From b3529dc7482e6a8d2bdbb0e77374d960b58974a1 Mon Sep 17 00:00:00 2001
From: seidler2547 <github@stefanseidel.info>
Date: Mon, 27 Jun 2022 19:42:16 +0000
Subject: [PATCH 01/24] remove dns_do as it does not work anymore

The API that it uses was shut down in May 2022
---
 dnsapi/dns_do.sh | 148 -----------------------------------------------
 1 file changed, 148 deletions(-)
 delete mode 100755 dnsapi/dns_do.sh

diff --git a/dnsapi/dns_do.sh b/dnsapi/dns_do.sh
deleted file mode 100755
index 3850890c..00000000
--- a/dnsapi/dns_do.sh
+++ /dev/null
@@ -1,148 +0,0 @@
-#!/usr/bin/env sh
-
-# DNS API for Domain-Offensive / Resellerinterface / Domainrobot
-
-# Report bugs at https://github.com/seidler2547/acme.sh/issues
-
-# set these environment variables to match your customer ID and password:
-# DO_PID="KD-1234567"
-# DO_PW="cdfkjl3n2"
-
-DO_URL="https://soap.resellerinterface.de/"
-
-########  Public functions #####################
-
-#Usage: dns_myapi_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
-dns_do_add() {
-  fulldomain=$1
-  txtvalue=$2
-  if _dns_do_authenticate; then
-    _info "Adding TXT record to ${_domain} as ${fulldomain}"
-    _dns_do_soap createRR origin "${_domain}" name "${fulldomain}" type TXT data "${txtvalue}" ttl 300
-    if _contains "${response}" '>success<'; then
-      return 0
-    fi
-    _err "Could not create resource record, check logs"
-  fi
-  return 1
-}
-
-#fulldomain
-dns_do_rm() {
-  fulldomain=$1
-  if _dns_do_authenticate; then
-    if _dns_do_list_rrs; then
-      _dns_do_had_error=0
-      for _rrid in ${_rr_list}; do
-        _info "Deleting resource record $_rrid for $_domain"
-        _dns_do_soap deleteRR origin "${_domain}" rrid "${_rrid}"
-        if ! _contains "${response}" '>success<'; then
-          _dns_do_had_error=1
-          _err "Could not delete resource record for ${_domain}, id ${_rrid}"
-        fi
-      done
-      return $_dns_do_had_error
-    fi
-  fi
-  return 1
-}
-
-####################  Private functions below ##################################
-_dns_do_authenticate() {
-  _info "Authenticating as ${DO_PID}"
-  _dns_do_soap authPartner partner "${DO_PID}" password "${DO_PW}"
-  if _contains "${response}" '>success<'; then
-    _get_root "$fulldomain"
-    _debug "_domain $_domain"
-    return 0
-  else
-    _err "Authentication failed, are DO_PID and DO_PW set correctly?"
-  fi
-  return 1
-}
-
-_dns_do_list_rrs() {
-  _dns_do_soap getRRList origin "${_domain}"
-  if ! _contains "${response}" 'SOAP-ENC:Array'; then
-    _err "getRRList origin ${_domain} failed"
-    return 1
-  fi
-  _rr_list="$(echo "${response}" |
-    tr -d "\n\r\t" |
-    sed -e 's/<item xsi:type="ns2:Map">/\n/g' |
-    grep ">$(_regexcape "$fulldomain")</value>" |
-    sed -e 's/<\/item>/\n/g' |
-    grep '>id</key><value' |
-    _egrep_o '>[0-9]{1,16}<' |
-    tr -d '><')"
-  [ "${_rr_list}" ]
-}
-
-_dns_do_soap() {
-  func="$1"
-  shift
-  # put the parameters to xml
-  body="<tns:${func} xmlns:tns=\"${DO_URL}\">"
-  while [ "$1" ]; do
-    _k="$1"
-    shift
-    _v="$1"
-    shift
-    body="$body<$_k>$_v</$_k>"
-  done
-  body="$body</tns:${func}>"
-  _debug2 "SOAP request ${body}"
-
-  # build SOAP XML
-  _xml='<?xml version="1.0" encoding="UTF-8"?>
-<env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
-  <env:Body>'"$body"'</env:Body>
-</env:Envelope>'
-
-  # set SOAP headers
-  export _H1="SOAPAction: ${DO_URL}#${func}"
-
-  if ! response="$(_post "${_xml}" "${DO_URL}")"; then
-    _err "Error <$1>"
-    return 1
-  fi
-  _debug2 "SOAP response $response"
-
-  # retrieve cookie header
-  _H2="$(_egrep_o 'Cookie: [^;]+' <"$HTTP_HEADER" | _head_n 1)"
-  export _H2
-
-  return 0
-}
-
-_get_root() {
-  domain=$1
-  i=1
-
-  _dns_do_soap getDomainList
-  _all_domains="$(echo "${response}" |
-    tr -d "\n\r\t " |
-    _egrep_o 'domain</key><value[^>]+>[^<]+' |
-    sed -e 's/^domain<\/key><value[^>]*>//g')"
-
-  while true; do
-    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
-    if [ -z "$h" ]; then
-      return 1
-    fi
-
-    if _contains "${_all_domains}" "^$(_regexcape "$h")\$"; then
-      _domain="$h"
-      return 0
-    fi
-
-    i=$(_math $i + 1)
-  done
-  _debug "$domain not found"
-
-  return 1
-}
-
-_regexcape() {
-  echo "$1" | sed -e 's/\([]\.$*^[]\)/\\\1/g'
-}

From c7f6f20c9d4ae05a5ce366d8f3f62cd3eb1b1710 Mon Sep 17 00:00:00 2001
From: Scruel Tao <scruelt@hotmail.com>
Date: Thu, 20 Jul 2023 02:48:29 +0800
Subject: [PATCH 02/24] Add SYNO_USE_TEMP_ADMIN variable & Fix broken logic

1. Fix the broken logic in (Sorry for including fix commit in same PR, I'm feeling quite tired and would like to go to sleep right away...)
2. Provides new method to obtain credential info for authentication, it will create a temp admin user if SYNO_USE_TEMP_ADMIN is set, instead of requiring the user's own credentials which will be saved in disk.

I do really don't like to have plaintext credentials be saved in disk, and I noticed that you've spent a lot of time fighting with 2FA related stuffs, so why not just get rid of the whole old way. :)
---
 deploy/synology_dsm.sh | 89 +++++++++++++++++++++++++++++++-----------
 1 file changed, 66 insertions(+), 23 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 7398b350..d7dd1890 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -9,8 +9,11 @@
 # Issues:  https://github.com/acmesh-official/acme.sh/issues/2727
 ################################################################################
 # Usage:
-# 1. export SYNO_Username="adminUser"
-# 2. export SYNO_Password="adminPassword"
+# - Create temp admin user automatically:
+#   export SYNO_USE_TEMP_ADMIN=1
+# - Or provide your own admin user credential:
+#   1. export SYNO_Username="adminUser"
+#   2. export SYNO_Password="adminPassword"
 # Optional exports (shown values are the defaults):
 # - export SYNO_Certificate="" to replace a specific certificate via description
 # - export SYNO_Scheme="http"
@@ -22,6 +25,7 @@
 ################################################################################
 # Dependencies:
 # - jq & curl
+# - synouser & synogroup (When available and SYNO_USE_TEMP_ADMIN is set)
 ################################################################################
 # Return value:
 # 0 means success, otherwise error.
@@ -38,6 +42,7 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get username & password, but don't save until we authenticated successfully
+  _getdeployconf SYNO_USE_TEMP_ADMIN
   _getdeployconf SYNO_Username
   _getdeployconf SYNO_Password
   _getdeployconf SYNO_Create
@@ -45,12 +50,25 @@ synology_dsm_deploy() {
   _getdeployconf SYNO_TOTP_SECRET
   _getdeployconf SYNO_Device_Name
   _getdeployconf SYNO_Device_ID
-  if [ -z "${SYNO_Username:-}" ] || [ -z "${SYNO_Password:-}" ]; then
-    _err "SYNO_Username & SYNO_Password must be set"
-    return 1
+
+  # Prepare temp admin user info if SYNO_USE_TEMP_ADMIN is set
+  if [ -n "${SYNO_USE_TEMP_ADMIN:-}" ]; then
+    if ! _exists synouser; then
+      if ! _exists synogroup; then
+        _err "Tools are missing for creating temp admin user, please set SYNO_Username & SYNO_Password instead."
+        return 1
+      fi
+    fi
+    _debug "Setting temp admin user credential..."
+    SYNO_Username=sc-acmesh-tmp
+    SYNO_Password=`openssl rand -base64 16`
+    # Ignore 2FA-OTP settings which won't be needed.
+    SYNO_Device_Name=
+    SYNO_Device_ID=
   fi
-  if [ -n "${SYNO_Device_Name:-}" ] && [ -z "${SYNO_Device_ID:-}" ]; then
-    _err "SYNO_Device_Name set, but SYNO_Device_ID is empty"
+  
+  if [ -z "${SYNO_Username:-}" ] || [ -z "${SYNO_Password:-}" ]; then
+    _err "You must set either SYNO_USE_TEMP_ADMIN, or set both SYNO_Username and SYNO_Password."
     return 1
   fi
   _debug2 SYNO_Username "$SYNO_Username"
@@ -69,6 +87,7 @@ synology_dsm_deploy() {
   [ -n "${SYNO_Scheme}" ] || SYNO_Scheme="http"
   [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost"
   [ -n "${SYNO_Port}" ] || SYNO_Port="5000"
+  _savedeployconf SYNO_USE_TEMP_ADMIN "$SYNO_USE_TEMP_ADMIN"
   _savedeployconf SYNO_Scheme "$SYNO_Scheme"
   _savedeployconf SYNO_Hostname "$SYNO_Hostname"
   _savedeployconf SYNO_Port "$SYNO_Port"
@@ -106,13 +125,11 @@ synology_dsm_deploy() {
     _info "WARNING: Usage of SYNO_TOTP_SECRET is deprecated!"
     _info "         See synology_dsm.sh script or ACME.sh Wiki page for details:"
     _info "         https://github.com/acmesh-official/acme.sh/wiki/Synology-NAS-Guide"
-    DEPRECATED_otp_code=""
-    if _exists oathtool; then
-      DEPRECATED_otp_code="$(oathtool --base32 --totp "${SYNO_TOTP_SECRET}" 2>/dev/null)"
-    else
+    if ! _exists oathtool; then
       _err "oathtool could not be found, install oathtool to use SYNO_TOTP_SECRET"
       return 1
     fi
+    DEPRECATED_otp_code="$(oathtool --base32 --totp "${SYNO_TOTP_SECRET}" 2>/dev/null)"
 
     if [ -n "$SYNO_DID" ]; then
       _H1="Cookie: did=$SYNO_DID"
@@ -123,21 +140,30 @@ synology_dsm_deploy() {
     response=$(_post "method=login&account=$encoded_username&passwd=$encoded_password&api=SYNO.API.Auth&version=$api_version&enable_syno_token=yes&otp_code=$DEPRECATED_otp_code&device_name=certrenewal&device_id=$SYNO_DID" "$_base_url/webapi/auth.cgi?enable_syno_token=yes")
     _debug3 response "$response"
   # END - DEPRECATED, only kept for legacy compatibility reasons
+  # If SYNO_DeviceDevice_ID & SYNO_Device_Name both empty, just log in normally
+  elif [ -z "${SYNO_Device_ID:-}" ] && [ -z "${SYNO_Device_Name:-}" ]; then
+    if [ -n "$SYNO_USE_TEMP_ADMIN" ]; then
+      _debug "Creating temp admin user in Synology DSM"
+      synouser --del "$SYNO_Username" >/dev/null 2>/dev/null
+      synouser --add "$SYNO_Username" "$SYNO_Password" "" 0 "" 0 >/dev/null
+      synogroup --memberadd administrators "$SYNO_Username" >/dev/null
+    fi
+    response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=login&format=sid&account=$encoded_username&passwd=$encoded_password&enable_syno_token=yes")
+    _debug3 response "$response"
   # Get device ID if still empty first, otherwise log in right away
-  elif [ -z "${SYNO_Device_ID:-}" ]; then
+  elif [ -n "${SYNO_Device_Name:-}" ] && [ -z "${SYNO_Device_ID:-}" ]; then
     printf "Enter OTP code for user '%s': " "$SYNO_Username"
     read -r otp_code
-    if [ -z "${SYNO_Device_Name:-}" ]; then
-      printf "Enter device name or leave empty for default (CertRenewal): "
-      read -r SYNO_Device_Name
-      [ -n "${SYNO_Device_Name}" ] || SYNO_Device_Name="CertRenewal"
-    fi
-
     response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=login&format=sid&account=$encoded_username&passwd=$encoded_password&otp_code=$otp_code&enable_syno_token=yes&enable_device_token=yes&device_name=$SYNO_Device_Name")
     _debug3 response "$response"
     SYNO_Device_ID=$(echo "$response" | grep "device_id" | sed -n 's/.*"device_id" *: *"\([^"]*\).*/\1/p')
     _secure_debug2 SYNO_Device_ID "$SYNO_Device_ID"
   else
+    if [ -z "${SYNO_Device_Name:-}" ]; then
+      printf "Enter device name or leave empty for default (CertRenewal): "
+      read -r SYNO_Device_Name
+      [ -n "${SYNO_Device_Name}" ] || SYNO_Device_Name="CertRenewal"
+    fi
     response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=login&format=sid&account=$encoded_username&passwd=$encoded_password&enable_syno_token=yes&device_name=$SYNO_Device_Name&device_id=$SYNO_Device_ID")
     _debug3 response "$response"
   fi
@@ -146,9 +172,12 @@ synology_dsm_deploy() {
   token=$(echo "$response" | grep "synotoken" | sed -n 's/.*"synotoken" *: *"\([^"]*\).*/\1/p')
   _debug "Session ID" "$sid"
   _debug SynoToken "$token"
-  if [ -z "$SYNO_DID" ] && [ -z "$SYNO_Device_ID" ] || [ -z "$sid" ] || [ -z "$token" ]; then
+  if [ -z "$sid" ] || [ -z "$token" ]; then
     _err "Unable to authenticate to $_base_url - check your username & password."
-    _err "If two-factor authentication is enabled for the user, set SYNO_Device_ID."
+    _err "If two-factor authentication is enabled for the user:"
+    _err "- set SYNO_Device_Name then input *correct* OTP-code manually"
+    _err "- get & set SYNO_Device_ID via your browser cookies"
+    _remove_temp_admin "$SYNO_USE_TEMP_ADMIN" "$SYNO_Username"
     return 1
   fi
 
@@ -159,8 +188,10 @@ synology_dsm_deploy() {
   # Now that we know the username & password are good, save them
   _savedeployconf SYNO_Username "$SYNO_Username"
   _savedeployconf SYNO_Password "$SYNO_Password"
-  _savedeployconf SYNO_Device_Name "$SYNO_Device_Name"
-  _savedeployconf SYNO_Device_ID "$SYNO_Device_ID"
+  if [ -z "${SYNO_USE_TEMP_ADMIN:-}" ]; then
+    _savedeployconf SYNO_Device_Name "$SYNO_Device_Name"
+    _savedeployconf SYNO_Device_ID "$SYNO_Device_ID"
+  fi
 
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1&_sid=$sid" "$_base_url/webapi/entry.cgi")
@@ -172,6 +203,7 @@ synology_dsm_deploy() {
 
   if [ -z "$id" ] && [ -z "${SYNO_Create:-}" ]; then
     _err "Unable to find certificate: $SYNO_Certificate & \$SYNO_Create is not set"
+    _remove_temp_admin "$SYNO_USE_TEMP_ADMIN" "$SYNO_Username"
     return 1
   fi
 
@@ -206,10 +238,11 @@ synology_dsm_deploy() {
     else
       _info "Restarting HTTP services failed"
     fi
-
+    _remove_temp_admin "$SYNO_USE_TEMP_ADMIN" "$SYNO_Username"
     _logout
     return 0
   else
+    _remove_temp_admin "$SYNO_USE_TEMP_ADMIN" "$SYNO_Username"
     _err "Unable to update certificate, error code $response"
     _logout
     return 1
@@ -222,3 +255,13 @@ _logout() {
   response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=logout")
   _debug3 response "$response"
 }
+
+_remove_temp_admin() {
+  flag=$1
+  username=$2
+  
+  if [ -n "${flag}" ]; then
+    _debug "Removing temp admin user in Synology DSM"
+    synouser --del "$username" >/dev/null
+  fi
+}

From 9e958f4e32794db65fa7fd938df2bcc27f7faaff Mon Sep 17 00:00:00 2001
From: Scruel Tao <scruelt@hotmail.com>
Date: Thu, 20 Jul 2023 13:09:21 +0800
Subject: [PATCH 03/24] Fix shellcheck

---
 deploy/synology_dsm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index d7dd1890..22e485ce 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -61,7 +61,7 @@ synology_dsm_deploy() {
     fi
     _debug "Setting temp admin user credential..."
     SYNO_Username=sc-acmesh-tmp
-    SYNO_Password=`openssl rand -base64 16`
+    SYNO_Password=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 16)
     # Ignore 2FA-OTP settings which won't be needed.
     SYNO_Device_Name=
     SYNO_Device_ID=

From cf86d57a9f61e9e2d759c8a44811c3ea6cb612c6 Mon Sep 17 00:00:00 2001
From: Scruel Tao <scruelt@hotmail.com>
Date: Thu, 20 Jul 2023 13:34:57 +0800
Subject: [PATCH 04/24] Fix for shfmt check

---
 deploy/synology_dsm.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 22e485ce..b69916c7 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -66,7 +66,7 @@ synology_dsm_deploy() {
     SYNO_Device_Name=
     SYNO_Device_ID=
   fi
-  
+
   if [ -z "${SYNO_Username:-}" ] || [ -z "${SYNO_Password:-}" ]; then
     _err "You must set either SYNO_USE_TEMP_ADMIN, or set both SYNO_Username and SYNO_Password."
     return 1
@@ -104,8 +104,7 @@ synology_dsm_deploy() {
     _err "Do not use a backslash (\) in your certificate description"
     return 1
   fi
-
-  _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
+ _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
   _debug _base_url "$_base_url"
 
   _debug "Getting API version"
@@ -259,7 +258,7 @@ _logout() {
 _remove_temp_admin() {
   flag=$1
   username=$2
-  
+
   if [ -n "${flag}" ]; then
     _debug "Removing temp admin user in Synology DSM"
     synouser --del "$username" >/dev/null

From ba468bb5e4156c6b914b8653abb2af9d4b2006b4 Mon Sep 17 00:00:00 2001
From: Scruel Tao <scruelt@hotmail.com>
Date: Thu, 20 Jul 2023 13:38:36 +0800
Subject: [PATCH 05/24] Fix for shfmt check

---
 deploy/synology_dsm.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index b69916c7..8dc99a85 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -104,7 +104,8 @@ synology_dsm_deploy() {
     _err "Do not use a backslash (\) in your certificate description"
     return 1
   fi
- _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
+
+  _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
   _debug _base_url "$_base_url"
 
   _debug "Getting API version"

From 29b2960805ac850a564e5ec6521720a3511a1771 Mon Sep 17 00:00:00 2001
From: Scruel Tao <scruelt@hotmail.com>
Date: Thu, 7 Sep 2023 15:01:37 +0800
Subject: [PATCH 06/24] Optimze comment & remove tail space

---
 deploy/synology_dsm.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 15f961e2..455d9de4 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -19,7 +19,7 @@
 # - export SYNO_Scheme="http"
 # - export SYNO_Hostname="localhost"
 # - export SYNO_Port="5000"
-# - export SYNO_Create=1 to allow creating the certificate if it doesn't exist
+# - export SYNO_Create=1   - to allow creating the certificate if it doesn't exist
 # - export SYNO_Device_Name="CertRenewal" - required if 2FA-OTP enabled
 # - export SYNO_Device_ID=""              - required for skipping 2FA-OTP
 # 3. acme.sh --deploy --deploy-hook synology_dsm -d example.com
@@ -191,7 +191,7 @@ synology_dsm_deploy() {
 
   _H1="X-SYNO-TOKEN: $token"
   export _H1
-  _debug2 H1 "${_H1}" 
+  _debug2 H1 "${_H1}"
 
   # Now that we know the username & password are good, save them
   _savedeployconf SYNO_Username "$SYNO_Username"

From f59a92589759de16bf7b639de027309c614dd458 Mon Sep 17 00:00:00 2001
From: LordDarkneo <40838306+LordDarkneo@users.noreply.github.com>
Date: Fri, 22 Dec 2023 09:09:29 -0500
Subject: [PATCH 07/24] Update synology_dsm.sh

Issue for lougout
---
 deploy/synology_dsm.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 10da861a..5ada76de 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -223,7 +223,8 @@ synology_dsm_deploy() {
 
 ####################  Private functions below ##################################
 _logout() {
-  # Logout to not occupy a permanent session, e.g. in DSM's "Connected Users" widget
-  response=$(_get "$_base_url/webapi/entry.cgi?api=SYNO.API.Auth&version=$api_version&method=logout")
+  # Logout to not occupy a permanent session, e.g. in DSM's "Connected Users" widget 
+  #Edit Darkneo - reuse previous variables to logout properly only for CERT user
+  response=$(_get "$_base_url/webapi/$api_path?api=SYNO.API.Auth&version=$api_version&method=logout&_sid=$sid")
   _debug3 response "$response"
 }

From 05696d443a59a205d5e0b1b2f06beef35c4cd0a3 Mon Sep 17 00:00:00 2001
From: LordDarkneo <40838306+LordDarkneo@users.noreply.github.com>
Date: Fri, 22 Dec 2023 14:34:35 -0500
Subject: [PATCH 08/24] Update synology_dsm.sh

#2727 issue when logging out on older version - using variables to unlog only for CERT user
---
 deploy/synology_dsm.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 5ada76de..0dd4d49e 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -223,8 +223,7 @@ synology_dsm_deploy() {
 
 ####################  Private functions below ##################################
 _logout() {
-  # Logout to not occupy a permanent session, e.g. in DSM's "Connected Users" widget 
-  #Edit Darkneo - reuse previous variables to logout properly only for CERT user
+  # Logout SERT user only to not occupy a permanent session, e.g. in DSM's "Connected Users" widget (based on previous variables)
   response=$(_get "$_base_url/webapi/$api_path?api=SYNO.API.Auth&version=$api_version&method=logout&_sid=$sid")
   _debug3 response "$response"
 }

From 6992659ba9063fc3ed8d912ab0cf6d8e8a353d2c Mon Sep 17 00:00:00 2001
From: LordDarkneo <40838306+LordDarkneo@users.noreply.github.com>
Date: Fri, 22 Dec 2023 14:36:52 -0500
Subject: [PATCH 09/24] Update synology_dsm.sh

---
 deploy/synology_dsm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 0dd4d49e..1d945cad 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -223,7 +223,7 @@ synology_dsm_deploy() {
 
 ####################  Private functions below ##################################
 _logout() {
-  # Logout SERT user only to not occupy a permanent session, e.g. in DSM's "Connected Users" widget (based on previous variables)
+  # Logout CERT user only to not occupy a permanent session, e.g. in DSM's "Connected Users" widget (based on previous variables)
   response=$(_get "$_base_url/webapi/$api_path?api=SYNO.API.Auth&version=$api_version&method=logout&_sid=$sid")
   _debug3 response "$response"
 }

From 3ca97d7258204c200eb1fdef32654aff5a23691a Mon Sep 17 00:00:00 2001
From: Dario Pilori <dario.pilori@polito.it>
Date: Thu, 4 Jan 2024 18:28:05 +0100
Subject: [PATCH 10/24] Remove whitespace in script name in routeros.sh deploy
 hook

---
 deploy/routeros.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/routeros.sh b/deploy/routeros.sh
index c4c9470d..d1779b8d 100644
--- a/deploy/routeros.sh
+++ b/deploy/routeros.sh
@@ -137,7 +137,7 @@ routeros_deploy() {
     return $_err_code
   fi
 
-  DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=$ROUTER_OS_USERNAME \
+  DEPLOY_SCRIPT_CMD="/system script add name=\"LECertDeploy-$_cdomain\" owner=$ROUTER_OS_USERNAME \
 comment=\"generated by routeros deploy script in acme.sh\" \
 source=\"/certificate remove [ find name=$_cdomain.cer_0 ];\
 \n/certificate remove [ find name=$_cdomain.cer_1 ];\
@@ -158,11 +158,11 @@ source=\"/certificate remove [ find name=$_cdomain.cer_0 ];\
     return $_err_code
   fi
 
-  if ! _ssh_remote_cmd "/system script run \"LE Cert Deploy - $_cdomain\""; then
+  if ! _ssh_remote_cmd "/system script run \"LECertDeploy-$_cdomain\""; then
     return $_err_code
   fi
 
-  if ! _ssh_remote_cmd "/system script remove \"LE Cert Deploy - $_cdomain\""; then
+  if ! _ssh_remote_cmd "/system script remove \"LECertDeploy-$_cdomain\""; then
     return $_err_code
   fi
 

From b79c3f5cc4eff383f501ad31d60843b84a6b2b21 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Fri, 12 Jan 2024 20:36:49 +0100
Subject: [PATCH 11/24] fix pkg_add

---
 .github/workflows/DNS.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index bf56c1d6..7fd7c45c 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -332,7 +332,7 @@ jobs:
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_NO_SUBDOMAIN TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG http_proxy https_proxy TokenName1 TokenName2 TokenName3 TokenName4 TokenName5 ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: |
-          pkg_add curl socat
+          /usr/sbin/pkg_add curl socat
         usesh: true
         copyback: false
         run: |

From 85e3ecfe0b47dd1dd0e2bd0f926d30d3eed230cd Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sat, 13 Jan 2024 20:28:21 +0100
Subject: [PATCH 12/24] fix omnios

---
 .github/workflows/DNS.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index 7fd7c45c..727ba315 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -493,8 +493,6 @@ jobs:
         copyback: false
         prepare: pkg install socat
         run: |
-          pkg set-mediator -v -I default@1.1 openssl
-          export PATH=/usr/gnu/bin:$PATH
           if [ "${{ secrets.TokenName1}}" ] ; then
             export ${{ secrets.TokenName1}}="${{ secrets.TokenValue1}}"
           fi

From bfb41ce12327ccd49fd7ef0b4d077d2f1a6506e7 Mon Sep 17 00:00:00 2001
From: Robert <rparenton@users.noreply.github.com>
Date: Fri, 12 Jan 2024 15:38:52 -0600
Subject: [PATCH 13/24] Fix acmesh-official#4836 (Switch to new Gandi LiveDNS
 API)

1. Updated LiveDNS API URL for the new API to allow Personal Access Tokens to work
2. Updated authorization header syntax to allow deprecated API Keys to work with the new API
3. Removed white space in JSON response parsing to match responses returned by the server
---
 dnsapi/dns_gandi_livedns.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_gandi_livedns.sh b/dnsapi/dns_gandi_livedns.sh
index 14939d7c..6092f45c 100644
--- a/dnsapi/dns_gandi_livedns.sh
+++ b/dnsapi/dns_gandi_livedns.sh
@@ -13,7 +13,7 @@
 #
 ########  Public functions #####################
 
-GANDI_LIVEDNS_API="https://dns.api.gandi.net/api/v5"
+GANDI_LIVEDNS_API="https://api.gandi.net/v5/livedns"
 
 #Usage: dns_gandi_livedns_add   _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_gandi_livedns_add() {
@@ -78,7 +78,7 @@ dns_gandi_livedns_rm() {
   _gandi_livedns_rest PUT \
     "domains/$_domain/records/$_sub_domain/TXT" \
     "{\"rrset_ttl\": 300, \"rrset_values\": $_new_rrset_values}" &&
-    _contains "$response" '{"message": "DNS Record Created"}' &&
+    _contains "$response" '{"message":"DNS Record Created"}' &&
     _info "Removing record $(__green "success")"
 }
 
@@ -134,7 +134,7 @@ _dns_gandi_append_record() {
   _debug new_rrset_values "$_rrset_values"
   _gandi_livedns_rest PUT "domains/$_domain/records/$sub_domain/TXT" \
     "{\"rrset_ttl\": 300, \"rrset_values\": $_rrset_values}" &&
-    _contains "$response" '{"message": "DNS Record Created"}' &&
+    _contains "$response" '{"message":"DNS Record Created"}' &&
     _info "Adding record $(__green "success")"
 }
 
@@ -144,11 +144,11 @@ _dns_gandi_existing_rrset_values() {
   if ! _gandi_livedns_rest GET "domains/$domain/records/$sub_domain"; then
     return 1
   fi
-  if ! _contains "$response" '"rrset_type": "TXT"'; then
+  if ! _contains "$response" '"rrset_type":"TXT"'; then
     _debug "Does not have a _acme-challenge TXT record yet."
     return 1
   fi
-  if _contains "$response" '"rrset_values": \[\]'; then
+  if _contains "$response" '"rrset_values":\[\]'; then
     _debug "Empty rrset_values for TXT record, no previous TXT record."
     return 1
   fi
@@ -169,7 +169,7 @@ _gandi_livedns_rest() {
   if [ -n "$GANDI_LIVEDNS_TOKEN" ]; then
     export _H2="Authorization: Bearer $GANDI_LIVEDNS_TOKEN"
   else
-    export _H2="X-Api-Key: $GANDI_LIVEDNS_KEY"
+    export _H2="Authorization: Apikey $GANDI_LIVEDNS_KEY"
   fi
 
   if [ "$m" = "GET" ]; then

From f8dac5905ce49088995f4c12c36b5bb5842ffb16 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sat, 3 Feb 2024 18:07:50 +0800
Subject: [PATCH 14/24] check the status of Order object and the Authorization
 object.

---
 acme.sh | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 75030acd..aa41a1d9 100755
--- a/acme.sh
+++ b/acme.sh
@@ -4515,7 +4515,7 @@ issue() {
 
   vlist="$Le_Vlist"
   _cleardomainconf "Le_Vlist"
-  _info "Getting domain auth token for each domain"
+  _debug "Getting domain auth token for each domain"
   sep='#'
   dvsep=','
   if [ -z "$vlist" ]; then
@@ -4571,12 +4571,22 @@ issue() {
     if [ "$_notAfter" ]; then
       _newOrderObj="$_newOrderObj,\"notAfter\": \"$_notAfter\""
     fi
+    _debug "STEP 1, Ordering a Certificate"
     if ! _send_signed_request "$ACME_NEW_ORDER" "$_newOrderObj}"; then
       _err "Create new order error."
       _clearup
       _on_issue_err "$_post_hook"
       return 1
     fi
+    if _contains "$response" "invalid"; then
+      if echo "$response" | _normalizeJson | grep '"status":"invalid"' >/dev/null 2>&1; then
+        _err "Create new order with invalid status."
+        _err "$response"
+        _clearup
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
+    fi
 
     Le_LinkOrder="$(echo "$responseHeaders" | grep -i '^Location.*$' | _tail_n 1 | tr -d "\r\n " | cut -d ":" -f 2-)"
     _debug Le_LinkOrder "$Le_LinkOrder"
@@ -4601,6 +4611,7 @@ issue() {
       return 1
     fi
 
+    _debug "STEP 2, Get the authorizations of each domain"
     #domain and authz map
     _authorizations_map=""
     for _authz_url in $(echo "$_authorizations_seg" | tr ',' ' '); do
@@ -4609,6 +4620,7 @@ issue() {
         _err "get to authz error."
         _err "_authorizations_seg" "$_authorizations_seg"
         _err "_authz_url" "$_authz_url"
+        _err "$response"
         _clearup
         _on_issue_err "$_post_hook"
         return 1
@@ -4616,6 +4628,14 @@ issue() {
 
       response="$(echo "$response" | _normalizeJson)"
       _debug2 response "$response"
+      if echo "$response" | grep '"status":"invalid"' >/dev/null 2>&1; then
+        _err "get authz objec with invalid status, please try again later."
+        _err "_authorizations_seg" "$_authorizations_seg"
+        _err "$response"
+        _clearup
+        _on_issue_err "$_post_hook"
+        return 1
+      fi
       _d="$(echo "$response" | _egrep_o '"value" *: *"[^"]*"' | cut -d : -f 2- | tr -d ' "')"
       if _contains "$response" "\"wildcard\" *: *true"; then
         _d="*.$_d"

From 3dca67112d4df8d0124617053f1c2bf64e2a9aef Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sat, 3 Feb 2024 18:39:58 +0800
Subject: [PATCH 15/24] fix netbsd

---
 .github/workflows/NetBSD.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/NetBSD.yml b/.github/workflows/NetBSD.yml
index a5565d09..4574bef5 100644
--- a/.github/workflows/NetBSD.yml
+++ b/.github/workflows/NetBSD.yml
@@ -20,7 +20,6 @@ concurrency:
 
 
 
-
 jobs:
   NetBSD:
     strategy:
@@ -44,6 +43,7 @@ jobs:
       CA: ${{ matrix.CA }}
       CA_EMAIL: ${{ matrix.CA_EMAIL }}
       TEST_PREFERRED_CHAIN: ${{ matrix.TEST_PREFERRED_CHAIN }}
+      ACME_USE_WGET: ${{ matrix.ACME_USE_WGET }}
     steps:
     - uses: actions/checkout@v4
     - uses: vmactions/cf-tunnel@v0
@@ -57,7 +57,7 @@ jobs:
       run: cd .. && git clone --depth=1 https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - uses: vmactions/netbsd-vm@v1
       with:
-        envs: 'TEST_LOCAL TestingDomain TEST_ACME_Server CA_ECDSA CA CA_EMAIL TEST_PREFERRED_CHAIN'
+        envs: 'TEST_LOCAL TestingDomain TEST_ACME_Server CA_ECDSA CA CA_EMAIL TEST_PREFERRED_CHAIN ACME_USE_WGET'
         nat: |
           "8080": "80"
         prepare: |

From 7ec692cdefb3ef3775c3a12e3fe46e147a89c75b Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sat, 3 Feb 2024 23:59:48 +0800
Subject: [PATCH 16/24] fix socat for netbsd: listens to ipv4 by default.

---
 acme.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index aa41a1d9..270a0531 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2499,10 +2499,10 @@ _startserver() {
   _debug Le_Listen_V6 "$Le_Listen_V6"
 
   _NC="socat"
-  if [ "$Le_Listen_V4" ]; then
-    _NC="$_NC -4"
-  elif [ "$Le_Listen_V6" ]; then
+  if [ "$Le_Listen_V6" ]; then
     _NC="$_NC -6"
+  else
+    _NC="$_NC -4"
   fi
 
   if [ "$DEBUG" ] && [ "$DEBUG" -gt "1" ]; then

From 802121d54a28b2a5636878331e494abb76e6ea1a Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 11:42:28 +0800
Subject: [PATCH 17/24] show dns message on any branch

---
 .github/workflows/pr_dns.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/pr_dns.yml b/.github/workflows/pr_dns.yml
index b627d3ab..645597e8 100644
--- a/.github/workflows/pr_dns.yml
+++ b/.github/workflows/pr_dns.yml
@@ -4,8 +4,6 @@ on:
   pull_request_target:
     types:
       - opened
-    branches:
-      - 'dev'
     paths:
       - 'dnsapi/*.sh'
 

From 99e5c159a7d0fe4cd22ee5fdff2de04f95d67017 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:17:03 +0800
Subject: [PATCH 18/24] check socat "Permission denied"

---
 acme.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 270a0531..4a3b53a2 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2519,12 +2519,21 @@ _startserver() {
   _content_len="$(printf "%s" "$content" | wc -c)"
   _debug _content_len "$_content_len"
   _debug "_NC" "$_NC $SOCAT_OPTIONS"
+  _socaterr="$(_mktemp)"
   $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
 echo 'HTTP/1.0 200 OK'; \
 echo 'Content-Length\: $_content_len'; \
 echo ''; \
-printf '%s' '$content';" &
+printf '%s' '$content';" 2>"$_socaterr" &
   serverproc="$!"
+  if [ -f "$_socaterr" ]; Then
+    if grep "Permission denied" "$_socaterr" >/dev/null; Then
+      _err "socat: $(cat $_socaterr)"
+      _err "Can not listen for user: $(whoami)"
+      _err "Maybe try with root again?"
+      return 1
+    fi
+  fi
 }
 
 _stopserver() {

From 0084cb7403f6310e005d99ec70443a7190aca8fb Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:18:58 +0800
Subject: [PATCH 19/24] fix format

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 4a3b53a2..53ff9563 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2527,7 +2527,7 @@ echo ''; \
 printf '%s' '$content';" 2>"$_socaterr" &
   serverproc="$!"
   if [ -f "$_socaterr" ]; Then
-    if grep "Permission denied" "$_socaterr" >/dev/null; Then
+    if grep "Permission denied" "$_socaterr" >/dev/null; then
       _err "socat: $(cat $_socaterr)"
       _err "Can not listen for user: $(whoami)"
       _err "Maybe try with root again?"

From 37e4f35c936621db5cab970ad77b638126458dea Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:21:50 +0800
Subject: [PATCH 20/24] fix format

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 53ff9563..36bcbce2 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2526,7 +2526,7 @@ echo 'Content-Length\: $_content_len'; \
 echo ''; \
 printf '%s' '$content';" 2>"$_socaterr" &
   serverproc="$!"
-  if [ -f "$_socaterr" ]; Then
+  if [ -f "$_socaterr" ]; then
     if grep "Permission denied" "$_socaterr" >/dev/null; then
       _err "socat: $(cat $_socaterr)"
       _err "Can not listen for user: $(whoami)"

From bd6bbba9487d3cf0803e361b2f81307da9c5193a Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:27:06 +0800
Subject: [PATCH 21/24] remove socaterr temp file

---
 acme.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/acme.sh b/acme.sh
index 36bcbce2..320e22af 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2531,6 +2531,7 @@ printf '%s' '$content';" 2>"$_socaterr" &
       _err "socat: $(cat $_socaterr)"
       _err "Can not listen for user: $(whoami)"
       _err "Maybe try with root again?"
+      rm -f "$_socaterr"
       return 1
     fi
   fi

From e04093efe2fd9418277260328e211d0cd2df8316 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:31:34 +0800
Subject: [PATCH 22/24] remove socket err temp file

---
 acme.sh | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/acme.sh b/acme.sh
index 320e22af..38ccaade 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2519,19 +2519,19 @@ _startserver() {
   _content_len="$(printf "%s" "$content" | wc -c)"
   _debug _content_len "$_content_len"
   _debug "_NC" "$_NC $SOCAT_OPTIONS"
-  _socaterr="$(_mktemp)"
+  export _SOCAT_ERR="$(_mktemp)"
   $_NC $SOCAT_OPTIONS SYSTEM:"sleep 1; \
 echo 'HTTP/1.0 200 OK'; \
 echo 'Content-Length\: $_content_len'; \
 echo ''; \
-printf '%s' '$content';" 2>"$_socaterr" &
+printf '%s' '$content';" 2>"$_SOCAT_ERR" &
   serverproc="$!"
-  if [ -f "$_socaterr" ]; then
-    if grep "Permission denied" "$_socaterr" >/dev/null; then
-      _err "socat: $(cat $_socaterr)"
+  if [ -f "$_SOCAT_ERR" ]; then
+    if grep "Permission denied" "$_SOCAT_ERR" >/dev/null; then
+      _err "socat: $(cat $_SOCAT_ERR)"
       _err "Can not listen for user: $(whoami)"
       _err "Maybe try with root again?"
-      rm -f "$_socaterr"
+      rm -f "$_SOCAT_ERR"
       return 1
     fi
   fi
@@ -2541,10 +2541,12 @@ _stopserver() {
   pid="$1"
   _debug "pid" "$pid"
   if [ -z "$pid" ]; then
+    rm -f "$_SOCAT_ERR"
     return
   fi
 
   kill $pid
+  rm -f "$_SOCAT_ERR"
 
 }
 

From d76272f0ea102a67563b8728df56b7d8a0d18eb1 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Sun, 4 Feb 2024 12:35:07 +0800
Subject: [PATCH 23/24] fix message

---
 .github/workflows/pr_dns.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/pr_dns.yml b/.github/workflows/pr_dns.yml
index 645597e8..4d7a325d 100644
--- a/.github/workflows/pr_dns.yml
+++ b/.github/workflows/pr_dns.yml
@@ -20,6 +20,7 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: `**Welcome**
+                First thing: don't send PR to the master branch, please send to the dev branch instead.
                 Please make sure you've read our [DNS API Dev Guide](../wiki/DNS-API-Dev-Guide) and [DNS-API-Test](../wiki/DNS-API-Test).
                 Then reply on this message, otherwise, your code will not be reviewed or merged.
                 We look forward to reviewing your Pull request shortly ✨

From 10b4bb598a48613eaadebecd05a9cffc6e1f2e36 Mon Sep 17 00:00:00 2001
From: neil <neilgit@neilpang.com>
Date: Mon, 12 Feb 2024 13:16:08 +0800
Subject: [PATCH 24/24] fix
 https://github.com/acmesh-official/acme.sh/issues/4995#issuecomment-1937486243

---
 acme.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index 38ccaade..9c5b1481 100755
--- a/acme.sh
+++ b/acme.sh
@@ -3195,7 +3195,8 @@ _setNginx() {
     return 1
   fi
   _info "Check the nginx conf before setting up."
-  if ! nginx -t >/dev/null; then
+  if ! nginx -t >/dev/null 2>&1; then
+    _err "It seems that nginx conf is not correct, cannot continue."
     return 1
   fi
 
@@ -3222,14 +3223,14 @@ location ~ \"^/\.well-known/acme-challenge/([-_a-zA-Z0-9]+)\$\" {
   fi
   _debug3 "Modified config:$(cat $FOUND_REAL_NGINX_CONF)"
   _info "nginx conf is done, let's check it again."
-  if ! nginx -t >/dev/null; then
+  if ! nginx -t >/dev/null 2>&1; then
     _err "It seems that nginx conf was broken, let's restore."
     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
     return 1
   fi
 
   _info "Reload nginx"
-  if ! nginx -s reload >/dev/null; then
+  if ! nginx -s reload >/dev/null 2>&1; then
     _err "It seems that nginx reload error, let's restore."
     cat "$_backup_conf" >"$FOUND_REAL_NGINX_CONF"
     return 1