From f354e6de69f66c23b67cc29dd84baac06d2fe5d6 Mon Sep 17 00:00:00 2001
From: Michael Weber <mw@magneticflux.net>
Date: Sat, 6 Feb 2021 08:25:49 +0000
Subject: [PATCH 01/33] lighttpd deploy hook

* verbatim copy from haproxy.sh, s/haproxy/lighttpd
* enable issuer
---
 deploy/lighttpd.sh | 275 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 275 insertions(+)
 create mode 100644 deploy/lighttpd.sh

diff --git a/deploy/lighttpd.sh b/deploy/lighttpd.sh
new file mode 100644
index 00000000..c003f455
--- /dev/null
+++ b/deploy/lighttpd.sh
@@ -0,0 +1,275 @@
+#!/usr/bin/env sh
+
+# Script for acme.sh to deploy certificates to lighttpd
+#
+# The following variables can be exported:
+#
+# export DEPLOY_LIGHTTPD_PEM_NAME="${domain}.pem"
+#
+# Defines the name of the PEM file.
+# Defaults to "<domain>.pem"
+#
+# export DEPLOY_LIGHTTPD_PEM_PATH="/etc/lighttpd"
+#
+# Defines location of PEM file for Lighttpd.
+# Defaults to /etc/lighttpd
+#
+# export DEPLOY_LIGHTTPD_RELOAD="systemctl reload lighttpd"
+#
+# OPTIONAL: Reload command used post deploy
+# This defaults to be a no-op (ie "true").
+# It is strongly recommended to set this something that makes sense
+# for your distro.
+#
+# export DEPLOY_LIGHTTPD_ISSUER="yes"
+#
+# OPTIONAL: Places CA file as "${DEPLOY_LIGHTTPD_PEM}.issuer"
+# Note: Required for OCSP stapling to work
+#
+# export DEPLOY_LIGHTTPD_BUNDLE="no"
+#
+# OPTIONAL: Deploy this certificate as part of a multi-cert bundle
+# This adds a suffix to the certificate based on the certificate type
+# eg RSA certificates will have .rsa as a suffix to the file name
+# Lighttpd will load all certificates and provide one or the other
+# depending on client capabilities
+# Note: This functionality requires Lighttpd was compiled against
+# a version of OpenSSL that supports this.
+#
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+lighttpd_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  # Some defaults
+  DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT="/etc/lighttpd"
+  DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT="${_cdomain}.pem"
+  DEPLOY_LIGHTTPD_BUNDLE_DEFAULT="no"
+  DEPLOY_LIGHTTPD_ISSUER_DEFAULT="yes"
+  DEPLOY_LIGHTTPD_RELOAD_DEFAULT="true"
+
+  if [ -f "${DOMAIN_CONF}" ]; then
+    # shellcheck disable=SC1090
+    . "${DOMAIN_CONF}"
+  fi
+
+  _debug _cdomain "${_cdomain}"
+  _debug _ckey "${_ckey}"
+  _debug _ccert "${_ccert}"
+  _debug _cca "${_cca}"
+  _debug _cfullchain "${_cfullchain}"
+
+  # PEM_PATH is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT}"
+  if [ -n "${DEPLOY_LIGHTTPD_PEM_PATH}" ]; then
+    Le_Deploy_lighttpd_pem_path="${DEPLOY_LIGHTTPD_PEM_PATH}"
+    _savedomainconf Le_Deploy_lighttpd_pem_path "${Le_Deploy_lighttpd_pem_path}"
+  elif [ -z "${Le_Deploy_lighttpd_pem_path}" ]; then
+    Le_Deploy_lighttpd_pem_path="${DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT}"
+  fi
+
+  # Ensure PEM_PATH exists
+  if [ -d "${Le_Deploy_lighttpd_pem_path}" ]; then
+    _debug "PEM_PATH ${Le_Deploy_lighttpd_pem_path} exists"
+  else
+    _err "PEM_PATH ${Le_Deploy_lighttpd_pem_path} does not exist"
+    return 1
+  fi
+
+  # PEM_NAME is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT}"
+  if [ -n "${DEPLOY_LIGHTTPD_PEM_NAME}" ]; then
+    Le_Deploy_lighttpd_pem_name="${DEPLOY_LIGHTTPD_PEM_NAME}"
+    _savedomainconf Le_Deploy_lighttpd_pem_name "${Le_Deploy_lighttpd_pem_name}"
+  elif [ -z "${Le_Deploy_lighttpd_pem_name}" ]; then
+    Le_Deploy_lighttpd_pem_name="${DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT}"
+  fi
+
+  # BUNDLE is optional. If not provided then assume "${DEPLOY_LIGHTTPD_BUNDLE_DEFAULT}"
+  if [ -n "${DEPLOY_LIGHTTPD_BUNDLE}" ]; then
+    Le_Deploy_lighttpd_bundle="${DEPLOY_LIGHTTPD_BUNDLE}"
+    _savedomainconf Le_Deploy_lighttpd_bundle "${Le_Deploy_lighttpd_bundle}"
+  elif [ -z "${Le_Deploy_lighttpd_bundle}" ]; then
+    Le_Deploy_lighttpd_bundle="${DEPLOY_LIGHTTPD_BUNDLE_DEFAULT}"
+  fi
+
+  # ISSUER is optional. If not provided then assume "${DEPLOY_LIGHTTPD_ISSUER_DEFAULT}"
+  if [ -n "${DEPLOY_LIGHTTPD_ISSUER}" ]; then
+    Le_Deploy_lighttpd_issuer="${DEPLOY_LIGHTTPD_ISSUER}"
+    _savedomainconf Le_Deploy_lighttpd_issuer "${Le_Deploy_lighttpd_issuer}"
+  elif [ -z "${Le_Deploy_lighttpd_issuer}" ]; then
+    Le_Deploy_lighttpd_issuer="${DEPLOY_LIGHTTPD_ISSUER_DEFAULT}"
+  fi
+
+  # RELOAD is optional. If not provided then assume "${DEPLOY_LIGHTTPD_RELOAD_DEFAULT}"
+  if [ -n "${DEPLOY_LIGHTTPD_RELOAD}" ]; then
+    Le_Deploy_lighttpd_reload="${DEPLOY_LIGHTTPD_RELOAD}"
+    _savedomainconf Le_Deploy_lighttpd_reload "${Le_Deploy_lighttpd_reload}"
+  elif [ -z "${Le_Deploy_lighttpd_reload}" ]; then
+    Le_Deploy_lighttpd_reload="${DEPLOY_LIGHTTPD_RELOAD_DEFAULT}"
+  fi
+
+  # Set the suffix depending if we are creating a bundle or not
+  if [ "${Le_Deploy_lighttpd_bundle}" = "yes" ]; then
+    _info "Bundle creation requested"
+    # Initialise $Le_Keylength if its not already set
+    if [ -z "${Le_Keylength}" ]; then
+      Le_Keylength=""
+    fi
+    if _isEccKey "${Le_Keylength}"; then
+      _info "ECC key type detected"
+      _suffix=".ecdsa"
+    else
+      _info "RSA key type detected"
+      _suffix=".rsa"
+    fi
+  else
+    _suffix=""
+  fi
+  _debug _suffix "${_suffix}"
+
+  # Set variables for later
+  _pem="${Le_Deploy_lighttpd_pem_path}/${Le_Deploy_lighttpd_pem_name}${_suffix}"
+  _issuer="${_pem}.issuer"
+  _ocsp="${_pem}.ocsp"
+  _reload="${Le_Deploy_lighttpd_reload}"
+
+  _info "Deploying PEM file"
+  # Create a temporary PEM file
+  _temppem="$(_mktemp)"
+  _debug _temppem "${_temppem}"
+  cat "${_ckey}" "${_ccert}" "${_cca}" >"${_temppem}"
+  _ret="$?"
+
+  # Check that we could create the temporary file
+  if [ "${_ret}" != "0" ]; then
+    _err "Error code ${_ret} returned during PEM file creation"
+    [ -f "${_temppem}" ] && rm -f "${_temppem}"
+    return ${_ret}
+  fi
+
+  # Move PEM file into place
+  _info "Moving new certificate into place"
+  _debug _pem "${_pem}"
+  cat "${_temppem}" >"${_pem}"
+  _ret=$?
+
+  # Clean up temp file
+  [ -f "${_temppem}" ] && rm -f "${_temppem}"
+
+  # Deal with any failure of moving PEM file into place
+  if [ "${_ret}" != "0" ]; then
+    _err "Error code ${_ret} returned while moving new certificate into place"
+    return ${_ret}
+  fi
+
+  # Update .issuer file if requested
+  if [ "${Le_Deploy_lighttpd_issuer}" = "yes" ]; then
+    _info "Updating .issuer file"
+    _debug _issuer "${_issuer}"
+    cat "${_cca}" >"${_issuer}"
+    _ret="$?"
+
+    if [ "${_ret}" != "0" ]; then
+      _err "Error code ${_ret} returned while copying issuer/CA certificate into place"
+      return ${_ret}
+    fi
+  else
+    [ -f "${_issuer}" ] && _err "Issuer file update not requested but .issuer file exists"
+  fi
+
+  # Update .ocsp file if certificate was requested with --ocsp/--ocsp-must-staple option
+  if [ -z "${Le_OCSP_Staple}" ]; then
+    Le_OCSP_Staple="0"
+  fi
+  if [ "${Le_OCSP_Staple}" = "1" ]; then
+    _info "Updating OCSP stapling info"
+    _debug _ocsp "${_ocsp}"
+    _info "Extracting OCSP URL"
+    _ocsp_url=$(openssl x509 -noout -ocsp_uri -in "${_pem}")
+    _debug _ocsp_url "${_ocsp_url}"
+
+    # Only process OCSP if URL was present
+    if [ "${_ocsp_url}" != "" ]; then
+      # Extract the hostname from the OCSP URL
+      _info "Extracting OCSP URL"
+      _ocsp_host=$(echo "${_ocsp_url}" | cut -d/ -f3)
+      _debug _ocsp_host "${_ocsp_host}"
+
+      # Only process the certificate if we have a .issuer file
+      if [ -r "${_issuer}" ]; then
+        # Check if issuer cert is also a root CA cert
+        _subjectdn=$(openssl x509 -in "${_issuer}" -subject -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _debug _subjectdn "${_subjectdn}"
+        _issuerdn=$(openssl x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _debug _issuerdn "${_issuerdn}"
+        _info "Requesting OCSP response"
+        # If the issuer is a CA cert then our command line has "-CAfile" added
+        if [ "${_subjectdn}" = "${_issuerdn}" ]; then
+          _cafile_argument="-CAfile \"${_issuer}\""
+        else
+          _cafile_argument=""
+        fi
+        _debug _cafile_argument "${_cafile_argument}"
+        # if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
+        _openssl_version=$(openssl version | cut -d' ' -f2)
+        _debug _openssl_version "${_openssl_version}"
+        _openssl_major=$(echo "${_openssl_version}" | cut -d '.' -f1)
+        _openssl_minor=$(echo "${_openssl_version}" | cut -d '.' -f2)
+        if [ "${_openssl_major}" -eq "1" ] && [ "${_openssl_minor}" -ge "1" ] || [ "${_openssl_major}" -ge "2" ]; then
+          _header_sep="="
+        else
+          _header_sep=" "
+        fi
+        # Request the OCSP response from the issuer and store it
+        _openssl_ocsp_cmd="openssl ocsp \
+          -issuer \"${_issuer}\" \
+          -cert \"${_pem}\" \
+          -url \"${_ocsp_url}\" \
+          -header Host${_header_sep}\"${_ocsp_host}\" \
+          -respout \"${_ocsp}\" \
+          -verify_other \"${_issuer}\" \
+          ${_cafile_argument} \
+          | grep -q \"${_pem}: good\""
+        _debug _openssl_ocsp_cmd "${_openssl_ocsp_cmd}"
+        eval "${_openssl_ocsp_cmd}"
+        _ret=$?
+      else
+        # Non fatal: No issuer file was present so no OCSP stapling file created
+        _err "OCSP stapling in use but no .issuer file was present"
+      fi
+    else
+      # Non fatal: No OCSP url was found int the certificate
+      _err "OCSP update requested but no OCSP URL was found in certificate"
+    fi
+
+    # Non fatal: Check return code of openssl command
+    if [ "${_ret}" != "0" ]; then
+      _err "Updating OCSP stapling failed with return code ${_ret}"
+    fi
+  else
+    # An OCSP file was already present but certificate did not have OCSP extension
+    if [ -f "${_ocsp}" ]; then
+      _err "OCSP was not requested but .ocsp file exists."
+      # Could remove the file at this step, although Lighttpd just ignores it in this case
+      # rm -f "${_ocsp}" || _err "Problem removing stale .ocsp file"
+    fi
+  fi
+
+  # Reload Lighttpd
+  _debug _reload "${_reload}"
+  eval "${_reload}"
+  _ret=$?
+  if [ "${_ret}" != "0" ]; then
+    _err "Error code ${_ret} during reload"
+    return ${_ret}
+  else
+    _info "Reload successful"
+  fi
+
+  return 0
+}

From c43c711f720c672e2662e3d0c37cbcca44407e7a Mon Sep 17 00:00:00 2001
From: Glenn Strauss <gstrauss@gluelogic.com>
Date: Wed, 1 Sep 2021 16:36:11 -0400
Subject: [PATCH 02/33] use _getdeployconf instead of sourcing DOMAIN_CONF

(requested by @Neilpang in #3394)

github: closes #3394
---
 deploy/haproxy.sh  | 15 ++++++++++-----
 deploy/lighttpd.sh | 15 ++++++++++-----
 deploy/ssh.sh      | 27 ++++++++++++++++++++++-----
 3 files changed, 42 insertions(+), 15 deletions(-)

diff --git a/deploy/haproxy.sh b/deploy/haproxy.sh
index 0a45ee07..4497c34b 100644
--- a/deploy/haproxy.sh
+++ b/deploy/haproxy.sh
@@ -54,11 +54,6 @@ haproxy_deploy() {
   DEPLOY_HAPROXY_ISSUER_DEFAULT="no"
   DEPLOY_HAPROXY_RELOAD_DEFAULT="true"
 
-  if [ -f "${DOMAIN_CONF}" ]; then
-    # shellcheck disable=SC1090
-    . "${DOMAIN_CONF}"
-  fi
-
   _debug _cdomain "${_cdomain}"
   _debug _ckey "${_ckey}"
   _debug _ccert "${_ccert}"
@@ -66,6 +61,8 @@ haproxy_deploy() {
   _debug _cfullchain "${_cfullchain}"
 
   # PEM_PATH is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_PATH_DEFAULT}"
+  _getdeployconf DEPLOY_HAPROXY_PEM_PATH
+  _debug2 DEPLOY_HAPROXY_PEM_PATH "${DEPLOY_HAPROXY_PEM_PATH}"
   if [ -n "${DEPLOY_HAPROXY_PEM_PATH}" ]; then
     Le_Deploy_haproxy_pem_path="${DEPLOY_HAPROXY_PEM_PATH}"
     _savedomainconf Le_Deploy_haproxy_pem_path "${Le_Deploy_haproxy_pem_path}"
@@ -82,6 +79,8 @@ haproxy_deploy() {
   fi
 
   # PEM_NAME is optional. If not provided then assume "${DEPLOY_HAPROXY_PEM_NAME_DEFAULT}"
+  _getdeployconf DEPLOY_HAPROXY_PEM_NAME
+  _debug2 DEPLOY_HAPROXY_PEM_NAME "${DEPLOY_HAPROXY_PEM_NAME}"
   if [ -n "${DEPLOY_HAPROXY_PEM_NAME}" ]; then
     Le_Deploy_haproxy_pem_name="${DEPLOY_HAPROXY_PEM_NAME}"
     _savedomainconf Le_Deploy_haproxy_pem_name "${Le_Deploy_haproxy_pem_name}"
@@ -90,6 +89,8 @@ haproxy_deploy() {
   fi
 
   # BUNDLE is optional. If not provided then assume "${DEPLOY_HAPROXY_BUNDLE_DEFAULT}"
+  _getdeployconf DEPLOY_HAPROXY_BUNDLE
+  _debug2 DEPLOY_HAPROXY_BUNDLE "${DEPLOY_HAPROXY_BUNDLE}"
   if [ -n "${DEPLOY_HAPROXY_BUNDLE}" ]; then
     Le_Deploy_haproxy_bundle="${DEPLOY_HAPROXY_BUNDLE}"
     _savedomainconf Le_Deploy_haproxy_bundle "${Le_Deploy_haproxy_bundle}"
@@ -98,6 +99,8 @@ haproxy_deploy() {
   fi
 
   # ISSUER is optional. If not provided then assume "${DEPLOY_HAPROXY_ISSUER_DEFAULT}"
+  _getdeployconf DEPLOY_HAPROXY_ISSUER
+  _debug2 DEPLOY_HAPROXY_ISSUER "${DEPLOY_HAPROXY_ISSUER}"
   if [ -n "${DEPLOY_HAPROXY_ISSUER}" ]; then
     Le_Deploy_haproxy_issuer="${DEPLOY_HAPROXY_ISSUER}"
     _savedomainconf Le_Deploy_haproxy_issuer "${Le_Deploy_haproxy_issuer}"
@@ -106,6 +109,8 @@ haproxy_deploy() {
   fi
 
   # RELOAD is optional. If not provided then assume "${DEPLOY_HAPROXY_RELOAD_DEFAULT}"
+  _getdeployconf DEPLOY_HAPROXY_RELOAD
+  _debug2 DEPLOY_HAPROXY_RELOAD "${DEPLOY_HAPROXY_RELOAD}"
   if [ -n "${DEPLOY_HAPROXY_RELOAD}" ]; then
     Le_Deploy_haproxy_reload="${DEPLOY_HAPROXY_RELOAD}"
     _savedomainconf Le_Deploy_haproxy_reload "${Le_Deploy_haproxy_reload}"
diff --git a/deploy/lighttpd.sh b/deploy/lighttpd.sh
index c003f455..e28cd27a 100644
--- a/deploy/lighttpd.sh
+++ b/deploy/lighttpd.sh
@@ -54,11 +54,6 @@ lighttpd_deploy() {
   DEPLOY_LIGHTTPD_ISSUER_DEFAULT="yes"
   DEPLOY_LIGHTTPD_RELOAD_DEFAULT="true"
 
-  if [ -f "${DOMAIN_CONF}" ]; then
-    # shellcheck disable=SC1090
-    . "${DOMAIN_CONF}"
-  fi
-
   _debug _cdomain "${_cdomain}"
   _debug _ckey "${_ckey}"
   _debug _ccert "${_ccert}"
@@ -66,6 +61,8 @@ lighttpd_deploy() {
   _debug _cfullchain "${_cfullchain}"
 
   # PEM_PATH is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_PATH_DEFAULT}"
+  _getdeployconf DEPLOY_LIGHTTPD_PEM_PATH
+  _debug2 DEPLOY_LIGHTTPD_PEM_PATH "${DEPLOY_LIGHTTPD_PEM_PATH}"
   if [ -n "${DEPLOY_LIGHTTPD_PEM_PATH}" ]; then
     Le_Deploy_lighttpd_pem_path="${DEPLOY_LIGHTTPD_PEM_PATH}"
     _savedomainconf Le_Deploy_lighttpd_pem_path "${Le_Deploy_lighttpd_pem_path}"
@@ -82,6 +79,8 @@ lighttpd_deploy() {
   fi
 
   # PEM_NAME is optional. If not provided then assume "${DEPLOY_LIGHTTPD_PEM_NAME_DEFAULT}"
+  _getdeployconf DEPLOY_LIGHTTPD_PEM_NAME
+  _debug2 DEPLOY_LIGHTTPD_PEM_NAME "${DEPLOY_LIGHTTPD_PEM_NAME}"
   if [ -n "${DEPLOY_LIGHTTPD_PEM_NAME}" ]; then
     Le_Deploy_lighttpd_pem_name="${DEPLOY_LIGHTTPD_PEM_NAME}"
     _savedomainconf Le_Deploy_lighttpd_pem_name "${Le_Deploy_lighttpd_pem_name}"
@@ -90,6 +89,8 @@ lighttpd_deploy() {
   fi
 
   # BUNDLE is optional. If not provided then assume "${DEPLOY_LIGHTTPD_BUNDLE_DEFAULT}"
+  _getdeployconf DEPLOY_LIGHTTPD_BUNDLE
+  _debug2 DEPLOY_LIGHTTPD_BUNDLE "${DEPLOY_LIGHTTPD_BUNDLE}"
   if [ -n "${DEPLOY_LIGHTTPD_BUNDLE}" ]; then
     Le_Deploy_lighttpd_bundle="${DEPLOY_LIGHTTPD_BUNDLE}"
     _savedomainconf Le_Deploy_lighttpd_bundle "${Le_Deploy_lighttpd_bundle}"
@@ -98,6 +99,8 @@ lighttpd_deploy() {
   fi
 
   # ISSUER is optional. If not provided then assume "${DEPLOY_LIGHTTPD_ISSUER_DEFAULT}"
+  _getdeployconf DEPLOY_LIGHTTPD_ISSUER
+  _debug2 DEPLOY_LIGHTTPD_ISSUER "${DEPLOY_LIGHTTPD_ISSUER}"
   if [ -n "${DEPLOY_LIGHTTPD_ISSUER}" ]; then
     Le_Deploy_lighttpd_issuer="${DEPLOY_LIGHTTPD_ISSUER}"
     _savedomainconf Le_Deploy_lighttpd_issuer "${Le_Deploy_lighttpd_issuer}"
@@ -106,6 +109,8 @@ lighttpd_deploy() {
   fi
 
   # RELOAD is optional. If not provided then assume "${DEPLOY_LIGHTTPD_RELOAD_DEFAULT}"
+  _getdeployconf DEPLOY_LIGHTTPD_RELOAD
+  _debug2 DEPLOY_LIGHTTPD_RELOAD "${DEPLOY_LIGHTTPD_RELOAD}"
   if [ -n "${DEPLOY_LIGHTTPD_RELOAD}" ]; then
     Le_Deploy_lighttpd_reload="${DEPLOY_LIGHTTPD_RELOAD}"
     _savedomainconf Le_Deploy_lighttpd_reload "${Le_Deploy_lighttpd_reload}"
diff --git a/deploy/ssh.sh b/deploy/ssh.sh
index 18de4aa6..89962621 100644
--- a/deploy/ssh.sh
+++ b/deploy/ssh.sh
@@ -35,11 +35,6 @@ ssh_deploy() {
   _cfullchain="$5"
   _deploy_ssh_servers=""
 
-  if [ -f "$DOMAIN_CONF" ]; then
-    # shellcheck disable=SC1090
-    . "$DOMAIN_CONF"
-  fi
-
   _debug _cdomain "$_cdomain"
   _debug _ckey "$_ckey"
   _debug _ccert "$_ccert"
@@ -47,6 +42,8 @@ ssh_deploy() {
   _debug _cfullchain "$_cfullchain"
 
   # USER is required to login by SSH to remote host.
+  _getdeployconf DEPLOY_SSH_USER
+  _debug2 DEPLOY_SSH_USER "$DEPLOY_SSH_USER"
   if [ -z "$DEPLOY_SSH_USER" ]; then
     if [ -z "$Le_Deploy_ssh_user" ]; then
       _err "DEPLOY_SSH_USER not defined."
@@ -58,6 +55,8 @@ ssh_deploy() {
   fi
 
   # SERVER is optional. If not provided then use _cdomain
+  _getdeployconf DEPLOY_SSH_SERVER
+  _debug2 DEPLOY_SSH_SERVER "$DEPLOY_SSH_SERVER"
   if [ -n "$DEPLOY_SSH_SERVER" ]; then
     Le_Deploy_ssh_server="$DEPLOY_SSH_SERVER"
     _savedomainconf Le_Deploy_ssh_server "$Le_Deploy_ssh_server"
@@ -66,6 +65,8 @@ ssh_deploy() {
   fi
 
   # CMD is optional. If not provided then use ssh
+  _getdeployconf DEPLOY_SSH_CMD
+  _debug2 DEPLOY_SSH_CMD "$DEPLOY_SSH_CMD"
   if [ -n "$DEPLOY_SSH_CMD" ]; then
     Le_Deploy_ssh_cmd="$DEPLOY_SSH_CMD"
     _savedomainconf Le_Deploy_ssh_cmd "$Le_Deploy_ssh_cmd"
@@ -74,6 +75,8 @@ ssh_deploy() {
   fi
 
   # BACKUP is optional. If not provided then default to previously saved value or yes.
+  _getdeployconf DEPLOY_SSH_BACKUP
+  _debug2 DEPLOY_SSH_BACKUP "$DEPLOY_SSH_BACKUP"
   if [ "$DEPLOY_SSH_BACKUP" = "no" ]; then
     Le_Deploy_ssh_backup="no"
   elif [ -z "$Le_Deploy_ssh_backup" ] || [ "$DEPLOY_SSH_BACKUP" = "yes" ]; then
@@ -82,6 +85,8 @@ ssh_deploy() {
   _savedomainconf Le_Deploy_ssh_backup "$Le_Deploy_ssh_backup"
 
   # BACKUP_PATH is optional. If not provided then default to previously saved value or .acme_ssh_deploy
+  _getdeployconf DEPLOY_SSH_BACKUP_PATH
+  _debug2 DEPLOY_SSH_BACKUP_PATH "$DEPLOY_SSH_BACKUP_PATH"
   if [ -n "$DEPLOY_SSH_BACKUP_PATH" ]; then
     Le_Deploy_ssh_backup_path="$DEPLOY_SSH_BACKUP_PATH"
   elif [ -z "$Le_Deploy_ssh_backup_path" ]; then
@@ -91,6 +96,8 @@ ssh_deploy() {
 
   # MULTI_CALL is optional. If not provided then default to previously saved
   # value (which may be undefined... equivalent to "no").
+  _getdeployconf DEPLOY_SSH_MULTI_CALL
+  _debug2 DEPLOY_SSH_MULTI_CALL "$DEPLOY_SSH_MULTI_CALL"
   if [ "$DEPLOY_SSH_MULTI_CALL" = "yes" ]; then
     Le_Deploy_ssh_multi_call="yes"
     _savedomainconf Le_Deploy_ssh_multi_call "$Le_Deploy_ssh_multi_call"
@@ -141,6 +148,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 
   # KEYFILE is optional.
   # If provided then private key will be copied to provided filename.
+  _getdeployconf DEPLOY_SSH_KEYFILE
+  _debug2 DEPLOY_SSH_KEYFILE "$DEPLOY_SSH_KEYFILE"
   if [ -n "$DEPLOY_SSH_KEYFILE" ]; then
     Le_Deploy_ssh_keyfile="$DEPLOY_SSH_KEYFILE"
     _savedomainconf Le_Deploy_ssh_keyfile "$Le_Deploy_ssh_keyfile"
@@ -163,6 +172,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 
   # CERTFILE is optional.
   # If provided then certificate will be copied or appended to provided filename.
+  _getdeployconf DEPLOY_SSH_CERTFILE
+  _debug2 DEPLOY_SSH_CERTFILE "$DEPLOY_SSH_CERTFILE"
   if [ -n "$DEPLOY_SSH_CERTFILE" ]; then
     Le_Deploy_ssh_certfile="$DEPLOY_SSH_CERTFILE"
     _savedomainconf Le_Deploy_ssh_certfile "$Le_Deploy_ssh_certfile"
@@ -189,6 +200,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 
   # CAFILE is optional.
   # If provided then CA intermediate certificate will be copied or appended to provided filename.
+  _getdeployconf DEPLOY_SSH_CAFILE
+  _debug2 DEPLOY_SSH_CAFILE "$DEPLOY_SSH_CAFILE"
   if [ -n "$DEPLOY_SSH_CAFILE" ]; then
     Le_Deploy_ssh_cafile="$DEPLOY_SSH_CAFILE"
     _savedomainconf Le_Deploy_ssh_cafile "$Le_Deploy_ssh_cafile"
@@ -216,6 +229,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 
   # FULLCHAIN is optional.
   # If provided then fullchain certificate will be copied or appended to provided filename.
+  _getdeployconf DEPLOY_SSH_FULLCHAIN
+  _debug2 DEPLOY_SSH_FULLCHAIN "$DEPLOY_SSH_FULLCHAIN"
   if [ -n "$DEPLOY_SSH_FULLCHAIN" ]; then
     Le_Deploy_ssh_fullchain="$DEPLOY_SSH_FULLCHAIN"
     _savedomainconf Le_Deploy_ssh_fullchain "$Le_Deploy_ssh_fullchain"
@@ -244,6 +259,8 @@ then rm -rf \"\$fn\"; echo \"Backup \$fn deleted as older than 180 days\"; fi; d
 
   # REMOTE_CMD is optional.
   # If provided then this command will be executed on remote host.
+  _getdeployconf DEPLOY_SSH_REMOTE_CMD
+  _debug2 DEPLOY_SSH_REMOTE_CMD "$DEPLOY_SSH_REMOTE_CMD"
   if [ -n "$DEPLOY_SSH_REMOTE_CMD" ]; then
     Le_Deploy_ssh_remote_cmd="$DEPLOY_SSH_REMOTE_CMD"
     _savedomainconf Le_Deploy_ssh_remote_cmd "$Le_Deploy_ssh_remote_cmd"

From 2447fccf1eed45ef654e1ef60a9ffa5df1db96f0 Mon Sep 17 00:00:00 2001
From: Nookery <nooks@qq.com>
Date: Sat, 4 Sep 2021 16:59:50 +0800
Subject: [PATCH 03/33] name="snis" => name="snis[]"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kong 2.5.x，snis参数是一个数组
---
 deploy/kong.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/kong.sh b/deploy/kong.sh
index 1e1e310c..b8facedf 100755
--- a/deploy/kong.sh
+++ b/deploy/kong.sh
@@ -45,7 +45,7 @@ kong_deploy() {
   #Generate data for request (Multipart/form-data with mixed content)
   if [ -z "$ssl_uuid" ]; then
     #set sni to domain
-    content="--$delim${nl}Content-Disposition: form-data; name=\"snis\"${nl}${nl}$_cdomain"
+    content="--$delim${nl}Content-Disposition: form-data; name=\"snis[]\"${nl}${nl}$_cdomain"
   fi
   #add key
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"

From 1064c270d96050ed829e832392fef8cc54cc4b33 Mon Sep 17 00:00:00 2001
From: Philipp B <16269108+TheTyrius@users.noreply.github.com>
Date: Mon, 6 Sep 2021 17:01:31 +0200
Subject: [PATCH 04/33] Fix variable name

Wrong variable name was used in login() and logout(), preventing operation.
---
 dnsapi/dns_netcup.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_netcup.sh b/dnsapi/dns_netcup.sh
index d519e4f7..776fa02d 100644
--- a/dnsapi/dns_netcup.sh
+++ b/dnsapi/dns_netcup.sh
@@ -119,16 +119,16 @@ login() {
   tmp=$(_post "{\"action\": \"login\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apipassword\": \"$NC_Apipw\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
   sid=$(echo "$tmp" | tr '{}' '\n' | grep apisessionid | cut -d '"' -f 4)
   _debug "$tmp"
-  if [ "$(_getfield "$msg" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
-    _err "$msg"
+  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
+    _err "$tmp"
     return 1
   fi
 }
 logout() {
   tmp=$(_post "{\"action\": \"logout\", \"param\": {\"apikey\": \"$NC_Apikey\", \"apisessionid\": \"$sid\", \"customernumber\": \"$NC_CID\"}}" "$end" "" "POST")
   _debug "$tmp"
-  if [ "$(_getfield "$msg" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
-    _err "$msg"
+  if [ "$(_getfield "$tmp" "4" | sed s/\"status\":\"//g | sed s/\"//g)" != "success" ]; then
+    _err "$tmp"
     return 1
   fi
 }

From d317b49940adc07fc33f0d2cf0f011e4f1da0e03 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Wed, 8 Sep 2021 22:48:43 -0400
Subject: [PATCH 05/33] use head instead of tail so that the sessionid cookie
 gets set correctly

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index d720c1c5..4d5549ab 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -150,7 +150,7 @@ _1984hosting_login() {
   _debug2 response "$response"
 
   if _contains "$response" '"loggedin": true'; then
-    One984HOSTING_COOKIE="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _tail_n 1 | _egrep_o 'sessionid=[^;]*;' | tr -d ';')"
+    One984HOSTING_COOKIE="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _head_n 1 | _egrep_o 'sessionid=[^;]*;' | tr -d ';')"
     export One984HOSTING_COOKIE
     _saveaccountconf_mutable One984HOSTING_COOKIE "$One984HOSTING_COOKIE"
     return 0

From 1312ef7e504c8bbac7c95c1acb0fd29032d36b5e Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Fri, 10 Sep 2021 07:25:18 -0400
Subject: [PATCH 06/33] simplify One984HOSTING_COOKIE grep

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 33c9bb2a..a9eb9dd2 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -150,7 +150,7 @@ _1984hosting_login() {
   _debug2 response "$response"
 
   if _contains "$response" '"loggedin": true'; then
-    One984HOSTING_COOKIE="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _head_n 1 | _egrep_o 'sessionid=[^;]*;' | tr -d ';')"
+    One984HOSTING_COOKIE="$(grep -io 'sessionid=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
     export One984HOSTING_COOKIE
     _saveaccountconf_mutable One984HOSTING_COOKIE "$One984HOSTING_COOKIE"
     return 0

From 92f13eb8bf329523e618b32e97283cb4bf392126 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Fri, 10 Sep 2021 08:02:13 -0400
Subject: [PATCH 07/33] get both the CSRF token and session ID cookies, as they
 are both needed for login now

---
 dnsapi/dns_1984hosting.sh | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index a9eb9dd2..62448754 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -135,7 +135,7 @@ dns_1984hosting_rm() {
 _1984hosting_login() {
   if ! _check_credentials; then return 1; fi
 
-  if _check_cookie; then
+  if _check_cookies; then
     _debug "Already logged in"
     return 0
   fi
@@ -150,9 +150,12 @@ _1984hosting_login() {
   _debug2 response "$response"
 
   if _contains "$response" '"loggedin": true'; then
-    One984HOSTING_COOKIE="$(grep -io 'sessionid=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
-    export One984HOSTING_COOKIE
-    _saveaccountconf_mutable One984HOSTING_COOKIE "$One984HOSTING_COOKIE"
+    One984HOSTING_SESSIONID_COOKIE="$(grep -io 'sessionid=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
+    One984HOSTING_CSRFTOKEN_COOKIE="$(grep -io 'csrftoken=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
+    export One984HOSTING_SESSIONID_COOKIE
+    export One984HOSTING_CSRFTOKEN_COOKIE
+    _saveaccountconf_mutable One984HOSTING_SESSIONID_COOKIE "$One984HOSTING_SESSIONID_COOKIE"
+    _saveaccountconf_mutable One984HOSTING_CSRFTOKEN_COOKIE "$One984HOSTING_CSRFTOKEN_COOKIE"
     return 0
   fi
   return 1
@@ -169,21 +172,24 @@ _check_credentials() {
   return 0
 }
 
-_check_cookie() {
-  One984HOSTING_COOKIE="${One984HOSTING_COOKIE:-$(_readaccountconf_mutable One984HOSTING_COOKIE)}"
-  if [ -z "$One984HOSTING_COOKIE" ]; then
-    _debug "No cached cookie found"
+_check_cookies() {
+  One984HOSTING_SESSIONID_COOKIE="${One984HOSTING_SESSIONID_COOKIE:-$(_readaccountconf_mutable One984HOSTING_SESSIONID_COOKIE)}"
+  One984HOSTING_CSRFTOKEN_COOKIE="${One984HOSTING_CSRFTOKEN_COOKIE:-$(_readaccountconf_mutable One984HOSTING_CSRFTOKEN_COOKIE)}"
+  if [ -z "$One984HOSTING_SESSIONID_COOKIE" ] || [ -z "$One984HOSTING_CSRFTOKEN_COOKIE" ]; then
+    _debug "No cached cookie(s) found"
     return 1
   fi
 
   _authget "https://management.1984hosting.com/accounts/loginstatus/"
   if _contains "$response" '"ok": true'; then
-    _debug "Cached cookie still valid"
+    _debug "Cached cookies still valid"
     return 0
   fi
-  _debug "Cached cookie no longer valid"
-  One984HOSTING_COOKIE=""
-  _saveaccountconf_mutable One984HOSTING_COOKIE "$One984HOSTING_COOKIE"
+  _debug "Cached cookies no longer valid"
+  One984HOSTING_SESSIONID_COOKIE=""
+  One984HOSTING_CSRFTOKEN_COOKIE=""
+  _saveaccountconf_mutable One984HOSTING_SESSIONID_COOKIE "$One984HOSTING_SESSIONID_COOKIE"
+  _saveaccountconf_mutable One984HOSTING_CSRFTOKEN_COOKIE "$One984HOSTING_CSRFTOKEN_COOKIE"
   return 1
 }
 
@@ -217,7 +223,8 @@ _get_root() {
 
 # add extra headers to request
 _authget() {
-  export _H1="Cookie: $One984HOSTING_COOKIE"
+  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
+  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
   _response=$(_get "$1" | _normalizeJson)
   _debug2 _response "$_response"
 }
@@ -225,12 +232,14 @@ _authget() {
 # truncate huge HTML response
 # echo: Argument list too long
 _htmlget() {
-  export _H1="Cookie: $One984HOSTING_COOKIE"
+  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
+  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
   _response=$(_get "$1" | grep "$2" | _head_n 1)
 }
 
 # add extra headers to request
 _authpost() {
-  export _H1="Cookie: $One984HOSTING_COOKIE"
+  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
+  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
   _response=$(_post "$1" "$2")
 }

From ced7110a78ba8faa6163bbe1f8a786f00ad5c6a9 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Fri, 10 Sep 2021 08:49:38 -0400
Subject: [PATCH 08/33] remove -o option from grep and use _egrep_o instead

---
 dnsapi/dns_1984hosting.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 62448754..f626e75a 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -150,8 +150,8 @@ _1984hosting_login() {
   _debug2 response "$response"
 
   if _contains "$response" '"loggedin": true'; then
-    One984HOSTING_SESSIONID_COOKIE="$(grep -io 'sessionid=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
-    One984HOSTING_CSRFTOKEN_COOKIE="$(grep -io 'csrftoken=[^;]*;' "$HTTP_HEADER"  | tr -d ';')"
+    One984HOSTING_SESSIONID_COOKIE="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _egrep_o 'sessionid=[^;]*;' | tr -d ';')"
+    One984HOSTING_CSRFTOKEN_COOKIE="$(grep -i '^set-cookie:' "$HTTP_HEADER" | _egrep_o 'csrftoken=[^;]*;' | tr -d ';')"
     export One984HOSTING_SESSIONID_COOKIE
     export One984HOSTING_CSRFTOKEN_COOKIE
     _saveaccountconf_mutable One984HOSTING_SESSIONID_COOKIE "$One984HOSTING_SESSIONID_COOKIE"

From ea18c47011279cbabbba4e857abea5a2a92e8a3a Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:35:20 -0400
Subject: [PATCH 09/33] move getting zone id code into its own function

---
 dnsapi/dns_1984hosting.sh | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index f626e75a..fceb7618 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -95,17 +95,7 @@ dns_1984hosting_rm() {
   _debug _domain "$_domain"
 
   _debug "Delete $fulldomain TXT record"
-  url="https://management.1984hosting.com/domains"
-
-  _htmlget "$url" "$_domain"
-  _debug2 _response "$_response"
-  zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
-  _debug2 zone_id "$zone_id"
-  if [ -z "$zone_id" ]; then
-    _err "Error getting zone_id for $1"
-    return 1
-  fi
-
+  
   _htmlget "$url/$zone_id" "$_sub_domain"
   _debug2 _response "$_response"
   entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
@@ -221,6 +211,22 @@ _get_root() {
   return 1
 }
 
+#domain.com
+#returns zone id for domain.com
+_get_zone_id() {
+  url="https://management.1984hosting.com/domains"
+
+  _htmlget "$url" "$_domain"
+  _debug2 _response "$_response"
+  _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
+  _debug2 _zone_id "$_zone_id"
+  if [ -z "$zone_id" ]; then
+    _err "Error getting _zone_id for $1"
+    return 1
+  fi
+  return 0
+}
+
 # add extra headers to request
 _authget() {
   export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"

From 8f3b7c179ec3e6333c67ce41a054f2c5bf2fd7fb Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:37:56 -0400
Subject: [PATCH 10/33] put cookies into a format that the 1984 Hosting website
 expects

---
 dnsapi/dns_1984hosting.sh | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index fceb7618..d1d7b154 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -229,8 +229,7 @@ _get_zone_id() {
 
 # add extra headers to request
 _authget() {
-  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
-  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
+  export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   _response=$(_get "$1" | _normalizeJson)
   _debug2 _response "$_response"
 }
@@ -238,14 +237,12 @@ _authget() {
 # truncate huge HTML response
 # echo: Argument list too long
 _htmlget() {
-  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
-  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
+  export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   _response=$(_get "$1" | grep "$2" | _head_n 1)
 }
 
 # add extra headers to request
 _authpost() {
-  export _H1="Cookie: $One984HOSTING_SESSIONID_COOKIE"
-  export _H2="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE"
+  export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   _response=$(_post "$1" "$2")
 }

From c668c603cc1a4be51393dcb6fd1896df3a5afe1a Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:45:06 -0400
Subject: [PATCH 11/33] add Referer and X-CSRFToken HTTP headers

---
 dnsapi/dns_1984hosting.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index d1d7b154..dc33ca60 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -243,6 +243,10 @@ _htmlget() {
 
 # add extra headers to request
 _authpost() {
+  _get_zone_id "$@"
+  csrf_header="$(echo "$One984HOSTING_CSRFTOKEN_COOKIE" | _egrep_o "=[^=][0-9a-zA-Z]*" | tr -d "=")"
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
+  export _H2="Referer: https://management.1984hosting.com/domains/$_zone_id"
+  export _H3="X-CSRFToken: $csrf_header"
   _response=$(_post "$1" "$2")
 }

From c5c2014081b8c0ae87bfe1d92572d86140f43bf9 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:48:27 -0400
Subject: [PATCH 12/33] add _get_zone_id to dns_1984hosting_rm to get the zone
 id

---
 dnsapi/dns_1984hosting.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index dc33ca60..395c0da1 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -96,7 +96,9 @@ dns_1984hosting_rm() {
 
   _debug "Delete $fulldomain TXT record"
   
-  _htmlget "$url/$zone_id" "$_sub_domain"
+  _get_zone_id
+
+  _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
   entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"

From 46e62f1a9ab12b1b111e141deef2f62ab3451578 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:50:03 -0400
Subject: [PATCH 13/33] fix typo

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 395c0da1..4d1bd9af 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -222,7 +222,7 @@ _get_zone_id() {
   _debug2 _response "$_response"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 _zone_id "$_zone_id"
-  if [ -z "$zone_id" ]; then
+  if [ -z "$_zone_id" ]; then
     _err "Error getting _zone_id for $1"
     return 1
   fi

From 384bc62f257eebd58850ef0e32c068b8831f548e Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 12:54:42 -0400
Subject: [PATCH 14/33] make _get_zone_id usage consistent

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 4d1bd9af..fafd9e8d 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -96,7 +96,7 @@ dns_1984hosting_rm() {
 
   _debug "Delete $fulldomain TXT record"
   
-  _get_zone_id
+  _get_zone_id "$@"
 
   _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"

From aa05a1e81ddd3a5cb71dff985881b081ba9cc4e0 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 13:00:03 -0400
Subject: [PATCH 15/33] make sure _url gets set where it is needed

---
 dnsapi/dns_1984hosting.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index fafd9e8d..d011f334 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -96,9 +96,10 @@ dns_1984hosting_rm() {
 
   _debug "Delete $fulldomain TXT record"
   
+  _url="https://management.1984hosting.com/domains" 
   _get_zone_id "$@"
 
-  _htmlget "$url/$_zone_id" "$_sub_domain"
+  _htmlget "$_url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
   entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"
@@ -216,9 +217,7 @@ _get_root() {
 #domain.com
 #returns zone id for domain.com
 _get_zone_id() {
-  url="https://management.1984hosting.com/domains"
-
-  _htmlget "$url" "$_domain"
+  _htmlget "$_url" "$_domain"
   _debug2 _response "$_response"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 _zone_id "$_zone_id"

From f101418658fd4980071cdc0e34c96e2346d44d3f Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 13:03:54 -0400
Subject: [PATCH 16/33] change _url -> url

---
 dnsapi/dns_1984hosting.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index d011f334..764aad9e 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -96,10 +96,10 @@ dns_1984hosting_rm() {
 
   _debug "Delete $fulldomain TXT record"
   
-  _url="https://management.1984hosting.com/domains" 
+  url="https://management.1984hosting.com/domains" 
   _get_zone_id "$@"
 
-  _htmlget "$_url/$_zone_id" "$_sub_domain"
+  _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
   entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"
@@ -217,7 +217,7 @@ _get_root() {
 #domain.com
 #returns zone id for domain.com
 _get_zone_id() {
-  _htmlget "$_url" "$_domain"
+  _htmlget "$url" "$_domain"
   _debug2 _response "$_response"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 _zone_id "$_zone_id"

From a196958bd6f26d429db8845ef0e096d40d57773e Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 13:13:55 -0400
Subject: [PATCH 17/33] add check when getting zone id

---
 dnsapi/dns_1984hosting.sh | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 764aad9e..734d64fb 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -97,7 +97,11 @@ dns_1984hosting_rm() {
   _debug "Delete $fulldomain TXT record"
   
   url="https://management.1984hosting.com/domains" 
-  _get_zone_id "$@"
+
+  if ! _get_zone_id "$_domain"; then
+	_err "invalid zone" "$_domain"
+	return 1
+  fi
 
   _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
@@ -214,10 +218,12 @@ _get_root() {
   return 1
 }
 
-#domain.com
+#usage: _get_zone_id domain.com
 #returns zone id for domain.com
 _get_zone_id() {
-  _htmlget "$url" "$_domain"
+  url="https://management.1984hosting.com/domains"
+  domain=$1
+  _htmlget "$url" "$domain"
   _debug2 _response "$_response"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 _zone_id "$_zone_id"

From b45a44e4057fbc39f8be727520f3ee17739cd530 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 13:33:55 -0400
Subject: [PATCH 18/33] fix formatting

---
 dnsapi/dns_1984hosting.sh | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 734d64fb..c517dc3f 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -93,14 +93,12 @@ dns_1984hosting_rm() {
   fi
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
-
   _debug "Delete $fulldomain TXT record"
-  
-  url="https://management.1984hosting.com/domains" 
 
-  if ! _get_zone_id "$_domain"; then
-	_err "invalid zone" "$_domain"
-	return 1
+  url="https://management.1984hosting.com/domains"
+  if ! _get_zone_id "$url" "$_domain"; then
+    _err "invalid zone" "$_domain"
+    return 1
   fi
 
   _htmlget "$url/$_zone_id" "$_sub_domain"
@@ -218,11 +216,11 @@ _get_root() {
   return 1
 }
 
-#usage: _get_zone_id domain.com
+#usage: _get_zone_id url domain.com
 #returns zone id for domain.com
 _get_zone_id() {
-  url="https://management.1984hosting.com/domains"
-  domain=$1
+  url=$1
+  domain=$2
   _htmlget "$url" "$domain"
   _debug2 _response "$_response"
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"

From 622464ff5e8dad1adb89815250dd79515c7858f7 Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 13:49:31 -0400
Subject: [PATCH 19/33] fix error message for _get_zone_id

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index c517dc3f..572173b2 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -226,7 +226,7 @@ _get_zone_id() {
   _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
   _debug2 _zone_id "$_zone_id"
   if [ -z "$_zone_id" ]; then
-    _err "Error getting _zone_id for $1"
+    _err "Error getting _zone_id for $2"
     return 1
   fi
   return 0

From 8d7a48701361cf0952b7022fba28d259a0c3a30e Mon Sep 17 00:00:00 2001
From: Christophe B Billheimer <cbillhei@gmu.edu>
Date: Sun, 12 Sep 2021 14:10:15 -0400
Subject: [PATCH 20/33] change $@ -> $_domain

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 572173b2..16cd22a7 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -248,7 +248,7 @@ _htmlget() {
 
 # add extra headers to request
 _authpost() {
-  _get_zone_id "$@"
+  _get_zone_id "$_domain"
   csrf_header="$(echo "$One984HOSTING_CSRFTOKEN_COOKIE" | _egrep_o "=[^=][0-9a-zA-Z]*" | tr -d "=")"
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   export _H2="Referer: https://management.1984hosting.com/domains/$_zone_id"

From 2f3ec3a77f071e4e56e78a5b858b8572005c29ec Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 16:25:21 -0400
Subject: [PATCH 21/33] filter out instances where email@domain.com exists

---
 dnsapi/dns_1984hosting.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 16cd22a7..cd7102f1 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -244,6 +244,9 @@ _authget() {
 _htmlget() {
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   _response=$(_get "$1" | grep "$2" | _head_n 1)
+  if _contains "$_response" "@$2"; then
+	_response=$(echo "$_response" | grep -v "[@]" | _head_n 1)
+  fi
 }
 
 # add extra headers to request

From 148336929d2aa0143fdddd9a301ba09e7c028cbb Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 16:27:40 -0400
Subject: [PATCH 22/33] fix formatting

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index cd7102f1..80587101 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -245,7 +245,7 @@ _htmlget() {
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   _response=$(_get "$1" | grep "$2" | _head_n 1)
   if _contains "$_response" "@$2"; then
-	_response=$(echo "$_response" | grep -v "[@]" | _head_n 1)
+    _response=$(echo "$_response" | grep -v "[@]" | _head_n 1)
   fi
 }
 

From f3196396a2cfb836df25af196017fb9cb7394ea1 Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 16:49:53 -0400
Subject: [PATCH 23/33] fix email filtering

---
 dnsapi/dns_1984hosting.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 80587101..c75e4217 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -223,7 +223,7 @@ _get_zone_id() {
   domain=$2
   _htmlget "$url" "$domain"
   _debug2 _response "$_response"
-  _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+')"
+  _zone_id="$(echo "$_response" | _egrep_o 'zone\/[0-9]+' | _head_n 1)"
   _debug2 _zone_id "$_zone_id"
   if [ -z "$_zone_id" ]; then
     _err "Error getting _zone_id for $2"
@@ -243,7 +243,7 @@ _authget() {
 # echo: Argument list too long
 _htmlget() {
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
-  _response=$(_get "$1" | grep "$2" | _head_n 1)
+  _response=$(_get "$1" | grep "$2")
   if _contains "$_response" "@$2"; then
     _response=$(echo "$_response" | grep -v "[@]" | _head_n 1)
   fi

From 64e3cab6ab7ee2ea2b420d02da50e87ca8dfa79e Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 16:57:32 -0400
Subject: [PATCH 24/33] add correct number of vars for _get_zone_id

---
 dnsapi/dns_1984hosting.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index c75e4217..0a562605 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -251,7 +251,8 @@ _htmlget() {
 
 # add extra headers to request
 _authpost() {
-  _get_zone_id "$_domain"
+  url="https://management.1984hosting.com/domains"
+  _get_zone_id "$url" "$_domain"
   csrf_header="$(echo "$One984HOSTING_CSRFTOKEN_COOKIE" | _egrep_o "=[^=][0-9a-zA-Z]*" | tr -d "=")"
   export _H1="Cookie: $One984HOSTING_CSRFTOKEN_COOKIE;$One984HOSTING_SESSIONID_COOKIE"
   export _H2="Referer: https://management.1984hosting.com/domains/$_zone_id"

From b910726c4356383b69601ce3b52a101e0f55353d Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 17:05:36 -0400
Subject: [PATCH 25/33] pick first entry if more than one TXT entry exists

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 0a562605..cb60651d 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -103,7 +103,7 @@ dns_1984hosting_rm() {
 
   _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
-  entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
+  entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//' | _head_n 1)"
   _debug2 entry_id "$entry_id"
   if [ -z "$entry_id" ]; then
     _err "Error getting TXT entry_id for $1"

From 4e553f34ba6958931e0a29bb97a629319dd3f95a Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 17:20:01 -0400
Subject: [PATCH 26/33] get TXT entry based on $txtvalue

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index cb60651d..5fa8b738 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -103,7 +103,7 @@ dns_1984hosting_rm() {
 
   _htmlget "$url/$_zone_id" "$_sub_domain"
   _debug2 _response "$_response"
-  entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//' | _head_n 1)"
+  entry_id="$(echo "$_response" | grep "$txtvalue" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"
   if [ -z "$entry_id" ]; then
     _err "Error getting TXT entry_id for $1"

From 4d95e35c06e4d5268edfb46a0909d7342e91dc04 Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Sun, 12 Sep 2021 17:38:27 -0400
Subject: [PATCH 27/33] get response based on $txtvalue

---
 dnsapi/dns_1984hosting.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index 5fa8b738..c36c7758 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -101,9 +101,9 @@ dns_1984hosting_rm() {
     return 1
   fi
 
-  _htmlget "$url/$_zone_id" "$_sub_domain"
+  _htmlget "$url/$_zone_id" "$txtvalue"
   _debug2 _response "$_response"
-  entry_id="$(echo "$_response" | grep "$txtvalue" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
+  entry_id="$(echo "$_response" | _egrep_o 'entry_[0-9]+' | sed 's/entry_//')"
   _debug2 entry_id "$entry_id"
   if [ -z "$entry_id" ]; then
     _err "Error getting TXT entry_id for $1"

From 41a2d0e06c7f7af044cf6815c6733c36664f57c3 Mon Sep 17 00:00:00 2001
From: DerVerruckteFuchs <cbillhei@billhei.org>
Date: Mon, 13 Sep 2021 11:44:39 -0400
Subject: [PATCH 28/33] reduce ttl

---
 dnsapi/dns_1984hosting.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_1984hosting.sh b/dnsapi/dns_1984hosting.sh
index c36c7758..db0cbe15 100755
--- a/dnsapi/dns_1984hosting.sh
+++ b/dnsapi/dns_1984hosting.sh
@@ -46,7 +46,7 @@ dns_1984hosting_add() {
 
   postdata="entry=new"
   postdata="$postdata&type=TXT"
-  postdata="$postdata&ttl=3600"
+  postdata="$postdata&ttl=900"
   postdata="$postdata&zone=$_domain"
   postdata="$postdata&host=$_sub_domain"
   postdata="$postdata&rdata=%22$value%22"

From 5a689ce897e86d0e493de908b54de87e4e583915 Mon Sep 17 00:00:00 2001
From: Stephen Pliaskin <strelok@e-kirov.ru>
Date: Wed, 22 Sep 2021 23:17:50 +0300
Subject: [PATCH 29/33] Add Veesp DNS API

---
 dnsapi/dns_veesp.sh | 158 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 158 insertions(+)
 create mode 100644 dnsapi/dns_veesp.sh

diff --git a/dnsapi/dns_veesp.sh b/dnsapi/dns_veesp.sh
new file mode 100644
index 00000000..b8a41d00
--- /dev/null
+++ b/dnsapi/dns_veesp.sh
@@ -0,0 +1,158 @@
+#!/usr/bin/env sh
+
+# bug reports to stepan@plyask.in
+
+#
+#     export VEESP_User="username"
+#     export VEESP_Password="password"
+
+VEESP_Api="https://secure.veesp.com/api"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_veesp_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  VEESP_Password="${VEESP_Password:-$(_readaccountconf_mutable VEESP_Password)}"
+  VEESP_User="${VEESP_User:-$(_readaccountconf_mutable VEESP_User)}"
+  VEESP_auth=$(printf "%s" "$VEESP_User:$VEESP_Password" | _base64)
+
+  if [ -z "$VEESP_Password" ] || [ -z "$VEESP_User" ]; then
+    VEESP_Password=""
+    VEESP_User=""
+    _err "You don't specify veesp api key and email yet."
+    _err "Please create you key and try again."
+    return 1
+  fi
+
+  #save the api key and email to the account conf file.
+  _saveaccountconf_mutable VEESP_Password "$VEESP_Password"
+  _saveaccountconf_mutable VEESP_User "$VEESP_User"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _info "Adding record"
+  if VEESP_rest POST "service/$_service_id/dns/$_domain_id/records" "{\"name\":\"$fulldomain\",\"ttl\":1,\"priority\":0,\"type\":\"TXT\",\"content\":\"$txtvalue\"}"; then
+    if _contains "$response" "\"success\":true"; then
+      _info "Added"
+      #todo: check if the record takes effect
+      return 0
+    else
+      _err "Add txt record error."
+      return 1
+    fi
+  fi
+}
+
+# Usage: fulldomain txtvalue
+# Used to remove the txt record after validation
+dns_veesp_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  VEESP_Password="${VEESP_Password:-$(_readaccountconf_mutable VEESP_Password)}"
+  VEESP_User="${VEESP_User:-$(_readaccountconf_mutable VEESP_User)}"
+  VEESP_auth=$(printf "%s" "$VEESP_User:$VEESP_Password" | _base64)
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain_id "$_domain_id"
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  VEESP_rest GET "service/$_service_id/dns/$_domain_id"
+
+  count=$(printf "%s\n" "$response" | _egrep_o "\"type\":\"TXT\",\"content\":\".\"$txtvalue.\"\"" | wc -l | tr -d " ")
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Don't need to remove."
+  else
+    record_id=$(printf "%s\n" "$response" | _egrep_o "{\"id\":[^}]*\"type\":\"TXT\",\"content\":\".\"$txtvalue.\"\"" | cut -d\" -f4)
+    _debug "record_id" "$record_id"
+    if [ -z "$record_id" ]; then
+      _err "Can not get record id to remove."
+      return 1
+    fi
+    if ! VEESP_rest DELETE "service/$_service_id/dns/$_domain_id/records/$record_id"; then
+      _err "Delete record error."
+      return 1
+    fi
+    _contains "$response" "\"success\":true"
+  fi
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_id=sdjkglgdfewsdfg
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  if ! VEESP_rest GET "dns"; then
+    return 1
+  fi
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"domain_id\":[^,]*,\"name\":\"$h\"" | cut -d : -f 2 | cut -d , -f 1 | cut -d '"' -f 2)
+      _debug _domain_id "$_domain_id"
+      _service_id=$(printf "%s\n" "$response" | _egrep_o "\"name\":\"$h\",\"service_id\":[^}]*" | cut -d : -f 3 | cut -d '"' -f 2)
+      _debug _service_id "$_service_id"
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+        _domain="$h"
+        return 0
+      fi
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+VEESP_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Accept: application/json"
+  export _H2="Authorization: Basic $VEESP_auth"
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    export _H3="Content-Type: application/json"
+    response="$(_post "$data" "$VEESP_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$VEESP_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From 8d3ad3a8c17adc419dd25de6cbcf920888ae58f7 Mon Sep 17 00:00:00 2001
From: Tom Cocca <tcocca@propertybase.com>
Date: Thu, 23 Sep 2021 08:10:17 -0400
Subject: [PATCH 30/33] Rackspace changed their API response, fixed the sed
 matching

---
 dnsapi/dns_rackspace.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_rackspace.sh b/dnsapi/dns_rackspace.sh
index 03e1fa68..9c967182 100644
--- a/dnsapi/dns_rackspace.sh
+++ b/dnsapi/dns_rackspace.sh
@@ -7,6 +7,7 @@
 
 RACKSPACE_Endpoint="https://dns.api.rackspacecloud.com/v1.0"
 
+# 20210923 - RS changed the fields in the API response; fix sed
 # 20190213 - The name & id fields swapped in the API response; fix sed
 # 20190101 - Duplicating file for new pull request to dev branch
 # Original - tcocca:rackspace_dnsapi https://github.com/acmesh-official/acme.sh/pull/1297
@@ -79,8 +80,8 @@ _get_root_zone() {
     _debug2 response "$response"
     if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
       # Response looks like:
-      #   {"ttl":300,"accountId":12345,"id":1111111,"name":"example.com","emailAddress": ...<and so on>
-      _domain_id=$(echo "$response" | sed -n "s/^.*\"id\":\([^,]*\),\"name\":\"$h\",.*/\1/p")
+      #   {"id": "12345","accountId": "1111111","name": "example.com","ttl": 3600,"emailAddress": ...<and so on>
+      _domain_id=$(echo "$response" | sed -n "s/^.*\"id\":\"\([^,]*\)\",\"accountId\":\"[0-9]*\",\"name\":\"$h\",.*/\1/p")
       _debug2 domain_id "$_domain_id"
       if [ -n "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)

From b9aa4f4478416e33593d9cc6c958cf1eaf73a2d5 Mon Sep 17 00:00:00 2001
From: Tom Cocca <tcocca@propertybase.com>
Date: Thu, 23 Sep 2021 08:20:50 -0400
Subject: [PATCH 31/33] trigger a GH actions change

---
 dnsapi/dns_rackspace.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_rackspace.sh b/dnsapi/dns_rackspace.sh
index 9c967182..62af3c67 100644
--- a/dnsapi/dns_rackspace.sh
+++ b/dnsapi/dns_rackspace.sh
@@ -80,7 +80,7 @@ _get_root_zone() {
     _debug2 response "$response"
     if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
       # Response looks like:
-      #   {"id": "12345","accountId": "1111111","name": "example.com","ttl": 3600,"emailAddress": ...<and so on>
+      #   {"id": "12345","accountId": "1111111","name": "example.com","ttl": 3600,"emailAddress": ... <and so on>
       _domain_id=$(echo "$response" | sed -n "s/^.*\"id\":\"\([^,]*\)\",\"accountId\":\"[0-9]*\",\"name\":\"$h\",.*/\1/p")
       _debug2 domain_id "$_domain_id"
       if [ -n "$_domain_id" ]; then

From 16d0416f2211809f9d38945d506f508ef58bc462 Mon Sep 17 00:00:00 2001
From: Tom Cocca <tcocca@propertybase.com>
Date: Thu, 23 Sep 2021 08:50:20 -0400
Subject: [PATCH 32/33] trigger GH Actions again

---
 dnsapi/dns_rackspace.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_rackspace.sh b/dnsapi/dns_rackspace.sh
index 62af3c67..b50d9168 100644
--- a/dnsapi/dns_rackspace.sh
+++ b/dnsapi/dns_rackspace.sh
@@ -80,7 +80,7 @@ _get_root_zone() {
     _debug2 response "$response"
     if _contains "$response" "\"name\":\"$h\"" >/dev/null; then
       # Response looks like:
-      #   {"id": "12345","accountId": "1111111","name": "example.com","ttl": 3600,"emailAddress": ... <and so on>
+      #   {"id":"12345","accountId":"1111111","name": "example.com","ttl":3600,"emailAddress": ... <and so on>
       _domain_id=$(echo "$response" | sed -n "s/^.*\"id\":\"\([^,]*\)\",\"accountId\":\"[0-9]*\",\"name\":\"$h\",.*/\1/p")
       _debug2 domain_id "$_domain_id"
       if [ -n "$_domain_id" ]; then

From 8419b42e83ff4278a441390b8963281c50279b40 Mon Sep 17 00:00:00 2001
From: Glenn Strauss <gstrauss@gluelogic.com>
Date: Thu, 30 Sep 2021 19:00:21 -0400
Subject: [PATCH 33/33] use ${ACME_OPENSSL_BIN:-openssl} instead of openssl

(requested by @Neilpang in #3687)
---
 deploy/haproxy.sh  | 10 +++++-----
 deploy/lighttpd.sh | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/deploy/haproxy.sh b/deploy/haproxy.sh
index 4497c34b..c255059d 100644
--- a/deploy/haproxy.sh
+++ b/deploy/haproxy.sh
@@ -195,7 +195,7 @@ haproxy_deploy() {
     _info "Updating OCSP stapling info"
     _debug _ocsp "${_ocsp}"
     _info "Extracting OCSP URL"
-    _ocsp_url=$(openssl x509 -noout -ocsp_uri -in "${_pem}")
+    _ocsp_url=$(${ACME_OPENSSL_BIN:-openssl} x509 -noout -ocsp_uri -in "${_pem}")
     _debug _ocsp_url "${_ocsp_url}"
 
     # Only process OCSP if URL was present
@@ -208,9 +208,9 @@ haproxy_deploy() {
       # Only process the certificate if we have a .issuer file
       if [ -r "${_issuer}" ]; then
         # Check if issuer cert is also a root CA cert
-        _subjectdn=$(openssl x509 -in "${_issuer}" -subject -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _subjectdn=$(${ACME_OPENSSL_BIN:-openssl} x509 -in "${_issuer}" -subject -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
         _debug _subjectdn "${_subjectdn}"
-        _issuerdn=$(openssl x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _issuerdn=$(${ACME_OPENSSL_BIN:-openssl} x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
         _debug _issuerdn "${_issuerdn}"
         _info "Requesting OCSP response"
         # If the issuer is a CA cert then our command line has "-CAfile" added
@@ -221,7 +221,7 @@ haproxy_deploy() {
         fi
         _debug _cafile_argument "${_cafile_argument}"
         # if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
-        _openssl_version=$(openssl version | cut -d' ' -f2)
+        _openssl_version=$(${ACME_OPENSSL_BIN:-openssl} version | cut -d' ' -f2)
         _debug _openssl_version "${_openssl_version}"
         _openssl_major=$(echo "${_openssl_version}" | cut -d '.' -f1)
         _openssl_minor=$(echo "${_openssl_version}" | cut -d '.' -f2)
@@ -231,7 +231,7 @@ haproxy_deploy() {
           _header_sep=" "
         fi
         # Request the OCSP response from the issuer and store it
-        _openssl_ocsp_cmd="openssl ocsp \
+        _openssl_ocsp_cmd="${ACME_OPENSSL_BIN:-openssl} ocsp \
           -issuer \"${_issuer}\" \
           -cert \"${_pem}\" \
           -url \"${_ocsp_url}\" \
diff --git a/deploy/lighttpd.sh b/deploy/lighttpd.sh
index e28cd27a..71f64b96 100644
--- a/deploy/lighttpd.sh
+++ b/deploy/lighttpd.sh
@@ -195,7 +195,7 @@ lighttpd_deploy() {
     _info "Updating OCSP stapling info"
     _debug _ocsp "${_ocsp}"
     _info "Extracting OCSP URL"
-    _ocsp_url=$(openssl x509 -noout -ocsp_uri -in "${_pem}")
+    _ocsp_url=$(${ACME_OPENSSL_BIN:-openssl} x509 -noout -ocsp_uri -in "${_pem}")
     _debug _ocsp_url "${_ocsp_url}"
 
     # Only process OCSP if URL was present
@@ -208,9 +208,9 @@ lighttpd_deploy() {
       # Only process the certificate if we have a .issuer file
       if [ -r "${_issuer}" ]; then
         # Check if issuer cert is also a root CA cert
-        _subjectdn=$(openssl x509 -in "${_issuer}" -subject -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _subjectdn=$(${ACME_OPENSSL_BIN:-openssl} x509 -in "${_issuer}" -subject -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
         _debug _subjectdn "${_subjectdn}"
-        _issuerdn=$(openssl x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
+        _issuerdn=$(${ACME_OPENSSL_BIN:-openssl} x509 -in "${_issuer}" -issuer -noout | cut -d'/' -f2,3,4,5,6,7,8,9,10)
         _debug _issuerdn "${_issuerdn}"
         _info "Requesting OCSP response"
         # If the issuer is a CA cert then our command line has "-CAfile" added
@@ -221,7 +221,7 @@ lighttpd_deploy() {
         fi
         _debug _cafile_argument "${_cafile_argument}"
         # if OpenSSL/LibreSSL is v1.1 or above, the format for the -header option has changed
-        _openssl_version=$(openssl version | cut -d' ' -f2)
+        _openssl_version=$(${ACME_OPENSSL_BIN:-openssl} version | cut -d' ' -f2)
         _debug _openssl_version "${_openssl_version}"
         _openssl_major=$(echo "${_openssl_version}" | cut -d '.' -f1)
         _openssl_minor=$(echo "${_openssl_version}" | cut -d '.' -f2)
@@ -231,7 +231,7 @@ lighttpd_deploy() {
           _header_sep=" "
         fi
         # Request the OCSP response from the issuer and store it
-        _openssl_ocsp_cmd="openssl ocsp \
+        _openssl_ocsp_cmd="${ACME_OPENSSL_BIN:-openssl} ocsp \
           -issuer \"${_issuer}\" \
           -cert \"${_pem}\" \
           -url \"${_ocsp_url}\" \