+          elif [[ "$DNS_CHECK_FUNC" == "host" ]]; then
+            check_result=$($DNS_CHECK_FUNC -t TXT "_acme-challenge.${d}" "${ns}" \
+                           | grep 'descriptive text'|awk -F'"' '{ print $2}')
+          else
+            check_result=$(nslookup -type=txt "_acme-challenge.${d}" "${ns}" \
+                           | grep 'text ='|awk -F'"' '{ print $2}')
+          fi
+          debug "expecting  $auth_key"
+          debug "${ns} gave ... $check_result"
 
-info() { # write out info as long as the quiet flag has not been set.
-  if [[ ${_QUIET} -eq 0 ]]; then
-    echo "$@"
+          if [[ "$check_result" == *"$auth_key"* ]]; then
+            check_dns="success"
+          else
+            if [[ $ntries -lt 100 ]]; then
+              ntries=$(( ntries + 1 ))
+              info "checking DNS at ${ns} for ${d}. Attempt $ntries/100 gave wrong result, "\
+                "waiting $DNS_WAIT secs before checking again"
+              sleep $DNS_WAIT
+            else
+              debug "dns check failed - removing existing value"
+              error_exit "checking _acme-challenge.${d} gave $check_result not $auth_key"
+            fi
+          fi
+        done
+      done
+    fi
+  done
+
+  if [[ "$DNS_EXTRA_WAIT" -gt 0 && "$PREVIOUSLY_VALIDATED" != "true" ]]; then
+    info "sleeping $DNS_EXTRA_WAIT seconds before asking the ACME-server to check the dns"
+    sleep "$DNS_EXTRA_WAIT"
   fi
-}
 
-json_awk() { # AWK json converter used for API2 - needs tidying up ;)
-# shellcheck disable=SC2086
-echo "$1" | tr -d '\n' | awk '
-{
-  tokenize($0) # while(get_token()) {print TOKEN}
-  if (0 == parse()) {
-    apply(JPATHS, NJPATHS)
-  }
-}
+  # loop through dns-variable files to let the ACME server check the challenges
+  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
+    if [[ -e "$dnsfile" ]]; then
+      debug "loading DNSfile: $dnsfile"
+      # shellcheck source=/dev/null
+      . "$dnsfile"
 
-function apply (ary,size,i) {
-  for (i=1; i<size; i++)
-    print ary[i]
-}
+      check_challenge_completion "$uri" "$d" "$keyauthorization"
 
-function get_token() {
-  TOKEN = TOKENS[++ITOKENS] # for internal tokenize()
-  return ITOKENS < NTOKENS
+      debug "remove DNS entry"
+      eval "$DNS_DEL_COMMAND" "$d" "$auth_key"
+      # remove $dnsfile after each loop.
+      rm -f "$dnsfile"
+    fi
+  done
+fi
+# end of ... perform validation if via DNS challenge
+#end of varify each domain.
 }
 
-function parse_array(a1,idx,ary,ret) {
-  idx=0
-  ary=""
-  get_token()
-  if (TOKEN != "]") {
-    while (1) {
-      if (ret = parse_value(a1, idx)) {
-        return ret
-      }
-      idx=idx+1
-      ary=ary VALUE
-      get_token()
-      if (TOKEN == "]") {
-        break
-      } else if (TOKEN == ",") {
-        ary = ary ","
-      } else {
-        report(", or ]", TOKEN ? TOKEN : "EOF")
-        return 2
-      }
-      get_token()
-    }
-  }
-  VALUE=""
-  return 0
-}
-
-function parse_object(a1,key,obj) {
-  obj=""
-  get_token()
-  if (TOKEN != "}") {
-    while (1) {
-      if (TOKEN ~ /^".*"$/) {
-        key=TOKEN
-      } else {
-        report("string", TOKEN ? TOKEN : "EOF")
-        return 3
-      }
-      get_token()
-      if (TOKEN != ":") {
-        report(":", TOKEN ? TOKEN : "EOF")
-        return 4
-      }
-      get_token()
-      if (parse_value(a1, key)) {
-        return 5
-      }
-      obj=obj key ":" VALUE
-      get_token()
-      if (TOKEN == "}") {
-        break
-      } else if (TOKEN == ",") {
-        obj=obj ","
-      } else {
-        report(", or }", TOKEN ? TOKEN : "EOF")
-        return 6
-      }
-      get_token()
-    }
-  }
-  VALUE=""
-  return 0
-}
-
-
-function parse_value(a1, a2,   jpath,ret,x) {
-  jpath=(a1!="" ? a1 "," : "") a2 # "${1:+$1,}$2"
-  if (TOKEN == "{") {
-    if (parse_object(jpath)) {
-      return 7
-    }
-  } else if (TOKEN == "[") {
-    if (ret = parse_array(jpath)) {
-      return ret
-    }
-  } else if (TOKEN == "") { #test case 20150410 #4
-    report("value", "EOF")
-    return 9
-  } else if (TOKEN ~ /^([^0-9])$/) {
-    # At this point, the only valid single-character tokens are digits.
-    report("value", TOKEN)
-    return 9
-  } else {
-    VALUE=TOKEN
-  }
-  if (! ("" == jpath || "" == VALUE)) {
-    x=sprintf("[%s]\t%s", jpath, VALUE)
-    print x
-  }
-  return 0
-}
-
-function parse(   ret) {
-  get_token()
-  if (ret = parse_value()) {
-    return ret
-  }
-  if (get_token()) {
-    report("EOF", TOKEN)
-    return 11
-  }
-  return 0
-}
-
-function report(expected, got,   i,from,to,context) {
-  from = ITOKENS - 10; if (from < 1) from = 1
-  to = ITOKENS + 10; if (to > NTOKENS) to = NTOKENS
-  for (i = from; i < ITOKENS; i++)
-    context = context sprintf("%s ", TOKENS[i])
-  context = context "<<" got ">> "
-  for (i = ITOKENS + 1; i <= to; i++)
-    context = context sprintf("%s ", TOKENS[i])
-  scream("json_awk expected <" expected "> but got <" got "> at input token " ITOKENS "\n" context)
-}
-
-function reset() {
-  TOKEN=""; delete TOKENS; NTOKENS=ITOKENS=0
-  delete JPATHS; NJPATHS=0
-  VALUE=""
-}
-
-function scream(msg) {
-  FAILS[FILENAME] = FAILS[FILENAME] (FAILS[FILENAME]!="" ? "\n" : "") msg
-  msg = FILENAME ": " msg
-  print msg >"/dev/stderr"
-}
-
-function tokenize(a1,pq,pb,ESCAPE,CHAR,STRING,NUMBER,KEYWORD,SPACE) {
-  SPACE="[ \t\n]+"
-  gsub(/"[^\001-\037"\\]*((\\[^u\001-\037]|\\u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])[^\001-\037"\\]*)*"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[ \t\n]+|./, "\n&", a1)
-  gsub("\n" SPACE, "\n", a1)
-  sub(/^\n/, "", a1)
-  ITOKENS=0 # get_token() helper
-  return NTOKENS = split(a1, TOKENS, /\n/)
-}'
-}
+get_auth_dns() { # get the authoritative dns server for a domain (sets primary_ns )
+  gad_d="$1" # domain name
+  gad_s="$PUBLIC_DNS_SERVER" # start with PUBLIC_DNS_SERVER
 
-json_get() { # get values from json
-  if [[ -z "$1" ]] || [[ "$1" == "null" ]]; then
-    echo "json was blank"
+  if [[ "$os" == "cygwin" ]]; then
+    all_auth_dns_servers=$(nslookup -type=soa "${d}" ${PUBLIC_DNS_SERVER} 2>/dev/null \
+                          | grep "primary name server" \
+                          | awk '{print $NF}')
+    if [[ -z "$all_auth_dns_servers" ]]; then
+      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
+    fi
+    primary_ns="$all_auth_dns_servers"
     return
   fi
-  if [[ $API = 1 ]]; then
-    # remove newlines, so it's a single chunk of JSON
-    json_data=$( echo "$1" | tr '\n' ' ')
-    # if $3 is defined, this is the section which the item is in.
-    if [[ -n "$3" ]]; then
-      jg_section=$(echo "$json_data" | awk -F"[}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${3}"'\"/){print $i}}}')
-      if [[ "$2" == "uri" ]]; then
-        jg_subsect=$(echo "$jg_section" | awk -F"[,]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i)}}}')
-        jg_result=$(echo "$jg_subsect" | awk -F'"' '{print $4}')
-      else
-        jg_result=$(echo "$jg_section" | awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
-      fi
+
+  if [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
+    if [[ -z "$gad_s" ]]; then #checking for CNAMEs
+      res=$($DNS_CHECK_FUNC CNAME "$gad_d"| grep "^$gad_d")
     else
-      jg_result=$(echo "$json_data" |awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+      res=$($DNS_CHECK_FUNC CNAME "$gad_d" "@$gad_s"| grep "^$gad_d")
     fi
-    # check number of quotes
-    jg_q=${jg_result//[^\"]/}
-    # if 2 quotes, assume it's a quoted variable and just return the data within the quotes.
-    if [[ ${#jg_q} -eq 2 ]]; then
-      echo "$jg_result" | awk -F'"' '{print $2}'
+    if [[ -n "$res" ]]; then # domain is a CNAME so get main domain
+      gad_d=$(echo "$res"| awk '{print $5}' |sed 's/\.$//g')
+    fi
+    if [[ -z "$gad_s" ]]; then #checking for CNAMEs
+      res=$($DNS_CHECK_FUNC NS "$gad_d"| grep "^$gad_d")
     else
-      echo "$jg_result"
+      res=$($DNS_CHECK_FUNC NS "$gad_d" "@$gad_s"| grep "^$gad_d")
     fi
-  else
-    if [[ -n "$6" ]]; then
-      full=$(json_awk "$1")
-      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
-      echo "$full" | grep "^..${5}\",$section\]" | awk '{print $2}' | tr -d '"'
-    elif [[ -n "$5" ]]; then
-      full=$(json_awk "$1")
-      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
-      echo "$full" | grep "^..${2}\",$section" | grep "$5" | awk '{print $2}' | tr -d '"'
-    elif [[ -n "$3" ]]; then
-      json_awk "$1" | grep "^..${2}...${3}" | awk '{print $2}' | tr -d '"'
-    elif [[ -n "$2" ]]; then
-      json_awk "$1" | grep "^..${2}" | awk '{print $2}' | tr -d '"'
+    if [[ -z "$res" ]]; then
+      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
     else
-      json_awk "$1"
+      all_auth_dns_servers=$(echo "$res" | awk '$4 ~ "NS" {print $5}' | sed 's/\.$//g'|tr '\n' ' ')
     fi
+    if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
+      primary_ns="$all_auth_dns_servers"
+    else
+      primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
+    fi
+    return
   fi
-}
-
-os_esed() { # Use different sed version for different os types (extended regex)
-  if [[ "$os" == "bsd" ]]; then # BSD requires -E flag for extended regex
-    sed -E "${@}"
-  elif [[ "$os" == "mac" ]]; then # MAC uses older BSD style sed.
-    sed -E "${@}"
-  else
-    sed -r "${@}"
-  fi
-}
 
-purge_archive() { # purge archive of old, invalid, certificates
-  arcdir="$1/archive"
-  debug "purging archives in ${arcdir}/"
-  for padir in "$arcdir"/????_??_??_??_??; do
-    # check each directory
-    if [[ -d "$padir" ]]; then
-      tstamp=$(basename "$padir"| awk -F"_" '{print $1"-"$2"-"$3" "$4":"$5}')
-      if [[ "$os" == "bsd" ]]; then
-        direpoc=$(date -j -f "%F %H:%M" "$tstamp" +%s)
-      elif [[ "$os" == "mac" ]]; then
-        direpoc=$(date -j -f "%F %H:%M" "$tstamp" +%s)
-      else
-        direpoc=$(date -d "$tstamp" +%s)
-      fi
-      current_epoc=$(date "+%s")
-      # as certs currently valid for 90 days, purge anything older than 100
-      purgedate=$((current_epoc - 60*60*24*100))
-      if [[ "$direpoc" -lt "$purgedate" ]]; then
-        echo "purge $padir"
-        rm -rf "${padir:?}"
-      fi
+  if [[ "$DNS_CHECK_FUNC" == "host" ]]; then
+    if [[ -z "$gad_s" ]]; then
+      res=$($DNS_CHECK_FUNC -t NS "$gad_d"| grep "name server")
+    else
+      res=$($DNS_CHECK_FUNC -t NS "$gad_d" "$gad_s"| grep "name server")
     fi
-  done
-}
-
-reload_service() {  # Runs a command to reload services ( via ssh if needed)
-  if [[ -n "$RELOAD_CMD" ]]; then
-    info "reloading SSL services"
-    if [[ "${RELOAD_CMD:0:4}" == "ssh:" ]] ; then
-      sshhost=$(echo "$RELOAD_CMD"| awk -F: '{print $2}')
-      command=${RELOAD_CMD:(( ${#sshhost} + 5))}
-      debug "running following command to reload cert"
-      debug "ssh $SSH_OPTS $sshhost ${command}"
-      # shellcheck disable=SC2029
-      # shellcheck disable=SC2086
-      ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
-      # allow 2 seconds for services to restart
-      sleep 2
+    if [[ -z "$res" ]]; then
+      error_exit "couldn't find primary DNS server - please set AUTH_DNS_SERVER in config"
     else
-      debug "running reload command $RELOAD_CMD"
-      if ! eval "$RELOAD_CMD" ; then
-        error_exit "error running $RELOAD_CMD"
-      fi
+      all_auth_dns_servers=$(echo "$res" | awk '{print $4}' | sed 's/\.$//g'|tr '\n' ' ')
+    fi
+    if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
+      primary_ns="$all_auth_dns_servers"
+    else
+      primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
     fi
+    return
   fi
-}
 
-revoke_certificate() { # revoke a certificate
-  debug "revoking cert $REVOKE_CERT"
-  debug "using key $REVOKE_KEY"
-  ACCOUNT_KEY="$REVOKE_KEY"
-  # need to set the revoke key as "account_key" since it's used in send_signed_request.
-  get_signing_params "$REVOKE_KEY"
-  TEMP_DIR=$(mktemp -d 2>/dev/null || mktemp -d -t getssl)
-  debug "revoking from $CA"
-  rcertdata=$(openssl x509 -in "$REVOKE_CERT" -inform PEM -outform DER | urlbase64)
-  send_signed_request "$URL_revoke" "{\"resource\": \"revoke-cert\", \"certificate\": \"$rcertdata\"}"
-  if [[ $code -eq "200" ]]; then
-    info "certificate revoked"
+  res=$(nslookup -debug -type=soa -type=ns "$gad_d" ${gad_s})
+
+  if [[ "$(echo "$res" | grep -c "Non-authoritative")" -gt 0 ]]; then
+    # this is a Non-authoritative server, need to check for an authoritative one.
+    gad_s=$(echo "$res" | awk '$2 ~ "nameserver" {print $4; exit }' |sed 's/\.$//g')
+    if [[ "$(echo "$res" | grep -c "an't find")" -gt 0 ]]; then
+      # if domain name doesn't exist, then find auth servers for next level up
+      gad_s=$(echo "$res" | awk '$1 ~ "origin" {print $3; exit }')
+      gad_d=$(echo "$res" | awk '$1 ~ "->" {print $2; exit}')
+    fi
+  fi
+
+  if [[ -z "$gad_s" ]]; then
+    res=$(nslookup -debug -type=soa -type=ns "$gad_d")
   else
-    error_exit "Revocation failed: $(echo "$response" | grep "detail")"
+    res=$(nslookup -debug -type=soa -type=ns "$gad_d" "${gad_s}")
   fi
-}
 
-requires() { # check if required function is available
-  if [[ "$#" -gt 1 ]]; then # if more than 1 value, check list
-    for i in "$@"; do
-      if [[ "$i" == "${!#}" ]]; then # if on last variable then exit as not found
-        error_exit "this script requires one of: ${*:1:$(($#-1))}"
-      fi
-      res=$(command -v "$i" 2>/dev/null)
-      debug "checking for $i ... $res"
-      if [[ -n "$res" ]]; then # if function found, then set variable to function and return
-        debug "function $i found at $res  - setting ${!#} to $i"
-        eval "${!#}=\$i"
-        return
-      fi
-    done
-  else # only one value, so check it.
-    result=$(command -v "$1" 2>/dev/null)
-    debug "checking for required $1 ... $result"
-    if [[ -z "$result" ]]; then
-      error_exit "This script requires $1 installed"
-    fi
+  if [[ "$(echo "$res" | grep -c "canonical name")" -gt 0 ]]; then
+    gad_d=$(echo "$res" | awk ' $2 ~ "canonical" {print $5; exit }' |sed 's/\.$//g')
+  elif [[ "$(echo "$res" | grep -c "an't find")" -gt 0 ]]; then
+    gad_s=$(echo "$res" | awk ' $1 ~ "origin" {print $3; exit }')
+    gad_d=$(echo "$res"| awk '$1 ~ "->" {print $2; exit}')
   fi
-}
 
-set_server_type() { # uses SERVER_TYPE to set REMOTE_PORT and REMOTE_EXTRA
-  if [[ ${SERVER_TYPE} == "https" ]] || [[ ${SERVER_TYPE} == "webserver" ]]; then
-    REMOTE_PORT=443
-  elif [[ ${SERVER_TYPE} == "ftp" ]]; then
-    REMOTE_PORT=21
-    REMOTE_EXTRA="-starttls ftp"
-  elif [[ ${SERVER_TYPE} == "ftpi" ]]; then
-    REMOTE_PORT=990
-  elif [[ ${SERVER_TYPE} == "imap" ]]; then
-    REMOTE_PORT=143
-    REMOTE_EXTRA="-starttls imap"
-  elif [[ ${SERVER_TYPE} == "imaps" ]]; then
-    REMOTE_PORT=993
-  elif [[ ${SERVER_TYPE} == "pop3" ]]; then
-    REMOTE_PORT=110
-    REMOTE_EXTRA="-starttls pop3"
-  elif [[ ${SERVER_TYPE} == "pop3s" ]]; then
-    REMOTE_PORT=995
-  elif [[ ${SERVER_TYPE} == "smtp" ]]; then
-    REMOTE_PORT=25
-    REMOTE_EXTRA="-starttls smtp"
-  elif [[ ${SERVER_TYPE} == "smtps_deprecated" ]]; then
-    REMOTE_PORT=465
-  elif [[ ${SERVER_TYPE} == "smtps" ]] || [[ ${SERVER_TYPE} == "smtp_submission" ]]; then
-    REMOTE_PORT=587
-    REMOTE_EXTRA="-starttls smtp"
-  elif [[ ${SERVER_TYPE} == "xmpp" ]]; then
-    REMOTE_PORT=5222
-    REMOTE_EXTRA="-starttls xmpp"
-  elif [[ ${SERVER_TYPE} == "xmpps" ]]; then
-    REMOTE_PORT=5269
-  elif [[ ${SERVER_TYPE} == "ldaps" ]]; then
-    REMOTE_PORT=636
-  elif [[ ${SERVER_TYPE} =~ ^[0-9]+$ ]]; then
-    REMOTE_PORT=${SERVER_TYPE}
+  all_auth_dns_servers=$(nslookup -type=soa -type=ns "$gad_d" "$gad_s" \
+                        | awk ' $2 ~ "nameserver" {print $4}' \
+                        | sed 's/\.$//g'| tr '\n' ' ')
+  if [[ $CHECK_ALL_AUTH_DNS == "true" ]]; then
+    primary_ns="$all_auth_dns_servers"
   else
-    info "${DOMAIN}: unknown server type \"$SERVER_TYPE\" in SERVER_TYPE"
-    config_errors=true
+    primary_ns=$(echo "$all_auth_dns_servers" | awk '{print $1}')
   fi
 }
 
-send_signed_request() { # Sends a request to the ACME server, signed with your private key.
-  url=$1
-  payload=$2
-  needbase64=$3
-  outfile=$4 # save response into this file (certificate data)
+get_certificate() { # get certificate for csr, if all domains validated.
+  gc_csr=$1         # the csr file
+  gc_certfile=$2    # The filename for the certificate
+  gc_cafile=$3      # The filename for the CA certificate
 
-  debug url "$url"
+  der=$(openssl req -in "$gc_csr" -outform DER | urlbase64)
+  if [[ $API -eq 1 ]]; then
+    send_signed_request "$URL_new_cert" "{\"resource\": \"new-cert\", \"csr\": \"$der\"}" "needbase64"
+    # convert certificate information into correct format and save to file.
+    CertData=$(awk ' $1 ~ "^Location" {print $2}' "$CURL_HEADER" |tr -d '\r')
+    if [[ "$CertData" ]] ; then
+      echo -----BEGIN CERTIFICATE----- > "$gc_certfile"
+      curl --user-agent "$CURL_USERAGENT" --silent "$CertData" | openssl base64 -e  >> "$gc_certfile"
+      echo -----END CERTIFICATE-----  >> "$gc_certfile"
+      info "Certificate saved in $CERT_FILE"
+    fi
 
-  CURL_HEADER="$TEMP_DIR/curl.header"
-  dp="$TEMP_DIR/curl.dump"
+    # If certificate wasn't a valid certificate, error exit.
+    if [[ -z "$CertData" ]] ; then
+      response2=$(echo "$response" | fold -w64 |openssl base64 -d)
+      debug "response was $response"
+      error_exit "Sign failed: $(echo "$response2" | grep "detail")"
+    fi
 
-  CURL="curl "
-  # shellcheck disable=SC2072
-  if [[ "$($CURL -V | head -1 | cut -d' ' -f2 )" > "7.33" ]]; then
-    CURL="$CURL --http1.1 "
+    # get a copy of the CA certificate.
+    IssuerData=$(grep -i '^Link' "$CURL_HEADER" \
+                | cut -d " " -f 2\
+                | cut -d ';' -f 1 \
+                | sed 's/<//g' \
+                | sed 's/>//g')
+    if [[ "$IssuerData" ]] ; then
+      echo -----BEGIN CERTIFICATE----- > "$gc_cafile"
+      curl --user-agent "$CURL_USERAGENT" --silent "$IssuerData" | openssl base64 -e  >> "$gc_cafile"
+      echo -----END CERTIFICATE-----  >> "$gc_cafile"
+      info "The intermediate CA cert is in $gc_cafile"
+    fi
+  else # APIv2
+    info "Requesting Finalize Link"
+    send_signed_request "$FinalizeLink" "{\"csr\": \"$der\"}" "needbase64"
+    info Requesting Order Link
+    debug "order link was $OrderLink"
+    send_signed_request "$OrderLink" ""
+    # if ACME response is processing (still creating certificates) then wait and try again.
+    while [[ "$response_status" == "processing" ]]; do
+      info "ACME server still Processing certificates"
+      sleep 5
+      send_signed_request "$OrderLink" ""
+    done
+    info "Requesting certificate"
+    CertData=$(json_get "$response" "certificate")
+    send_signed_request "$CertData" "" "" "$FULL_CHAIN"
+    info "Full certificate saved in $FULL_CHAIN"
+    awk -v CERT_FILE="$gc_certfile" -v CA_CERT="$gc_cafile" 'BEGIN {outfile=CERT_FILE} split_after==1 {outfile=CA_CERT;split_after=0} /-----END CERTIFICATE-----/ {split_after=1} {print > outfile}' "$FULL_CHAIN"
+    info "Certificate saved in $gc_certfile"
   fi
+}
 
-  CURL="$CURL --user-agent $CURL_USERAGENT --silent --dump-header $CURL_HEADER "
+get_cr() { # get curl response
+  url="$1"
+  debug url "$url"
+  response=$(curl --user-agent "$CURL_USERAGENT" --silent "$url")
+  ret=$?
+  debug response  "$response"
+  code=$(json_get "$response" status)
+  debug code "$code"
+  debug "get_cr return code $ret"
+  return $ret
+}
 
-  if [[ ${_USE_DEBUG} -eq 1 ]]; then
-    CURL="$CURL --trace-ascii $dp "
+get_os() { # function to get the current Operating System
+  uname_res=$(uname -s)
+  if [[ $(date -h 2>&1 | grep -ic busybox) -gt 0 ]]; then
+    os="busybox"
+  elif [[ ${uname_res} == "Linux" ]]; then
+    os="linux"
+  elif [[ ${uname_res} == "FreeBSD" ]]; then
+    os="bsd"
+  elif [[ ${uname_res} == "Darwin" ]]; then
+    os="mac"
+  elif [[ ${uname_res:0:6} == "CYGWIN" ]]; then
+    os="cygwin"
+  elif [[ ${uname_res:0:5} == "MINGW" ]]; then
+    os="mingw"
+  else
+    os="unknown"
   fi
+  debug "detected os type = $os"
+  if [[ -f /etc/issue ]]; then
+    debug "Running $(cat /etc/issue)"
+  fi
+}
 
-  # convert payload to url base 64
-  payload64="$(printf '%s' "${payload}" | urlbase64)"
+get_signing_params() { # get signing parameters from key
+  skey=$1
+  if openssl rsa -in "${skey}" -noout 2>/dev/null ; then # RSA key
+    pub_exp64=$(openssl rsa -in "${skey}" -noout -text \
+                | grep publicExponent \
+                | grep -oE "0x[a-f0-9]+" \
+                | cut -d'x' -f2 \
+                | hex2bin \
+                | urlbase64)
+    pub_mod64=$(openssl rsa -in "${skey}" -noout -modulus \
+                | cut -d'=' -f2 \
+                | hex2bin \
+                | urlbase64)
 
-  # get nonce from ACME server
-  if [[ $API -eq 1 ]]; then
-    nonceurl="$CA/directory"
-    nonce=$($CURL -I $nonceurl | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
-  else # APIv2
-    nonce=$($CURL -I "$URL_newNonce" | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
+    jwk='{"e":"'"${pub_exp64}"'","kty":"RSA","n":"'"${pub_mod64}"'"}'
+    jwkalg="RS256"
+    signalg="sha256"
+  elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
+    crv="$(openssl ec -in  "$skey" -noout -text 2>/dev/null | awk '$2 ~ "CURVE:" {print $3}')"
+    if [[ -z "$crv" ]]; then
+      gsp_keytype="$(openssl ec -in  "$skey" -noout -text 2>/dev/null \
+                     | grep "^ASN1 OID:" \
+                     | awk '{print $3}')"
+      case "$gsp_keytype" in
+        prime256v1) crv="P-256" ;;
+        secp384r1) crv="P-384" ;;
+        secp521r1) crv="P-521" ;;
+        *) error_exit "invalid curve algorithm type $gsp_keytype";;
+      esac
+    fi
+    case "$crv" in
+      P-256) jwkalg="ES256" ; signalg="sha256" ;;
+      P-384) jwkalg="ES384" ; signalg="sha384" ;;
+      P-521) jwkalg="ES512" ; signalg="sha512" ;;
+      *) error_exit "invalid curve algorithm type $crv";;
+    esac
+    pubtext="$(openssl ec  -in "$skey"  -noout -text 2>/dev/null \
+               | awk '/^pub:/{p=1;next}/^ASN1 OID:/{p=0}p' \
+               | tr -d ": \n\r")"
+    mid=$(( (${#pubtext} -2) / 2 + 2 ))
+    x64=$(echo "$pubtext" | cut -b 3-$mid | hex2bin | urlbase64)
+    y64=$(echo "$pubtext" | cut -b $((mid+1))-${#pubtext} | hex2bin | urlbase64)
+    jwk='{"crv":"'"$crv"'","kty":"EC","x":"'"$x64"'","y":"'"$y64"'"}'
+  else
+    error_exit "Invalid key file"
   fi
+  thumbprint="$(printf "%s" "$jwk" | openssl dgst -sha256 -binary | urlbase64)"
+  debug "jwk alg = $jwkalg"
+}
 
-  nonceproblem="true"
-  while [[ "$nonceproblem" == "true" ]]; do
+graceful_exit() { # normal exit function.
+  clean_up
+  exit
+}
 
-    debug nonce "$nonce"
+help_message() { # print out the help message
+  cat <<- _EOF_
+	$PROGNAME ver. $VERSION
+	Obtain SSL certificates from the letsencrypt.org ACME server
 
-    # Build header with just our public key and algorithm information
-    header='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"'}'
+	$(usage)
 
-    # Build another header which also contains the previously received nonce and encode it as urlbase64
-    if [[ $API -eq 1 ]]; then
-      protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
-      protected64="$(printf '%s' "${protected}" | urlbase64)"
-    else # APIv2
-      if [[ -z "$KID" ]]; then
-        debug "KID is blank, so using jwk"
-        protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
-        protected64="$(printf '%s' "${protected}" | urlbase64)"
-      else
-        debug "using KID=${KID}"
-        protected="{\"alg\": \"$jwkalg\", \"kid\": \"$KID\",\"nonce\": \"${nonce}\", \"url\": \"${url}\"}"
-        protected64="$(printf '%s' "${protected}" | urlbase64)"
-      fi
-    fi
-
-    # Sign header with nonce and our payload with our private key and encode signature as urlbase64
-    sign_string "$(printf '%s' "${protected64}.${payload64}")"  "${ACCOUNT_KEY}" "$signalg"
-
-    # Send header + extended header + payload + signature to the acme-server
-    if [[ $API -eq 1 ]]; then
-      debug "header = $header"
-      debug "protected = $protected"
-      debug "payload = $payload"
-      body="{\"header\": ${header},"
-      body="${body}\"protected\": \"${protected64}\","
-      body="${body}\"payload\": \"${payload64}\","
-      body="${body}\"signature\": \"${signed64}\"}"
-      debug "header, payload and signature = $body"
-    else
-      debug "protected = $protected"
-      debug "payload = $payload"
-      body="{"
-      body="${body}\"protected\": \"${protected64}\","
-      body="${body}\"payload\": \"${payload64}\","
-      body="${body}\"signature\": \"${signed64}\"}"
-      debug "header, payload and signature = $body"
-    fi
-
-    code="500"
-    loop_limit=5
-    while [[ "$code" -eq 500 ]]; do
-      if [[ "$outfile" ]] ; then
-        $CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > "$outfile"
-        response=$(cat "$outfile")
-      elif [[ "$needbase64" ]] ; then
-        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" | urlbase64)
-      else
-        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url")
-      fi
-
-      if [[ "$response" == "" ]]; then
-        error_exit "ERROR curl \"$url\" returned nothing"
-      fi
-
-      responseHeaders=$(cat "$CURL_HEADER")
-      if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
-        # response is in base64 too, decode
-        response=$(urlbase64_decode "$response")
-      fi
+	Options:
+	  -a, --all          Check all certificates
+	  -d, --debug        Output debug information
+	  -c, --create       Create default config files
+	  -f, --force        Force renewal of cert (overrides expiry checks)
+	  -h, --help         Display this help message and exit
+	  -q, --quiet        Quiet mode (only outputs on error, success of new cert, or getssl was upgraded)
+	  -Q, --mute         Like -q, but also mute notification about successful upgrade
+	  -r, --revoke   "cert" "key" [CA_server] Revoke a certificate (the cert and key are required)
+	  -u, --upgrade      Upgrade getssl if a more recent version is available
+	  -k, --keep     "#" Maximum number of old getssl versions to keep when upgrading
+	  -U, --nocheck      Do not check if a more recent version is available
+	  -w working_dir "Working directory"
 
-      debug responseHeaders "$responseHeaders"
-      debug response  "$response"
-      code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
-      debug code "$code"
-      if [[ $API -eq 1 ]]; then
-        response_status=$(json_get "$response" status \
-                        | head -1| awk -F'"' '{print $2}')
-      else # APIv2
-        if [[ "$outfile" && "$response" ]]; then
-          debug "response written to $outfile"
-        elif [[ ${response##*()} == "{"* ]]; then
-          response_status=$(json_get "$response" status)
-        else
-          debug "response not in json format"
-          debug "$response"
-        fi
-      fi
-      debug "response status = $response_status"
-      if [[ "$code" -eq 500 ]]; then
-        info "error on acme server - trying again ...."
-        debug "loop_limit = $loop_limit"
-        sleep 5
-        loop_limit=$((loop_limit - 1))
-        if [[ $loop_limit -lt 1 ]]; then
-          error_exit "500 error from ACME server:  $response"
-        fi
-      fi
-      if [[ "$code" -eq 429 ]]; then
-        error_exit "429 rate limited error from ACME server"
-      fi
-    done
-    if [[ $response == *"error:badNonce"* ]]; then
-      debug "bad nonce"
-      nonce=$(echo "$responseHeaders" | grep -i "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
-      debug "trying new nonce $nonce"
-    else
-      nonceproblem="false"
-    fi
-  done
+	_EOF_
 }
 
-sign_string() { # sign a string with a given key and algorithm and return urlbase64
-                # sets the result in variable signed64
-  str=$1
-  key=$2
-  signalg=$3
-
-  if openssl rsa -in "${skey}" -noout 2>/dev/null ; then # RSA key
-    signed64="$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" | urlbase64)"
-  elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
-    signed=$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" -hex | awk '{print $2}')
-    debug "EC signature $signed"
-    if [[ "${signed:4:4}" == "0220" ]]; then #sha256
-      R=$(echo "$signed" | cut -c 9-72)
-      part2=$(echo "$signed" | cut -c 73-)
-    elif [[ "${signed:4:4}" == "0221" ]]; then #sha256
-      R=$(echo "$signed" | cut -c 11-74)
-      part2=$(echo "$signed" | cut -c 75-)
-    elif [[ "${signed:4:4}" == "0230" ]]; then #sha384
-      R=$(echo "$signed" | cut -c 9-104)
-      part2=$(echo "$signed" | cut -c 105-)
-    elif [[ "${signed:4:4}" == "0231" ]]; then #sha384
-      R=$(echo "$signed" | cut -c 11-106)
-      part2=$(echo "$signed" | cut -c 107-)
-    elif [[ "${signed:6:4}" == "0241" ]]; then #sha512
-      R=$(echo "$signed" | cut -c 11-140)
-      part2=$(echo "$signed" | cut -c 141-)
-    elif [[ "${signed:6:4}" == "0242" ]]; then #sha512
-      R=$(echo "$signed" | cut -c 11-142)
-      part2=$(echo "$signed" | cut -c 143-)
-    else
-      error_exit "error in EC signing couldn't get R from $signed"
-    fi
-    debug "R $R"
-
-    if [[ "${part2:0:4}" == "0220" ]]; then #sha256
-      S=$(echo "$part2" | cut -c 5-68)
-    elif [[ "${part2:0:4}" == "0221" ]]; then #sha256
-      S=$(echo "$part2" | cut -c 7-70)
-    elif [[ "${part2:0:4}" == "0230" ]]; then #sha384
-      S=$(echo "$part2" | cut -c 5-100)
-    elif [[ "${part2:0:4}" == "0231" ]]; then #sha384
-      S=$(echo "$part2" | cut -c 7-102)
-    elif [[ "${part2:0:4}" == "0241" ]]; then #sha512
-      S=$(echo "$part2" | cut -c 5-136)
-    elif [[ "${part2:0:4}" == "0242" ]]; then #sha512
-      S=$(echo "$part2" | cut -c 5-136)
-    else
-      error_exit "error in EC signing couldn't get S from $signed"
-    fi
+hex2bin() { # Remove spaces, add leading zero, escape as hex string ensuring no trailing new line char
+#  printf -- "$(cat | os_esed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')"
+  echo -e -n "$(cat | os_esed -e 's/[[:space:]]//g' -e 's/^(.(.{2})*)$/0\1/' -e 's/(.{2})/\\x\1/g')"
+}
 
-    debug "S $S"
-    signed64=$(printf '%s' "${R}${S}" | hex2bin | urlbase64 )
-    debug "encoded RS $signed64"
+info() { # write out info as long as the quiet flag has not been set.
+  if [[ ${_QUIET} -eq 0 ]]; then
+    echo "$@"
   fi
 }
 
-signal_exit() { # Handle trapped signals
-  case $1 in
-    INT)
-      error_exit "Program interrupted by user" ;;
-    TERM)
-      echo -e "\n$PROGNAME: Program terminated" >&2
-      graceful_exit ;;
-    *)
-      error_exit "$PROGNAME: Terminating on unknown signal" ;;
-  esac
+json_awk() { # AWK json converter used for API2 - needs tidying up ;)
+# shellcheck disable=SC2086
+echo "$1" | tr -d '\n' | awk '
+{
+  tokenize($0) # while(get_token()) {print TOKEN}
+  if (0 == parse()) {
+    apply(JPATHS, NJPATHS)
+  }
 }
 
-urlbase64() { # urlbase64: base64 encoded string with '+' replaced with '-' and '/' replaced with '_'
-  openssl base64 -e | tr -d '\n\r' | os_esed -e 's:=*$::g' -e 'y:+/:-_:'
+function apply (ary,size,i) {
+  for (i=1; i<size; i++)
+    print ary[i]
 }
 
-# base64url decode
-# From: https://gist.github.com/alvis/89007e96f7958f2686036d4276d28e47
-urlbase64_decode() {
-  INPUT=$1 # $(if [ -z "$1" ]; then echo -n $(cat -); else echo -n "$1"; fi)
-  MOD=$(($(echo -n "$INPUT" | wc -c) % 4))
-  PADDING=$(if [ $MOD -eq 2 ]; then echo -n '=='; elif [ $MOD -eq 3 ]; then echo -n '=' ; fi)
-  echo -n "$INPUT$PADDING" |
-    sed s/-/+/g |
-    sed s/_/\\//g |
-    openssl base64 -d -A
+function get_token() {
+  TOKEN = TOKENS[++ITOKENS] # for internal tokenize()
+  return ITOKENS < NTOKENS
 }
 
-usage() { # echos out the program usage
-  echo "Usage: $PROGNAME [-h|--help] [-d|--debug] [-c|--create] [-f|--force] [-a|--all] [-q|--quiet]"\
-       "[-Q|--mute] [-u|--upgrade] [-k|--keep #] [-U|--nocheck] [-r|--revoke cert key] [-w working_dir] domain"
+function parse_array(a1,idx,ary,ret) {
+  idx=0
+  ary=""
+  get_token()
+  if (TOKEN != "]") {
+    while (1) {
+      if (ret = parse_value(a1, idx)) {
+        return ret
+      }
+      idx=idx+1
+      ary=ary VALUE
+      get_token()
+      if (TOKEN == "]") {
+        break
+      } else if (TOKEN == ",") {
+        ary = ary ","
+      } else {
+        report(", or ]", TOKEN ? TOKEN : "EOF")
+        return 2
+      }
+      get_token()
+    }
+  }
+  VALUE=""
+  return 0
 }
 
-write_domain_template() { # write out a template file for a domain.
-  cat > "$1" <<- _EOF_domain_
-	# This file is read second (and per domain if running with the -a option)
-	# and overwrites any settings from the first file
-	#
-	# Uncomment and modify any variables you need
-	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
-	# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
-	#
-	# The staging server is best for testing
-	#CA="https://acme-staging-v02.api.letsencrypt.org/"
-	# This server issues full certificates, however has rate limits
-	#CA="https://acme-v02.api.letsencrypt.org"
-
-	# Private key types - can be rsa, prime256v1, secp384r1 or secp521r1
-	#PRIVATE_KEY_ALG="rsa"
-
-	# Additional domains - this could be multiple domains / subdomains in a comma separated list
-	# Note: this is Additional domains - so should not include the primary domain.
-	SANS="${EX_SANS}"
-
-	# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
-	# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
-	# An ssh key will be needed to provide you with access to the remote server.
-	# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
-	# If left blank, the username on the local server will be used to authenticate against the remote server.
-	# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
-	# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
-	# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
-	# You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
-	# password, host, port (explicitly needed even if using default port 443) and path on the server.
-	#ACL=('/var/www/${DOMAIN}/web/.well-known/acme-challenge'
-	#     'ssh:server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
-	#     'ssh:sshuserid@server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
-	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge'
-	#     'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
-
-	# Specify SSH options, e.g. non standard port in SSH_OPTS
-	# (Can also use SCP_OPTS and SFTP_OPTS)
-	# SSH_OPTS=-p 12345
-
-	# Set USE_SINGLE_ACL="true" to use a single ACL for all checks
-	#USE_SINGLE_ACL="false"
-
-	# Location for all your certs, these can either be on the server (full path name)
-	# or using ssh /sftp as for the ACL
-	#DOMAIN_CERT_LOCATION="/etc/ssl/${DOMAIN}.crt" # this is domain cert
-	#DOMAIN_KEY_LOCATION="/etc/ssl/${DOMAIN}.key" # this is domain key
-	#CA_CERT_LOCATION="/etc/ssl/chain.crt" # this is CA cert
-	#DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
-	#DOMAIN_PEM_LOCATION="" # this is the domain key, domain cert and CA cert
-
-	# The command needed to reload apache / nginx or whatever you use
-	#RELOAD_CMD=""
+function parse_object(a1,key,obj) {
+  obj=""
+  get_token()
+  if (TOKEN != "}") {
+    while (1) {
+      if (TOKEN ~ /^".*"$/) {
+        key=TOKEN
+      } else {
+        report("string", TOKEN ? TOKEN : "EOF")
+        return 3
+      }
+      get_token()
+      if (TOKEN != ":") {
+        report(":", TOKEN ? TOKEN : "EOF")
+        return 4
+      }
+      get_token()
+      if (parse_value(a1, key)) {
+        return 5
+      }
+      obj=obj key ":" VALUE
+      get_token()
+      if (TOKEN == "}") {
+        break
+      } else if (TOKEN == ",") {
+        obj=obj ","
+      } else {
+        report(", or }", TOKEN ? TOKEN : "EOF")
+        return 6
+      }
+      get_token()
+    }
+  }
+  VALUE=""
+  return 0
+}
 
-	# Uncomment the following line to prevent non-interactive renewals of certificates
-	#PREVENT_NON_INTERACTIVE_RENEWAL="true"
 
-	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
-	# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
-	# will be checked for certificate expiry and also will be checked after
-	# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
-	#SERVER_TYPE="https"
-	#CHECK_REMOTE="true"
-	#CHECK_REMOTE_WAIT="2" # wait 2 seconds before checking the remote server
-	_EOF_domain_
+function parse_value(a1, a2,   jpath,ret,x) {
+  jpath=(a1!="" ? a1 "," : "") a2 # "${1:+$1,}$2"
+  if (TOKEN == "{") {
+    if (parse_object(jpath)) {
+      return 7
+    }
+  } else if (TOKEN == "[") {
+    if (ret = parse_array(jpath)) {
+      return ret
+    }
+  } else if (TOKEN == "") { #test case 20150410 #4
+    report("value", "EOF")
+    return 9
+  } else if (TOKEN ~ /^([^0-9])$/) {
+    # At this point, the only valid single-character tokens are digits.
+    report("value", TOKEN)
+    return 9
+  } else {
+    VALUE=TOKEN
+  }
+  if (! ("" == jpath || "" == VALUE)) {
+    x=sprintf("[%s]\t%s", jpath, VALUE)
+    print x
+  }
+  return 0
 }
 
-write_getssl_template() { # write out the main template file
-  cat > "$1" <<- _EOF_getssl_
-	# This file is read first and is common to all domains
-	#
-	# Uncomment and modify any variables you need
-	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
-	#
-	# The staging server is best for testing (hence set as default)
-	CA="https://acme-staging-v02.api.letsencrypt.org"
-	# This server issues full certificates, however has rate limits
-	#CA="https://acme-v02.api.letsencrypt.org"
-
-	# The agreement that must be signed with the CA, if not defined the default agreement will be used
-	#AGREEMENT="$AGREEMENT"
+function parse(   ret) {
+  get_token()
+  if (ret = parse_value()) {
+    return ret
+  }
+  if (get_token()) {
+    report("EOF", TOKEN)
+    return 11
+  }
+  return 0
+}
 
-	# Set an email address associated with your account - generally set at account level rather than domain.
-	#ACCOUNT_EMAIL="me@example.com"
-	ACCOUNT_KEY_LENGTH=4096
-	ACCOUNT_KEY="$WORKING_DIR/account.key"
+function report(expected, got,   i,from,to,context) {
+  from = ITOKENS - 10; if (from < 1) from = 1
+  to = ITOKENS + 10; if (to > NTOKENS) to = NTOKENS
+  for (i = from; i < ITOKENS; i++)
+    context = context sprintf("%s ", TOKENS[i])
+  context = context "<<" got ">> "
+  for (i = ITOKENS + 1; i <= to; i++)
+    context = context sprintf("%s ", TOKENS[i])
+  scream("json_awk expected <" expected "> but got <" got "> at input token " ITOKENS "\n" context)
+}
 
-	# Account key and private key types - can be rsa, prime256v1, secp384r1 or secp521r1
-	#ACCOUNT_KEY_TYPE="rsa"
-	PRIVATE_KEY_ALG="rsa"
-	#REUSE_PRIVATE_KEY="true"
+function reset() {
+  TOKEN=""; delete TOKENS; NTOKENS=ITOKENS=0
+  delete JPATHS; NJPATHS=0
+  VALUE=""
+}
 
-	# The command needed to reload apache / nginx or whatever you use
-	#RELOAD_CMD=""
+function scream(msg) {
+  FAILS[FILENAME] = FAILS[FILENAME] (FAILS[FILENAME]!="" ? "\n" : "") msg
+  msg = FILENAME ": " msg
+  print msg >"/dev/stderr"
+}
 
-	# The time period within which you want to allow renewal of a certificate
-	#  this prevents hitting some of the rate limits.
-	# Creating a file called FORCE_RENEWAL in the domain directory allows one-off overrides
-	# of this setting
-	RENEW_ALLOW="30"
+function tokenize(a1,pq,pb,ESCAPE,CHAR,STRING,NUMBER,KEYWORD,SPACE) {
+  SPACE="[ \t\n]+"
+  gsub(/"[^\001-\037"\\]*((\\[^u\001-\037]|\\u[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])[^\001-\037"\\]*)*"|-?(0|[1-9][0-9]*)([.][0-9]*)?([eE][+-]?[0-9]*)?|null|false|true|[ \t\n]+|./, "\n&", a1)
+  gsub("\n" SPACE, "\n", a1)
+  sub(/^\n/, "", a1)
+  ITOKENS=0 # get_token() helper
+  return NTOKENS = split(a1, TOKENS, /\n/)
+}'
+}
 
-	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
-	# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
-	# will be checked for certificate expiry and also will be checked after
-	# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
-	SERVER_TYPE="https"
-	CHECK_REMOTE="true"
+json_get() { # get values from json
+  if [[ -z "$1" ]] || [[ "$1" == "null" ]]; then
+    echo "json was blank"
+    return
+  fi
+  if [[ $API = 1 ]]; then
+    # remove newlines, so it's a single chunk of JSON
+    json_data=$( echo "$1" | tr '\n' ' ')
+    # if $3 is defined, this is the section which the item is in.
+    if [[ -n "$3" ]]; then
+      jg_section=$(echo "$json_data" | awk -F"[}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${3}"'\"/){print $i}}}')
+      if [[ "$2" == "uri" ]]; then
+        jg_subsect=$(echo "$jg_section" | awk -F"[,]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i)}}}')
+        jg_result=$(echo "$jg_subsect" | awk -F'"' '{print $4}')
+      else
+        jg_result=$(echo "$jg_section" | awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+      fi
+    else
+      jg_result=$(echo "$json_data" |awk -F"[,:}]" '{for(i=1;i<=NF;i++){if($i~/\"'"${2}"'\"/){print $(i+1)}}}')
+    fi
+    # check number of quotes
+    jg_q=${jg_result//[^\"]/}
+    # if 2 quotes, assume it's a quoted variable and just return the data within the quotes.
+    if [[ ${#jg_q} -eq 2 ]]; then
+      echo "$jg_result" | awk -F'"' '{print $2}'
+    else
+      echo "$jg_result"
+    fi
+  else
+    if [[ -n "$6" ]]; then
+      full=$(json_awk "$1")
+      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
+      echo "$full" | grep "^..${5}\",$section\]" | awk '{print $2}' | tr -d '"'
+    elif [[ -n "$5" ]]; then
+      full=$(json_awk "$1")
+      section=$(echo "$full" | grep "\"$2\"" | grep "\"$3\"" | grep "\"$4\"" | awk -F"," '{print $2}')
+      echo "$full" | grep "^..${2}\",$section" | grep "$5" | awk '{print $2}' | tr -d '"'
+    elif [[ -n "$3" ]]; then
+      json_awk "$1" | grep "^..${2}...${3}" | awk '{print $2}' | tr -d '"'
+    elif [[ -n "$2" ]]; then
+      json_awk "$1" | grep "^..${2}" | awk '{print $2}' | tr -d '"'
+    else
+      json_awk "$1"
+    fi
+  fi
+}
 
-	# Use the following 3 variables if you want to validate via DNS
-	#VALIDATE_VIA_DNS="true"
-	#DNS_ADD_COMMAND=
-	#DNS_DEL_COMMAND=
-	_EOF_getssl_
+os_esed() { # Use different sed version for different os types (extended regex)
+  if [[ "$os" == "bsd" ]]; then # BSD requires -E flag for extended regex
+    sed -E "${@}"
+  elif [[ "$os" == "mac" ]]; then # MAC uses older BSD style sed.
+    sed -E "${@}"
+  else
+    sed -r "${@}"
+  fi
 }
 
-write_openssl_conf() { # write out a minimal openssl conf
-  cat > "$1" <<- _EOF_openssl_conf_
-	# minimal openssl.cnf file
-	distinguished_name  = req_distinguished_name
-	[ req_distinguished_name ]
-	[v3_req]
-	[v3_ca]
-	_EOF_openssl_conf_
+purge_archive() { # purge archive of old, invalid, certificates
+  arcdir="$1/archive"
+  debug "purging archives in ${arcdir}/"
+  for padir in "$arcdir"/????_??_??_??_??; do
+    # check each directory
+    if [[ -d "$padir" ]]; then
+      tstamp=$(basename "$padir"| awk -F"_" '{print $1"-"$2"-"$3" "$4":"$5}')
+      if [[ "$os" == "bsd" ]]; then
+        direpoc=$(date -j -f "%F %H:%M" "$tstamp" +%s)
+      elif [[ "$os" == "mac" ]]; then
+        direpoc=$(date -j -f "%F %H:%M" "$tstamp" +%s)
+      else
+        direpoc=$(date -d "$tstamp" +%s)
+      fi
+      current_epoc=$(date "+%s")
+      # as certs currently valid for 90 days, purge anything older than 100
+      purgedate=$((current_epoc - 60*60*24*100))
+      if [[ "$direpoc" -lt "$purgedate" ]]; then
+        echo "purge $padir"
+        rm -rf "${padir:?}"
+      fi
+    fi
+  done
 }
 
-# Trap signals
-trap "signal_exit TERM" TERM HUP
-trap "signal_exit INT"  INT
-
-# Parse command-line
-while [[ -n ${1+defined} ]]; do
-  case $1 in
-    -h | --help)
-      help_message; graceful_exit ;;
-    -d | --debug)
-     _USE_DEBUG=1 ;;
-    -c | --create)
-     _CREATE_CONFIG=1 ;;
-    -f | --force)
-     _FORCE_RENEW=1 ;;
-    -a | --all)
-     _CHECK_ALL=1 ;;
-    -k | --keep)
-     shift; _KEEP_VERSIONS="$1";;
-    -q | --quiet)
-     _QUIET=1 ;;
-    -Q | --mute)
-     _QUIET=1
-     _MUTE=1 ;;
-    -r | --revoke)
-     _REVOKE=1
-     shift
-     REVOKE_CERT="$1"
-     shift
-     REVOKE_KEY="$1"
-     shift
-     REVOKE_CA="$1" ;;
-    -u | --upgrade)
-     _UPGRADE=1 ;;
-    -U | --nocheck)
-      _UPGRADE_CHECK=0 ;;
-    -w)
-      shift; WORKING_DIR="$1" ;;
-    -*)
-      usage
-      error_exit "Unknown option $1" ;;
-    *)
-      if [[ -n $DOMAIN ]]; then
-        error_exit "invalid command line $DOMAIN - it appears to contain more than one domain"
+reload_service() {  # Runs a command to reload services ( via ssh if needed)
+  if [[ -n "$RELOAD_CMD" ]]; then
+    info "reloading SSL services"
+    if [[ "${RELOAD_CMD:0:4}" == "ssh:" ]] ; then
+      sshhost=$(echo "$RELOAD_CMD"| awk -F: '{print $2}')
+      command=${RELOAD_CMD:(( ${#sshhost} + 5))}
+      debug "running following command to reload cert"
+      debug "ssh $SSH_OPTS $sshhost ${command}"
+      # shellcheck disable=SC2029
+      # shellcheck disable=SC2086
+      ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
+      # allow 2 seconds for services to restart
+      sleep 2
+    else
+      debug "running reload command $RELOAD_CMD"
+      if ! eval "$RELOAD_CMD" ; then
+        error_exit "error running $RELOAD_CMD"
       fi
-      DOMAIN="$1"
-      if [[ -z $DOMAIN ]]; then
-        error_exit "invalid command line - it appears to contain a null variable"
-      fi ;;
-  esac
-  shift
-done
-
-# Main logic
-############
-
-# Get the current OS, so the correct functions can be used for that OS. (sets the variable os)
-get_os
-
-# check if "recent" version of bash.
-#if [[ "${BASH_VERSINFO[0]}${BASH_VERSINFO[1]}" -lt 42 ]]; then
-#  info "this script is designed for bash v4.2 or later - earlier version may give errors"
-#fi
-
-#check if required applications are included
-
-requires which
-requires openssl
-requires curl
-requires nslookup drill dig host DNS_CHECK_FUNC
-requires awk
-requires tr
-requires date
-requires grep
-requires sed
-requires sort
-requires mktemp
-
-# Check if upgrades are available (unless they have specified -U to ignore Upgrade checks)
-if [[ $_UPGRADE_CHECK -eq 1 ]]; then
-  check_getssl_upgrade
-fi
+    fi
+  fi
+}
 
-# Revoke a certificate if requested
-if [[ $_REVOKE -eq 1 ]]; then
-  if [[ -z $REVOKE_CA ]]; then
-    CA=$DEFAULT_REVOKE_CA
-  elif [[ "$REVOKE_CA" == "-d" ]]; then
-    _USE_DEBUG=1
-    CA=$DEFAULT_REVOKE_CA
+revoke_certificate() { # revoke a certificate
+  debug "revoking cert $REVOKE_CERT"
+  debug "using key $REVOKE_KEY"
+  ACCOUNT_KEY="$REVOKE_KEY"
+  # need to set the revoke key as "account_key" since it's used in send_signed_request.
+  get_signing_params "$REVOKE_KEY"
+  TEMP_DIR=$(mktemp -d 2>/dev/null || mktemp -d -t getssl)
+  debug "revoking from $CA"
+  rcertdata=$(openssl x509 -in "$REVOKE_CERT" -inform PEM -outform DER | urlbase64)
+  send_signed_request "$URL_revoke" "{\"resource\": \"revoke-cert\", \"certificate\": \"$rcertdata\"}"
+  if [[ $code -eq "200" ]]; then
+    info "certificate revoked"
   else
-    CA=$REVOKE_CA
+    error_exit "Revocation failed: $(echo "$response" | grep "detail")"
   fi
-  URL_revoke=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null | grep "revoke-cert" | awk -F'"' '{print $4}')
-  revoke_certificate
-  graceful_exit
-fi
+}
 
-# get latest agreement from CA (as default)
-AGREEMENT=$(curl --user-agent "$CURL_USERAGENT" -I "${CA}/terms" 2>/dev/null | awk 'tolower($1) ~ "location:" {print $2}'|tr -d '\r')
+requires() { # check if required function is available
+  if [[ "$#" -gt 1 ]]; then # if more than 1 value, check list
+    for i in "$@"; do
+      if [[ "$i" == "${!#}" ]]; then # if on last variable then exit as not found
+        error_exit "this script requires one of: ${*:1:$(($#-1))}"
+      fi
+      res=$(command -v "$i" 2>/dev/null)
+      debug "checking for $i ... $res"
+      if [[ -n "$res" ]]; then # if function found, then set variable to function and return
+        debug "function $i found at $res  - setting ${!#} to $i"
+        eval "${!#}=\$i"
+        return
+      fi
+    done
+  else # only one value, so check it.
+    result=$(command -v "$1" 2>/dev/null)
+    debug "checking for required $1 ... $result"
+    if [[ -z "$result" ]]; then
+      error_exit "This script requires $1 installed"
+    fi
+  fi
+}
 
-# if nothing in command line, print help and exit.
-if [[ -z "$DOMAIN" ]] && [[ ${_CHECK_ALL} -ne 1 ]]; then
-  help_message
-  graceful_exit
-fi
+set_server_type() { # uses SERVER_TYPE to set REMOTE_PORT and REMOTE_EXTRA
+  if [[ ${SERVER_TYPE} == "https" ]] || [[ ${SERVER_TYPE} == "webserver" ]]; then
+    REMOTE_PORT=443
+  elif [[ ${SERVER_TYPE} == "ftp" ]]; then
+    REMOTE_PORT=21
+    REMOTE_EXTRA="-starttls ftp"
+  elif [[ ${SERVER_TYPE} == "ftpi" ]]; then
+    REMOTE_PORT=990
+  elif [[ ${SERVER_TYPE} == "imap" ]]; then
+    REMOTE_PORT=143
+    REMOTE_EXTRA="-starttls imap"
+  elif [[ ${SERVER_TYPE} == "imaps" ]]; then
+    REMOTE_PORT=993
+  elif [[ ${SERVER_TYPE} == "pop3" ]]; then
+    REMOTE_PORT=110
+    REMOTE_EXTRA="-starttls pop3"
+  elif [[ ${SERVER_TYPE} == "pop3s" ]]; then
+    REMOTE_PORT=995
+  elif [[ ${SERVER_TYPE} == "smtp" ]]; then
+    REMOTE_PORT=25
+    REMOTE_EXTRA="-starttls smtp"
+  elif [[ ${SERVER_TYPE} == "smtps_deprecated" ]]; then
+    REMOTE_PORT=465
+  elif [[ ${SERVER_TYPE} == "smtps" ]] || [[ ${SERVER_TYPE} == "smtp_submission" ]]; then
+    REMOTE_PORT=587
+    REMOTE_EXTRA="-starttls smtp"
+  elif [[ ${SERVER_TYPE} == "xmpp" ]]; then
+    REMOTE_PORT=5222
+    REMOTE_EXTRA="-starttls xmpp"
+  elif [[ ${SERVER_TYPE} == "xmpps" ]]; then
+    REMOTE_PORT=5269
+  elif [[ ${SERVER_TYPE} == "ldaps" ]]; then
+    REMOTE_PORT=636
+  elif [[ ${SERVER_TYPE} =~ ^[0-9]+$ ]]; then
+    REMOTE_PORT=${SERVER_TYPE}
+  else
+    info "${DOMAIN}: unknown server type \"$SERVER_TYPE\" in SERVER_TYPE"
+    config_errors=true
+  fi
+}
 
-# if the "working directory" doesn't exist, then create it.
-if [[ ! -d "$WORKING_DIR" ]]; then
-  debug "Making working directory - $WORKING_DIR"
-  mkdir -p "$WORKING_DIR"
-fi
+send_signed_request() { # Sends a request to the ACME server, signed with your private key.
+  url=$1
+  payload=$2
+  needbase64=$3
+  outfile=$4 # save response into this file (certificate data)
 
-# read any variables from config in working directory
-if [[ -s "$WORKING_DIR/getssl.cfg" ]]; then
-  debug "reading config from $WORKING_DIR/getssl.cfg"
-  # shellcheck source=/dev/null
-  . "$WORKING_DIR/getssl.cfg"
-fi
+  debug url "$url"
 
-# Define defaults for variables not set in the main config.
-ACCOUNT_KEY="${ACCOUNT_KEY:=$WORKING_DIR/account.key}"
-DOMAIN_STORAGE="${DOMAIN_STORAGE:=$WORKING_DIR}"
-DOMAIN_DIR="$DOMAIN_STORAGE/$DOMAIN"
-CERT_FILE="$DOMAIN_DIR/${DOMAIN}.crt"
-FULL_CHAIN="$DOMAIN_DIR/fullchain.crt"
-CA_CERT="$DOMAIN_DIR/chain.crt"
-TEMP_DIR="$DOMAIN_DIR/tmp"
-if [[ "$os" == "mingw" ]]; then
-  CSR_SUBJECT="//"
-fi
+  CURL_HEADER="$TEMP_DIR/curl.header"
+  dp="$TEMP_DIR/curl.dump"
 
-# Set the OPENSSL_CONF environment variable so openssl knows which config to use
-export OPENSSL_CONF=$SSLCONF
+  CURL="curl "
+  # shellcheck disable=SC2072
+  if [[ "$($CURL -V | head -1 | cut -d' ' -f2 )" > "7.33" ]]; then
+    CURL="$CURL --http1.1 "
+  fi
 
-# if "-a" option then check other parameters and create run for each domain.
-if [[ ${_CHECK_ALL} -eq 1 ]]; then
-  info "Check all certificates"
+  CURL="$CURL --user-agent $CURL_USERAGENT --silent --dump-header $CURL_HEADER "
 
-  if [[ ${_CREATE_CONFIG} -eq 1 ]]; then
-    error_exit "cannot combine -c|--create with -a|--all"
+  if [[ ${_USE_DEBUG} -eq 1 ]]; then
+    CURL="$CURL --trace-ascii $dp "
   fi
 
-  if [[ ${_FORCE_RENEW} -eq 1 ]]; then
-    error_exit "cannot combine -f|--force with -a|--all because of rate limits"
-  fi
+  # convert payload to url base 64
+  payload64="$(printf '%s' "${payload}" | urlbase64)"
 
-  if [[ ! -d "$DOMAIN_STORAGE" ]]; then
-    error_exit "DOMAIN_STORAGE not found  - $DOMAIN_STORAGE"
+  # get nonce from ACME server
+  if [[ $API -eq 1 ]]; then
+    nonceurl="$CA/directory"
+    nonce=$($CURL -I $nonceurl | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
+  else # APIv2
+    nonce=$($CURL -I "$URL_newNonce" | grep "^Replay-Nonce:" | awk '{print $2}' | tr -d '\r\n ')
   fi
 
-  for dir in "${DOMAIN_STORAGE}"/*; do
-    if [[ -d "$dir" ]]; then
-      debug "Checking $dir"
-      cmd="$0 -U" # No update checks when calling recursively
-      if [[ ${_USE_DEBUG} -eq 1 ]]; then
-        cmd="$cmd -d"
+  nonceproblem="true"
+  while [[ "$nonceproblem" == "true" ]]; do
+
+    # Build header with just our public key and algorithm information
+    header='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"'}'
+
+    # Build another header which also contains the previously received nonce and encode it as urlbase64
+    if [[ $API -eq 1 ]]; then
+      protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
+      protected64="$(printf '%s' "${protected}" | urlbase64)"
+    else # APIv2
+      if [[ -z "$KID" ]]; then
+        debug "KID is blank, so using jwk"
+        protected='{"alg": "'"$jwkalg"'", "jwk": '"$jwk"', "nonce": "'"${nonce}"'", "url": "'"${url}"'"}'
+        protected64="$(printf '%s' "${protected}" | urlbase64)"
+      else
+        debug "using KID=${KID}"
+        protected="{\"alg\": \"$jwkalg\", \"kid\": \"$KID\",\"nonce\": \"${nonce}\", \"url\": \"${url}\"}"
+        protected64="$(printf '%s' "${protected}" | urlbase64)"
       fi
-      if [[ ${_QUIET} -eq 1 ]]; then
-        cmd="$cmd -q"
+    fi
+
+    # Sign header with nonce and our payload with our private key and encode signature as urlbase64
+    sign_string "$(printf '%s' "${protected64}.${payload64}")"  "${ACCOUNT_KEY}" "$signalg"
+
+    # Send header + extended header + payload + signature to the acme-server
+    debug "payload = $payload"
+    if [[ $API -eq 1 ]]; then
+      body="{\"header\": ${header},"
+      body="${body}\"protected\": \"${protected64}\","
+      body="${body}\"payload\": \"${payload64}\","
+      body="${body}\"signature\": \"${signed64}\"}"
+    else
+      body="{"
+      body="${body}\"protected\": \"${protected64}\","
+      body="${body}\"payload\": \"${payload64}\","
+      body="${body}\"signature\": \"${signed64}\"}"
+    fi
+
+    code="500"
+    loop_limit=5
+    while [[ "$code" -eq 500 ]]; do
+      if [[ "$outfile" ]] ; then
+        $CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" > "$outfile"
+        response=$(cat "$outfile")
+      elif [[ "$needbase64" ]] ; then
+        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url" | urlbase64)
+      else
+        response=$($CURL -X POST -H "Content-Type: application/jose+json" --data "$body" "$url")
       fi
-      # check if $dir is a directory with a getssl.cfg in it
-      if [[ -f "$dir/getssl.cfg" ]]; then
-        cmd="$cmd -w $WORKING_DIR $(basename "$dir")"
-        debug "CMD: $cmd"
-        eval "$cmd"
+
+      if [[ "$response" == "" ]]; then
+        error_exit "ERROR curl \"$url\" returned nothing"
       fi
+
+      responseHeaders=$(cat "$CURL_HEADER")
+      if [[ "$needbase64" && ${response##*()} != "{"* ]]; then
+        # response is in base64 too, decode
+        response=$(urlbase64_decode "$response")
+      fi
+
+      debug responseHeaders "$responseHeaders"
+      debug response  "$response"
+      code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
+      debug code "$code"
+      if [[ "$code" == 4* && $response != *"error:badNonce"* ]]; then
+        detail=$(echo "$response" | grep "detail")
+        error_exit "ACME server returned error: ${code}: ${detail}"
+      fi
+
+      if [[ $API -eq 1 ]]; then
+        response_status=$(json_get "$response" status \
+                        | head -1| awk -F'"' '{print $2}')
+      else # APIv2
+        if [[ "$outfile" && "$response" ]]; then
+          debug "response written to $outfile"
+        elif [[ ${response##*()} == "{"* ]]; then
+          response_status=$(json_get "$response" status)
+        else
+          debug "response not in json format"
+          debug "$response"
+        fi
+      fi
+      debug "response status = $response_status"
+      if [[ "$code" -eq 500 ]]; then
+        info "error on acme server - trying again ...."
+        debug "loop_limit = $loop_limit"
+        sleep 5
+        loop_limit=$((loop_limit - 1))
+        if [[ $loop_limit -lt 1 ]]; then
+          error_exit "500 error from ACME server:  $response"
+        fi
+      fi
+    done
+    if [[ $response == *"error:badNonce"* ]]; then
+      debug "bad nonce"
+      nonce=$(echo "$responseHeaders" | grep -i "^replay-nonce:" | awk '{print $2}' | tr -d '\r\n ')
+      debug "trying new nonce $nonce"
+    else
+      nonceproblem="false"
     fi
   done
+}
 
-  graceful_exit
-fi
-# end of "-a" option (looping through all domains)
+sign_string() { # sign a string with a given key and algorithm and return urlbase64
+                # sets the result in variable signed64
+  str=$1
+  key=$2
+  signalg=$3
 
-# if "-c|--create" option used, then create config files.
-if [[ ${_CREATE_CONFIG} -eq 1 ]]; then
-  # If main config file does not exists then create it.
-  if [[ ! -s "$WORKING_DIR/getssl.cfg" ]]; then
-    info "creating main config file $WORKING_DIR/getssl.cfg"
-    if [[ ! -s "$SSLCONF" ]]; then
-      SSLCONF="$WORKING_DIR/openssl.cnf"
-      write_openssl_conf "$SSLCONF"
+  if openssl rsa -in "${skey}" -noout 2>/dev/null ; then # RSA key
+    signed64="$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" | urlbase64)"
+  elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
+    signed=$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" -hex | awk '{print $2}')
+    debug "EC signature $signed"
+    if [[ "${signed:4:4}" == "0220" ]]; then #sha256
+      R=$(echo "$signed" | cut -c 9-72)
+      part2=$(echo "$signed" | cut -c 73-)
+    elif [[ "${signed:4:4}" == "0221" ]]; then #sha256
+      R=$(echo "$signed" | cut -c 11-74)
+      part2=$(echo "$signed" | cut -c 75-)
+    elif [[ "${signed:4:4}" == "0230" ]]; then #sha384
+      R=$(echo "$signed" | cut -c 9-104)
+      part2=$(echo "$signed" | cut -c 105-)
+    elif [[ "${signed:4:4}" == "0231" ]]; then #sha384
+      R=$(echo "$signed" | cut -c 11-106)
+      part2=$(echo "$signed" | cut -c 107-)
+    elif [[ "${signed:6:4}" == "0241" ]]; then #sha512
+      R=$(echo "$signed" | cut -c 11-140)
+      part2=$(echo "$signed" | cut -c 141-)
+    elif [[ "${signed:6:4}" == "0242" ]]; then #sha512
+      R=$(echo "$signed" | cut -c 11-142)
+      part2=$(echo "$signed" | cut -c 143-)
+    else
+      error_exit "error in EC signing couldn't get R from $signed"
     fi
-    write_getssl_template "$WORKING_DIR/getssl.cfg"
-  fi
-  # If domain and domain config don't exist then create them.
-  if [[ ! -d "$DOMAIN_DIR" ]]; then
-    info "Making domain directory - $DOMAIN_DIR"
-    mkdir -p "$DOMAIN_DIR"
-  fi
-  if [[ -s "$DOMAIN_DIR/getssl.cfg" ]]; then
-    info "domain config already exists $DOMAIN_DIR/getssl.cfg"
-  else
-    info "creating domain config file in $DOMAIN_DIR/getssl.cfg"
-    # if domain has an existing cert, copy from domain and use to create defaults.
-    EX_CERT=$(echo \
-      | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:443" 2>/dev/null \
-      | openssl x509 2>/dev/null)
-    EX_SANS="www.${DOMAIN}"
-    if [[ -n "${EX_CERT}" ]]; then
-      EX_SANS=$(echo "$EX_CERT" \
-        | openssl x509 -noout -text 2>/dev/null| grep "Subject Alternative Name" -A2 \
-        | grep -Eo "DNS:[a-zA-Z 0-9.-]*" | sed "s@DNS:$DOMAIN@@g" | grep -v '^$' | cut -c 5-)
-      EX_SANS=${EX_SANS//$'\n'/','}
+    debug "R $R"
+
+    if [[ "${part2:0:4}" == "0220" ]]; then #sha256
+      S=$(echo "$part2" | cut -c 5-68)
+    elif [[ "${part2:0:4}" == "0221" ]]; then #sha256
+      S=$(echo "$part2" | cut -c 7-70)
+    elif [[ "${part2:0:4}" == "0230" ]]; then #sha384
+      S=$(echo "$part2" | cut -c 5-100)
+    elif [[ "${part2:0:4}" == "0231" ]]; then #sha384
+      S=$(echo "$part2" | cut -c 7-102)
+    elif [[ "${part2:0:4}" == "0241" ]]; then #sha512
+      S=$(echo "$part2" | cut -c 5-136)
+    elif [[ "${part2:0:4}" == "0242" ]]; then #sha512
+      S=$(echo "$part2" | cut -c 5-136)
+    else
+      error_exit "error in EC signing couldn't get S from $signed"
     fi
-    write_domain_template "$DOMAIN_DIR/getssl.cfg"
+
+    debug "S $S"
+    signed64=$(printf '%s' "${R}${S}" | hex2bin | urlbase64 )
+    debug "encoded RS $signed64"
   fi
-  TEMP_DIR="$DOMAIN_DIR/tmp"
-  # end of "-c|--create" option, so exit
-  graceful_exit
-fi
-# end of "-c|--create" option to create config file.
+}
 
-# if domain directory doesn't exist, then create it.
-if [[ ! -d "$DOMAIN_DIR" ]]; then
-  debug "Making working directory - $DOMAIN_DIR"
-  mkdir -p "$DOMAIN_DIR"
-fi
+signal_exit() { # Handle trapped signals
+  case $1 in
+    INT)
+      error_exit "Program interrupted by user" ;;
+    TERM)
+      echo -e "\n$PROGNAME: Program terminated" >&2
+      graceful_exit ;;
+    *)
+      error_exit "$PROGNAME: Terminating on unknown signal" ;;
+  esac
+}
 
-# define a temporary directory, and if it doesn't exist, create it.
-TEMP_DIR="$DOMAIN_DIR/tmp"
-if [[ ! -d "${TEMP_DIR}" ]]; then
-  debug "Making temp directory - ${TEMP_DIR}"
-  mkdir -p "${TEMP_DIR}"
-fi
+urlbase64() { # urlbase64: base64 encoded string with '+' replaced with '-' and '/' replaced with '_'
+  openssl base64 -e | tr -d '\n\r' | os_esed -e 's:=*$::g' -e 'y:+/:-_:'
+}
 
-# read any variables from config in domain directory
-if [[ -s "$DOMAIN_DIR/getssl.cfg" ]]; then
-  debug "reading config from $DOMAIN_DIR/getssl.cfg"
-  # shellcheck source=/dev/null
-  . "$DOMAIN_DIR/getssl.cfg"
-fi
+# base64url decode
+# From: https://gist.github.com/alvis/89007e96f7958f2686036d4276d28e47
+urlbase64_decode() {
+  INPUT=$1 # $(if [ -z "$1" ]; then echo -n $(cat -); else echo -n "$1"; fi)
+  MOD=$(($(echo -n "$INPUT" | wc -c) % 4))
+  PADDING=$(if [ $MOD -eq 2 ]; then echo -n '=='; elif [ $MOD -eq 3 ]; then echo -n '=' ; fi)
+  echo -n "$INPUT$PADDING" |
+    sed s/-/+/g |
+    sed s/_/\\//g |
+    openssl base64 -d -A
+}
 
-# from SERVER_TYPE set REMOTE_PORT and REMOTE_EXTRA
-set_server_type
+usage() { # echos out the program usage
+  echo "Usage: $PROGNAME [-h|--help] [-d|--debug] [-c|--create] [-f|--force] [-a|--all] [-q|--quiet]"\
+       "[-Q|--mute] [-u|--upgrade] [-k|--keep #] [-U|--nocheck] [-r|--revoke cert key] [-w working_dir] domain"
+}
 
-# check config for typical errors.
-check_config
+write_domain_template() { # write out a template file for a domain.
+  cat > "$1" <<- _EOF_domain_
+	# This file is read second (and per domain if running with the -a option)
+	# and overwrites any settings from the first file
+	#
+	# Uncomment and modify any variables you need
+	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+	# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+	#
+	# The staging server is best for testing
+	#CA="https://acme-staging-v02.api.letsencrypt.org/"
+	# This server issues full certificates, however has rate limits
+	#CA="https://acme-v02.api.letsencrypt.org"
 
-if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
-  rm -f "$DOMAIN_DIR/FORCE_RENEWAL" || error_exit "problem deleting file $DOMAIN_DIR/FORCE_RENEWAL"
-  _FORCE_RENEW=1
-  info "${DOMAIN}: forcing renewal (due to FORCE_RENEWAL file)"
-fi
+	# Private key types - can be rsa, prime256v1, secp384r1 or secp521r1
+	#PRIVATE_KEY_ALG="rsa"
 
-# Obtain CA resource locations
-ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}" 2>/dev/null)
-debug "ca_all_loc from ${CA} gives $ca_all_loc"
-# APIv1
-URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
-URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
-URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
-#API v2
-URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
-URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
-URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
-if [[ -z "$URL_new_reg" ]]  && [[ -z "$URL_newAccount" ]]; then
-  ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null)
-  debug "ca_all_loc from ${CA}/directory gives $ca_all_loc"
-  # APIv1
-  URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
-  URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
-  URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
-  #API v2
-  URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
-  URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
-  URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
-fi
+	# Additional domains - this could be multiple domains / subdomains in a comma separated list
+	# Note: this is Additional domains - so should not include the primary domain.
+	SANS="${EX_SANS}"
 
-if [[ -n "$URL_new_reg" ]]; then
-  API=1
-elif [[ -n "$URL_newAccount" ]]; then
-  API=2
-else
-  info "unknown API version"
-  graceful_exit
-fi
-debug "Using API v$API"
+	# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
+	# If these start with ssh: then the next variable is assumed to be the hostname and the rest the location.
+	# An ssh key will be needed to provide you with access to the remote server.
+	# Optionally, you can specify a different userid for ssh/scp to use on the remote server before the @ sign.
+	# If left blank, the username on the local server will be used to authenticate against the remote server.
+	# If these start with ftp: then the next variables are ftpuserid:ftppassword:servername:ACL_location
+	# These should be of the form "/path/to/your/website/folder/.well-known/acme-challenge"
+	# where "/path/to/your/website/folder/" is the path, on your web server, to the web root for your domain.
+	# You can also user WebDAV over HTTPS as transport mechanism. To do so, start with davs: followed by username,
+	# password, host, port (explicitly needed even if using default port 443) and path on the server.
+	#ACL=('/var/www/${DOMAIN}/web/.well-known/acme-challenge'
+	#     'ssh:server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
+	#     'ssh:sshuserid@server5:/var/www/${DOMAIN}/web/.well-known/acme-challenge'
+	#     'ftp:ftpuserid:ftppassword:${DOMAIN}:/web/.well-known/acme-challenge'
+	#     'davs:davsuserid:davspassword:{DOMAIN}:443:/web/.well-known/acme-challenge')
 
-# Check if awk supports json_awk (required for ACMEv2)
-if [[ $API -eq 2 ]]; then
-    json_awk_test=$(json_awk '{ "test": "1" }' 2>/dev/null)
-    if [[ "${json_awk_test}" == "" ]]; then
-        error_exit "Your version of awk does not work with json_awk (see http://github.com/step-/JSON.awk/issues/6), please install a newer version of mawk or gawk"
-    fi
-fi
+	# Specify SSH options, e.g. non standard port in SSH_OPTS
+	# (Can also use SCP_OPTS and SFTP_OPTS)
+	# SSH_OPTS=-p 12345
 
-# if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
-if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
-  debug "getting certificate for $DOMAIN from remote server"
-  # shellcheck disable=SC2086
-  EX_CERT=$(echo \
-    | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
-    | openssl x509 2>/dev/null)
-  if [[ -n "$EX_CERT" ]]; then # if obtained a cert
-    if [[ -s "$CERT_FILE" ]]; then # if local exists
-      CERT_LOCAL=$(openssl x509 -noout -fingerprint < "$CERT_FILE" 2>/dev/null)
-    else # since local doesn't exist leave empty so that the domain validation will happen
-      CERT_LOCAL=""
-    fi
-    CERT_REMOTE=$(echo "$EX_CERT" | openssl x509 -noout -fingerprint 2>/dev/null)
-    if [[ "$CERT_LOCAL" == "$CERT_REMOTE" ]]; then
-      debug "certificate on server is same as the local cert"
-    else
-      # check if the certificate is for the right domain
-      EX_CERT_DOMAIN=$(echo "$EX_CERT" | openssl x509 -text \
-        | sed -n -e 's/^ *Subject: .* CN=\([A-Za-z0-9.-]*\).*$/\1/p; /^ *DNS:.../ { s/ *DNS://g; y/,/\n/; p; }' \
-        | sort -u | grep "^$DOMAIN\$")
-      if [[ "$EX_CERT_DOMAIN" == "$DOMAIN" ]]; then
-        # check renew-date on ex_cert and compare to local ( if local exists)
-        enddate_ex=$(echo "$EX_CERT" | openssl x509 -noout -enddate 2>/dev/null| cut -d= -f 2-)
-        enddate_ex_s=$(date_epoc "$enddate_ex")
-        debug "external cert has enddate $enddate_ex ( $enddate_ex_s ) "
-        if [[ -s "$CERT_FILE" ]]; then # if local exists
-          enddate_lc=$(openssl x509 -noout -enddate < "$CERT_FILE" 2>/dev/null| cut -d= -f 2-)
-          enddate_lc_s=$(date_epoc "$enddate_lc")
-          debug "local cert has enddate $enddate_lc ( $enddate_lc_s ) "
-        else
-          enddate_lc_s=0
-          debug "local cert doesn't exist"
-        fi
-        if [[ "$enddate_ex_s" -eq "$enddate_lc_s" ]]; then
-          debug "certificates expire at the same time"
-        elif [[ "$enddate_ex_s" -gt "$enddate_lc_s" ]]; then
-          # remote has longer to expiry date than local copy.
-          debug "remote cert has longer to run than local cert - ignoring"
-        else
-          info "${DOMAIN}: remote cert expires sooner than local, attempting to upload from local"
-          copy_file_to_location "domain certificate" \
-                                "$CERT_FILE" \
-                                "$DOMAIN_CERT_LOCATION"
-          copy_file_to_location "private key" \
-                                "$DOMAIN_DIR/${DOMAIN}.key" \
-                                "$DOMAIN_KEY_LOCATION"
-          copy_file_to_location "CA certificate" "$CA_CERT" "$CA_CERT_LOCATION"
-          cat "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}_chain.pem"
-          copy_file_to_location "full pem" \
-                                "$TEMP_DIR/${DOMAIN}_chain.pem" \
-                                "$DOMAIN_CHAIN_LOCATION"
-          cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" > "$TEMP_DIR/${DOMAIN}_K_C.pem"
-          copy_file_to_location "private key and domain cert pem" \
-                                "$TEMP_DIR/${DOMAIN}_K_C.pem"  \
-                                "$DOMAIN_KEY_CERT_LOCATION"
-          cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}.pem"
-          copy_file_to_location "full pem" \
-                                "$TEMP_DIR/${DOMAIN}.pem"  \
-                                "$DOMAIN_PEM_LOCATION"
-          reload_service
-        fi
-      else
-        info "${DOMAIN}: Certificate on remote domain does not match, ignoring remote certificate"
+	# Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+	#USE_SINGLE_ACL="false"
+
+	# Location for all your certs, these can either be on the server (full path name)
+	# or using ssh /sftp as for the ACL
+	#DOMAIN_CERT_LOCATION="/etc/ssl/${DOMAIN}.crt" # this is domain cert
+	#DOMAIN_KEY_LOCATION="/etc/ssl/${DOMAIN}.key" # this is domain key
+	#CA_CERT_LOCATION="/etc/ssl/chain.crt" # this is CA cert
+	#DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+	#DOMAIN_PEM_LOCATION="" # this is the domain key, domain cert and CA cert
+
+	# The command needed to reload apache / nginx or whatever you use
+	#RELOAD_CMD=""
+
+	# Uncomment the following line to prevent non-interactive renewals of certificates
+	#PREVENT_NON_INTERACTIVE_RENEWAL="true"
+
+	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
+	# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
+	# will be checked for certificate expiry and also will be checked after
+	# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
+	#SERVER_TYPE="https"
+	#CHECK_REMOTE="true"
+	#CHECK_REMOTE_WAIT="2" # wait 2 seconds before checking the remote server
+	_EOF_domain_
+}
+
+write_getssl_template() { # write out the main template file
+  cat > "$1" <<- _EOF_getssl_
+	# This file is read first and is common to all domains
+	#
+	# Uncomment and modify any variables you need
+	# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+	#
+	# The staging server is best for testing (hence set as default)
+	CA="https://acme-staging-v02.api.letsencrypt.org"
+	# This server issues full certificates, however has rate limits
+	#CA="https://acme-v02.api.letsencrypt.org"
+
+	# The agreement that must be signed with the CA, if not defined the default agreement will be used
+	#AGREEMENT="$AGREEMENT"
+
+	# Set an email address associated with your account - generally set at account level rather than domain.
+	#ACCOUNT_EMAIL="me@example.com"
+	ACCOUNT_KEY_LENGTH=4096
+	ACCOUNT_KEY="$WORKING_DIR/account.key"
+
+	# Account key and private key types - can be rsa, prime256v1, secp384r1 or secp521r1
+	#ACCOUNT_KEY_TYPE="rsa"
+	PRIVATE_KEY_ALG="rsa"
+	#REUSE_PRIVATE_KEY="true"
+
+	# The command needed to reload apache / nginx or whatever you use
+	#RELOAD_CMD=""
+
+	# The time period within which you want to allow renewal of a certificate
+	#  this prevents hitting some of the rate limits.
+	# Creating a file called FORCE_RENEWAL in the domain directory allows one-off overrides
+	# of this setting
+	RENEW_ALLOW="30"
+
+	# Define the server type. This can be https, ftp, ftpi, imap, imaps, pop3, pop3s, smtp,
+	# smtps_deprecated, smtps, smtp_submission, xmpp, xmpps, ldaps or a port number which
+	# will be checked for certificate expiry and also will be checked after
+	# an update to confirm correct certificate is running (if CHECK_REMOTE) is set to true
+	SERVER_TYPE="https"
+	CHECK_REMOTE="true"
+
+	# Use the following 3 variables if you want to validate via DNS
+	#VALIDATE_VIA_DNS="true"
+	#DNS_ADD_COMMAND=
+	#DNS_DEL_COMMAND=
+	_EOF_getssl_
+}
+
+write_openssl_conf() { # write out a minimal openssl conf
+  cat > "$1" <<- _EOF_openssl_conf_
+	# minimal openssl.cnf file
+	distinguished_name  = req_distinguished_name
+	[ req_distinguished_name ]
+	[v3_req]
+	[v3_ca]
+	_EOF_openssl_conf_
+}
+
+# Trap signals
+trap "signal_exit TERM" TERM HUP
+trap "signal_exit INT"  INT
+
+# Parse command-line
+while [[ -n ${1+defined} ]]; do
+  case $1 in
+    -h | --help)
+      help_message; graceful_exit ;;
+    -d | --debug)
+     _USE_DEBUG=1 ;;
+    -c | --create)
+     _CREATE_CONFIG=1 ;;
+    -f | --force)
+     _FORCE_RENEW=1 ;;
+    -a | --all)
+     _CHECK_ALL=1 ;;
+    -k | --keep)
+     shift; _KEEP_VERSIONS="$1";;
+    -q | --quiet)
+     _QUIET=1 ;;
+    -Q | --mute)
+     _QUIET=1
+     _MUTE=1 ;;
+    -r | --revoke)
+     _REVOKE=1
+     shift
+     REVOKE_CERT="$1"
+     shift
+     REVOKE_KEY="$1"
+     shift
+     REVOKE_CA="$1" ;;
+    -u | --upgrade)
+     _UPGRADE=1 ;;
+    -U | --nocheck)
+      _UPGRADE_CHECK=0 ;;
+    -w)
+      shift; WORKING_DIR="$1" ;;
+    -*)
+      usage
+      error_exit "Unknown option $1" ;;
+    *)
+      if [[ -n $DOMAIN ]]; then
+        error_exit "invalid command line $DOMAIN - it appears to contain more than one domain"
       fi
-    fi
-  else
-    info "${DOMAIN}: no certificate obtained from host"
-  fi
-  # end of .... if obtained a cert
+      DOMAIN="$1"
+      if [[ -z $DOMAIN ]]; then
+        error_exit "invalid command line - it appears to contain a null variable"
+      fi ;;
+  esac
+  shift
+done
+
+# Main logic
+############
+
+# Get the current OS, so the correct functions can be used for that OS. (sets the variable os)
+get_os
+
+# check if "recent" version of bash.
+#if [[ "${BASH_VERSINFO[0]}${BASH_VERSINFO[1]}" -lt 42 ]]; then
+#  info "this script is designed for bash v4.2 or later - earlier version may give errors"
+#fi
+
+#check if required applications are included
+
+requires which
+requires openssl
+requires curl
+requires nslookup drill dig host DNS_CHECK_FUNC
+requires awk
+requires tr
+requires date
+requires grep
+requires sed
+requires sort
+requires mktemp
+
+# Check if upgrades are available (unless they have specified -U to ignore Upgrade checks)
+if [[ $_UPGRADE_CHECK -eq 1 ]]; then
+  check_getssl_upgrade
 fi
-# end of .... check_remote is true then connect and obtain the current certificate
 
-# if there is an existing certificate file, check details.
-if [[ -s "$CERT_FILE" ]]; then
-  debug "certificate $CERT_FILE exists"
-  enddate=$(openssl x509 -in "$CERT_FILE" -noout -enddate 2>/dev/null| cut -d= -f 2-)
-  debug "local cert is valid until $enddate"
-  if [[ "$enddate" != "-" ]]; then
-    enddate_s=$(date_epoc "$enddate")
-    if [[ $(date_renew) -lt "$enddate_s" ]] && [[ $_FORCE_RENEW -ne 1 ]]; then
-      issuer=$(openssl x509 -in "$CERT_FILE" -noout -issuer 2>/dev/null)
-      if [[ "$issuer" == *"Fake LE Intermediate"* ]] && [[ "$CA" == "https://acme-v02.api.letsencrypt.org" ]]; then
-        debug "upgrading from fake cert to real"
-      else
-        info "${DOMAIN}: certificate is valid for more than $RENEW_ALLOW days (until $enddate)"
-        # everything is OK, so exit.
-        graceful_exit
-      fi
-    else
-      debug "${DOMAIN}: certificate needs renewal"
-    fi
+# Revoke a certificate if requested
+if [[ $_REVOKE -eq 1 ]]; then
+  if [[ -z $REVOKE_CA ]]; then
+    CA=$DEFAULT_REVOKE_CA
+  elif [[ "$REVOKE_CA" == "-d" ]]; then
+    _USE_DEBUG=1
+    CA=$DEFAULT_REVOKE_CA
+  else
+    CA=$REVOKE_CA
   fi
+  URL_revoke=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null | grep "revoke-cert" | awk -F'"' '{print $4}')
+  revoke_certificate
+  graceful_exit
 fi
-# end of .... if there is an existing certificate file, check details.
 
-if [[ ! -t 0 ]] && [[ "$PREVENT_NON_INTERACTIVE_RENEWAL" = "true" ]]; then
-  errmsg="$DOMAIN due for renewal,"
-  errmsg="${errmsg} but not completed due to PREVENT_NON_INTERACTIVE_RENEWAL=true in config"
-  error_exit "$errmsg"
-fi
+# get latest agreement from CA (as default)
+AGREEMENT=$(curl --user-agent "$CURL_USERAGENT" -I "${CA}/terms" 2>/dev/null | awk 'tolower($1) ~ "location:" {print $2}'|tr -d '\r')
 
-# create account key if it doesn't exist.
-if [[ -s "$ACCOUNT_KEY" ]]; then
-  debug "Account key exists at $ACCOUNT_KEY skipping generation"
-else
-  info "creating account key $ACCOUNT_KEY"
-  create_key "$ACCOUNT_KEY_TYPE" "$ACCOUNT_KEY" "$ACCOUNT_KEY_LENGTH"
+# if nothing in command line, print help and exit.
+if [[ -z "$DOMAIN" ]] && [[ ${_CHECK_ALL} -ne 1 ]]; then
+  help_message
+  graceful_exit
 fi
 
-# if not reusing private key, then remove the old keys
-if [[ "$REUSE_PRIVATE_KEY" != "true" ]]; then
-  if [[ -s "$DOMAIN_DIR/${DOMAIN}.key" ]]; then
-   rm -f "$DOMAIN_DIR/${DOMAIN}.key"
-  fi
-  if [[ -s "$DOMAIN_DIR/${DOMAIN}.ec.key" ]]; then
-   rm -f "$DOMAIN_DIR/${DOMAIN}.ecs.key"
-  fi
-fi
-# create new domain keys if they don't already exist
-if [[ "$DUAL_RSA_ECDSA" == "false" ]]; then
-  create_key "${PRIVATE_KEY_ALG}" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LENGTH"
-else
-  create_key "rsa" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LENGTH"
-  create_key "${PRIVATE_KEY_ALG}" "$DOMAIN_DIR/${DOMAIN}.ec.key" "$DOMAIN_KEY_LENGTH"
+# if the "working directory" doesn't exist, then create it.
+if [[ ! -d "$WORKING_DIR" ]]; then
+  debug "Making working directory - $WORKING_DIR"
+  mkdir -p "$WORKING_DIR"
 fi
-# End of creating domain keys.
 
-#create SAN
-if [[ -z "$SANS" ]]; then
-  SANLIST="subjectAltName=DNS:${DOMAIN}"
-elif [[ "$IGNORE_DIRECTORY_DOMAIN" == "true" ]]; then
-  SANLIST="subjectAltName=DNS:${SANS//,/,DNS:}"
-else
-  SANLIST="subjectAltName=DNS:${DOMAIN},DNS:${SANS//,/,DNS:}"
+# read any variables from config in working directory
+if [[ -s "$WORKING_DIR/getssl.cfg" ]]; then
+  debug "reading config from $WORKING_DIR/getssl.cfg"
+  # shellcheck source=/dev/null
+  . "$WORKING_DIR/getssl.cfg"
 fi
-debug "created SAN list = $SANLIST"
 
-#create CSR's
-if [[ "$DUAL_RSA_ECDSA" == "false" ]]; then
-  create_csr "$DOMAIN_DIR/${DOMAIN}.csr" "$DOMAIN_DIR/${DOMAIN}.key"
-else
-  create_csr "$DOMAIN_DIR/${DOMAIN}.csr" "$DOMAIN_DIR/${DOMAIN}.key"
-  create_csr "$DOMAIN_DIR/${DOMAIN}.ec.csr" "$DOMAIN_DIR/${DOMAIN}.ec.key"
+# Define defaults for variables not set in the main config.
+ACCOUNT_KEY="${ACCOUNT_KEY:=$WORKING_DIR/account.key}"
+DOMAIN_STORAGE="${DOMAIN_STORAGE:=$WORKING_DIR}"
+DOMAIN_DIR="$DOMAIN_STORAGE/$DOMAIN"
+CERT_FILE="$DOMAIN_DIR/${DOMAIN}.crt"
+FULL_CHAIN="$DOMAIN_DIR/fullchain.crt"
+CA_CERT="$DOMAIN_DIR/chain.crt"
+TEMP_DIR="$DOMAIN_DIR/tmp"
+if [[ "$os" == "mingw" ]]; then
+  CSR_SUBJECT="//"
 fi
 
-# use account key to register with CA
-# currently the code registers every time, and gets an "already registered" back if it has been.
-get_signing_params "$ACCOUNT_KEY"
+# Set the OPENSSL_CONF environment variable so openssl knows which config to use
+export OPENSSL_CONF=$SSLCONF
 
-info "Registering account"
-# send the request to the ACME server.
-if [[ $API -eq 1 ]]; then
-  if [[ "$ACCOUNT_EMAIL" ]] ; then
-	regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
-  else
-	regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
-  fi
-  send_signed_request "$URL_new_reg"  "$regjson"
-elif [[ $API -eq 2 ]]; then
-  if [[ "$ACCOUNT_EMAIL" ]] ; then
-	regjson='{"termsOfServiceAgreed": true, "contact": ["mailto: '$ACCOUNT_EMAIL'"]}'
-  else
-	regjson='{"termsOfServiceAgreed": true}'
-  fi
-  send_signed_request "$URL_newAccount"  "$regjson"
-else
-	debug "cant determine account API"
-	graceful_exit
-fi
+# if "-a" option then check other parameters and create run for each domain.
+if [[ ${_CHECK_ALL} -eq 1 ]]; then
+  info "Check all certificates"
 
-if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
-  info "Registered"
-  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
-  debug "KID=_$KID}_"
-  echo "$response" > "$TEMP_DIR/account.json"
-elif [[ "$code" == '409' ]] ; then
-  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
-  debug responseHeaders "$responseHeaders"
-  debug "Already registered KID=$KID"
-elif [[ "$code" == '200' ]] ; then
-  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
-  debug responseHeaders "$responseHeaders"
-  debug "Already registered account, KID=${KID}"
-else
-  error_exit "Error registering account ...$responseHeaders ... $(json_get "$response" detail)"
-fi
-# end of registering account with CA
+  if [[ ${_CREATE_CONFIG} -eq 1 ]]; then
+    error_exit "cannot combine -c|--create with -a|--all"
+  fi
 
-# verify each domain
-info "Verify each domain"
+  if [[ ${_FORCE_RENEW} -eq 1 ]]; then
+    error_exit "cannot combine -f|--force with -a|--all because of rate limits"
+  fi
 
-# loop through domains for cert ( from SANS list)
-if [[ "$IGNORE_DIRECTORY_DOMAIN" == "true" ]]; then
-  alldomains=${SANS//,/ }
-else
-  alldomains=$(echo "$DOMAIN,$SANS" | sed "s/,/ /g")
-fi
+  if [[ ! -d "$DOMAIN_STORAGE" ]]; then
+    error_exit "DOMAIN_STORAGE not found  - $DOMAIN_STORAGE"
+  fi
 
-if [[ $API -eq 2 ]]; then
-  dstring="["
-  for d in $alldomains; do
-    dstring="${dstring}{\"type\":\"dns\",\"value\":\"$d\"},"
-  done
-  dstring="${dstring::${#dstring}-1}]"
-  # request NewOrder currently seems to ignore the dates ....
-  #  dstring="${dstring},\"notBefore\": \"$(date -d "-1 hour" --utc +%FT%TZ)\""
-  #  dstring="${dstring},\"notAfter\": \"$(date -d "2 days" --utc +%FT%TZ)\""
-  request="{\"identifiers\": $dstring}"
-  send_signed_request "$URL_newOrder" "$request"
-  OrderLink=$(echo "$responseHeaders" | grep -i location | awk '{print $2}'| tr -d '\r\n ')
-  debug "Order link $OrderLink"
-  FinalizeLink=$(json_get "$response" "finalize")
-  debug "finalise link $FinalizeLink"
-  dn=0
-  for d in $alldomains; do
-    # get authorizations link
-    AuthLink[$dn]=$(json_get "$response" "identifiers" "value" "$d" "authorizations" "x")
-    debug "authorizations link for $d - ${AuthLink[$dn]}"
-    ((dn++))
+  for dir in "${DOMAIN_STORAGE}"/*; do
+    if [[ -d "$dir" ]]; then
+      debug "Checking $dir"
+      cmd="$0 -U" # No update checks when calling recursively
+      if [[ ${_USE_DEBUG} -eq 1 ]]; then
+        cmd="$cmd -d"
+      fi
+      if [[ ${_QUIET} -eq 1 ]]; then
+        cmd="$cmd -q"
+      fi
+      # check if $dir is a directory with a getssl.cfg in it
+      if [[ -f "$dir/getssl.cfg" ]]; then
+        cmd="$cmd -w $WORKING_DIR $(basename "$dir")"
+        debug "CMD: $cmd"
+        eval "$cmd"
+      fi
+    fi
   done
+
+  graceful_exit
 fi
+# end of "-a" option (looping through all domains)
 
-dn=0
-for d in $alldomains; do
-  # $d is domain in current loop, which is number $dn for ACL
-  info "Verifying $d"
-  if [[ "$USE_SINGLE_ACL" == "true" ]]; then
-    DOMAIN_ACL="${ACL[0]}"
+# if "-c|--create" option used, then create config files.
+if [[ ${_CREATE_CONFIG} -eq 1 ]]; then
+  # If main config file does not exists then create it.
+  if [[ ! -s "$WORKING_DIR/getssl.cfg" ]]; then
+    info "creating main config file $WORKING_DIR/getssl.cfg"
+    if [[ ! -s "$SSLCONF" ]]; then
+      SSLCONF="$WORKING_DIR/openssl.cnf"
+      write_openssl_conf "$SSLCONF"
+    fi
+    write_getssl_template "$WORKING_DIR/getssl.cfg"
+  fi
+  # If domain and domain config don't exist then create them.
+  if [[ ! -d "$DOMAIN_DIR" ]]; then
+    info "Making domain directory - $DOMAIN_DIR"
+    mkdir -p "$DOMAIN_DIR"
+  fi
+  if [[ -s "$DOMAIN_DIR/getssl.cfg" ]]; then
+    info "domain config already exists $DOMAIN_DIR/getssl.cfg"
   else
-    DOMAIN_ACL="${ACL[$dn]}"
+    info "creating domain config file in $DOMAIN_DIR/getssl.cfg"
+    # if domain has an existing cert, copy from domain and use to create defaults.
+    EX_CERT=$(echo \
+      | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:443" 2>/dev/null \
+      | openssl x509 2>/dev/null)
+    EX_SANS="www.${DOMAIN}"
+    if [[ -n "${EX_CERT}" ]]; then
+      EX_SANS=$(echo "$EX_CERT" \
+        | openssl x509 -noout -text 2>/dev/null| grep "Subject Alternative Name" -A2 \
+        | grep -Eo "DNS:[a-zA-Z 0-9.-]*" | sed "s@DNS:$DOMAIN@@g" | grep -v '^$' | cut -c 5-)
+      EX_SANS=${EX_SANS//$'\n'/','}
+    fi
+    write_domain_template "$DOMAIN_DIR/getssl.cfg"
   fi
+  TEMP_DIR="$DOMAIN_DIR/tmp"
+  # end of "-c|--create" option, so exit
+  graceful_exit
+fi
+# end of "-c|--create" option to create config file.
 
-  # request a challenge token from ACME server
-  if [[ $API -eq 1 ]]; then
-    request="{\"resource\":\"new-authz\",\"identifier\":{\"type\":\"dns\",\"value\":\"$d\"}}"
-    send_signed_request "$URL_new_authz" "$request"
-    debug "completed send_signed_request"
+# if domain directory doesn't exist, then create it.
+if [[ ! -d "$DOMAIN_DIR" ]]; then
+  debug "Making working directory - $DOMAIN_DIR"
+  mkdir -p "$DOMAIN_DIR"
+fi
 
-    # check if we got a valid response and token, if not then error exit
-    if [[ -n "$code" ]] && [[ ! "$code" == '201' ]] ; then
-      error_exit "new-authz error: $response"
-    fi
-  else
-    send_signed_request "${AuthLink[$dn]}" ""
-  fi
+# define a temporary directory, and if it doesn't exist, create it.
+TEMP_DIR="$DOMAIN_DIR/tmp"
+if [[ ! -d "${TEMP_DIR}" ]]; then
+  debug "Making temp directory - ${TEMP_DIR}"
+  mkdir -p "${TEMP_DIR}"
+fi
 
-  if [[ $response_status == "valid" ]]; then
-    info "$d is already validated"
-    if [[ "$DEACTIVATE_AUTH" == "true" ]]; then
-      deactivate_url="$(echo "$responseHeaders" | awk ' $1 ~ "^Location" {print $2}' | tr -d "\r")"
-      deactivate_url_list+=" $deactivate_url "
-      debug "url added to deactivate list ${deactivate_url}"
-      debug "deactivate list is now $deactivate_url_list"
-    fi
-    # increment domain-counter
-    ((dn++))
-  else
-    PREVIOUSLY_VALIDATED="false"
-    if [[ $VALIDATE_VIA_DNS == "true" ]]; then # set up the correct DNS token for verification
-      if [[ $API -eq 1 ]]; then
-        # get the dns component of the ACME response
-        # get the token from the dns component
-        token=$(json_get "$response" "token" "dns-01")
-        debug token "$token"
-        # get the uri from the dns component
-        uri=$(json_get "$response" "uri" "dns-01")
-        debug uri "$uri"
-      else # APIv2
-        debug "authlink response = $response"
-        # get the token from the http-01 component
-        token=$(json_get "$response" "challenges" "type" "dns-01" "token")
-        debug token "$token"
-        # get the uri from the http component
-        uri=$(json_get "$response" "challenges" "type" "dns-01" "url")
-        debug uri "$uri"
-      fi
+# read any variables from config in domain directory
+if [[ -s "$DOMAIN_DIR/getssl.cfg" ]]; then
+  debug "reading config from $DOMAIN_DIR/getssl.cfg"
+  # shellcheck source=/dev/null
+  . "$DOMAIN_DIR/getssl.cfg"
+fi
 
-      keyauthorization="$token.$thumbprint"
-      debug keyauthorization "$keyauthorization"
+# from SERVER_TYPE set REMOTE_PORT and REMOTE_EXTRA
+set_server_type
 
-      #create signed authorization key from token.
-      auth_key=$(printf '%s' "$keyauthorization" | openssl dgst -sha256 -binary \
-                 | openssl base64 -e \
-                 | tr -d '\n\r' \
-                 | sed -e 's:=*$::g' -e 'y:+/:-_:')
-      debug auth_key "$auth_key"
+# check config for typical errors.
+check_config
 
-      debug "adding dns via command: $DNS_ADD_COMMAND $d $auth_key"
-      if ! eval "$DNS_ADD_COMMAND" "$d" "$auth_key" ; then
-        error_exit "DNS_ADD_COMMAND failed for domain $d"
-      fi
+if [[ -e "$DOMAIN_DIR/FORCE_RENEWAL" ]]; then
+  rm -f "$DOMAIN_DIR/FORCE_RENEWAL" || error_exit "problem deleting file $DOMAIN_DIR/FORCE_RENEWAL"
+  _FORCE_RENEW=1
+  info "${DOMAIN}: forcing renewal (due to FORCE_RENEWAL file)"
+fi
 
-      # find a primary / authoritative DNS server for the domain
-      if [[ -z "$AUTH_DNS_SERVER" ]]; then
-        get_auth_dns "$d"
-      else
-        primary_ns="$AUTH_DNS_SERVER"
-      fi
-      debug primary_ns "$primary_ns"
+# Obtain CA resource locations
+ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}" 2>/dev/null)
+debug "ca_all_loc from ${CA} gives $ca_all_loc"
+# APIv1
+URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
+URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
+URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
+#API v2
+URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
+URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
+URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
+if [[ -z "$URL_new_reg" ]]  && [[ -z "$URL_newAccount" ]]; then
+  ca_all_loc=$(curl --user-agent "$CURL_USERAGENT" "${CA}/directory" 2>/dev/null)
+  debug "ca_all_loc from ${CA}/directory gives $ca_all_loc"
+  # APIv1
+  URL_new_reg=$(echo "$ca_all_loc" | grep "new-reg" | awk -F'"' '{print $4}')
+  URL_new_authz=$(echo "$ca_all_loc" | grep "new-authz" | awk -F'"' '{print $4}')
+  URL_new_cert=$(echo "$ca_all_loc" | grep "new-cert" | awk -F'"' '{print $4}')
+  #API v2
+  URL_newAccount=$(echo "$ca_all_loc" | grep "newAccount" | awk -F'"' '{print $4}')
+  URL_newNonce=$(echo "$ca_all_loc" | grep "newNonce" | awk -F'"' '{print $4}')
+  URL_newOrder=$(echo "$ca_all_loc" | grep "newOrder" | awk -F'"' '{print $4}')
+fi
 
-      # make a directory to hold pending dns-challenges
-      if [[ ! -d "$TEMP_DIR/dns_verify" ]]; then
-        mkdir "$TEMP_DIR/dns_verify"
-      fi
+if [[ -n "$URL_new_reg" ]]; then
+  API=1
+elif [[ -n "$URL_newAccount" ]]; then
+  API=2
+else
+  info "unknown API version"
+  graceful_exit
+fi
+debug "Using API v$API"
 
-      # generate a file with the current variables for the dns-challenge
-      cat > "$TEMP_DIR/dns_verify/$d" <<- _EOF_
-			token="${token}"
-			uri="${uri}"
-			keyauthorization="${keyauthorization}"
-			d="${d}"
-			primary_ns="${primary_ns}"
-			auth_key="${auth_key}"
-			_EOF_
+# Check if awk supports json_awk (required for ACMEv2)
+if [[ $API -eq 2 ]]; then
+    json_awk_test=$(json_awk '{ "test": "1" }' 2>/dev/null)
+    if [[ "${json_awk_test}" == "" ]]; then
+        error_exit "Your version of awk does not work with json_awk (see http://github.com/step-/JSON.awk/issues/6), please install a newer version of mawk or gawk"
+    fi
+fi
 
-    else      # set up the correct http token for verification
-      if [[ $API -eq 1 ]]; then
-        # get the token from the http component
-        token=$(json_get "$response" "token" "http-01")
-        debug token "$token"
-        # get the uri from the http component
-        uri=$(json_get "$response" "uri" "http-01")
-        debug uri "$uri"
-      else # APIv2
-        send_signed_request "${AuthLink[$dn]}" ""
-        debug "authlink response = $response"
-        # get the token from the http-01 component
-        token=$(json_get "$response" "challenges" "type" "http-01" "token")
-        debug token "$token"
-        # get the uri from the http component
-        uri=$(json_get "$response" "challenges" "type" "http-01" "url" | head -n1)
-        debug uri "$uri"
+# if check_remote is true then connect and obtain the current certificate (if not forcing renewal)
+if [[ "${CHECK_REMOTE}" == "true" ]] && [[ $_FORCE_RENEW -eq 0 ]]; then
+  debug "getting certificate for $DOMAIN from remote server"
+  # shellcheck disable=SC2086
+  EX_CERT=$(echo \
+    | openssl s_client -servername "${DOMAIN}" -connect "${DOMAIN}:${REMOTE_PORT}" ${REMOTE_EXTRA} 2>/dev/null \
+    | openssl x509 2>/dev/null)
+  if [[ -n "$EX_CERT" ]]; then # if obtained a cert
+    if [[ -s "$CERT_FILE" ]]; then # if local exists
+      CERT_LOCAL=$(openssl x509 -noout -fingerprint < "$CERT_FILE" 2>/dev/null)
+    else # since local doesn't exist leave empty so that the domain validation will happen
+      CERT_LOCAL=""
+    fi
+    CERT_REMOTE=$(echo "$EX_CERT" | openssl x509 -noout -fingerprint 2>/dev/null)
+    if [[ "$CERT_LOCAL" == "$CERT_REMOTE" ]]; then
+      debug "certificate on server is same as the local cert"
+    else
+      # check if the certificate is for the right domain
+      EX_CERT_DOMAIN=$(echo "$EX_CERT" | openssl x509 -text \
+        | sed -n -e 's/^ *Subject: .* CN=\([A-Za-z0-9.-]*\).*$/\1/p; /^ *DNS:.../ { s/ *DNS://g; y/,/\n/; p; }' \
+        | sort -u | grep "^$DOMAIN\$")
+      if [[ "$EX_CERT_DOMAIN" == "$DOMAIN" ]]; then
+        # check renew-date on ex_cert and compare to local ( if local exists)
+        enddate_ex=$(echo "$EX_CERT" | openssl x509 -noout -enddate 2>/dev/null| cut -d= -f 2-)
+        enddate_ex_s=$(date_epoc "$enddate_ex")
+        debug "external cert has enddate $enddate_ex ( $enddate_ex_s ) "
+        if [[ -s "$CERT_FILE" ]]; then # if local exists
+          enddate_lc=$(openssl x509 -noout -enddate < "$CERT_FILE" 2>/dev/null| cut -d= -f 2-)
+          enddate_lc_s=$(date_epoc "$enddate_lc")
+          debug "local cert has enddate $enddate_lc ( $enddate_lc_s ) "
+        else
+          enddate_lc_s=0
+          debug "local cert doesn't exist"
+        fi
+        if [[ "$enddate_ex_s" -eq "$enddate_lc_s" ]]; then
+          debug "certificates expire at the same time"
+        elif [[ "$enddate_ex_s" -gt "$enddate_lc_s" ]]; then
+          # remote has longer to expiry date than local copy.
+          debug "remote cert has longer to run than local cert - ignoring"
+        else
+          info "${DOMAIN}: remote cert expires sooner than local, attempting to upload from local"
+          copy_file_to_location "domain certificate" \
+                                "$CERT_FILE" \
+                                "$DOMAIN_CERT_LOCATION"
+          copy_file_to_location "private key" \
+                                "$DOMAIN_DIR/${DOMAIN}.key" \
+                                "$DOMAIN_KEY_LOCATION"
+          copy_file_to_location "CA certificate" "$CA_CERT" "$CA_CERT_LOCATION"
+          cat "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}_chain.pem"
+          copy_file_to_location "full pem" \
+                                "$TEMP_DIR/${DOMAIN}_chain.pem" \
+                                "$DOMAIN_CHAIN_LOCATION"
+          cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" > "$TEMP_DIR/${DOMAIN}_K_C.pem"
+          copy_file_to_location "private key and domain cert pem" \
+                                "$TEMP_DIR/${DOMAIN}_K_C.pem"  \
+                                "$DOMAIN_KEY_CERT_LOCATION"
+          cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" "$CA_CERT" > "$TEMP_DIR/${DOMAIN}.pem"
+          copy_file_to_location "full pem" \
+                                "$TEMP_DIR/${DOMAIN}.pem"  \
+                                "$DOMAIN_PEM_LOCATION"
+          reload_service
+        fi
+      else
+        info "${DOMAIN}: Certificate on remote domain does not match, ignoring remote certificate"
       fi
+    fi
+  else
+    info "${DOMAIN}: no certificate obtained from host"
+  fi
+  # end of .... if obtained a cert
+fi
+# end of .... check_remote is true then connect and obtain the current certificate
 
-      #create signed authorization key from token.
-      keyauthorization="$token.$thumbprint"
-      debug keyauthorization "$keyauthorization"
-
-      # save variable into temporary file
-      echo -n "$keyauthorization" > "$TEMP_DIR/$token"
-      chmod 644 "$TEMP_DIR/$token"
-
-      # copy to token to acme challenge location
-      umask 0022
-      IFS=\; read -r -a token_locations <<<"$DOMAIN_ACL"
-      for t_loc in "${token_locations[@]}"; do
-        debug "copying file from $TEMP_DIR/$token to ${t_loc}"
-        copy_file_to_location "challenge token" \
-                              "$TEMP_DIR/$token" \
-                              "${t_loc}/$token"
-      done
-      umask "$ORIG_UMASK"
-
-      wellknown_url="${CHALLENGE_CHECK_TYPE}://${d}/.well-known/acme-challenge/$token"
-      debug wellknown_url "$wellknown_url"
-
-      if [[ "$SKIP_HTTP_TOKEN_CHECK" == "true" ]]; then
-        info "SKIP_HTTP_TOKEN_CHECK=true so not checking that token is working correctly"
+# if there is an existing certificate file, check details.
+if [[ -s "$CERT_FILE" ]]; then
+  debug "certificate $CERT_FILE exists"
+  enddate=$(openssl x509 -in "$CERT_FILE" -noout -enddate 2>/dev/null| cut -d= -f 2-)
+  debug "local cert is valid until $enddate"
+  if [[ "$enddate" != "-" ]]; then
+    enddate_s=$(date_epoc "$enddate")
+    if [[ $(date_renew) -lt "$enddate_s" ]] && [[ $_FORCE_RENEW -ne 1 ]]; then
+      issuer=$(openssl x509 -in "$CERT_FILE" -noout -issuer 2>/dev/null)
+      if [[ "$issuer" == *"Fake LE Intermediate"* ]] && [[ "$CA" == "https://acme-v02.api.letsencrypt.org" ]]; then
+        debug "upgrading from fake cert to real"
       else
-        sleep "$HTTP_TOKEN_CHECK_WAIT"
-        # check that we can reach the challenge ourselves, if not, then error
-        if [[ ! "$(curl --user-agent "$CURL_USERAGENT" -k --silent --location "$wellknown_url")" == "$keyauthorization" ]]; then
-          error_exit "for some reason could not reach $wellknown_url - please check it manually"
-        fi
+        info "${DOMAIN}: certificate is valid for more than $RENEW_ALLOW days (until $enddate)"
+        # everything is OK, so exit.
+        graceful_exit
       fi
+    else
+      debug "${DOMAIN}: certificate needs renewal"
+    fi
+  fi
+fi
+# end of .... if there is an existing certificate file, check details.
 
-      check_challenge_completion "$uri" "$d" "$keyauthorization"
+if [[ ! -t 0 ]] && [[ "$PREVENT_NON_INTERACTIVE_RENEWAL" = "true" ]]; then
+  errmsg="$DOMAIN due for renewal,"
+  errmsg="${errmsg} but not completed due to PREVENT_NON_INTERACTIVE_RENEWAL=true in config"
+  error_exit "$errmsg"
+fi
 
-      debug "remove token from ${DOMAIN_ACL}"
-      IFS=\; read -r -a token_locations <<<"$DOMAIN_ACL"
-      for t_loc in "${token_locations[@]}"; do
-        if [[ "${t_loc:0:4}" == "ssh:" ]] ; then
-          sshhost=$(echo "${t_loc}"| awk -F: '{print $2}')
-          command="rm -f ${t_loc:(( ${#sshhost} + 5))}/${token:?}"
-          debug "running following command to remove token"
-          debug "ssh $SSH_OPTS $sshhost ${command}"
-          # shellcheck disable=SC2029
-          # shellcheck disable=SC2086
-          ssh $SSH_OPTS "$sshhost" "${command}" 1>/dev/null 2>&1
-          rm -f "${TEMP_DIR:?}/${token:?}"
-        elif [[ "${t_loc:0:4}" == "ftp:" ]] ; then
-          debug "using ftp to remove token file"
-          ftpuser=$(echo "${t_loc}"| awk -F: '{print $2}')
-          ftppass=$(echo "${t_loc}"| awk -F: '{print $3}')
-          ftphost=$(echo "${t_loc}"| awk -F: '{print $4}')
-          ftplocn=$(echo "${t_loc}"| awk -F: '{print $5}')
-          debug "ftp user=$ftpuser - pass=$ftppass - host=$ftphost location=$ftplocn"
-          ftp -n <<- EOF
-					open $ftphost
-					user $ftpuser $ftppass
-					cd $ftplocn
-					delete ${token:?}
-					EOF
-        else
-          rm -f "${t_loc:?}/${token:?}"
-        fi
-      done
-    fi
-    # increment domain-counter
-    ((dn++))
+# create account key if it doesn't exist.
+if [[ -s "$ACCOUNT_KEY" ]]; then
+  debug "Account key exists at $ACCOUNT_KEY skipping generation"
+else
+  info "creating account key $ACCOUNT_KEY"
+  create_key "$ACCOUNT_KEY_TYPE" "$ACCOUNT_KEY" "$ACCOUNT_KEY_LENGTH"
+fi
+
+# if not reusing private key, then remove the old keys
+if [[ "$REUSE_PRIVATE_KEY" != "true" ]]; then
+  if [[ -s "$DOMAIN_DIR/${DOMAIN}.key" ]]; then
+   rm -f "$DOMAIN_DIR/${DOMAIN}.key"
   fi
-done # end of ... loop through domains for cert ( from SANS list)
+  if [[ -s "$DOMAIN_DIR/${DOMAIN}.ec.key" ]]; then
+   rm -f "$DOMAIN_DIR/${DOMAIN}.ec.key"
+  fi
+fi
+# create new domain keys if they don't already exist
+if [[ "$DUAL_RSA_ECDSA" == "false" ]]; then
+  create_key "${PRIVATE_KEY_ALG}" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LENGTH"
+else
+  create_key "rsa" "$DOMAIN_DIR/${DOMAIN}.key" "$DOMAIN_KEY_LENGTH"
+  create_key "${PRIVATE_KEY_ALG}" "$DOMAIN_DIR/${DOMAIN}.ec.key" "$DOMAIN_KEY_LENGTH"
+fi
+# End of creating domain keys.
 
-# perform validation if via DNS challenge
-if [[ $VALIDATE_VIA_DNS == "true" ]]; then
-  # loop through dns-variable files to check if dns has been changed
-  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
-    if [[ -e "$dnsfile" ]]; then
-      debug "loading DNSfile: $dnsfile"
-      # shellcheck source=/dev/null
-      . "$dnsfile"
+#create SAN
+if [[ -z "$SANS" ]]; then
+  SANLIST="subjectAltName=DNS:${DOMAIN}"
+elif [[ "$IGNORE_DIRECTORY_DOMAIN" == "true" ]]; then
+  SANLIST="subjectAltName=DNS:${SANS//,/,DNS:}"
+else
+  SANLIST="subjectAltName=DNS:${DOMAIN},DNS:${SANS//,/,DNS:}"
+fi
+debug "created SAN list = $SANLIST"
 
-      # check for token at public dns server, waiting for a valid response.
-      for ns in $primary_ns; do
-        debug "checking dns at $ns"
-        ntries=0
-        check_dns="fail"
-        while [[ "$check_dns" == "fail" ]]; do
-          if [[ "$os" == "cygwin" ]]; then
-            check_result=$(nslookup -type=txt "_acme-challenge.${d}" "${ns}" \
-                           | grep ^_acme -A2\
-                           | grep '"'|awk -F'"' '{ print $2}')
-          elif [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
-            check_result=$($DNS_CHECK_FUNC TXT "_acme-challenge.${d}" "@${ns}" \
-                           | grep '300 IN TXT'|awk -F'"' '{ print $2}')
-          elif [[ "$DNS_CHECK_FUNC" == "host" ]]; then
-            check_result=$($DNS_CHECK_FUNC -t TXT "_acme-challenge.${d}" "${ns}" \
-                           | grep 'descriptive text'|awk -F'"' '{ print $2}')
-          else
-            check_result=$(nslookup -type=txt "_acme-challenge.${d}" "${ns}" \
-                           | grep 'text ='|awk -F'"' '{ print $2}')
-          fi
-          debug "expecting  $auth_key"
-          debug "${ns} gave ... $check_result"
+#create CSR's
+if [[ "$DUAL_RSA_ECDSA" == "false" ]]; then
+  create_csr "$DOMAIN_DIR/${DOMAIN}.csr" "$DOMAIN_DIR/${DOMAIN}.key"
+else
+  create_csr "$DOMAIN_DIR/${DOMAIN}.csr" "$DOMAIN_DIR/${DOMAIN}.key"
+  create_csr "$DOMAIN_DIR/${DOMAIN}.ec.csr" "$DOMAIN_DIR/${DOMAIN}.ec.key"
+fi
 
-          if [[ "$check_result" == *"$auth_key"* ]]; then
-            check_dns="success"
-          else
-            if [[ $ntries -lt 100 ]]; then
-              ntries=$(( ntries + 1 ))
-              info "checking DNS at ${ns} for ${d}. Attempt $ntries/100 gave wrong result, "\
-                "waiting $DNS_WAIT secs before checking again"
-              sleep $DNS_WAIT
-            else
-              debug "dns check failed - removing existing value"
-              error_exit "checking _acme-challenge.${d} gave $check_result not $auth_key"
-            fi
-          fi
-        done
-      done
-    fi
-  done
+# use account key to register with CA
+# currently the code registers every time, and gets an "already registered" back if it has been.
+get_signing_params "$ACCOUNT_KEY"
 
-  if [[ "$DNS_EXTRA_WAIT" -gt 0 && "$PREVIOUSLY_VALIDATED" != "true" ]]; then
-    info "sleeping $DNS_EXTRA_WAIT seconds before asking the ACME-server to check the dns"
-    sleep "$DNS_EXTRA_WAIT"
+info "Registering account"
+# send the request to the ACME server.
+if [[ $API -eq 1 ]]; then
+  if [[ "$ACCOUNT_EMAIL" ]] ; then
+	regjson='{"resource": "new-reg", "contact": ["mailto: '$ACCOUNT_EMAIL'"], "agreement": "'$AGREEMENT'"}'
+  else
+	regjson='{"resource": "new-reg", "agreement": "'$AGREEMENT'"}'
   fi
+  send_signed_request "$URL_new_reg"  "$regjson"
+elif [[ $API -eq 2 ]]; then
+  if [[ "$ACCOUNT_EMAIL" ]] ; then
+	regjson='{"termsOfServiceAgreed": true, "contact": ["mailto: '$ACCOUNT_EMAIL'"]}'
+  else
+	regjson='{"termsOfServiceAgreed": true}'
+  fi
+  send_signed_request "$URL_newAccount"  "$regjson"
+else
+	debug "cant determine account API"
+	graceful_exit
+fi
 
-  # loop through dns-variable files to let the ACME server check the challenges
-  for dnsfile in "$TEMP_DIR"/dns_verify/*; do
-    if [[ -e "$dnsfile" ]]; then
-      debug "loading DNSfile: $dnsfile"
-      # shellcheck source=/dev/null
-      . "$dnsfile"
+if [[ "$code" == "" ]] || [[ "$code" == '201' ]] ; then
+  info "Registered"
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
+  debug "KID=_$KID}_"
+  echo "$response" > "$TEMP_DIR/account.json"
+elif [[ "$code" == '409' ]] ; then
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
+  debug responseHeaders "$responseHeaders"
+  debug "Already registered KID=$KID"
+elif [[ "$code" == '200' ]] ; then
+  KID=$(echo "$responseHeaders" | grep -i "^location" | awk '{print $2}'| tr -d '\r\n ')
+  debug responseHeaders "$responseHeaders"
+  debug "Already registered account, KID=${KID}"
+else
+  error_exit "Error registering account ...$responseHeaders ... $(json_get "$response" detail)"
+fi
+# end of registering account with CA
 
-      check_challenge_completion "$uri" "$d" "$keyauthorization"
+# verify each domain
+info "Verify each domain"
 
-      debug "remove DNS entry"
-      eval "$DNS_DEL_COMMAND" "$d" "$auth_key"
-      # remove $dnsfile after each loop.
-      rm -f "$dnsfile"
-    fi
-  done
+# loop through domains for cert ( from SANS list)
+if [[ "$IGNORE_DIRECTORY_DOMAIN" == "true" ]]; then
+  alldomains=${SANS//,/ }
+else
+  alldomains=$(echo "$DOMAIN,$SANS" | sed "s/,/ /g")
+fi
+
+if [[ $API -eq 2 ]]; then
+  create_order
 fi
-# end of ... perform validation if via DNS challenge
-#end of varify each domain.
 
-# Verification has been completed for all SANS, so  request certificate.
+fulfill_challenges
+
+# Verification has been completed for all SANS, so request certificate.
 info "Verification completed, obtaining certificate."
 
 #obtain the certificate.
@@ -2504,6 +2505,12 @@ get_certificate "$DOMAIN_DIR/${DOMAIN}.csr" \
                 "$CERT_FILE" \
                 "$CA_CERT"
 if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
+  info "Creating order for EC certificate"
+  if [[ $API -eq 2 ]]; then
+    create_order
+    fulfill_challenges
+  fi
+  info "obtaining EC certificate."
   get_certificate "$DOMAIN_DIR/${DOMAIN}.ec.csr" \
                   "${CERT_FILE%.*}.ec.crt" \
                   "${CA_CERT%.*}.ec.crt"
@@ -2549,7 +2556,7 @@ if [[ -n "$DOMAIN_CHAIN_LOCATION" ]]; then
   copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
     cat "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_chain.pem.ec"
-    copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem.ec"  "${to_location}.ec"
+    copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
   fi
 fi
 # if DOMAIN_KEY_CERT_LOCATION is not blank, then create and copy file.
@@ -2563,7 +2570,7 @@ if [[ -n "$DOMAIN_KEY_CERT_LOCATION" ]]; then
   copy_file_to_location "private key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
   cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"
-  copy_file_to_location "private ec key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"  "${to_location}.ec"
+  copy_file_to_location "private ec key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
   fi
 fi
 # if DOMAIN_PEM_LOCATION is not blank, then create and copy file.
@@ -2577,7 +2584,7 @@ if [[ -n "$DOMAIN_PEM_LOCATION" ]]; then
   copy_file_to_location "full key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
     cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}.pem.ec"
-    copy_file_to_location "full ec key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem.ec"  "${to_location}.ec"
+    copy_file_to_location "full ec key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
   fi
 fi
 # end of copying certs.
diff --git a/test/3-dual-rsa-ecdsa.bats b/test/3-dual-rsa-ecdsa.bats
new file mode 100644
index 0000000..2dc9257
--- /dev/null
+++ b/test/3-dual-rsa-ecdsa.bats
@@ -0,0 +1,43 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Create dual certificates using HTTP-01 verification" {
+    CONFIG_FILE="getssl-http01-dual-rsa-ecdsa.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of dual certificates using HTTP-01" {
+    #!FIXME test certificate has been updated
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+}
+
+@test "Create dual certificates using DNS-01 verification" {
+    CONFIG_FILE="getssl-dns01-dual-rsa-ecdsa.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of dual certificates using DNS-01" {
+    #!FIXME test certificate has been updated
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    cleanup_environment
+}
diff --git a/test/Dockerfile-debian b/test/Dockerfile-debian
index c4c88a1..95ebbac 100644
--- a/test/Dockerfile-debian
+++ b/test/Dockerfile-debian
@@ -10,9 +10,6 @@ WORKDIR /root
 RUN mkdir /etc/nginx/pki
 RUN mkdir /etc/nginx/pki/private
 
-# Prevent "Can't load /root/.rnd into RNG" error from openssl
-# RUN touch /root/.rnd
-
 # BATS (Bash Automated Testings)
 RUN git clone https://github.com/bats-core/bats-core.git /bats-core
 RUN git clone https://github.com/jasonkarns/bats-support /bats-support
diff --git a/test/README.md b/test/README.md
index 98ff929..7648f17 100644
--- a/test/README.md
+++ b/test/README.md
@@ -35,6 +35,6 @@ docker exec -it getssl-ubuntu18 /getssl/test/debug-test.sh getssl-http01.cfg
 
 ## TODO
 
-1. Test RHEL6, Debian as well
-2. Test SSH, SFTP
-3. Test wildcards
+1. Test wildcards
+2. Test SSH, SFTP, SCP
+3. Test change of key algorithm
diff --git a/test/test-config/getssl-dns01-dual-rsa-ecdsa.cfg b/test/test-config/getssl-dns01-dual-rsa-ecdsa.cfg
new file mode 100644
index 0000000..042ed15
--- /dev/null
+++ b/test/test-config/getssl-dns01-dual-rsa-ecdsa.cfg
@@ -0,0 +1,37 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+CA="https://pebble:14000/dir"
+
+VALIDATE_VIA_DNS=true
+DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_challtestsrv"
+DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_challtestsrv"
+
+DUAL_RSA_ECDSA="true"
+ACCOUNT_KEY_TYPE="prime256v1"
+PRIVATE_KEY_ALG="prime256v1"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS=""
+
+# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-http01-dual-rsa-ecdsa.cfg b/test/test-config/getssl-http01-dual-rsa-ecdsa.cfg
new file mode 100644
index 0000000..f6cfcb7
--- /dev/null
+++ b/test/test-config/getssl-http01-dual-rsa-ecdsa.cfg
@@ -0,0 +1,33 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+CA="https://pebble:14000/dir"
+
+DUAL_RSA_ECDSA="true"
+ACCOUNT_KEY_TYPE="prime256v1"
+PRIVATE_KEY_ALG="prime256v1"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS=""
+
+# Acme Challenge Location.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"

From b09e1807ba0a8d5c1bfc90f8af456842decb39bb Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 12 Feb 2020 14:22:30 +0000
Subject: [PATCH 83/93] Fix #424 -  Sporadic "error in EC signing couldn't get
 R from ..."

---
 getssl                                     | 29 ++++++++++-----
 test/5-secp384-http01.bats                 | 41 ++++++++++++++++++++++
 test/test-config/getssl-http01-secp384.cfg | 32 +++++++++++++++++
 test/test-config/getssl-http01-secp521.cfg | 32 +++++++++++++++++
 4 files changed, 125 insertions(+), 9 deletions(-)
 create mode 100644 test/5-secp384-http01.bats
 create mode 100644 test/test-config/getssl-http01-secp384.cfg
 create mode 100644 test/test-config/getssl-http01-secp521.cfg

diff --git a/getssl b/getssl
index 0d593d7..5af09e1 100755
--- a/getssl
+++ b/getssl
@@ -1801,20 +1801,27 @@ sign_string() { # sign a string with a given key and algorithm and return urlbas
   elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
     signed=$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" -hex | awk '{print $2}')
     debug "EC signature $signed"
-    if [[ "${signed:4:4}" == "0220" ]]; then #sha256
+    if [[ "${signed:4:4}" == "021f" ]]; then #sha256 which needs padding
+      R=$(echo -n 00;echo "$signed" | cut -c 9-70)
+      part2=$(echo "$signed" | cut -c 71-)
+    elif [[ "${signed:4:4}" == "0220" ]]; then #sha256
       R=$(echo "$signed" | cut -c 9-72)
       part2=$(echo "$signed" | cut -c 73-)
-    elif [[ "${signed:4:4}" == "0221" ]]; then #sha256
+    elif [[ "${signed:4:4}" == "0221" ]]; then #sha256 which needs trimming
       R=$(echo "$signed" | cut -c 11-74)
       part2=$(echo "$signed" | cut -c 75-)
+    elif [[ "${signed:4:4}" == "022f" ]]; then #sha384 which needs padding
+      info "Padding sha384"
+      R=$(echo -n 00;echo "$signed" | cut -c 9-102)
+      part2=$(echo "$signed" | cut -c 103-)
     elif [[ "${signed:4:4}" == "0230" ]]; then #sha384
       R=$(echo "$signed" | cut -c 9-104)
       part2=$(echo "$signed" | cut -c 105-)
-    elif [[ "${signed:4:4}" == "0231" ]]; then #sha384
+    elif [[ "${signed:4:4}" == "0231" ]]; then #sha384 which needs trimming
       R=$(echo "$signed" | cut -c 11-106)
       part2=$(echo "$signed" | cut -c 107-)
-    elif [[ "${signed:6:4}" == "0241" ]]; then #sha512
-      R=$(echo "$signed" | cut -c 11-140)
+    elif [[ "${signed:6:4}" == "0241" ]]; then #sha512 which needs padding
+      R=$(echo -n 00;echo "$signed" | cut -c 11-140)
       part2=$(echo "$signed" | cut -c 141-)
     elif [[ "${signed:6:4}" == "0242" ]]; then #sha512
       R=$(echo "$signed" | cut -c 11-142)
@@ -1824,18 +1831,22 @@ sign_string() { # sign a string with a given key and algorithm and return urlbas
     fi
     debug "R $R"
 
-    if [[ "${part2:0:4}" == "0220" ]]; then #sha256
+    if [[ "${part2:0:4}" == "021f" ]]; then #sha256 with padding
+      S=$(echo -n 00;echo "$part2" | cut -c 5-)
+    elif [[ "${part2:0:4}" == "0220" ]]; then #sha256
       S=$(echo "$part2" | cut -c 5-68)
     elif [[ "${part2:0:4}" == "0221" ]]; then #sha256
       S=$(echo "$part2" | cut -c 7-70)
+    elif [[ "${part2:0:4}" == "022f" ]]; then #sha384 with padding
+      S=$(echo -n 00;echo "$part2" | cut -c 5-)
     elif [[ "${part2:0:4}" == "0230" ]]; then #sha384
       S=$(echo "$part2" | cut -c 5-100)
     elif [[ "${part2:0:4}" == "0231" ]]; then #sha384
       S=$(echo "$part2" | cut -c 7-102)
-    elif [[ "${part2:0:4}" == "0241" ]]; then #sha512
-      S=$(echo "$part2" | cut -c 5-136)
+    elif [[ "${part2:0:4}" == "0241" ]]; then #sha512 with padding
+      S=$(echo -n 00;echo "$part2" | cut -c 5-)
     elif [[ "${part2:0:4}" == "0242" ]]; then #sha512
-      S=$(echo "$part2" | cut -c 5-136)
+      S=$(echo "$part2" | cut -c 5-)
     else
       error_exit "error in EC signing couldn't get S from $signed"
     fi
diff --git a/test/5-secp384-http01.bats b/test/5-secp384-http01.bats
new file mode 100644
index 0000000..9010d58
--- /dev/null
+++ b/test/5-secp384-http01.bats
@@ -0,0 +1,41 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# This is run for every test
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+}
+
+
+@test "Create new secp384r1 certificate using HTTP-01 verification" {
+    CONFIG_FILE="getssl-http01-secp384.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of secp384r1 certificate using HTTP-01" {
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+}
+
+
+@test "Create new secp521r1 certificate using HTTP-01 verification" {
+    CONFIG_FILE="getssl-http01-secp521.cfg"
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+}
+
+
+@test "Force renewal of secp521r1 certificate using HTTP-01" {
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+}
diff --git a/test/test-config/getssl-http01-secp384.cfg b/test/test-config/getssl-http01-secp384.cfg
new file mode 100644
index 0000000..4fa3e82
--- /dev/null
+++ b/test/test-config/getssl-http01-secp384.cfg
@@ -0,0 +1,32 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+CA="https://pebble:14000/dir"
+
+ACCOUNT_KEY_TYPE="secp384r1"
+PRIVATE_KEY_ALG="secp384r1"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS=""
+
+# Acme Challenge Location.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test-config/getssl-http01-secp521.cfg b/test/test-config/getssl-http01-secp521.cfg
new file mode 100644
index 0000000..6068fbf
--- /dev/null
+++ b/test/test-config/getssl-http01-secp521.cfg
@@ -0,0 +1,32 @@
+# Uncomment and modify any variables you need
+# see https://github.com/srvrco/getssl/wiki/Config-variables for details
+# see https://github.com/srvrco/getssl/wiki/Example-config-files for example configs
+#
+CA="https://pebble:14000/dir"
+
+ACCOUNT_KEY_TYPE="secp521r1"
+PRIVATE_KEY_ALG="secp521r1"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS=""
+
+# Acme Challenge Location.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"

From e0626f37c07fb80cc6f0416ce08a2922269cc7e3 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 12 Feb 2020 16:01:35 +0000
Subject: [PATCH 84/93] Update version and revision history

---
 getssl | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/getssl b/getssl
index 5af09e1..7de661c 100755
--- a/getssl
+++ b/getssl
@@ -208,10 +208,12 @@
 # 2020-02-05 Fix epoch_date for busybox
 # 2020-02-06 Bugfixes for json_awk and nslookup to support old awk versions (2.17)
 # 2020-02-11 Add SCP_OPTS and SFTP_OPTS
+# 2020-02-12 Fix for DUAL_RSA_ECDSA not working with ACMEv2 (#334, #474, #502)
+# 2020-02-12 Fix #424 - Sporadic "error in EC signing couldn't get R from ..." (2.18)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.17"
+VERSION="2.18"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096

From a9d0419c75fbfb57031a4a4410097d4256079b07 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Wed, 12 Feb 2020 20:50:38 +0000
Subject: [PATCH 85/93] Fix "Registration key already in use" error

---
 getssl | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/getssl b/getssl
index 7de661c..2de9612 100755
--- a/getssl
+++ b/getssl
@@ -210,10 +210,11 @@
 # 2020-02-11 Add SCP_OPTS and SFTP_OPTS
 # 2020-02-12 Fix for DUAL_RSA_ECDSA not working with ACMEv2 (#334, #474, #502)
 # 2020-02-12 Fix #424 - Sporadic "error in EC signing couldn't get R from ..." (2.18)
+# 2020-02-12 Fix "Registration key already in use" (2.19)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.18"
+VERSION="2.19"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -1753,7 +1754,7 @@ send_signed_request() { # Sends a request to the ACME server, signed with your p
       debug response  "$response"
       code=$(awk ' $1 ~ "^HTTP" {print $2}' "$CURL_HEADER" | tail -1)
       debug code "$code"
-      if [[ "$code" == 4* && $response != *"error:badNonce"* ]]; then
+      if [[ "$code" == 4* && $response != *"error:badNonce"* && "$code" != 409 ]]; then
         detail=$(echo "$response" | grep "detail")
         error_exit "ACME server returned error: ${code}: ${detail}"
       fi

From 74f4bbeac9ebe819f8f90f539e7944c3994ae10f Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Fri, 14 Feb 2020 07:18:26 +0000
Subject: [PATCH 86/93] Fix bug #505 with DUAL_RSA_ECDSA and multiple locations

---
 getssl                                        | 37 +++++++++++------
 test/4-more-than-10-hosts.bats                |  4 +-
 test/6-dual-rsa-ecdsa-copy-2-locations.bats   | 40 +++++++++++++++++++
 test/debug-test.sh                            | 14 ++++++-
 test/run-all-tests.cmd                        |  5 +++
 ...tssl-http01-dual-rsa-ecdsa-2-locations.cfg | 32 +++++++++++++++
 test/test_helper.bash                         |  6 +--
 7 files changed, 119 insertions(+), 19 deletions(-)
 create mode 100644 test/6-dual-rsa-ecdsa-copy-2-locations.bats
 create mode 100644 test/run-all-tests.cmd
 create mode 100644 test/test-config/getssl-http01-dual-rsa-ecdsa-2-locations.cfg

diff --git a/getssl b/getssl
index 2de9612..dbcd867 100755
--- a/getssl
+++ b/getssl
@@ -211,10 +211,11 @@
 # 2020-02-12 Fix for DUAL_RSA_ECDSA not working with ACMEv2 (#334, #474, #502)
 # 2020-02-12 Fix #424 - Sporadic "error in EC signing couldn't get R from ..." (2.18)
 # 2020-02-12 Fix "Registration key already in use" (2.19)
+# 2020-02-13 Fix bug with copying to all locations when creating RSA and ECDSA certs (2.20)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}
-VERSION="2.19"
+VERSION="2.20"
 
 # defaults
 ACCOUNT_KEY_LENGTH=4096
@@ -549,8 +550,12 @@ copy_file_to_location() { # copies a file, using scp, sftp or ftp if required.
   cert=$1   # descriptive name, just used for display
   from=$2   # current file location
   to=$3     # location to move file to.
+  suffix=$4 # (optional) optional suffix for DUAL_RSA_ECDSA, i.e. save to private.key becomes save to private.ec.key
   IFS=\; read -r -a copy_locations <<<"$3"
   for to in "${copy_locations[@]}"; do
+    if [[ -n "$suffix" ]]; then
+      to="${to%.*}.${suffix}.${to##*.}"
+    fi
     info "copying $cert to $to"
     if [[ "${to:0:4}" == "ssh:" ]] ; then
       debug "using scp -q $SCP_OPTS $from ${to:4}"
@@ -1823,6 +1828,9 @@ sign_string() { # sign a string with a given key and algorithm and return urlbas
     elif [[ "${signed:4:4}" == "0231" ]]; then #sha384 which needs trimming
       R=$(echo "$signed" | cut -c 11-106)
       part2=$(echo "$signed" | cut -c 107-)
+    elif [[ "${signed:6:4}" == "0240" ]]; then #sha512 which needs padding
+      R=$(echo -n 00;echo "$signed" | cut -c 9-138)
+      part2=$(echo "$signed" | cut -c 141-)
     elif [[ "${signed:6:4}" == "0241" ]]; then #sha512 which needs padding
       R=$(echo -n 00;echo "$signed" | cut -c 11-140)
       part2=$(echo "$signed" | cut -c 141-)
@@ -1846,6 +1854,8 @@ sign_string() { # sign a string with a given key and algorithm and return urlbas
       S=$(echo "$part2" | cut -c 5-100)
     elif [[ "${part2:0:4}" == "0231" ]]; then #sha384
       S=$(echo "$part2" | cut -c 7-102)
+    elif [[ "${part2:0:4}" == "0240" ]]; then #sha512 with padding
+      S=$(echo -n 00;echo "$part2" | cut -c 5-)
     elif [[ "${part2:0:4}" == "0241" ]]; then #sha512 with padding
       S=$(echo -n 00;echo "$part2" | cut -c 5-)
     elif [[ "${part2:0:4}" == "0242" ]]; then #sha512
@@ -2545,17 +2555,20 @@ if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
   if [[ -n "$DOMAIN_CERT_LOCATION" ]]; then
     copy_file_to_location "ec domain certificate" \
                           "${CERT_FILE%.*}.ec.crt" \
-                          "${DOMAIN_CERT_LOCATION%.*}.ec.crt"
+                          "${DOMAIN_CERT_LOCATION}" \
+                          "ec"
   fi
   if [[ -n "$DOMAIN_KEY_LOCATION" ]]; then
-  copy_file_to_location "ec private key" \
-                        "$DOMAIN_DIR/${DOMAIN}.ec.key" \
-                        "${DOMAIN_KEY_LOCATION%.*}.ec.key"
+    copy_file_to_location "ec private key" \
+                          "$DOMAIN_DIR/${DOMAIN}.ec.key" \
+                          "${DOMAIN_KEY_LOCATION}" \
+                          "ec"
   fi
   if [[ -n "$CA_CERT_LOCATION" ]]; then
-  copy_file_to_location "ec CA certificate" \
-                        "${CA_CERT%.*}.ec.crt" \
-                        "${CA_CERT_LOCATION%.*}.ec.crt"
+    copy_file_to_location "ec CA certificate" \
+                          "${CA_CERT%.*}.ec.crt" \
+                          "${CA_CERT_LOCATION%.*}.crt" \
+                          "ec"
   fi
 fi
 
@@ -2570,7 +2583,7 @@ if [[ -n "$DOMAIN_CHAIN_LOCATION" ]]; then
   copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
     cat "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_chain.pem.ec"
-    copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
+    copy_file_to_location "full chain" "$TEMP_DIR/${DOMAIN}_chain.pem.ec"  "${to_location}" "ec"
   fi
 fi
 # if DOMAIN_KEY_CERT_LOCATION is not blank, then create and copy file.
@@ -2583,8 +2596,8 @@ if [[ -n "$DOMAIN_KEY_CERT_LOCATION" ]]; then
   cat "$DOMAIN_DIR/${DOMAIN}.key" "$CERT_FILE" > "$TEMP_DIR/${DOMAIN}_K_C.pem"
   copy_file_to_location "private key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
-  cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"
-  copy_file_to_location "private ec key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
+    cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}_K_C.pem.ec"
+    copy_file_to_location "private ec key and domain cert pem" "$TEMP_DIR/${DOMAIN}_K_C.pem.ec" "${to_location}" "ec"
   fi
 fi
 # if DOMAIN_PEM_LOCATION is not blank, then create and copy file.
@@ -2598,7 +2611,7 @@ if [[ -n "$DOMAIN_PEM_LOCATION" ]]; then
   copy_file_to_location "full key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem"  "$to_location"
   if [[ "$DUAL_RSA_ECDSA" == "true" ]]; then
     cat "$DOMAIN_DIR/${DOMAIN}.ec.key" "${CERT_FILE%.*}.ec.crt" "${CA_CERT%.*}.ec.crt" > "$TEMP_DIR/${DOMAIN}.pem.ec"
-    copy_file_to_location "full ec key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem.ec"  "${to_location%.*}.ec.${to_location##*.}"
+    copy_file_to_location "full ec key, cert and chain pem" "$TEMP_DIR/${DOMAIN}.pem.ec"  "${to_location}" "ec"
   fi
 fi
 # end of copying certs.
diff --git a/test/4-more-than-10-hosts.bats b/test/4-more-than-10-hosts.bats
index 01e364d..ff61d52 100644
--- a/test/4-more-than-10-hosts.bats
+++ b/test/4-more-than-10-hosts.bats
@@ -17,7 +17,7 @@ setup() {
 
     # Add 11 hosts to DNS (also need to be added as aliases in docker-compose.yml)
     for prefix in a b c d e f g h i j k; do
-        curl -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
+        curl --silent -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
     done
 
     init_getssl
@@ -39,6 +39,6 @@ setup() {
     # Remove all the dns aliases
     cleanup_environment
     for prefix in a b c d e f g h i j k; do
-        curl -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+        curl --silent -X POST -d '{"host":"'$prefix.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
     done
 }
diff --git a/test/6-dual-rsa-ecdsa-copy-2-locations.bats b/test/6-dual-rsa-ecdsa-copy-2-locations.bats
new file mode 100644
index 0000000..4e64043
--- /dev/null
+++ b/test/6-dual-rsa-ecdsa-copy-2-locations.bats
@@ -0,0 +1,40 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# These are run for every test, not once per file
+setup() {
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+    curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
+}
+
+
+teardown() {
+    curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+}
+
+
+@test "Create dual certificates and copy RSA and ECDSA chain and key to two locations" {
+    CONFIG_FILE="getssl-http01-dual-rsa-ecdsa-2-locations.cfg"
+    setup_environment
+    mkdir -p /root/a.${GETSSL_HOST}
+
+    init_getssl
+    create_certificate
+    assert_success
+
+    # Check that the RSA chain and key have been copied to both locations
+    assert [ -e "/etc/nginx/pki/domain-chain.crt" ]
+    assert [ -e "/root/a.${GETSSL_HOST}/domain-chain.crt" ]
+    assert [ -e "/etc/nginx/pki/private/server.key" ]
+    assert [ -e "/root/a.${GETSSL_HOST}/server.key" ]
+
+    # Check that the ECDSA chain and key have been copied to both locations
+    assert [ -e "/etc/nginx/pki/domain-chain.ec.crt" ]
+    assert [ -e "/root/a.${GETSSL_HOST}/domain-chain.ec.crt" ]
+    assert [ -e "/etc/nginx/pki/private/server.ec.key" ]
+    assert [ -e "/root/a.${GETSSL_HOST}/server.ec.key" ]
+}
diff --git a/test/debug-test.sh b/test/debug-test.sh
index 23d1983..ab00666 100644
--- a/test/debug-test.sh
+++ b/test/debug-test.sh
@@ -3,12 +3,22 @@
 # This runs getssl outside of the BATS framework for debugging, etc, against pebble
 # Usage: /getssl/test/debug-test.sh getssl-http01.cfg
 
+DEBUG=""
+if [ $# -eq 2 ]; then
+    DEBUG=$1
+    shift
+fi
+
 CONFIG_FILE=$1
+if [ ! -e "$CONFIG_FILE" ]; then
+    CONFIG_FILE=${CODE_DIR}/test/test-config/${CONFIG_FILE}
+fi
 source /getssl/test/test_helper.bash
 
 setup_environment 3>&1
 export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
 
 "${CODE_DIR}/getssl" -c "$GETSSL_HOST" 3>&1
-cp "${CODE_DIR}/test/test-config/${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
-"${CODE_DIR}/getssl" -f "$GETSSL_HOST" 3>&1
+cp "${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+# shellcheck disable=SC2086
+"${CODE_DIR}/getssl" ${DEBUG} -f "$GETSSL_HOST" 3>&1
diff --git a/test/run-all-tests.cmd b/test/run-all-tests.cmd
new file mode 100644
index 0000000..16c6fd5
--- /dev/null
+++ b/test/run-all-tests.cmd
@@ -0,0 +1,5 @@
+docker exec -it getssl-alpine bats /getssl/test
+docker exec -it getssl-centos6 bats /getssl/test
+docker exec -it getssl-debian bats /getssl/test
+docker exec -it getssl-ubuntu bats /getssl/test
+docker exec -it getssl-ubuntu18 bats /getssl/test
diff --git a/test/test-config/getssl-http01-dual-rsa-ecdsa-2-locations.cfg b/test/test-config/getssl-http01-dual-rsa-ecdsa-2-locations.cfg
new file mode 100644
index 0000000..80533ce
--- /dev/null
+++ b/test/test-config/getssl-http01-dual-rsa-ecdsa-2-locations.cfg
@@ -0,0 +1,32 @@
+# Test that more than one location can be specified for CERT and KEY locations and that the
+# files are copied to both locations when both RSA and ECDSA certificates are created
+#
+CA="https://pebble:14000/dir"
+
+DUAL_RSA_ECDSA="true"
+ACCOUNT_KEY_TYPE="prime256v1"
+PRIVATE_KEY_ALG="prime256v1"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS="a.${GETSSL_HOST}"
+
+# Acme Challenge Location.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="true"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key;/root/a.${GETSSL_HOST}/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="/etc/nginx/pki/domain-chain.crt;/root/a.${GETSSL_HOST}/domain-chain.crt" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed
+SERVER_TYPE="https"
+CHECK_REMOTE="true"
diff --git a/test/test_helper.bash b/test/test_helper.bash
index b33ee0b..554d60a 100644
--- a/test/test_helper.bash
+++ b/test/test_helper.bash
@@ -9,7 +9,7 @@ setup_environment() {
     fi
 
     if [ ! -f ${INSTALL_DIR}/pebble.minica.pem ]; then
-        wget --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem 2>&1
+        wget --quiet --no-clobber https://raw.githubusercontent.com/letsencrypt/pebble/master/test/certs/pebble.minica.pem 2>&1
         CERT_FILE=/etc/ssl/certs/ca-certificates.crt
         if [ ! -f $CERT_FILE ]; then
             CERT_FILE=/etc/pki/tls/certs/ca-bundle.crt
@@ -17,14 +17,14 @@ setup_environment() {
         cat $CERT_FILE ${INSTALL_DIR}/pebble.minica.pem > ${INSTALL_DIR}/pebble-ca-bundle.crt
     fi
 
-    curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/add-a
+    curl --silent -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/add-a
     cp ${CODE_DIR}/test/test-config/nginx-ubuntu-no-ssl "${NGINX_CONFIG}"
     /getssl/test/restart-nginx
 }
 
 
 cleanup_environment() {
-    curl -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/del-a
+    curl --silent -X POST -d '{"host":"'"$GETSSL_HOST"'", "addresses":["'"$GETSSL_IP"'"]}' http://10.30.50.3:8055/del-a
 }
 
 

From 535909bd3b54944d6292ed29a2c1e245c081c1a8 Mon Sep 17 00:00:00 2001
From: sergio <sergio@outerface.net>
Date: Fri, 21 Feb 2020 01:06:23 +0300
Subject: [PATCH 87/93] ${options} must be without quotes

---
 dns_scripts/dns_add_nsupdate | 2 +-
 dns_scripts/dns_del_nsupdate | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 13b0fc9..7a2f300 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -23,7 +23,7 @@ fi
 
 # Note that blank line is a "send" command to nsupdate
 
-nsupdate "${options}" -v <<EOF
+nsupdate ${options} -v <<EOF
 update add  _acme-challenge.${fulldomain}. 300 in TXT "${token}"
 
 EOF
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index e8442e3..d2ff048 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -23,7 +23,7 @@ fi
 
 # Note that blank line is a "send" command to nsupdate
 
-nsupdate "${options}" -v <<EOF
+nsupdate ${options} -v <<EOF
 update delete  "_acme-challenge.${fulldomain}." 300 in TXT "${token}"
 
 EOF

From 64d8405ede29a140668dd47719bfd8ce16c4e9eb Mon Sep 17 00:00:00 2001
From: sergio <sergio@outerface.net>
Date: Fri, 21 Feb 2020 01:30:55 +0300
Subject: [PATCH 88/93] indent correction

---
 dns_scripts/dns_add_nsupdate | 14 +++++++-------
 dns_scripts/dns_del_nsupdate | 14 +++++++-------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 7a2f300..7e0a722 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -14,11 +14,11 @@ token="$2"
 
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'open' "${fulldomain}" ; then
-        exit $(( $? + 128 ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'open' "${fulldomain}" ; then
+    exit $(( $? + 128 ))
+  fi
 
-    options="-k ${DNS_NSUPDATE_KEYFILE}"
+  options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
 # Note that blank line is a "send" command to nsupdate
@@ -31,9 +31,9 @@ EOF
 sts=$?
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'close'  "${fulldomain}"; then
-        exit $(( sts + ( $? * 10 ) ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'close'  "${fulldomain}"; then
+    exit $(( sts + ( $? * 10 ) ))
+  fi
 fi
 
 exit ${sts}
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index d2ff048..8e0f253 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -14,11 +14,11 @@ token="$2"
 #                          'open" / 'close'
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'open' "${fulldomain}" ; then
-        exit $(( $? + 128 ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'open' "${fulldomain}" ; then
+    exit $(( $? + 128 ))
+  fi
 
-    options="-k ${DNS_NSUPDATE_KEYFILE}"
+  options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
 # Note that blank line is a "send" command to nsupdate
@@ -31,9 +31,9 @@ EOF
 sts=$?
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'close'  "${fulldomain}" ; then
-        exit $(( sts + ( $? * 10 ) ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'close'  "${fulldomain}" ; then
+      exit $(( sts + ( $? * 10 ) ))
+  fi
 fi
 
 exit ${sts}

From b869824b49cc9e24e4592f75452a8b3b3527bf6d Mon Sep 17 00:00:00 2001
From: sergio <sergio@outerface.net>
Date: Fri, 21 Feb 2020 02:28:25 +0300
Subject: [PATCH 89/93] nsupdate scripts: add support for custom nameserver and
 zone

---
 dns_scripts/dns_add_nsupdate | 10 ++++++----
 dns_scripts/dns_del_nsupdate | 10 ++++++----
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 7e0a722..98f5e7f 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -21,12 +21,14 @@ if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
   options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
-# Note that blank line is a "send" command to nsupdate
+if [ -n "${DNS_SERVER}" ]; then
+        cmd+="server ${DNS_SERVER}\n"
+fi
 
-nsupdate ${options} -v <<EOF
-update add  _acme-challenge.${fulldomain}. 300 in TXT "${token}"
+cmd+="update add  ${DNS_ZONE:-"_acme-challenge.${fulldomain}."} 300 in TXT \"${token}\"\n"
+cmd+="\n" # blank line is a "send" command to nsupdate
 
-EOF
+printf "$cmd" | nsupdate ${options} -v
 
 sts=$?
 
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index 8e0f253..c0432b6 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -21,12 +21,14 @@ if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
   options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
-# Note that blank line is a "send" command to nsupdate
+if [ -n "${DNS_SERVER}" ]; then
+        cmd+="server ${DNS_SERVER}\n"
+fi
 
-nsupdate ${options} -v <<EOF
-update delete  "_acme-challenge.${fulldomain}." 300 in TXT "${token}"
+cmd+="update delete  ${DNS_ZONE:-"_acme-challenge.${fulldomain}."} 300 in TXT \"${token}\"\n"
+cmd+="\n" # blank line is a "send" command to nsupdate
 
-EOF
+printf "$cmd" | nsupdate ${options} -v
 
 sts=$?
 

From 896d55dd51720d73b3d13cbb3b2756c75f2777c8 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sat, 22 Feb 2020 18:02:21 +0000
Subject: [PATCH 90/93] Use openssl asn1parse in sign_string

---
 getssl | 80 ++++++++++++++++------------------------------------------
 1 file changed, 22 insertions(+), 58 deletions(-)

diff --git a/getssl b/getssl
index dbcd867..d64b276 100755
--- a/getssl
+++ b/getssl
@@ -339,7 +339,7 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
 
     # if ACME response is that their check gave an invalid response, error exit
     if [[ "$status" == "invalid" ]] ; then
-      err_detail=$(json_get "$response" detail)
+      err_detail=$(echo "$response" | grep "detail")
       error_exit "$domain:Verify error:$err_detail"
     fi
 
@@ -347,7 +347,8 @@ check_challenge_completion() { # checks with the ACME server if our challenge is
     if [[ "$status" == "pending" ]] ; then
       info "Pending"
     else
-      error_exit "$domain:Verify error:$response"
+      err_detail=$(echo "$response" | grep "detail")
+      error_exit "$domain:Verify error:$status:$err_detail"
     fi
     debug "sleep 5 secs before testing verify again"
     sleep 5
@@ -431,7 +432,7 @@ check_config() { # check the config files for all obvious errors
         info "${DOMAIN}: ACL location not specified for domain $d in $DOMAIN_DIR/getssl.cfg"
         config_errors=true
       fi
-      # check domain exist
+      # check domain exists
       if [[ "$DNS_CHECK_FUNC" == "drill" ]] || [[ "$DNS_CHECK_FUNC" == "dig" ]]; then
         if [[ "$($DNS_CHECK_FUNC "${d}" |grep -c "${d}")" -ge 1 ]]; then
           debug "found IP for ${d}"
@@ -1807,65 +1808,28 @@ sign_string() { # sign a string with a given key and algorithm and return urlbas
   if openssl rsa -in "${skey}" -noout 2>/dev/null ; then # RSA key
     signed64="$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" | urlbase64)"
   elif openssl ec -in "${skey}" -noout 2>/dev/null ; then # Elliptic curve key.
-    signed=$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" -hex | awk '{print $2}')
-    debug "EC signature $signed"
-    if [[ "${signed:4:4}" == "021f" ]]; then #sha256 which needs padding
-      R=$(echo -n 00;echo "$signed" | cut -c 9-70)
-      part2=$(echo "$signed" | cut -c 71-)
-    elif [[ "${signed:4:4}" == "0220" ]]; then #sha256
-      R=$(echo "$signed" | cut -c 9-72)
-      part2=$(echo "$signed" | cut -c 73-)
-    elif [[ "${signed:4:4}" == "0221" ]]; then #sha256 which needs trimming
-      R=$(echo "$signed" | cut -c 11-74)
-      part2=$(echo "$signed" | cut -c 75-)
-    elif [[ "${signed:4:4}" == "022f" ]]; then #sha384 which needs padding
-      info "Padding sha384"
-      R=$(echo -n 00;echo "$signed" | cut -c 9-102)
-      part2=$(echo "$signed" | cut -c 103-)
-    elif [[ "${signed:4:4}" == "0230" ]]; then #sha384
-      R=$(echo "$signed" | cut -c 9-104)
-      part2=$(echo "$signed" | cut -c 105-)
-    elif [[ "${signed:4:4}" == "0231" ]]; then #sha384 which needs trimming
-      R=$(echo "$signed" | cut -c 11-106)
-      part2=$(echo "$signed" | cut -c 107-)
-    elif [[ "${signed:6:4}" == "0240" ]]; then #sha512 which needs padding
-      R=$(echo -n 00;echo "$signed" | cut -c 9-138)
-      part2=$(echo "$signed" | cut -c 141-)
-    elif [[ "${signed:6:4}" == "0241" ]]; then #sha512 which needs padding
-      R=$(echo -n 00;echo "$signed" | cut -c 11-140)
-      part2=$(echo "$signed" | cut -c 141-)
-    elif [[ "${signed:6:4}" == "0242" ]]; then #sha512
-      R=$(echo "$signed" | cut -c 11-142)
-      part2=$(echo "$signed" | cut -c 143-)
+    # ECDSA signature width
+    # e.g. 521 bits requires 66 bytes to express, a signature consists of 2 integers so 132 bytes
+    # https://crypto.stackexchange.com/questions/12299/ecc-key-size-and-signature-size/
+    if [ "$signalg" = "sha256" ]; then
+      w=64
+    elif [ "$signalg" = "sha384" ]; then
+      w=96
+    elif [ "$signalg" = "sha512" ]; then
+      w=132
     else
-      error_exit "error in EC signing couldn't get R from $signed"
+      error_exit "Unknown signing algorithm $signalg"
     fi
+    asn1parse=$(printf '%s' "${str}" | openssl dgst -"$signalg" -sign "$key" | openssl asn1parse -inform DER)
+    #shellcheck disable=SC2086
+    R=$(echo $asn1parse | awk '{ print $13 }' | cut -c2-)
     debug "R $R"
-
-    if [[ "${part2:0:4}" == "021f" ]]; then #sha256 with padding
-      S=$(echo -n 00;echo "$part2" | cut -c 5-)
-    elif [[ "${part2:0:4}" == "0220" ]]; then #sha256
-      S=$(echo "$part2" | cut -c 5-68)
-    elif [[ "${part2:0:4}" == "0221" ]]; then #sha256
-      S=$(echo "$part2" | cut -c 7-70)
-    elif [[ "${part2:0:4}" == "022f" ]]; then #sha384 with padding
-      S=$(echo -n 00;echo "$part2" | cut -c 5-)
-    elif [[ "${part2:0:4}" == "0230" ]]; then #sha384
-      S=$(echo "$part2" | cut -c 5-100)
-    elif [[ "${part2:0:4}" == "0231" ]]; then #sha384
-      S=$(echo "$part2" | cut -c 7-102)
-    elif [[ "${part2:0:4}" == "0240" ]]; then #sha512 with padding
-      S=$(echo -n 00;echo "$part2" | cut -c 5-)
-    elif [[ "${part2:0:4}" == "0241" ]]; then #sha512 with padding
-      S=$(echo -n 00;echo "$part2" | cut -c 5-)
-    elif [[ "${part2:0:4}" == "0242" ]]; then #sha512
-      S=$(echo "$part2" | cut -c 5-)
-    else
-      error_exit "error in EC signing couldn't get S from $signed"
-    fi
-
+    #shellcheck disable=SC2086
+    S=$(echo $asn1parse | awk '{ print $20 }' | cut -c2-)
     debug "S $S"
-    signed64=$(printf '%s' "${R}${S}" | hex2bin | urlbase64 )
+
+    # pad R and S to the correct length for the signing algorithm
+    signed64=$(printf "%${w}s%${w}s" "${R}" "${S}" | tr ' ' '0' | hex2bin | urlbase64 )
     debug "encoded RS $signed64"
   fi
 }

From aa5eb90a6b8a54bf178c0b620b8c5ae8ebed4b91 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sat, 22 Feb 2020 18:04:45 +0000
Subject: [PATCH 91/93] Add tests using staging server

---
 dns_scripts/dns_add_duckdns                 |  19 ++++
 dns_scripts/dns_del_duckdns                 |  12 +++
 docker-compose.yml                          |  19 +++-
 test/1-simple-http01.bats                   |   7 +-
 test/2-simple-dns01.bats                    |   8 +-
 test/3-dual-rsa-ecdsa.bats                  |  14 ++-
 test/4-more-than-10-hosts.bats              |   7 +-
 test/5-secp384-http01.bats                  |  12 +++
 test/6-dual-rsa-ecdsa-copy-2-locations.bats |  13 ++-
 test/7-duckdns-dns01.bats                   |  42 ++++++++
 test/8-duckdns-ecdsa.bats                   | 103 ++++++++++++++++++++
 test/debug-test.sh                          |   8 +-
 test/run-all-tests.cmd                      |   1 +
 test/run-all-tests.sh                       |   1 +
 test/test-config/getssl-duckdns01.cfg       |  37 +++++++
 15 files changed, 293 insertions(+), 10 deletions(-)
 create mode 100644 dns_scripts/dns_add_duckdns
 create mode 100644 dns_scripts/dns_del_duckdns
 create mode 100644 test/7-duckdns-dns01.bats
 create mode 100644 test/8-duckdns-ecdsa.bats
 create mode 100644 test/test-config/getssl-duckdns01.cfg

diff --git a/dns_scripts/dns_add_duckdns b/dns_scripts/dns_add_duckdns
new file mode 100644
index 0000000..ef40efe
--- /dev/null
+++ b/dns_scripts/dns_add_duckdns
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+# need to add your Token for duckdns below
+token=${DUCKDNS_TOKEN:-}
+
+if [ -z "$token" ]; then
+    echo "DUCKDNS_TOKEN not set"
+    exit 1
+fi
+
+domain="$1"
+txtvalue="$2"
+
+response=$(curl --silent "https://www.duckdns.org/update?domains=${domain}&token=${token}&txt=${txtvalue}")
+if [ "$response" != "OK" ]; then
+    echo "Failed to update TXT record for ${domain} at duckdns.org (is the TOKEN valid?)"
+    echo "Response: $response"
+    exit 1
+fi
diff --git a/dns_scripts/dns_del_duckdns b/dns_scripts/dns_del_duckdns
new file mode 100644
index 0000000..b9b9f9f
--- /dev/null
+++ b/dns_scripts/dns_del_duckdns
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+# need to add your Token for duckdns below
+token=${DUCKDNS_TOKEN:-}
+domain="$1"
+
+response=$(curl --silent "https://www.duckdns.org/update?domains=${domain}&token=${token}&txt=&clear=true")
+if [ "$response" != "OK" ]; then
+    echo "Failed to update TXT record for ${domain} at duckdns.org (is the TOKEN valid?)"
+    echo "$response"
+    exit 1
+fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 09a4264..8f9e4cb 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -156,7 +156,24 @@ services:
           - i.ubuntu18.getssl.test
           - j.ubuntu18.getssl.test
           - k.ubuntu18.getssl.test
-
+  getssl-duckdns:
+    build:
+      context: .
+      dockerfile: test/Dockerfile-ubuntu
+    container_name: getssl-duckdns
+    volumes:
+      - .:/getssl
+    environment:
+      GETSSL_HOST: getssl.duckdns.org
+      GETSSL_IP: 10.30.50.15
+      NGINX_CONFIG: /etc/nginx/sites-enabled/default
+      DUCKDNS_TOKEN: $DUCKDNS_TOKEN
+      STAGING: "true"
+    networks:
+      acmenet:
+        ipv4_address: 10.30.50.15
+        aliases:
+           - getssl.duckdns.org
 
 
 networks:
diff --git a/test/1-simple-http01.bats b/test/1-simple-http01.bats
index 4c55304..fd96a8a 100644
--- a/test/1-simple-http01.bats
+++ b/test/1-simple-http01.bats
@@ -12,6 +12,9 @@ setup() {
 
 
 @test "Create new certificate using HTTP-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01.cfg"
     setup_environment
     init_getssl
@@ -24,7 +27,9 @@ setup() {
 
 
 @test "Force renewal of certificate using HTTP-01" {
-    #!FIXME test certificate has been updated
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
     refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
diff --git a/test/2-simple-dns01.bats b/test/2-simple-dns01.bats
index 9d9f44b..ffd0b9e 100644
--- a/test/2-simple-dns01.bats
+++ b/test/2-simple-dns01.bats
@@ -12,6 +12,10 @@ setup() {
 
 
 @test "Create new certificate using DNS-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
+
     CONFIG_FILE="getssl-dns01.cfg"
     setup_environment
     init_getssl
@@ -24,7 +28,9 @@ setup() {
 
 
 @test "Force renewal of certificate using DNS-01" {
-    #!FIXME test certificate has been updated
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
     refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
diff --git a/test/3-dual-rsa-ecdsa.bats b/test/3-dual-rsa-ecdsa.bats
index 2dc9257..7820a96 100644
--- a/test/3-dual-rsa-ecdsa.bats
+++ b/test/3-dual-rsa-ecdsa.bats
@@ -12,6 +12,9 @@ setup() {
 
 
 @test "Create dual certificates using HTTP-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01-dual-rsa-ecdsa.cfg"
     setup_environment
     init_getssl
@@ -21,12 +24,17 @@ setup() {
 
 
 @test "Force renewal of dual certificates using HTTP-01" {
-    #!FIXME test certificate has been updated
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
 }
 
 @test "Create dual certificates using DNS-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-dns01-dual-rsa-ecdsa.cfg"
     setup_environment
     init_getssl
@@ -36,7 +44,9 @@ setup() {
 
 
 @test "Force renewal of dual certificates using DNS-01" {
-    #!FIXME test certificate has been updated
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
     cleanup_environment
diff --git a/test/4-more-than-10-hosts.bats b/test/4-more-than-10-hosts.bats
index ff61d52..5bdfc2a 100644
--- a/test/4-more-than-10-hosts.bats
+++ b/test/4-more-than-10-hosts.bats
@@ -12,6 +12,9 @@ setup() {
 
 
 @test "Create certificates for more than 10 hosts using HTTP-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01-10-hosts.cfg"
     setup_environment
 
@@ -30,7 +33,9 @@ setup() {
 
 
 @test "Force renewal of more than 10 certificates using HTTP-01" {
-    #!FIXME test certificate has been updated
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
     refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
diff --git a/test/5-secp384-http01.bats b/test/5-secp384-http01.bats
index 9010d58..29da2da 100644
--- a/test/5-secp384-http01.bats
+++ b/test/5-secp384-http01.bats
@@ -12,6 +12,9 @@ setup() {
 
 
 @test "Create new secp384r1 certificate using HTTP-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01-secp384.cfg"
     setup_environment
     init_getssl
@@ -21,12 +24,18 @@ setup() {
 
 
 @test "Force renewal of secp384r1 certificate using HTTP-01" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
 }
 
 
 @test "Create new secp521r1 certificate using HTTP-01 verification" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01-secp521.cfg"
     setup_environment
     init_getssl
@@ -36,6 +45,9 @@ setup() {
 
 
 @test "Force renewal of secp521r1 certificate using HTTP-01" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     run ${CODE_DIR}/getssl -f $GETSSL_HOST
     assert_success
 }
diff --git a/test/6-dual-rsa-ecdsa-copy-2-locations.bats b/test/6-dual-rsa-ecdsa-copy-2-locations.bats
index 4e64043..aae21bb 100644
--- a/test/6-dual-rsa-ecdsa-copy-2-locations.bats
+++ b/test/6-dual-rsa-ecdsa-copy-2-locations.bats
@@ -7,17 +7,24 @@ load '/getssl/test/test_helper.bash'
 
 # These are run for every test, not once per file
 setup() {
-    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
-    curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
+    if [ -z "$STAGING" ]; then
+        export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+        curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/add-a
+    fi
 }
 
 
 teardown() {
-    curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+    if [ -z "$STAGING" ]; then
+        curl --silent -X POST -d '{"host":"'a.$GETSSL_HOST'", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+    fi
 }
 
 
 @test "Create dual certificates and copy RSA and ECDSA chain and key to two locations" {
+    if [ -n "$STAGING" ]; then
+        skip "Using staging server, skipping internal test"
+    fi
     CONFIG_FILE="getssl-http01-dual-rsa-ecdsa-2-locations.cfg"
     setup_environment
     mkdir -p /root/a.${GETSSL_HOST}
diff --git a/test/7-duckdns-dns01.bats b/test/7-duckdns-dns01.bats
new file mode 100644
index 0000000..e81b414
--- /dev/null
+++ b/test/7-duckdns-dns01.bats
@@ -0,0 +1,42 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# These are run for every test, not once per file
+setup() {
+    if [ -n "$STAGING" ]; then
+        export GETSSL_HOST=getssl.duckdns.org
+    fi
+}
+
+
+@test "Create new certificate using staging server and DuckDNS" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    CONFIG_FILE="getssl-duckdns01.cfg"
+
+    setup_environment
+    init_getssl
+    create_certificate
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+}
+
+@test "Force renewal of certificate using staging server and DuckDNS" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+    cleanup_environment
+    curl --silent -X POST -d '{"host":"getssl.duckdns.org", "addresses":["'$GETSSL_IP'"]}' http://10.30.50.3:8055/del-a
+}
diff --git a/test/8-duckdns-ecdsa.bats b/test/8-duckdns-ecdsa.bats
new file mode 100644
index 0000000..f50dd05
--- /dev/null
+++ b/test/8-duckdns-ecdsa.bats
@@ -0,0 +1,103 @@
+#! /usr/bin/env bats
+
+load '/bats-support/load.bash'
+load '/bats-assert/load.bash'
+load '/getssl/test/test_helper.bash'
+
+
+# These are run for every test, not once per file
+setup() {
+    if [ -n "$STAGING" ]; then
+        export GETSSL_HOST=getssl.duckdns.org
+    fi
+}
+
+
+@test "Create new certificate using staging server and prime256v1" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    CONFIG_FILE="getssl-duckdns01.cfg"
+    GETSSL_HOST=getssl.duckdns.org
+
+    setup_environment
+    init_getssl
+    sed -e 's/rsa/prime256v1/g' < "${CODE_DIR}/test/test-config/${CONFIG_FILE}" > "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+    run ${CODE_DIR}/getssl "$GETSSL_HOST"
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+}
+
+
+@test "Force renewal of certificate using staging server and prime256v1" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+    cleanup_environment
+}
+
+
+@test "Create new certificate using staging server and secp384r1" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    CONFIG_FILE="getssl-duckdns01.cfg"
+    GETSSL_HOST=getssl.duckdns.org
+
+    setup_environment
+    init_getssl
+    sed -e 's/rsa/secp384r1/g' < "${CODE_DIR}/test/test-config/${CONFIG_FILE}" > "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+    run ${CODE_DIR}/getssl "$GETSSL_HOST"
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+}
+
+
+@test "Force renewal of certificate using staging server and secp384r1" {
+    if [ -z "$STAGING" ]; then
+        skip "Running internal tests, skipping external test"
+    fi
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+    cleanup_environment
+}
+
+
+@test "Create new certificate using staging server and secp521r1" {
+    skip "The staging server returns 'ECDSA curve P-521 not allowed'"
+
+    CONFIG_FILE="getssl-duckdns01.cfg"
+    GETSSL_HOST=getssl.duckdns.org
+
+    setup_environment
+    init_getssl
+    sed -e 's/rsa/secp521r1/g' < "${CODE_DIR}/test/test-config/${CONFIG_FILE}" > "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
+    run ${CODE_DIR}/getssl "$GETSSL_HOST"
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+}
+
+
+@test "Force renewal of certificate using staging server and secp521r1" {
+    skip "The staging server returns 'ECDSA curve P-521 not allowed'"
+    run ${CODE_DIR}/getssl -f $GETSSL_HOST
+    assert_success
+    refute_output --regexp '[Ff][Aa][Ii][Ll][Ee][Dd]'
+    refute_output --regexp '[Ee][Rr][Rr][Oo][Rr]'
+    refute_output --regexp '[Ww][Aa][Rr][Nn][Ii][Nn][Gg]'
+    cleanup_environment
+}
diff --git a/test/debug-test.sh b/test/debug-test.sh
index ab00666..1327fde 100644
--- a/test/debug-test.sh
+++ b/test/debug-test.sh
@@ -13,10 +13,16 @@ CONFIG_FILE=$1
 if [ ! -e "$CONFIG_FILE" ]; then
     CONFIG_FILE=${CODE_DIR}/test/test-config/${CONFIG_FILE}
 fi
+
+#shellcheck disable=SC1091
 source /getssl/test/test_helper.bash
 
 setup_environment 3>&1
-export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+
+# Only add the pebble CA to the cert bundle if using pebble
+if [ "$(grep -q pebble "${CONFIG_FILE}")" = 0 ]; then
+    export CURL_CA_BUNDLE=/root/pebble-ca-bundle.crt
+fi
 
 "${CODE_DIR}/getssl" -c "$GETSSL_HOST" 3>&1
 cp "${CONFIG_FILE}" "${INSTALL_DIR}/.getssl/${GETSSL_HOST}/getssl.cfg"
diff --git a/test/run-all-tests.cmd b/test/run-all-tests.cmd
index 16c6fd5..2c5ff6c 100644
--- a/test/run-all-tests.cmd
+++ b/test/run-all-tests.cmd
@@ -3,3 +3,4 @@ docker exec -it getssl-centos6 bats /getssl/test
 docker exec -it getssl-debian bats /getssl/test
 docker exec -it getssl-ubuntu bats /getssl/test
 docker exec -it getssl-ubuntu18 bats /getssl/test
+docker exec -it getssl-duckdns bats /getssl/test
diff --git a/test/run-all-tests.sh b/test/run-all-tests.sh
index b526c63..6a0eb8a 100644
--- a/test/run-all-tests.sh
+++ b/test/run-all-tests.sh
@@ -5,3 +5,4 @@ docker exec -it getssl-centos6 bats /getssl/test
 docker exec -it getssl-debian bats /getssl/test
 docker exec -it getssl-ubuntu bats /getssl/test
 docker exec -it getssl-ubuntu18 bats /getssl/test
+docker exec -it getssl-duckdns bats /getssl/test
diff --git a/test/test-config/getssl-duckdns01.cfg b/test/test-config/getssl-duckdns01.cfg
new file mode 100644
index 0000000..4a37bcd
--- /dev/null
+++ b/test/test-config/getssl-duckdns01.cfg
@@ -0,0 +1,37 @@
+# Test that the script works with external dns provider and staging server
+#
+CA="https://acme-staging-v02.api.letsencrypt.org/directory"
+
+VALIDATE_VIA_DNS=true
+DNS_ADD_COMMAND="/getssl/dns_scripts/dns_add_duckdns"
+DNS_DEL_COMMAND="/getssl/dns_scripts/dns_del_duckdns"
+AUTH_DNS_SERVER=1.1.1.1
+CHECK_ALL_AUTH_DNS=false
+DNS_EXTRA_WAIT=20
+
+ACCOUNT_KEY_TYPE="rsa"
+PRIVATE_KEY_ALG="rsa"
+
+# Additional domains - this could be multiple domains / subdomains in a comma separated list
+SANS=""
+
+# Acme Challenge Location. The first line for the domain, the following ones for each additional domain.
+ACL=('/var/www/html/.well-known/acme-challenge')
+
+#Set USE_SINGLE_ACL="true" to use a single ACL for all checks
+USE_SINGLE_ACL="false"
+
+# Location for all your certs, these can either be on the server (full path name)
+# or using ssh /sftp as for the ACL
+DOMAIN_CERT_LOCATION="/etc/nginx/pki/server.crt"
+DOMAIN_KEY_LOCATION="/etc/nginx/pki/private/server.key"
+CA_CERT_LOCATION="/etc/nginx/pki/chain.crt"
+DOMAIN_CHAIN_LOCATION="" # this is the domain cert and CA cert
+DOMAIN_PEM_LOCATION="" # this is the domain_key, domain cert and CA cert
+
+# The command needed to reload apache / nginx or whatever you use
+RELOAD_CMD="cp /getssl/test/test-config/nginx-ubuntu-ssl ${NGINX_CONFIG} && /getssl/test/restart-nginx"
+
+# Define the server type and confirm correct certificate is installed (using a custom port)
+SERVER_TYPE="https"
+CHECK_REMOTE="true"

From 6fea6179baa512cc97b47aec37e1fb2385ea4f84 Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sat, 22 Feb 2020 18:08:42 +0000
Subject: [PATCH 92/93] Merge pull request #513 from 532910/nsupdate_options

---
 dns_scripts/dns_add_nsupdate | 24 +++++++++++++-----------
 dns_scripts/dns_del_nsupdate | 24 +++++++++++++-----------
 2 files changed, 26 insertions(+), 22 deletions(-)

diff --git a/dns_scripts/dns_add_nsupdate b/dns_scripts/dns_add_nsupdate
index 13b0fc9..98f5e7f 100755
--- a/dns_scripts/dns_add_nsupdate
+++ b/dns_scripts/dns_add_nsupdate
@@ -14,26 +14,28 @@ token="$2"
 
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'open' "${fulldomain}" ; then
-        exit $(( $? + 128 ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'open' "${fulldomain}" ; then
+    exit $(( $? + 128 ))
+  fi
 
-    options="-k ${DNS_NSUPDATE_KEYFILE}"
+  options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
-# Note that blank line is a "send" command to nsupdate
+if [ -n "${DNS_SERVER}" ]; then
+        cmd+="server ${DNS_SERVER}\n"
+fi
 
-nsupdate "${options}" -v <<EOF
-update add  _acme-challenge.${fulldomain}. 300 in TXT "${token}"
+cmd+="update add  ${DNS_ZONE:-"_acme-challenge.${fulldomain}."} 300 in TXT \"${token}\"\n"
+cmd+="\n" # blank line is a "send" command to nsupdate
 
-EOF
+printf "$cmd" | nsupdate ${options} -v
 
 sts=$?
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'close'  "${fulldomain}"; then
-        exit $(( sts + ( $? * 10 ) ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! ${DNS_NSUPDATE_KEY_HOOK} 'add' 'close'  "${fulldomain}"; then
+    exit $(( sts + ( $? * 10 ) ))
+  fi
 fi
 
 exit ${sts}
diff --git a/dns_scripts/dns_del_nsupdate b/dns_scripts/dns_del_nsupdate
index e8442e3..c0432b6 100755
--- a/dns_scripts/dns_del_nsupdate
+++ b/dns_scripts/dns_del_nsupdate
@@ -14,26 +14,28 @@ token="$2"
 #                          'open" / 'close'
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'open' "${fulldomain}" ; then
-        exit $(( $? + 128 ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'open' "${fulldomain}" ; then
+    exit $(( $? + 128 ))
+  fi
 
-    options="-k ${DNS_NSUPDATE_KEYFILE}"
+  options="-k ${DNS_NSUPDATE_KEYFILE}"
 fi
 
-# Note that blank line is a "send" command to nsupdate
+if [ -n "${DNS_SERVER}" ]; then
+        cmd+="server ${DNS_SERVER}\n"
+fi
 
-nsupdate "${options}" -v <<EOF
-update delete  "_acme-challenge.${fulldomain}." 300 in TXT "${token}"
+cmd+="update delete  ${DNS_ZONE:-"_acme-challenge.${fulldomain}."} 300 in TXT \"${token}\"\n"
+cmd+="\n" # blank line is a "send" command to nsupdate
 
-EOF
+printf "$cmd" | nsupdate ${options} -v
 
 sts=$?
 
 if [ -n "${DNS_NSUPDATE_KEYFILE}" ]; then
-    if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'close'  "${fulldomain}" ; then
-        exit $(( sts + ( $? * 10 ) ))
-    fi
+  if [ -n "${DNS_NSUPDATE_KEY_HOOK}" ] && ! "${DNS_NSUPDATE_KEY_HOOK}" 'del' 'close'  "${fulldomain}" ; then
+      exit $(( sts + ( $? * 10 ) ))
+  fi
 fi
 
 exit ${sts}

From 8d901d0437fb731ca2e7c4ade785d9f52bc6c2ba Mon Sep 17 00:00:00 2001
From: Tim Kimber <tkimber@mobius.org.uk>
Date: Sat, 22 Feb 2020 18:10:30 +0000
Subject: [PATCH 93/93] Update revision history

---
 getssl | 1 +
 1 file changed, 1 insertion(+)

diff --git a/getssl b/getssl
index d64b276..f6e3972 100755
--- a/getssl
+++ b/getssl
@@ -212,6 +212,7 @@
 # 2020-02-12 Fix #424 - Sporadic "error in EC signing couldn't get R from ..." (2.18)
 # 2020-02-12 Fix "Registration key already in use" (2.19)
 # 2020-02-13 Fix bug with copying to all locations when creating RSA and ECDSA certs (2.20)
+# 2020-02-22 Change sign_string to use openssl asn1parse (better fix for #424)
 # ----------------------------------------------------------------------------------------
 
 PROGNAME=${0##*/}