From 6f88c81616f9d2ca81945564b51a3090d7b454b1 Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Fri, 4 Jun 2021 19:20:23 +1000
Subject: [PATCH 01/19] Add DNS API plugin for Oracle Cloud Infrastructure DNS
 Service

This plugin is has noticeably more required fields than most
other plugins due to the requirement that all requests to
the OCI REST API must be cryptographically signed by the client
using the draft standard proposed in draft-cavage-http-signatures-08[1].

The OCI specific implementation details of the draft standard are
documented in the Developer Guide[2].

NOTE: there is maximum allowed clock skew of five minutes between the
client and the API endpoint. Requests will be denied if the skew is
greater.

This PR also includes a minor tweak to the Solaris job in the DNS
workflow so that it uses the pre-installed GNU tools, curl and OpenSSL 1.1.1.
Without these changes, the signature generation function does not
work on Solaris.

[1]: https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-08
[2]: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/signingrequests.htm#five

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 .github/workflows/DNS.yml |  10 +-
 dnsapi/dns_oci.sh         | 246 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 251 insertions(+), 5 deletions(-)
 create mode 100644 dnsapi/dns_oci.sh

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index f8e501ed..b00ef263 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -59,7 +59,7 @@ jobs:
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Set env file
       run: |
-        cd ../acmetest 
+        cd ../acmetest
         if [ "${{ secrets.TokenName1}}" ] ; then
           echo "${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}" >> env.list
         fi
@@ -75,7 +75,7 @@ jobs:
         if [ "${{ secrets.TokenName5}}" ] ; then
           echo "${{ secrets.TokenName5}}=${{ secrets.TokenValue5}}" >> env.list
         fi
-        echo "TEST_DNS_NO_WILDCARD" >> env.list 
+        echo "TEST_DNS_NO_WILDCARD" >> env.list
         echo "TEST_DNS_SLEEP" >> env.list
     - name: Run acmetest
       run: cd ../acmetest && ./rundocker.sh  testall
@@ -226,8 +226,10 @@ jobs:
     - uses: vmactions/solaris-vm@v0.0.3
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
-        prepare: pkgutil -y -i socat curl
+        prepare: pkgutil -y -i socat
         run: |
+          pkg set-mediator -v -I default@1.1 openssl
+          export PATH=/usr/gnu/bin:$PATH
           if [ "${{ secrets.TokenName1}}" ] ; then
             export ${{ secrets.TokenName1}}=${{ secrets.TokenValue1}}
           fi
@@ -245,5 +247,3 @@ jobs:
           fi
           cd ../acmetest
           ./letest.sh
-
-        
diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
new file mode 100644
index 00000000..2843a8ca
--- /dev/null
+++ b/dnsapi/dns_oci.sh
@@ -0,0 +1,246 @@
+#!/usr/bin/env sh
+#
+# Acme.sh DNS API plugin for Oracle Cloud Infrastructure
+# Copyright (c) 2021, Oracle and/or its affiliates
+#
+# Required environment variables:
+# - OCI_TENANCY    : OCID of tenancy that contains the target DNS zone
+# - OCI_USER       : OCID of user with permission to add/remove records from zones
+# - OCI_FINGERPRINT: fingerprint of the public key for the user
+# - OCI_PRIVATE_KEY: Path to private API signing key file in PEM format
+#
+# Optional environment variables:
+# - OCI_KEY_PASSPHRASE: if the private key above s encrypted, the passphrase is required
+# - OCI_REGION: Your home region will probably response the fastest
+#
+
+dns_oci_add() {
+  _fqdn="$1"
+  _rdata="$2"
+
+  if _oci_config; then
+
+    if ! _get_zone "$_fqdn"; then
+      _err "Error: DNS Zone not found for $_fqdn."
+      return 1
+    fi
+
+    if [ "$_sub_domain" ] && [ "$_domain" ]; then
+      _add_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"ttl\": 30,\"operation\":\"ADD\"}]}"
+      response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_add_record_body")
+      if [ "$response" ]; then
+        _info "Success: added TXT record for ${_sub_domain}.${_domain}."
+      else
+        _err "Error: failed to add TXT record for ${_sub_domain}.${_domain}."
+        return 1
+      fi
+    fi
+
+  else
+    return 1
+  fi
+
+}
+
+dns_oci_rm() {
+  _fqdn="$1"
+  _rdata="$2"
+
+  if _oci_config; then
+
+    if ! _get_zone "$_fqdn"; then
+      _err "Error: DNS Zone not found for $_fqdn."
+      return 1
+    fi
+
+    if [ "$_sub_domain" ] && [ "$_domain" ]; then
+      _remove_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"operation\":\"REMOVE\"}]}"
+      response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_remove_record_body")
+      if [ "$response" ]; then
+        _info "Success: removed TXT record for ${_sub_domain}.${_domain}."
+      else
+        _err "Error: failed to remove TXT record for ${_sub_domain}.${_domain}."
+        return 1
+      fi
+    fi
+
+  else
+    return 1
+  fi
+
+}
+
+####################  Private functions below ##################################
+_oci_config() {
+
+  OCI_TENANCY="${OCI_TENANCY:-$(_readaccountconf_mutable OCI_TENANCY)}"
+  OCI_USER="${OCI_USER:-$(_readaccountconf_mutable OCI_USER)}"
+  OCI_FINGERPRINT="${OCI_FINGERPRINT:-$(_readaccountconf_mutable OCI_FINGERPRINT)}"
+  OCI_PRIVATE_KEY="${OCI_PRIVATE_KEY:-$(_readaccountconf_mutable OCI_PRIVATE_KEY)}"
+  OCI_KEY_PASSPHRASE="${OCI_KEY_PASSPHRASE:-$(_readaccountconf_mutable OCI_KEY_PASSPHRASE)}"
+  OCI_REGION="${OCI_REGION:-$(_readaccountconf_mutable OCI_REGION)}"
+
+  _not_set=""
+  _ret=0
+
+  if [ -f "$OCI_PRIVATE_KEY" ]; then
+    OCI_PRIVATE_KEY="$(openssl enc -a -A <"$OCI_PRIVATE_KEY")"
+  fi
+
+  if [ -z "$OCI_TENANCY" ]; then
+    _not_set="OCI_TENANCY "
+  fi
+
+  if [ -z "$OCI_USER" ]; then
+    _not_set="${_not_set}OCI_USER "
+  fi
+
+  if [ -z "$OCI_FINGERPRINT" ]; then
+    _not_set="${_not_set}OCI_FINGERPRINT "
+  fi
+
+  if [ -z "$OCI_PRIVATE_KEY" ]; then
+    _not_set="${_not_set}OCI_PRIVATE_KEY"
+  fi
+
+  if [ "$_not_set" ]; then
+    _err "Fatal: environment variable(s): ${_not_set} not set."
+    _ret=1
+  else
+    _saveaccountconf_mutable OCI_TENANCY "$OCI_TENANCY"
+    _saveaccountconf_mutable OCI_USER "$OCI_USER"
+    _saveaccountconf_mutable OCI_FINGERPRINT "$OCI_FINGERPRINT"
+    _saveaccountconf_mutable OCI_PRIVATE_KEY "$OCI_PRIVATE_KEY"
+  fi
+
+  if [ "$OCI_PRIVATE_KEY" ] && [ "$(printf "%s\n" "$OCI_PRIVATE_KEY" | wc -l)" -eq 1 ]; then
+    OCI_PRIVATE_KEY="$(echo "$OCI_PRIVATE_KEY" | openssl enc -d -a -A)"
+    _secure_debug3 OCI_PRIVATE_KEY "$OCI_PRIVATE_KEY"
+  fi
+
+  if [ "$OCI_KEY_PASSPHRASE" ]; then
+    _saveaccountconf_mutable OCI_KEY_PASSPHRASE "$OCI_KEY_PASSPHRASE"
+  fi
+
+  if [ "$OCI_REGION" ]; then
+    _saveaccountconf_mutable OCI_REGION "$OCI_REGION"
+  else
+    OCI_REGION="us-ashburn-1"
+  fi
+
+  return $_ret
+
+}
+
+# _get_zone(): retrieves the Zone name and OCID
+#
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+# _domain_ociid=ocid1.dns-zone.oc1..
+_get_zone() {
+  domain=$1
+  i=1
+  p=1
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      # not valid
+      return 1
+    fi
+
+    _domain_id=$(_signed_request "GET" "/20180115/zones/$h" "" "id")
+    if [ "$_domain_id" ]; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+
+      _debug _domain_id "$_domain_id"
+      _debug _sub_domain "$_sub_domain"
+      _debug _domain "$_domain"
+      return 0
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+
+}
+
+_signed_request() {
+
+  _sig_method="$1"
+  _sig_target="$2"
+  _sig_body="$3"
+  _return_field="$4"
+
+  _sig_host="dns.$OCI_REGION.oraclecloud.com"
+  _sig_keyId="$OCI_TENANCY/$OCI_USER/$OCI_FINGERPRINT"
+  _sig_alg="rsa-sha256"
+  _sig_version="1"
+  _sig_now="$(LC_ALL=C \date -u "+%a, %d %h %Y %H:%M:%S GMT")"
+
+  if [ "$OCI_KEY_PASSPHRASE" ]; then
+    export OCI_KEY_PASSPHRASE="$OCI_KEY_PASSPHRASE"
+    _sig_passinArg="-passin env:OCI_KEY_PASSPHRASE"
+  fi
+
+  _request_method=$(printf %s "$_sig_method" | _lower_case)
+  _curl_method=$(printf %s "$_sig_method" | _upper_case)
+
+  _request_target="(request-target): $_request_method $_sig_target"
+  _date_header="date: $_sig_now"
+  _host_header="host: $_sig_host"
+
+  _string_to_sign="$_request_target\n$_date_header\n$_host_header"
+  _sig_headers="(request-target) date host"
+
+  if [ "$_sig_body" ]; then
+    _secure_debug3 _sig_body "$_sig_body"
+    _sig_body_sha256="x-content-sha256: $(printf %s "$_sig_body" | openssl dgst -binary -sha256 | openssl enc -e -base64)"
+    _sig_body_type="content-type: application/json"
+    _sig_body_length="content-length: ${#_sig_body}"
+    _string_to_sign="$_string_to_sign\n$_sig_body_sha256\n$_sig_body_type\n$_sig_body_length"
+    _sig_headers="$_sig_headers x-content-sha256 content-type content-length"
+  fi
+
+  _tmp_file=$(_mktemp)
+  if [ -f "$_tmp_file" ]; then
+    printf '%s' "$OCI_PRIVATE_KEY" >"$_tmp_file"
+    # Double quoting the file and passphrase breaks openssl
+    # shellcheck disable=SC2086
+    _signature=$(printf '%b' "$_string_to_sign" | openssl dgst -sha256 -sign $_tmp_file $_sig_passinArg | openssl enc -e -base64 | tr -d '\r\n')
+    rm -f "$_tmp_file"
+  fi
+
+  _signed_header="Authorization: Signature version=\"$_sig_version\",keyId=\"$_sig_keyId\",algorithm=\"$_sig_alg\",headers=\"$_sig_headers\",signature=\"$_signature\""
+  _secure_debug3 _signed_header "$_signed_header"
+
+  if [ "$_curl_method" = "GET" ]; then
+    export _H1="$_date_header"
+    export _H2="$_signed_header"
+    _response="$(_get "https://${_sig_host}${_sig_target}")"
+  elif [ "$_curl_method" = "PATCH" ]; then
+    export _H1="$_date_header"
+    export _H2="$_sig_body_sha256"
+    export _H3="$_sig_body_type"
+    export _H4="$_sig_body_length"
+    export _H5="$_signed_header"
+    _response="$(_post "$_sig_body" "https://${_sig_host}${_sig_target}" "" "PATCH")"
+  else
+    _err "Unable to process method: $_curl_method."
+  fi
+
+  _ret="$?"
+  if [ "$_return_field" ]; then
+    _response="$(echo "$_response" | sed 's/\\\"//g'))"
+    _return=$(echo "${_response}" | _egrep_o "\"$_return_field\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+  else
+    _return="$_response"
+  fi
+
+  printf "%s" "$_return"
+  return $_ret
+
+}

From 6621ef6a0be7c267d992733d1238d08a7ef02e67 Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <hsu@peterdavehello.org>
Date: Sat, 5 Oct 2019 21:28:25 +0800
Subject: [PATCH 02/19] Remove invalid "Contribute" link in README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 07dc5d59..c1c3a3c4 100644
--- a/README.md
+++ b/README.md
@@ -469,7 +469,7 @@ TODO:
 
 ### Code Contributors
 
-This project exists thanks to all the people who contribute. [[Contribute](CONTRIBUTING.md)].
+This project exists thanks to all the people who contribute.
 <a href="https://github.com/acmesh-official/acme.sh/graphs/contributors"><img src="https://opencollective.com/acmesh/contributors.svg?width=890&button=false" /></a>
 
 ### Financial Contributors

From 447bf77dfe99d12999ec6c75495088e1a75e769b Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <hsu@peterdavehello.org>
Date: Sat, 5 Oct 2019 20:49:51 +0800
Subject: [PATCH 03/19] Simplify apk command in Dockerfile

With apk `--no-cache` parameter, there is no need to run `apk update`
and manually clean up the cache, apk will update automatically without
leaving local cache files to be cleaned up.
---
 Dockerfile | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 4618efaf..4d8f219f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,6 @@
 FROM alpine:3.12
 
-RUN apk update -f \
-  && apk --no-cache add -f \
+RUN apk --no-cache add -f \
   openssl \
   openssh-client \
   coreutils \
@@ -12,8 +11,7 @@ RUN apk update -f \
   tzdata \
   oath-toolkit-oathtool \
   tar \
-  libidn \
-  && rm -rf /var/cache/apk/*
+  libidn
 
 ENV LE_CONFIG_HOME /acme.sh
 

From 6f732a9957bbc41c3be6a37e9778b18c78f09816 Mon Sep 17 00:00:00 2001
From: Peter Dave Hello <hsu@peterdavehello.org>
Date: Sat, 5 Oct 2019 20:51:51 +0800
Subject: [PATCH 04/19] Use `COPY` instead of `ADD` in Dockerfile for folder

Ref:
https://docs.docker.com/develop/develop-images/#add-or-copy
---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 4d8f219f..c42f4f39 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,7 +20,7 @@ ARG AUTO_UPGRADE=1
 ENV AUTO_UPGRADE $AUTO_UPGRADE
 
 #Install
-ADD ./ /install_acme.sh/
+COPY ./ /install_acme.sh/
 RUN cd /install_acme.sh && ([ -f /install_acme.sh/acme.sh ] && /install_acme.sh/acme.sh --install || curl https://get.acme.sh | sh) && rm -rf /install_acme.sh/
 
 

From 017a10189c9a8d38c95b8d2631a1facf181a6549 Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Fri, 18 Jun 2021 10:16:32 +1000
Subject: [PATCH 05/19] fix: switch to using functions instead of calling
 OpenSSL directly

Also reduced the number of environment variables which simplifies
the documentation and requirements. The variable names now match
those used by the OCI CLI.

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 120 ++++++++++++++++++++++------------------------
 1 file changed, 58 insertions(+), 62 deletions(-)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index 2843a8ca..1c75b99f 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -3,15 +3,16 @@
 # Acme.sh DNS API plugin for Oracle Cloud Infrastructure
 # Copyright (c) 2021, Oracle and/or its affiliates
 #
-# Required environment variables:
-# - OCI_TENANCY    : OCID of tenancy that contains the target DNS zone
-# - OCI_USER       : OCID of user with permission to add/remove records from zones
-# - OCI_FINGERPRINT: fingerprint of the public key for the user
-# - OCI_PRIVATE_KEY: Path to private API signing key file in PEM format
+# Required OCI CLI environment variables:
+# - OCI_CLI_TENANCY : OCID of tenancy that contains the target DNS zone
+# - OCI_CLI_USER    : OCID of user with permission to add/remove records from zones
+# - OCI_CLI_REGION  : Should point to the tenancy home region
 #
-# Optional environment variables:
-# - OCI_KEY_PASSPHRASE: if the private key above s encrypted, the passphrase is required
-# - OCI_REGION: Your home region will probably response the fastest
+# One of the following two variables is required:
+# - OCI_CLI_KEY_FILE: Path to private API signing key file in PEM format; or
+# - OCI_CLI_KEY     : The private API signing key in PEM format
+#
+# NOTE: using an encrypted private key that needs a passphrase is not supported.
 #
 
 dns_oci_add() {
@@ -20,11 +21,6 @@ dns_oci_add() {
 
   if _oci_config; then
 
-    if ! _get_zone "$_fqdn"; then
-      _err "Error: DNS Zone not found for $_fqdn."
-      return 1
-    fi
-
     if [ "$_sub_domain" ] && [ "$_domain" ]; then
       _add_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"ttl\": 30,\"operation\":\"ADD\"}]}"
       response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_add_record_body")
@@ -48,11 +44,6 @@ dns_oci_rm() {
 
   if _oci_config; then
 
-    if ! _get_zone "$_fqdn"; then
-      _err "Error: DNS Zone not found for $_fqdn."
-      return 1
-    fi
-
     if [ "$_sub_domain" ] && [ "$_domain" ]; then
       _remove_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"operation\":\"REMOVE\"}]}"
       response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_remove_record_body")
@@ -73,59 +64,57 @@ dns_oci_rm() {
 ####################  Private functions below ##################################
 _oci_config() {
 
-  OCI_TENANCY="${OCI_TENANCY:-$(_readaccountconf_mutable OCI_TENANCY)}"
-  OCI_USER="${OCI_USER:-$(_readaccountconf_mutable OCI_USER)}"
-  OCI_FINGERPRINT="${OCI_FINGERPRINT:-$(_readaccountconf_mutable OCI_FINGERPRINT)}"
-  OCI_PRIVATE_KEY="${OCI_PRIVATE_KEY:-$(_readaccountconf_mutable OCI_PRIVATE_KEY)}"
-  OCI_KEY_PASSPHRASE="${OCI_KEY_PASSPHRASE:-$(_readaccountconf_mutable OCI_KEY_PASSPHRASE)}"
-  OCI_REGION="${OCI_REGION:-$(_readaccountconf_mutable OCI_REGION)}"
+  OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
+  OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
+  OCI_CLI_KEY="${OCI_CLI_KEY:-$(_readaccountconf_mutable OCI_CLI_KEY)}"
+  OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readaccountconf_mutable OCI_CLI_REGION)}"
 
   _not_set=""
   _ret=0
 
-  if [ -f "$OCI_PRIVATE_KEY" ]; then
-    OCI_PRIVATE_KEY="$(openssl enc -a -A <"$OCI_PRIVATE_KEY")"
+  if [ -z "$OCI_CLI_KEY_FILE" ] && [ -z "$OCI_CLI_KEY" ]; then
+    _err "Fatal: you must provide a value for either OCI_CLI_KEY_FILE or OCI_CLI_KEY."
+    return 1
   fi
 
-  if [ -z "$OCI_TENANCY" ]; then
-    _not_set="OCI_TENANCY "
+  if [ "$OCI_CLI_KEY_FILE" ] && [ -z "$OCI_CLI_KEY" ]; then
+    if [ -f "$OCI_CLI_KEY_FILE" ]; then
+      OCI_CLI_KEY=$(_base64 <"$OCI_CLI_KEY_FILE")
+    else
+      _err "Fatal: unable to read $OCI_CLI_KEY_FILE."
+      return 1
+    fi
   fi
 
-  if [ -z "$OCI_USER" ]; then
-    _not_set="${_not_set}OCI_USER "
+  if [ -z "$OCI_CLI_TENANCY" ]; then
+    _not_set="${_not_set}OCI_CLI_TENANCY "
   fi
 
-  if [ -z "$OCI_FINGERPRINT" ]; then
-    _not_set="${_not_set}OCI_FINGERPRINT "
+  if [ -z "$OCI_CLI_USER" ]; then
+    _not_set="${_not_set}OCI_CLI_USER "
   fi
 
-  if [ -z "$OCI_PRIVATE_KEY" ]; then
-    _not_set="${_not_set}OCI_PRIVATE_KEY"
+  if [ -z "$OCI_CLI_REGION" ]; then
+    _not_set="${_not_set}OCI_CLI_REGION "
   fi
 
   if [ "$_not_set" ]; then
-    _err "Fatal: environment variable(s): ${_not_set} not set."
+    _err "Fatal: required environment variable(s): ${_not_set} not set."
     _ret=1
   else
-    _saveaccountconf_mutable OCI_TENANCY "$OCI_TENANCY"
-    _saveaccountconf_mutable OCI_USER "$OCI_USER"
-    _saveaccountconf_mutable OCI_FINGERPRINT "$OCI_FINGERPRINT"
-    _saveaccountconf_mutable OCI_PRIVATE_KEY "$OCI_PRIVATE_KEY"
+    _saveaccountconf_mutable OCI_CLI_TENANCY "$OCI_CLI_TENANCY"
+    _saveaccountconf_mutable OCI_CLI_USER "$OCI_CLI_USER"
+    _saveaccountconf_mutable OCI_CLI_KEY "$OCI_CLI_KEY"
+    _saveaccountconf_mutable OCI_CLI_REGION "$OCI_CLI_REGION"
   fi
 
-  if [ "$OCI_PRIVATE_KEY" ] && [ "$(printf "%s\n" "$OCI_PRIVATE_KEY" | wc -l)" -eq 1 ]; then
-    OCI_PRIVATE_KEY="$(echo "$OCI_PRIVATE_KEY" | openssl enc -d -a -A)"
-    _secure_debug3 OCI_PRIVATE_KEY "$OCI_PRIVATE_KEY"
+  if ! _contains "PRIVATE KEY" "$OCI_CLI_KEY"; then
+    OCI_CLI_KEY=$(printf "%s" "$OCI_CLI_KEY" | _dbase64 multiline)
   fi
 
-  if [ "$OCI_KEY_PASSPHRASE" ]; then
-    _saveaccountconf_mutable OCI_KEY_PASSPHRASE "$OCI_KEY_PASSPHRASE"
-  fi
-
-  if [ "$OCI_REGION" ]; then
-    _saveaccountconf_mutable OCI_REGION "$OCI_REGION"
-  else
-    OCI_REGION="us-ashburn-1"
+  if ! _get_zone "$_fqdn"; then
+    _err "Error: DNS Zone not found for $_fqdn."
+    _ret=1
   fi
 
   return $_ret
@@ -168,6 +157,19 @@ _get_zone() {
 
 }
 
+#Usage: privatekey
+#Output MD5 fingerprint
+_fingerprint() {
+  pkey="$1"
+  if [ -z "$pkey" ]; then
+    _usage "Usage: _fingerprint privkey"
+    return 1
+  fi
+
+  printf "%s" "$pkey" | ${ACME_OPENSSL_BIN:-openssl} rsa -pubout -outform DER 2>/dev/null | ${ACME_OPENSSL_BIN:-openssl} md5 -c | cut -d = -f 2 | tr -d ' '
+
+}
+
 _signed_request() {
 
   _sig_method="$1"
@@ -175,17 +177,13 @@ _signed_request() {
   _sig_body="$3"
   _return_field="$4"
 
-  _sig_host="dns.$OCI_REGION.oraclecloud.com"
-  _sig_keyId="$OCI_TENANCY/$OCI_USER/$OCI_FINGERPRINT"
+  _key_fingerprint=$(_fingerprint "$OCI_CLI_KEY")
+  _sig_host="dns.$OCI_CLI_REGION.oraclecloud.com"
+  _sig_keyId="$OCI_CLI_TENANCY/$OCI_CLI_USER/$_key_fingerprint"
   _sig_alg="rsa-sha256"
   _sig_version="1"
   _sig_now="$(LC_ALL=C \date -u "+%a, %d %h %Y %H:%M:%S GMT")"
 
-  if [ "$OCI_KEY_PASSPHRASE" ]; then
-    export OCI_KEY_PASSPHRASE="$OCI_KEY_PASSPHRASE"
-    _sig_passinArg="-passin env:OCI_KEY_PASSPHRASE"
-  fi
-
   _request_method=$(printf %s "$_sig_method" | _lower_case)
   _curl_method=$(printf %s "$_sig_method" | _upper_case)
 
@@ -198,7 +196,7 @@ _signed_request() {
 
   if [ "$_sig_body" ]; then
     _secure_debug3 _sig_body "$_sig_body"
-    _sig_body_sha256="x-content-sha256: $(printf %s "$_sig_body" | openssl dgst -binary -sha256 | openssl enc -e -base64)"
+    _sig_body_sha256="x-content-sha256: $(printf %s "$_sig_body" | _digest sha256)"
     _sig_body_type="content-type: application/json"
     _sig_body_length="content-length: ${#_sig_body}"
     _string_to_sign="$_string_to_sign\n$_sig_body_sha256\n$_sig_body_type\n$_sig_body_length"
@@ -207,10 +205,8 @@ _signed_request() {
 
   _tmp_file=$(_mktemp)
   if [ -f "$_tmp_file" ]; then
-    printf '%s' "$OCI_PRIVATE_KEY" >"$_tmp_file"
-    # Double quoting the file and passphrase breaks openssl
-    # shellcheck disable=SC2086
-    _signature=$(printf '%b' "$_string_to_sign" | openssl dgst -sha256 -sign $_tmp_file $_sig_passinArg | openssl enc -e -base64 | tr -d '\r\n')
+    printf '%s' "$OCI_CLI_KEY" >"$_tmp_file"
+    _signature=$(printf '%b' "$_string_to_sign" | _sign "$_tmp_file" sha256 | tr -d '\r\n')
     rm -f "$_tmp_file"
   fi
 

From 74c054b2a5db14f2ef2f663944e60f2bf5090577 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Sat, 19 Jun 2021 11:52:11 +0800
Subject: [PATCH 06/19] fix
 https://github.com/acmesh-official/acme.sh/issues/3563

---
 dnsapi/dns_nsd.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nsd.sh b/dnsapi/dns_nsd.sh
index 83cc4cac..0d29a485 100644
--- a/dnsapi/dns_nsd.sh
+++ b/dnsapi/dns_nsd.sh
@@ -51,7 +51,7 @@ dns_nsd_rm() {
   Nsd_ZoneFile="${Nsd_ZoneFile:-$(_readdomainconf Nsd_ZoneFile)}"
   Nsd_Command="${Nsd_Command:-$(_readdomainconf Nsd_Command)}"
 
-  sed -i "/$fulldomain. $ttlvalue IN TXT \"$txtvalue\"/d" "$Nsd_ZoneFile"
+  _sed_i "/$fulldomain. $ttlvalue IN TXT \"$txtvalue\"/d" "$Nsd_ZoneFile"
   _info "Removed TXT record for $fulldomain"
   _debug "Running $Nsd_Command"
   if eval "$Nsd_Command"; then

From ed971df93aff3d5688d09049784e16aa0365761d Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Sat, 19 Jun 2021 15:41:34 +1000
Subject: [PATCH 07/19] fix: add missing else/return 1 to if block

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index 1c75b99f..1380f4d4 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -30,6 +30,8 @@ dns_oci_add() {
         _err "Error: failed to add TXT record for ${_sub_domain}.${_domain}."
         return 1
       fi
+    else
+      return 1
     fi
 
   else
@@ -53,6 +55,8 @@ dns_oci_rm() {
         _err "Error: failed to remove TXT record for ${_sub_domain}.${_domain}."
         return 1
       fi
+    else
+      return 1
     fi
 
   else

From 946c8b498a26a0d5e1cdb487f3a11d8c5f14d9dc Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Sun, 20 Jun 2021 09:06:21 +1000
Subject: [PATCH 08/19] feat: enable automatic configuration from an OCI
 configuration file

The individual parameters can still be overridden via the
corresponding OCI_CLI environment variable.

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 129 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 94 insertions(+), 35 deletions(-)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index 1380f4d4..4d013578 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -3,7 +3,10 @@
 # Acme.sh DNS API plugin for Oracle Cloud Infrastructure
 # Copyright (c) 2021, Oracle and/or its affiliates
 #
-# Required OCI CLI environment variables:
+# The plugin will automatically use the default profile from an OCI SDK and CLI
+# configuration file, if it exists.
+#
+# Alternatively, set the following environment variables:
 # - OCI_CLI_TENANCY : OCID of tenancy that contains the target DNS zone
 # - OCI_CLI_USER    : OCID of user with permission to add/remove records from zones
 # - OCI_CLI_REGION  : Should point to the tenancy home region
@@ -19,18 +22,15 @@ dns_oci_add() {
   _fqdn="$1"
   _rdata="$2"
 
-  if _oci_config; then
+  if _get_oci_zone; then
 
-    if [ "$_sub_domain" ] && [ "$_domain" ]; then
-      _add_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"ttl\": 30,\"operation\":\"ADD\"}]}"
-      response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_add_record_body")
-      if [ "$response" ]; then
-        _info "Success: added TXT record for ${_sub_domain}.${_domain}."
-      else
-        _err "Error: failed to add TXT record for ${_sub_domain}.${_domain}."
-        return 1
-      fi
+    _add_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"ttl\": 30,\"operation\":\"ADD\"}]}"
+    response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_add_record_body")
+    if [ "$response" ]; then
+      _info "Success: added TXT record for ${_sub_domain}.${_domain}."
     else
+      _err "Error: failed to add TXT record for ${_sub_domain}.${_domain}."
+      _err "Check that the user has permission to add records to this zone."
       return 1
     fi
 
@@ -44,18 +44,15 @@ dns_oci_rm() {
   _fqdn="$1"
   _rdata="$2"
 
-  if _oci_config; then
+  if _get_oci_zone; then
 
-    if [ "$_sub_domain" ] && [ "$_domain" ]; then
-      _remove_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"operation\":\"REMOVE\"}]}"
-      response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_remove_record_body")
-      if [ "$response" ]; then
-        _info "Success: removed TXT record for ${_sub_domain}.${_domain}."
-      else
-        _err "Error: failed to remove TXT record for ${_sub_domain}.${_domain}."
-        return 1
-      fi
+    _remove_record_body="{\"items\":[{\"domain\":\"${_sub_domain}.${_domain}\",\"rdata\":\"$_rdata\",\"rtype\":\"TXT\",\"operation\":\"REMOVE\"}]}"
+    response=$(_signed_request "PATCH" "/20180115/zones/${_domain}/records" "$_remove_record_body")
+    if [ "$response" ]; then
+      _info "Success: removed TXT record for ${_sub_domain}.${_domain}."
     else
+      _err "Error: failed to remove TXT record for ${_sub_domain}.${_domain}."
+      _err "Check that the user has permission to remove records from this zone."
       return 1
     fi
 
@@ -66,12 +63,41 @@ dns_oci_rm() {
 }
 
 ####################  Private functions below ##################################
+_get_oci_zone() {
+
+  if ! _oci_config; then
+    return 1
+  fi
+
+  if ! _get_zone "$_fqdn"; then
+    _err "Error: DNS Zone not found for $_fqdn in $OCI_CLI_TENANCY"
+    return 1
+  fi
+
+  return 0
+
+}
+
 _oci_config() {
 
-  OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
-  OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
-  OCI_CLI_KEY="${OCI_CLI_KEY:-$(_readaccountconf_mutable OCI_CLI_KEY)}"
-  OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readaccountconf_mutable OCI_CLI_REGION)}"
+  OCI_CLI_CONFIG_FILE="${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}"
+  OCI_CLI_PROFILE="${OCI_CLI_PROFILE:-DEFAULT}"
+
+  # Let's try and find the values automagically first
+  # But still let any environment variables take precendence
+  if [ -f "$OCI_CLI_CONFIG_FILE" ]; then
+    _info "Reading OCI configuration file: $(_green "$OCI_CLI_CONFIG_FILE")"
+    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_read_oci_config tenancy)}"
+    OCI_CLI_USER="${OCI_CLI_USER:-$(_read_oci_config user)}"
+    OCI_CLI_KEY_FILE="${OCI_CLI_KEY_FILE:-$(_read_oci_config key_file)}"
+    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_read_oci_config region)}"
+  else
+    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
+    OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
+    OCI_CLI_KEY="${OCI_CLI_KEY:-$(_readaccountconf_mutable OCI_CLI_KEY)}"
+    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readaccountconf_mutable OCI_CLI_REGION)}"
+    _save_config="true"
+  fi
 
   _not_set=""
   _ret=0
@@ -85,7 +111,7 @@ _oci_config() {
     if [ -f "$OCI_CLI_KEY_FILE" ]; then
       OCI_CLI_KEY=$(_base64 <"$OCI_CLI_KEY_FILE")
     else
-      _err "Fatal: unable to read $OCI_CLI_KEY_FILE."
+      _err "Fatal: unable to read key file: $OCI_CLI_KEY_FILE"
       return 1
     fi
   fi
@@ -106,21 +132,20 @@ _oci_config() {
     _err "Fatal: required environment variable(s): ${_not_set} not set."
     _ret=1
   else
-    _saveaccountconf_mutable OCI_CLI_TENANCY "$OCI_CLI_TENANCY"
-    _saveaccountconf_mutable OCI_CLI_USER "$OCI_CLI_USER"
-    _saveaccountconf_mutable OCI_CLI_KEY "$OCI_CLI_KEY"
-    _saveaccountconf_mutable OCI_CLI_REGION "$OCI_CLI_REGION"
+    if [ "$_save_config" ]; then
+      _saveaccountconf_mutable OCI_CLI_TENANCY "$OCI_CLI_TENANCY"
+      _saveaccountconf_mutable OCI_CLI_USER "$OCI_CLI_USER"
+      _saveaccountconf_mutable OCI_CLI_KEY "$OCI_CLI_KEY"
+      _saveaccountconf_mutable OCI_CLI_REGION "$OCI_CLI_REGION"
+    else
+      _info "Success: OCI configuration retrieved from $OCI_CLI_CONFIG_FILE."
+    fi
   fi
 
   if ! _contains "PRIVATE KEY" "$OCI_CLI_KEY"; then
     OCI_CLI_KEY=$(printf "%s" "$OCI_CLI_KEY" | _dbase64 multiline)
   fi
 
-  if ! _get_zone "$_fqdn"; then
-    _err "Error: DNS Zone not found for $_fqdn."
-    _ret=1
-  fi
-
   return $_ret
 
 }
@@ -244,3 +269,37 @@ _signed_request() {
   return $_ret
 
 }
+
+# file  key  [section]
+_read_oci_config() {
+  _key="$1"
+
+  _start_n=$(grep -n '\['"$OCI_CLI_PROFILE"']' "$OCI_CLI_CONFIG_FILE" | cut -d : -f 1)
+  _debug2 _start_n "$_start_n"
+  if [ -z "$_start_n" ]; then
+    _err "Can not find section: $OCI_CLI_PROFILE"
+    return 1
+  fi
+
+  _start_nn=$(_math "$_start_n" + 1)
+  _debug2 "_start_nn" "$_start_nn"
+
+  _left="$(sed -n "${_start_nn},99999p" "$OCI_CLI_CONFIG_FILE")"
+  _debug2 _left "$_left"
+  _end="$(echo "$_left" | grep -n "^\[" | _head_n 1)"
+  _debug2 "_end" "$_end"
+  if [ "$_end" ]; then
+    _end_n=$(echo "$_end" | cut -d : -f 1)
+    _debug "_end_n" "$_end_n"
+    _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
+  else
+    _seg_n="$_left"
+  fi
+
+  _debug2 "_seg_n" "$_seg_n"
+  _lineini="$(echo "$_seg_n" | grep "^ *$_key *= *")"
+
+  _debug2 "_lineini" "$_lineini"
+  printf "%b" "$(eval "echo $_lineini | sed -e \"s/${_key}[[:space:]]*=[[:space:]]*//g\"")"
+
+}

From 766602284045f00fbc019b9bfa8c140fc9279a5e Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Sun, 20 Jun 2021 13:12:14 +1000
Subject: [PATCH 09/19] fix: revert _readini() function to be more generic

Also switched [::space::] with a literal space for better
cross-platform compatibility.

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index 4d013578..1666c5a7 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -83,14 +83,14 @@ _oci_config() {
   OCI_CLI_CONFIG_FILE="${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}"
   OCI_CLI_PROFILE="${OCI_CLI_PROFILE:-DEFAULT}"
 
-  # Let's try and find the values automagically first
-  # But still let any environment variables take precendence
+  # Read the configuration from either the default or specified config file
+  # Override the config file value with the environment variable value (if set)
   if [ -f "$OCI_CLI_CONFIG_FILE" ]; then
-    _info "Reading OCI configuration file: $(_green "$OCI_CLI_CONFIG_FILE")"
-    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_read_oci_config tenancy)}"
-    OCI_CLI_USER="${OCI_CLI_USER:-$(_read_oci_config user)}"
-    OCI_CLI_KEY_FILE="${OCI_CLI_KEY_FILE:-$(_read_oci_config key_file)}"
-    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_read_oci_config region)}"
+    _info "Reading OCI configuration file: $OCI_CLI_CONFIG_FILE"
+    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readini tenancy "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
+    OCI_CLI_USER="${OCI_CLI_USER:-$(_readini user "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
+    OCI_CLI_KEY_FILE="${OCI_CLI_KEY_FILE:-$(_readini key_file "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
+    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readini region "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
   else
     OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
     OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
@@ -271,20 +271,22 @@ _signed_request() {
 }
 
 # file  key  [section]
-_read_oci_config() {
+_readini() {
   _key="$1"
+  _file="$2"
+  _section="${3:-DEFAULT}"
 
-  _start_n=$(grep -n '\['"$OCI_CLI_PROFILE"']' "$OCI_CLI_CONFIG_FILE" | cut -d : -f 1)
+  _start_n=$(grep -n '\['"$_section"']' "$_file" | cut -d : -f 1)
   _debug2 _start_n "$_start_n"
   if [ -z "$_start_n" ]; then
-    _err "Can not find section: $OCI_CLI_PROFILE"
+    _err "Can not find section: $_section"
     return 1
   fi
 
   _start_nn=$(_math "$_start_n" + 1)
   _debug2 "_start_nn" "$_start_nn"
 
-  _left="$(sed -n "${_start_nn},99999p" "$OCI_CLI_CONFIG_FILE")"
+  _left="$(sed -n "${_start_nn},99999p" "$_file")"
   _debug2 _left "$_left"
   _end="$(echo "$_left" | grep -n "^\[" | _head_n 1)"
   _debug2 "_end" "$_end"
@@ -300,6 +302,6 @@ _read_oci_config() {
   _lineini="$(echo "$_seg_n" | grep "^ *$_key *= *")"
 
   _debug2 "_lineini" "$_lineini"
-  printf "%b" "$(eval "echo $_lineini | sed -e \"s/${_key}[[:space:]]*=[[:space:]]*//g\"")"
+  printf "%b" "$(eval "echo $_lineini | sed -e \"s/^ *${_key} *= *//g\"")"
 
 }

From 1c786633780d5a070a24b1417039eeeaad54d3a2 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Sun, 20 Jun 2021 12:26:12 +0800
Subject: [PATCH 10/19] exclude test for dns api changes

---
 .github/workflows/LetsEncrypt.yml | 6 ++++++
 .github/workflows/Linux.yml       | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 84fe61ad..b579d6e9 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -6,12 +6,18 @@ on:
     paths:
       - '**.sh'
       - '**.yml'
+      - '!dnsapi/**'
+      - '!deploy/**'
+      - '!notify/**'
   pull_request:
     branches:
       - dev
     paths:
       - '**.sh'
       - '**.yml'
+      - '!dnsapi/**'
+      - '!deploy/**'
+      - '!notify/**'
 
 
 jobs:
diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index f5f74351..3e1d3cf8 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -6,12 +6,18 @@ on:
     paths:
       - '**.sh'
       - '**.yml'
+      - '!dnsapi/**'
+      - '!deploy/**'
+      - '!notify/**'
   pull_request:
     branches:
       - dev
     paths:
       - '**.sh'
       - '**.yml'
+      - '!dnsapi/**'
+      - '!deploy/**'
+      - '!notify/**'
 
 
 jobs:

From 1d089d4541ca2764113fb8c13b644e8d7fdd5c0a Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Sun, 20 Jun 2021 14:38:24 +1000
Subject: [PATCH 11/19] fix: refactor the way the config is read from file and
 envvars

The plugin will use the following order of precedence:

environment value > file value > default value

See the wiki for details on environment variable names.

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 125 ++++++++++++++++++++++++++--------------------
 1 file changed, 72 insertions(+), 53 deletions(-)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index 1666c5a7..c27023e2 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -80,76 +80,93 @@ _get_oci_zone() {
 
 _oci_config() {
 
-  OCI_CLI_CONFIG_FILE="${OCI_CLI_CONFIG_FILE:-$HOME/.oci/config}"
-  OCI_CLI_PROFILE="${OCI_CLI_PROFILE:-DEFAULT}"
+  _DEFAULT_OCI_CLI_CONFIG_FILE="$HOME/.oci/config"
+  OCI_CLI_CONFIG_FILE="${OCI_CLI_CONFIG_FILE:-$(_readaccountconf_mutable OCI_CLI_CONFIG_FILE)}"
 
-  # Read the configuration from either the default or specified config file
-  # Override the config file value with the environment variable value (if set)
-  if [ -f "$OCI_CLI_CONFIG_FILE" ]; then
-    _info "Reading OCI configuration file: $OCI_CLI_CONFIG_FILE"
-    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readini tenancy "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
-    OCI_CLI_USER="${OCI_CLI_USER:-$(_readini user "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
-    OCI_CLI_KEY_FILE="${OCI_CLI_KEY_FILE:-$(_readini key_file "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
-    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readini region "$OCI_CLI_CONFIG_FILE" "$OCI_CLI_PROFILE")}"
+  if [ -z "$OCI_CLI_CONFIG_FILE" ]; then
+    OCI_CLI_CONFIG_FILE="$_DEFAULT_OCI_CLI_CONFIG_FILE"
+  fi
+
+  if [ "$_DEFAULT_OCI_CLI_CONFIG_FILE" != "$OCI_CLI_CONFIG_FILE" ]; then
+    _saveaccountconf_mutable OCI_CLI_CONFIG_FILE "$OCI_CLI_CONFIG_FILE"
   else
-    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
-    OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
-    OCI_CLI_KEY="${OCI_CLI_KEY:-$(_readaccountconf_mutable OCI_CLI_KEY)}"
-    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readaccountconf_mutable OCI_CLI_REGION)}"
-    _save_config="true"
+    _clearaccountconf_mutable OCI_CLI_CONFIG_FILE
   fi
 
-  _not_set=""
-  _ret=0
-
-  if [ -z "$OCI_CLI_KEY_FILE" ] && [ -z "$OCI_CLI_KEY" ]; then
-    _err "Fatal: you must provide a value for either OCI_CLI_KEY_FILE or OCI_CLI_KEY."
-    return 1
+  _DEFAULT_OCI_CLI_PROFILE="DEFAULT"
+  OCI_CLI_PROFILE="${OCI_CLI_PROFILE:-$(_readaccountconf_mutable OCI_CLI_PROFILE)}"
+  if [ "$_DEFAULT_OCI_CLI_PROFILE" != "$OCI_CLI_PROFILE" ]; then
+    _saveaccountconf_mutable OCI_CLI_PROFILE "$OCI_CLI_PROFILE"
+  else
+    OCI_CLI_PROFILE="$_DEFAULT_OCI_CLI_PROFILE"
+    _clearaccountconf_mutable OCI_CLI_PROFILE
   fi
 
-  if [ "$OCI_CLI_KEY_FILE" ] && [ -z "$OCI_CLI_KEY" ]; then
-    if [ -f "$OCI_CLI_KEY_FILE" ]; then
-      OCI_CLI_KEY=$(_base64 <"$OCI_CLI_KEY_FILE")
-    else
-      _err "Fatal: unable to read key file: $OCI_CLI_KEY_FILE"
-      return 1
-    fi
+  OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readaccountconf_mutable OCI_CLI_TENANCY)}"
+  if [ "$OCI_CLI_TENANCY" ]; then
+    _saveaccountconf_mutable OCI_CLI_TENANCY "$OCI_CLI_TENANCY"
+  elif [ -f "$OCI_CLI_CONFIG_FILE" ]; then
+    _debug "Reading OCI_CLI_TENANCY value from: $OCI_CLI_CONFIG_FILE"
+    OCI_CLI_TENANCY="${OCI_CLI_TENANCY:-$(_readini "$OCI_CLI_CONFIG_FILE" tenancy "$OCI_CLI_PROFILE")}"
   fi
 
   if [ -z "$OCI_CLI_TENANCY" ]; then
-    _not_set="${_not_set}OCI_CLI_TENANCY "
+    _err "Error: unable to read OCI_CLI_TENANCY from config file or environment variable."
+    return 1
   fi
 
+  OCI_CLI_USER="${OCI_CLI_USER:-$(_readaccountconf_mutable OCI_CLI_USER)}"
+  if [ "$OCI_CLI_USER" ]; then
+    _saveaccountconf_mutable OCI_CLI_USER "$OCI_CLI_USER"
+  elif [ -f "$OCI_CLI_CONFIG_FILE" ]; then
+    _debug "Reading OCI_CLI_USER value from: $OCI_CLI_CONFIG_FILE"
+    OCI_CLI_USER="${OCI_CLI_USER:-$(_readini "$OCI_CLI_CONFIG_FILE" user "$OCI_CLI_PROFILE")}"
+  fi
   if [ -z "$OCI_CLI_USER" ]; then
-    _not_set="${_not_set}OCI_CLI_USER "
+    _err "Error: unable to read OCI_CLI_USER from config file or environment variable."
+    return 1
   fi
 
+  OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readaccountconf_mutable OCI_CLI_REGION)}"
+  if [ "$OCI_CLI_REGION" ]; then
+    _saveaccountconf_mutable OCI_CLI_REGION "$OCI_CLI_REGION"
+  elif [ -f "$OCI_CLI_CONFIG_FILE" ]; then
+    _debug "Reading OCI_CLI_REGION value from: $OCI_CLI_CONFIG_FILE"
+    OCI_CLI_REGION="${OCI_CLI_REGION:-$(_readini "$OCI_CLI_CONFIG_FILE" region "$OCI_CLI_PROFILE")}"
+  fi
   if [ -z "$OCI_CLI_REGION" ]; then
-    _not_set="${_not_set}OCI_CLI_REGION "
+    _err "Error: unable to read OCI_CLI_REGION from config file or environment variable."
+    return 1
   fi
 
-  if [ "$_not_set" ]; then
-    _err "Fatal: required environment variable(s): ${_not_set} not set."
-    _ret=1
-  else
-    if [ "$_save_config" ]; then
-      _saveaccountconf_mutable OCI_CLI_TENANCY "$OCI_CLI_TENANCY"
-      _saveaccountconf_mutable OCI_CLI_USER "$OCI_CLI_USER"
+  OCI_CLI_KEY="${OCI_CLI_KEY:-$(_readaccountconf_mutable OCI_CLI_KEY)}"
+  if [ -z "$OCI_CLI_KEY" ]; then
+    _clearaccountconf_mutable OCI_CLI_KEY
+    OCI_CLI_KEY_FILE="${OCI_CLI_KEY_FILE:-$(_readini "$OCI_CLI_CONFIG_FILE" key_file "$OCI_CLI_PROFILE")}"
+    if [ "$OCI_CLI_KEY_FILE" ] && [ -f "$OCI_CLI_KEY_FILE" ]; then
+      _debug "Reading OCI_CLI_KEY value from: $OCI_CLI_KEY_FILE"
+      OCI_CLI_KEY=$(_base64 <"$OCI_CLI_KEY_FILE")
       _saveaccountconf_mutable OCI_CLI_KEY "$OCI_CLI_KEY"
-      _saveaccountconf_mutable OCI_CLI_REGION "$OCI_CLI_REGION"
-    else
-      _info "Success: OCI configuration retrieved from $OCI_CLI_CONFIG_FILE."
     fi
+  else
+    _saveaccountconf_mutable OCI_CLI_KEY "$OCI_CLI_KEY"
   fi
 
-  if ! _contains "PRIVATE KEY" "$OCI_CLI_KEY"; then
+  if [ -z "$OCI_CLI_KEY_FILE" ] && [ -z "$OCI_CLI_KEY" ]; then
+    _err "Error: unable to find key file path in OCI config file or OCI_CLI_KEY_FILE."
+    _err "Error: unable to load private API signing key from OCI_CLI_KEY."
+    return 1
+  fi
+
+  if [ "$(printf "%s\n" "$OCI_CLI_KEY" | wc -l)" -eq 1 ]; then
     OCI_CLI_KEY=$(printf "%s" "$OCI_CLI_KEY" | _dbase64 multiline)
   fi
 
-  return $_ret
+  return 0
 
 }
 
+
 # _get_zone(): retrieves the Zone name and OCID
 #
 # _sub_domain=_acme-challenge.www
@@ -189,6 +206,7 @@ _get_zone() {
 #Usage: privatekey
 #Output MD5 fingerprint
 _fingerprint() {
+
   pkey="$1"
   if [ -z "$pkey" ]; then
     _usage "Usage: _fingerprint privkey"
@@ -272,36 +290,37 @@ _signed_request() {
 
 # file  key  [section]
 _readini() {
-  _key="$1"
-  _file="$2"
+  _file="$1"
+  _key="$2"
   _section="${3:-DEFAULT}"
 
   _start_n=$(grep -n '\['"$_section"']' "$_file" | cut -d : -f 1)
-  _debug2 _start_n "$_start_n"
+  _debug3 _start_n "$_start_n"
   if [ -z "$_start_n" ]; then
     _err "Can not find section: $_section"
     return 1
   fi
 
   _start_nn=$(_math "$_start_n" + 1)
-  _debug2 "_start_nn" "$_start_nn"
+  _debug3 "_start_nn" "$_start_nn"
 
   _left="$(sed -n "${_start_nn},99999p" "$_file")"
-  _debug2 _left "$_left"
+  _debug3 _left "$_left"
   _end="$(echo "$_left" | grep -n "^\[" | _head_n 1)"
-  _debug2 "_end" "$_end"
+  _debug3 "_end" "$_end"
   if [ "$_end" ]; then
     _end_n=$(echo "$_end" | cut -d : -f 1)
-    _debug "_end_n" "$_end_n"
+    _debug3 "_end_n" "$_end_n"
     _seg_n=$(echo "$_left" | sed -n "1,${_end_n}p")
   else
     _seg_n="$_left"
   fi
 
-  _debug2 "_seg_n" "$_seg_n"
+  _debug3 "_seg_n" "$_seg_n"
   _lineini="$(echo "$_seg_n" | grep "^ *$_key *= *")"
+  _inivalue="$(printf "%b" "$(eval "echo $_lineini | sed \"s/^ *${_key} *= *//g\"")")"
+  _debug2 _inivalue "$_inivalue"
+  echo "$_inivalue"
 
-  _debug2 "_lineini" "$_lineini"
-  printf "%b" "$(eval "echo $_lineini | sed -e \"s/^ *${_key} *= *//g\"")"
 
 }

From 25d0fdf8ff25135a8d071a46eb394b7e7b64d73f Mon Sep 17 00:00:00 2001
From: Avi Miller <avi.miller@oracle.com>
Date: Sun, 20 Jun 2021 17:07:04 +1000
Subject: [PATCH 12/19] fix: fix a format issue reported by shellfmt

Signed-off-by: Avi Miller <avi.miller@oracle.com>
---
 dnsapi/dns_oci.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/dnsapi/dns_oci.sh b/dnsapi/dns_oci.sh
index c27023e2..eb006120 100644
--- a/dnsapi/dns_oci.sh
+++ b/dnsapi/dns_oci.sh
@@ -166,7 +166,6 @@ _oci_config() {
 
 }
 
-
 # _get_zone(): retrieves the Zone name and OCID
 #
 # _sub_domain=_acme-challenge.www
@@ -322,5 +321,4 @@ _readini() {
   _debug2 _inivalue "$_inivalue"
   echo "$_inivalue"
 
-
 }

From 79fac4466e9b9bca12b659ea062dec2905b42052 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Sun, 20 Jun 2021 16:57:58 +0800
Subject: [PATCH 13/19] minor

---
 .github/workflows/LetsEncrypt.yml  | 11 +++--------
 .github/workflows/Linux.yml        | 12 ++++--------
 .github/workflows/PebbleStrict.yml |  4 ++--
 3 files changed, 9 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index b579d6e9..5986290d 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -4,20 +4,15 @@ on:
     branches:
       - '*'
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
-      - '!dnsapi/**'
-      - '!deploy/**'
-      - '!notify/**'
+
   pull_request:
     branches:
       - dev
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
-      - '!dnsapi/**'
-      - '!deploy/**'
-      - '!notify/**'
 
 
 jobs:
diff --git a/.github/workflows/Linux.yml b/.github/workflows/Linux.yml
index 3e1d3cf8..6d4dcf7c 100644
--- a/.github/workflows/Linux.yml
+++ b/.github/workflows/Linux.yml
@@ -4,20 +4,16 @@ on:
     branches:
       - '*'
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
-      - '!dnsapi/**'
-      - '!deploy/**'
-      - '!notify/**'
+
   pull_request:
     branches:
       - dev
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
-      - '!dnsapi/**'
-      - '!deploy/**'
-      - '!notify/**'
+
 
 
 jobs:
diff --git a/.github/workflows/PebbleStrict.yml b/.github/workflows/PebbleStrict.yml
index 976e5373..fee41feb 100644
--- a/.github/workflows/PebbleStrict.yml
+++ b/.github/workflows/PebbleStrict.yml
@@ -4,13 +4,13 @@ on:
     branches:
       - '*'
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
   pull_request:
     branches:
       - dev
     paths:
-      - '**.sh'
+      - '*.sh'
       - '**.yml'
 
 jobs:

From 280e44304ae87fa603b21d34dca3a39db951fa1a Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 20:11:15 +0800
Subject: [PATCH 14/19] fix for compatibility to sslcom

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 08de9ce7..df1d7567 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1210,7 +1210,7 @@ _createcsr() {
   _debug2 csr "$csr"
   _debug2 csrconf "$csrconf"
 
-  printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\nkeyUsage = nonRepudiation, digitalSignature, keyEncipherment" >"$csrconf"
+  printf "[ req_distinguished_name ]\n[ req ]\ndistinguished_name = req_distinguished_name\nreq_extensions = v3_req\n[ v3_req ]\n\n" >"$csrconf"
 
   if [ "$acmeValidationv1" ]; then
     domainlist="$(_idn "$domainlist")"

From 53d6ab6c2377f8bf6c2b0b1afd8b6d308d647c90 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 21:31:00 +0800
Subject: [PATCH 15/19] support SSL.com

---
 README.md |  1 +
 acme.sh   | 33 ++++++++++++++++++++++++++-------
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index c1c3a3c4..88373193 100644
--- a/README.md
+++ b/README.md
@@ -88,6 +88,7 @@ https://github.com/acmesh-official/acmetest
 - [ZeroSSL.com CA](https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA)(default)
 - Letsencrypt.org CA
 - [BuyPass.com CA](https://github.com/acmesh-official/acme.sh/wiki/BuyPass.com-CA)
+- [SSL.com CA](https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA)
 - [Pebble strict Mode](https://github.com/letsencrypt/pebble)
 - Any other [RFC8555](https://tools.ietf.org/html/rfc8555)-compliant CA
 
diff --git a/acme.sh b/acme.sh
index df1d7567..e398870f 100755
--- a/acme.sh
+++ b/acme.sh
@@ -29,18 +29,24 @@ CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory"
 CA_ZEROSSL="https://acme.zerossl.com/v2/DV90"
 _ZERO_EAB_ENDPOINT="http://api.zerossl.com/acme/eab-credentials-email"
 
+
+CA_SSLCOM_RSA="https://acme.ssl.com/sslcom-dv-rsa"
+CA_SSLCOM_ECC="https://acme.ssl.com/sslcom-dv-ecc"
+
+
 DEFAULT_CA=$CA_ZEROSSL
 DEFAULT_STAGING_CA=$CA_LETSENCRYPT_V2_TEST
 
 CA_NAMES="
+ZeroSSL.com,zerossl
 LetsEncrypt.org,letsencrypt
 LetsEncrypt.org_test,letsencrypt_test,letsencrypttest
 BuyPass.com,buypass
 BuyPass.com_test,buypass_test,buypasstest
-ZeroSSL.com,zerossl
+SSL.com,sslcom
 "
 
-CA_SERVERS="$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_ZEROSSL"
+CA_SERVERS="$CA_ZEROSSL,$CA_LETSENCRYPT_V2,$CA_LETSENCRYPT_V2_TEST,$CA_BUYPASS,$CA_BUYPASS_TEST,$CA_SSLCOM_RSA"
 
 DEFAULT_USER_AGENT="$PROJECT_NAME/$VER ($PROJECT)"
 
@@ -155,6 +161,8 @@ _REVOKE_WIKI="https://github.com/acmesh-official/acme.sh/wiki/revokecert"
 
 _ZEROSSL_WIKI="https://github.com/acmesh-official/acme.sh/wiki/ZeroSSL.com-CA"
 
+_SSLCOM_WIKI="https://github.com/acmesh-official/acme.sh/wiki/SSL.com-CA"
+
 _SERVER_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Server"
 
 _PREFERRED_CHAIN_WIKI="https://github.com/acmesh-official/acme.sh/wiki/Preferred-Chain"
@@ -2617,7 +2625,13 @@ _initpath() {
   _ACME_SERVER_HOST="$(echo "$ACME_DIRECTORY" | cut -d : -f 2 | tr -s / | cut -d / -f 2)"
   _debug2 "_ACME_SERVER_HOST" "$_ACME_SERVER_HOST"
 
-  CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
+  _ACME_SERVER_PATH="$(echo "$ACME_DIRECTORY" | cut -d : -f 2- | tr -s / | cut -d / -f 3-)"
+  _debug2 "_ACME_SERVER_PATH" "$_ACME_SERVER_PATH"
+  if [ -z "$_ACME_SERVER_PATH" ] || [ "$_ACME_SERVER_PATH" = "directory" ]; then
+    CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
+  else
+    CA_DIR="$CA_HOME/$_ACME_SERVER_HOST/$_ACME_SERVER_PATH"
+  fi
 
   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
 
@@ -6638,9 +6652,10 @@ _checkSudo() {
   return 0
 }
 
-#server
+#server  #keylength
 _selectServer() {
   _server="$1"
+  _skeylength="$2"
   _server_lower="$(echo "$_server" | _lower_case)"
   _sindex=0
   for snames in $CA_NAMES; do
@@ -6651,6 +6666,9 @@ _selectServer() {
       if [ "$_server_lower" = "$sname" ]; then
         _debug2 "_selectServer match $sname"
         _serverdir="$(_getfield "$CA_SERVERS" $_sindex)"
+        if [ "$_serverdir" = "$CA_SSLCOM_RSA" ] && _isEccKey "$_skeylength"; then
+          _serverdir="$CA_SSLCOM_ECC"
+        fi
         _debug "Selected server: $_serverdir"
         ACME_DIRECTORY="$_serverdir"
         export ACME_DIRECTORY
@@ -6882,7 +6900,6 @@ _process() {
       ;;
     --server)
       _server="$2"
-      _selectServer "$_server"
       shift
       ;;
     --debug)
@@ -6981,7 +6998,6 @@ _process() {
       Le_DNSSleep="$_dnssleep"
       shift
       ;;
-
     --keylength | -k)
       _keylength="$2"
       shift
@@ -6990,7 +7006,6 @@ _process() {
       _accountkeylength="$2"
       shift
       ;;
-
     --cert-file | --certpath)
       _cert_file="$2"
       shift
@@ -7254,6 +7269,10 @@ _process() {
     shift 1
   done
 
+  if [ "$_server" ]; then
+    _selectServer "$_server" "${_ecc-:$_keylength}"
+  fi
+
   if [ "${_CMD}" != "install" ]; then
     if [ "$__INTERACTIVE" ] && ! _checkSudo; then
       if [ -z "$FORCE" ]; then

From 30f11d0e16e79ff672f6ef54934d6625162da882 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 21:41:56 +0800
Subject: [PATCH 16/19] typo

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index e398870f..a22b053e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -7270,7 +7270,7 @@ _process() {
   done
 
   if [ "$_server" ]; then
-    _selectServer "$_server" "${_ecc-:$_keylength}"
+    _selectServer "$_server" "${_ecc:-$_keylength}"
   fi
 
   if [ "${_CMD}" != "install" ]; then

From 707cf35f0a4eb89687a2b8fcfba5184cf1a5d2f8 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 22:29:14 +0800
Subject: [PATCH 17/19] fix format

---
 acme.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index a22b053e..56bb3ddb 100755
--- a/acme.sh
+++ b/acme.sh
@@ -29,11 +29,9 @@ CA_BUYPASS_TEST="https://api.test4.buypass.no/acme/directory"
 CA_ZEROSSL="https://acme.zerossl.com/v2/DV90"
 _ZERO_EAB_ENDPOINT="http://api.zerossl.com/acme/eab-credentials-email"
 
-
 CA_SSLCOM_RSA="https://acme.ssl.com/sslcom-dv-rsa"
 CA_SSLCOM_ECC="https://acme.ssl.com/sslcom-dv-ecc"
 
-
 DEFAULT_CA=$CA_ZEROSSL
 DEFAULT_STAGING_CA=$CA_LETSENCRYPT_V2_TEST
 

From 593e8e1f636b83772224559b979c9a71724e4104 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 22:47:22 +0800
Subject: [PATCH 18/19] move ca key path

---
 acme.sh | 79 ++++++++++++++++++++++-----------------------------------
 1 file changed, 31 insertions(+), 48 deletions(-)

diff --git a/acme.sh b/acme.sh
index 56bb3ddb..a4bca7ea 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2625,19 +2625,44 @@ _initpath() {
 
   _ACME_SERVER_PATH="$(echo "$ACME_DIRECTORY" | cut -d : -f 2- | tr -s / | cut -d / -f 3-)"
   _debug2 "_ACME_SERVER_PATH" "$_ACME_SERVER_PATH"
-  if [ -z "$_ACME_SERVER_PATH" ] || [ "$_ACME_SERVER_PATH" = "directory" ]; then
-    CA_DIR="$CA_HOME/$_ACME_SERVER_HOST"
-  else
-    CA_DIR="$CA_HOME/$_ACME_SERVER_HOST/$_ACME_SERVER_PATH"
-  fi
 
+  CA_DIR="$CA_HOME/$_ACME_SERVER_HOST/$_ACME_SERVER_PATH"
   _DEFAULT_CA_CONF="$CA_DIR/ca.conf"
-
   if [ -z "$CA_CONF" ]; then
     CA_CONF="$_DEFAULT_CA_CONF"
   fi
   _debug3 CA_CONF "$CA_CONF"
 
+  _OLD_CADIR="$CA_HOME/$_ACME_SERVER_HOST"
+  _OLD_ACCOUNT_KEY="$_OLD_CADIR/account.key"
+  _OLD_ACCOUNT_JSON="$_OLD_CADIR/account.json"
+  _OLD_CA_CONF="$_OLD_CADIR/ca.conf"
+
+
+  _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
+  _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
+  if [ -z "$ACCOUNT_KEY_PATH" ]; then
+    ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
+    if [ -f "$_OLD_ACCOUNT_KEY" ] && ! [ -f "$ACCOUNT_KEY_PATH" ]; then
+      mkdir -p "$CA_DIR"
+      mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
+    fi
+  fi
+
+  if [ -z "$ACCOUNT_JSON_PATH" ]; then
+    ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
+    if [ -f "$_OLD_ACCOUNT_JSON" ] && ! [ -f "$ACCOUNT_JSON_PATH" ]; then
+      mkdir -p "$CA_DIR"
+      mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
+    fi
+  fi
+
+  if [ -f "$_OLD_CA_CONF" ] && ! [ -f "$CA_CONF" ]; then
+    mkdir -p "$CA_DIR"
+    mv "$_OLD_CA_CONF" "$CA_CONF"
+  fi
+
+
   if [ -f "$CA_CONF" ]; then
     . "$CA_CONF"
   fi
@@ -2658,19 +2683,6 @@ _initpath() {
     HTTP_HEADER="$LE_CONFIG_HOME/http.header"
   fi
 
-  _OLD_ACCOUNT_KEY="$LE_WORKING_DIR/account.key"
-  _OLD_ACCOUNT_JSON="$LE_WORKING_DIR/account.json"
-
-  _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
-  _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
-  if [ -z "$ACCOUNT_KEY_PATH" ]; then
-    ACCOUNT_KEY_PATH="$_DEFAULT_ACCOUNT_KEY_PATH"
-  fi
-
-  if [ -z "$ACCOUNT_JSON_PATH" ]; then
-    ACCOUNT_JSON_PATH="$_DEFAULT_ACCOUNT_JSON_PATH"
-  fi
-
   _DEFAULT_CERT_HOME="$LE_CONFIG_HOME"
   if [ -z "$CERT_HOME" ]; then
     CERT_HOME="$_DEFAULT_CERT_HOME"
@@ -3501,15 +3513,6 @@ _regAccount() {
   _initAPI
 
   mkdir -p "$CA_DIR"
-  if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
-    _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
-    mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
-  fi
-
-  if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
-    _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
-    mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
-  fi
 
   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
     if ! _create_account_key "$_reg_length"; then
@@ -3647,16 +3650,6 @@ _regAccount() {
 updateaccount() {
   _initpath
 
-  if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
-    _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
-    mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
-  fi
-
-  if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
-    _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
-    mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
-  fi
-
   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
     return 1
@@ -3699,16 +3692,6 @@ updateaccount() {
 deactivateaccount() {
   _initpath
 
-  if [ ! -f "$ACCOUNT_KEY_PATH" ] && [ -f "$_OLD_ACCOUNT_KEY" ]; then
-    _info "mv $_OLD_ACCOUNT_KEY to $ACCOUNT_KEY_PATH"
-    mv "$_OLD_ACCOUNT_KEY" "$ACCOUNT_KEY_PATH"
-  fi
-
-  if [ ! -f "$ACCOUNT_JSON_PATH" ] && [ -f "$_OLD_ACCOUNT_JSON" ]; then
-    _info "mv $_OLD_ACCOUNT_JSON to $ACCOUNT_JSON_PATH"
-    mv "$_OLD_ACCOUNT_JSON" "$ACCOUNT_JSON_PATH"
-  fi
-
   if [ ! -f "$ACCOUNT_KEY_PATH" ]; then
     _err "Account key is not found at: $ACCOUNT_KEY_PATH"
     return 1

From c0ae44a41bf0c093b599a405f6e18538a786c6ea Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 21 Jun 2021 22:59:14 +0800
Subject: [PATCH 19/19] fix format

---
 acme.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index a4bca7ea..4682544d 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2638,7 +2638,6 @@ _initpath() {
   _OLD_ACCOUNT_JSON="$_OLD_CADIR/account.json"
   _OLD_CA_CONF="$_OLD_CADIR/ca.conf"
 
-
   _DEFAULT_ACCOUNT_KEY_PATH="$CA_DIR/account.key"
   _DEFAULT_ACCOUNT_JSON_PATH="$CA_DIR/account.json"
   if [ -z "$ACCOUNT_KEY_PATH" ]; then
@@ -2662,7 +2661,6 @@ _initpath() {
     mv "$_OLD_CA_CONF" "$CA_CONF"
   fi
 
-
   if [ -f "$CA_CONF" ]; then
     . "$CA_CONF"
   fi