From 861df496707b2837d1972f76ce5c8c1fdf2d19d7 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 9 Mar 2018 16:29:47 +0100
Subject: [PATCH 01/68] Add All-inkl kasserver script.

---
 README.md         |   1 +
 dnsapi/dns_kas.sh | 153 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 154 insertions(+)
 create mode 100755 dnsapi/dns_kas.sh

diff --git a/README.md b/README.md
index bfcb477..ed84f4a 100644
--- a/README.md
+++ b/README.md
@@ -328,6 +328,7 @@ You don't have to do anything manually!
 1. zonomi.com DNS API
 1. DreamHost.com API
 1. DirectAdmin API
+1. All-inkl/Kasserver API
 
 
 And: 
diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
new file mode 100755
index 0000000..64a4472
--- /dev/null
+++ b/dnsapi/dns_kas.sh
@@ -0,0 +1,153 @@
+#!/usr/bin/env sh
+########################################################################
+# All-inkl Kasserver hook script for acme.sh
+#
+# Environment variables:
+#
+#  - $KAS_Login (Kasserver API login name)
+#  - $KAS_Authtype (Kasserver API auth type. Default: sha1)
+#  - $KAS_Authdata (Kasserver API auth data.)
+#
+# Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
+# Credits: Inspired by dns_he.sh. Thanks a lot man!
+# Git repo: TODO
+# TODO: Better Error handling
+# TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
+#       => Get all root zones and compare once the provider offers that.
+
+KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
+
+########  Public functions #####################
+
+dns_kas_add() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 All-inkl/Kasserver hook"
+  _info "Adding or Updating $_full_domain DNS TXT entry on All-inkl/Kasserver"
+
+  _check_and_save
+  _get_zone "$_full_domain"
+  _get_record_name "$_full_domain"
+  _get_record_id
+
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&var1=record_name"
+  params="$params&wert1=$_record_name"
+  params="$params&var2=record_type"
+  params="$params&wert2=TXT"
+  params="$params&var3=record_data"
+  params="$params&wert3=$_txt_value"
+  params="$params&var4=record_aux"
+  params="$params&wert4=0"
+  # If there is no record_id create the record
+  if [ -z "$_record_id" ]; then
+    _info "Creating TXT DNS record"
+    params="$params&kas_action=add_dns_settings"
+    params="$params&var5=zone_host"
+    params="$params&wert5=$_zone"
+  else # Update the existing record
+    _info "Updating existing TXT DNS record"
+    params="$params&kas_action=update_dns_settings"
+    params="$params&var5=record_id"
+    params="$params&wert5=$_record_id"
+  fi
+
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+
+  if ! _contains "$response" "TRUE"; then
+    _err "An unkown error occurred, please check manually."
+    return 1
+  fi
+  return 0
+}
+
+dns_kas_rm() {
+  _full_domain=$1
+  _txt_value=$2
+  _info "Using DNS-01 All-inkl/Kasserver hook"
+  _info "Cleaning up after All-inkl/Kasserver hook"
+  _info "Removing $_full_domain DNS TXT entry on All-inkl/Kasserver"
+
+  _check_and_save
+  _get_zone "$_full_domain"
+  _get_record_name "$_full_domain"
+  _get_record_id
+
+  # If there is a record_id, delete the entry
+  if [ -n "$_record_id" ]; then
+    params="?kas_login=$KAS_Login"
+    params="$params&kas_auth_type=$KAS_Authtype"
+    params="$params&kas_auth_data=$KAS_Authdata"
+    params="$params&kas_action=delete_dns_settings"
+    params="$params&var1=record_id"
+    params="$params&wert1=$_record_id"
+    response="$(_get "$KAS_Api$params")"
+    _debug2 "response" "$response"
+    if ! _contains "$response" "TRUE"; then
+      _err "Either the txt record is not found or another error occurred, please check manually."
+      return 1
+    fi
+  else # Cannot delete or unkown error
+    _err "No record_id found that can be deleted. Please check manually."
+    return 1
+  fi
+
+ return 0
+}
+
+########################## PRIVATE FUNCTIONS ###########################
+
+# Checks for the ENV variables and saves them
+_check_and_save() {
+  KAS_Login="${KAS_Login:-$(_readaccountconf_mutable KAS_Login)}"
+  KAS_Authtype="${KAS_Authtype:-$(_readaccountconf_mutable KAS_Authtype)}"
+  KAS_Authdata="${KAS_Authdata:-$(_readaccountconf_mutable KAS_Authdata)}"
+
+  if [ -z "$KAS_Login" ] || [ -z "$KAS_Authtype" ] || [ -z "$KAS_Authdata" ]; then
+    KAS_Login=
+    KAS_Authtype=
+    KAS_Authdata=
+    _err "No auth details provided. Please set user credentials using the \$KAS_Login, \$KAS_Authtype, and \$KAS_Authdata environment variables."
+    return 1
+  fi
+  _saveaccountconf_mutable KAS_Login "$KAS_Login"
+  _saveaccountconf_mutable KAS_Authtype "$KAS_Authtype"
+  _saveaccountconf_mutable KAS_Authdata "$KAS_Authdata"
+  return 0
+}
+
+# Gets back the base domain/zone.
+# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+_get_zone() {
+  _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
+}
+
+# Removes the domain/subdomain from the entry since kasserver
+# cannot handle _full_domain
+# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+_get_record_name() {
+  _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+}
+
+# Retrieve the DNS record ID
+_get_record_id() {
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&kas_action=get_dns_settings"
+  params="$params&var1=zone_host"
+  params="$params&wert1=$_zone"
+
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+
+  _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  _debug2 _record_id "$_record_id"
+
+  return 0
+}

From 32d7bd5ab1d390d67a2705dfa8c3914e4f43d00a Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 9 Mar 2018 16:33:35 +0100
Subject: [PATCH 02/68] Add own github repository URL.

---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 64a4472..647a7bb 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -10,7 +10,7 @@
 #
 # Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
-# Git repo: TODO
+# Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 # TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
 #       => Get all root zones and compare once the provider offers that.

From cbf0ceacd57fe16f27fa6150ffd2b180d796f3b3 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 14:51:16 +0100
Subject: [PATCH 03/68] Update dnsapi Readme.

---
 dnsapi/README.md | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/dnsapi/README.md b/dnsapi/README.md
index 8b4a835..ec6233f 100644
--- a/dnsapi/README.md
+++ b/dnsapi/README.md
@@ -784,6 +784,27 @@ acme.sh --issue --dns dns_da -d example.com -d www.example.com
 
 The `DA_Api` and `DA_Api_Insecure` will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
 
+## 42. Use All-inkl Kasserver API
+
+All-inkl Kasserver API (https://kasapi.kasserver.com/dokumentation) needs you to set your Login credentials like so:
+
+```
+export KAS_Login="yourusername"
+export KAS_Authtype="sha1"
+export KAS_Authdata="password"
+```
+
+Note: Please for now always set the `KAS_Authtype` always simply to `sha1`.
+
+Then you can issue your certificate:
+
+```
+acme.sh --issue --dns dns_kas -d example.com -d www.example.com
+```
+
+The `KAS_Login`, `KAS_Authtype` and `KAS_Authdata` settings will be saved in `~/.acme.sh/account.conf` and will be reused when needed.
+
+Please report any issues to https://github.com/phlegx/acme.sh.
 
 # Use custom API
 

From e431df06ab6457292e9d82e03f4d5ca015d0b85d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 14:54:08 +0100
Subject: [PATCH 04/68] Only create entry. Remove update.

---
 dnsapi/dns_kas.sh | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 647a7bb..518b283 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -30,6 +30,7 @@ dns_kas_add() {
   _get_record_name "$_full_domain"
   _get_record_id
 
+  _info "Creating TXT DNS record"
   params="?kas_login=$KAS_Login"
   params="$params&kas_auth_type=$KAS_Authtype"
   params="$params&kas_auth_data=$KAS_Authdata"
@@ -41,18 +42,9 @@ dns_kas_add() {
   params="$params&wert3=$_txt_value"
   params="$params&var4=record_aux"
   params="$params&wert4=0"
-  # If there is no record_id create the record
-  if [ -z "$_record_id" ]; then
-    _info "Creating TXT DNS record"
-    params="$params&kas_action=add_dns_settings"
-    params="$params&var5=zone_host"
-    params="$params&wert5=$_zone"
-  else # Update the existing record
-    _info "Updating existing TXT DNS record"
-    params="$params&kas_action=update_dns_settings"
-    params="$params&var5=record_id"
-    params="$params&wert5=$_record_id"
-  fi
+  params="$params&kas_action=add_dns_settings"
+  params="$params&var5=zone_host"
+  params="$params&wert5=$_zone"
 
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"

From 11bfb1e5fd679a21477c393f9cfc19004e72d306 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 15:02:47 +0100
Subject: [PATCH 05/68] Fix return values of some functions.

---
 dnsapi/dns_kas.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 518b283..dc87bee 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -116,6 +116,7 @@ _check_and_save() {
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone() {
   _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
+  return 0
 }
 
 # Removes the domain/subdomain from the entry since kasserver
@@ -124,6 +125,7 @@ _get_zone() {
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_record_name() {
   _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+  return 0
 }
 
 # Retrieve the DNS record ID

From 26b5180bf71f007f55c0264aba76defa0574626c Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 15:49:40 +0100
Subject: [PATCH 06/68] Rename full_domain and txt_value variables.

---
 dnsapi/dns_kas.sh | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index dc87bee..0eda1d3 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -20,14 +20,14 @@ KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
 ########  Public functions #####################
 
 dns_kas_add() {
-  _full_domain=$1
-  _txt_value=$2
+  _fulldomain=$1
+  _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
-  _info "Adding or Updating $_full_domain DNS TXT entry on All-inkl/Kasserver"
+  _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_full_domain"
-  _get_record_name "$_full_domain"
+  _get_zone "$_fulldomain"
+  _get_record_name "$_fulldomain"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -39,7 +39,7 @@ dns_kas_add() {
   params="$params&var2=record_type"
   params="$params&wert2=TXT"
   params="$params&var3=record_data"
-  params="$params&wert3=$_txt_value"
+  params="$params&wert3=$_txtvalue"
   params="$params&var4=record_aux"
   params="$params&wert4=0"
   params="$params&kas_action=add_dns_settings"
@@ -57,15 +57,15 @@ dns_kas_add() {
 }
 
 dns_kas_rm() {
-  _full_domain=$1
-  _txt_value=$2
+  _fulldomain=$1
+  _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
-  _info "Removing $_full_domain DNS TXT entry on All-inkl/Kasserver"
+  _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_full_domain"
-  _get_record_name "$_full_domain"
+  _get_zone "$_fulldomain"
+  _get_record_name "$_fulldomain"
   _get_record_id
 
   # If there is a record_id, delete the entry
@@ -86,7 +86,6 @@ dns_kas_rm() {
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
-
  return 0
 }
 
@@ -120,7 +119,7 @@ _get_zone() {
 }
 
 # Removes the domain/subdomain from the entry since kasserver
-# cannot handle _full_domain
+# cannot handle _fulldomain
 # TODO Get a list of all possible root zones and compare (Currently not possible via provider)
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_record_name() {
@@ -141,7 +140,12 @@ _get_record_id() {
   _debug2 "response" "$response"
 
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  echo "###########################"
+  echo "$_record_name"
+  echo "$_record_id"
+  echo "###########################"
+  echo "$response"
+  echo "###########################"
   _debug2 _record_id "$_record_id"
-
   return 0
 }

From cb4a2cf02921d538edc497f0af0d479df04ffb90 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 16 Mar 2018 16:47:47 +0100
Subject: [PATCH 07/68] remove debug output

---
 dnsapi/dns_kas.sh | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 0eda1d3..c3941d9 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -140,12 +140,6 @@ _get_record_id() {
   _debug2 "response" "$response"
 
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
-  echo "###########################"
-  echo "$_record_name"
-  echo "$_record_id"
-  echo "###########################"
-  echo "$response"
-  echo "###########################"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 68f66ca101ba04bf3abc3fb97f1f0162d6a2506c Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Thu, 2 Aug 2018 16:20:48 +0200
Subject: [PATCH 08/68] Add default delay for the calls to KAS api since they
 are very restrictive with that.

---
 dnsapi/dns_kas.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index c3941d9..3b608d4 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -45,7 +45,8 @@ dns_kas_add() {
   params="$params&kas_action=add_dns_settings"
   params="$params&var5=zone_host"
   params="$params&wert5=$_zone"
-
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
@@ -76,6 +77,8 @@ dns_kas_rm() {
     params="$params&kas_action=delete_dns_settings"
     params="$params&var1=record_id"
     params="$params&wert1=$_record_id"
+    _debug2 "Wait for 10 seconds by default before calling KAS API."
+    sleep 10
     response="$(_get "$KAS_Api$params")"
     _debug2 "response" "$response"
     if ! _contains "$response" "TRUE"; then
@@ -136,6 +139,8 @@ _get_record_id() {
   params="$params&var1=zone_host"
   params="$params&wert1=$_zone"
 
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 

From 1ef7fd36590068fd83631318c13b79bf384e0046 Mon Sep 17 00:00:00 2001
From: Dominic Jonas <djonas@haprotec.de>
Date: Wed, 5 Jun 2019 11:38:41 +0200
Subject: [PATCH 09/68] support to delete multiple entries

---
 dnsapi/dns_kas.sh | 32 +++++++++++++++++++-------------
 1 file changed, 19 insertions(+), 13 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 3b608d4..14c0b37 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -69,27 +69,33 @@ dns_kas_rm() {
   _get_record_name "$_fulldomain"
   _get_record_id
 
-  # If there is a record_id, delete the entry
+  # If there is a record_id, delete the entry   
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
     params="$params&kas_auth_type=$KAS_Authtype"
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
-    params="$params&var1=record_id"
-    params="$params&wert1=$_record_id"
-    _debug2 "Wait for 10 seconds by default before calling KAS API."
-    sleep 10
-    response="$(_get "$KAS_Api$params")"
-    _debug2 "response" "$response"
-    if ! _contains "$response" "TRUE"; then
-      _err "Either the txt record is not found or another error occurred, please check manually."
-      return 1
-    fi
+    
+    # split it into a seperated list, if there where multiples entries made
+    records=($_record_id)
+    for i in "${records[@]}"
+    do
+      params2="$params&var1=record_id"
+      params2="$params2&wert1=$i"
+      _debug2 "Wait for 10 seconds by default before calling KAS API."
+      sleep 10
+      response="$(_get "$KAS_Api$params2")"
+      _debug2 "response" "$response"
+      if ! _contains "$response" "TRUE"; then
+        _err "Either the txt record is not found or another error occurred, please check manually."
+        return 1
+      fi
+    done
   else # Cannot delete or unkown error
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
- return 0
+return 0
 }
 
 ########################## PRIVATE FUNCTIONS ###########################
@@ -147,4 +153,4 @@ _get_record_id() {
   _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
   _debug2 _record_id "$_record_id"
   return 0
-}
+}
\ No newline at end of file

From 4bf1f579f51d7343c1b643f7bb357ba9e48d0cd6 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 16:28:57 +0200
Subject: [PATCH 10/68] Add OPNsense Bind API Support

---
 dnsapi/dns_opnsense.sh | 262 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 262 insertions(+)
 create mode 100755 dnsapi/dns_opnsense.sh

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
new file mode 100755
index 0000000..aa12354
--- /dev/null
+++ b/dnsapi/dns_opnsense.sh
@@ -0,0 +1,262 @@
+#!/usr/bin/env sh
+
+#OPNsense Bind API
+#https://docs.opnsense.org/development/api.html
+#
+#OPNs_Host="opnsense.example.com"
+#OPNs_Port="443"
+#OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
+#OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
+#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+
+########  Public functions #####################
+#Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
+#fulldomain
+#txtvalue
+dns_opnsense_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! set_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+#fulldomain
+dns_opnsense_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _opns_check_auth || return 1
+
+  if ! rm_record "$fulldomain" "$txtvalue"; then
+    return 1
+  fi
+
+  return 0
+}
+
+set_record() {
+  _info "Adding record"
+  fulldomain=$1
+  new_challenge=$2
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _return_str=""
+  _record_string=""
+  _build_record_string "$_domainid" "$_host" "$new_challenge"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Update
+    if _opns_rest "POST" "/record/setRecord/${_uuid}" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+
+  else
+    #create
+    if _opns_rest "POST" "/record/addRecord" "$_record_string"; then
+      _return_str="$response"
+    else
+      return 1
+    fi
+  fi
+
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
+  then
+    _opns_rest "POST" "/service/reconfigure" "{}"
+    _debug "Record created"
+  else
+    _err "Error createing record $_record_string"
+    return 1
+  fi
+
+  return 0
+}
+
+rm_record() {
+  _info "Remove record"
+  fulldomain=$1
+  new_challenge="$2"
+
+  _debug "Detect root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _debug _domain "$_domain"
+  _debug _host "$_host"
+  _debug _domainid "$_domainid"
+  _uuid=""
+  if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
+    # Delete
+    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
+      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+        _opns_rest "POST" "/service/reconfigure" "{}"
+        _debug "Record deleted"
+      else
+        _err "Error delteting record $fulldomain"
+        return 1
+      fi
+    else
+        _err "Error delteting record $fulldomain"
+        return 1
+    fi
+  else
+    _info "Record not found, nothing to remove"
+  fi
+
+  return 0
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _domainid=domid
+ #_domain=domain.com
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  if _opns_rest "GET" "/domain/get"; then
+    _domain_response="$response"
+  else
+    return 1
+  fi
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+    _debug h "$h"
+    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+
+    if [ -n "$id" ];then
+      _debug id "$id"
+      _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain="${h}"
+      _domainid="${id}"
+      return 0
+    fi
+    p=$i
+    i=$(_math $i + 1)
+  done
+  _debug "$domain not found"
+
+  return 1
+}
+
+_opns_rest() {
+  method=$1
+  ep=$2
+  data=$3
+  #Percent encode user and token
+  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
+  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  export _H1="Content-Type: application/json"
+  if [ ! "$method" = "GET" ]; then
+    _debug data "$data"
+    export _H1="Content-Type: application/json"
+    response="$(_post "$data" "$opnsense_url" "" "$method")"
+  else
+    export _H1=""
+    response="$(_get "$opnsense_url")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+
+  return 0
+}
+
+_build_record_string() {
+  _record_string="{\"record\":{\"enabled\":\"1\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"}}"
+}
+
+_existingchallenge() {
+  if _opns_rest "GET" "/record/searchRecord"; then
+    _record_response="$response"
+  else
+    return 1
+  fi
+  _uuid=""
+  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+
+  if [ -n "$_uuid" ];then
+    _debug uuid "$_uuid"
+    return 0
+  fi
+  _debug "${2}.$1{1} record not found"
+
+  return 1
+}
+
+_opns_check_auth() {
+  OPNs_Host="${OPNs_Host:-$(_readaccountconf_mutable OPNs_Host)}"
+  OPNs_Port="${OPNs_Port:-$(_readaccountconf_mutable OPNs_Port)}"
+  OPNs_Key="${OPNs_Key:-$(_readaccountconf_mutable OPNs_Key)}"
+  OPNs_Token="${OPNs_Token:-$(_readaccountconf_mutable OPNs_Token)}"
+  OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
+
+  if [ -z "$OPNs_Host" ]; then
+    OPNs_Host="localhost"
+    _err "You don't specify OPNsense address."
+  fi
+
+  if [ -z "$OPNs_Port" ]; then
+    OPNs_Port="443"
+    _err "You don't specify OPNsense Port."
+  fi
+
+  if [ -z "$OPNs_Api_Insecure" ]; then
+    OPNs_Api_Insecure="0"
+  fi
+
+  if [ -z "$OPNs_Key" ]; then
+    OPNs_Key=""
+    _err "You don't specify OPNsense api key id."
+    _err "Please set you OPNs_Key and try again."
+    return 1
+  fi
+
+  if [ -z "$OPNs_Token" ]; then
+    OPNs_Token=""
+    _err "You don't specify OPNsense token."
+    _err "Please create you OPNs_Token and try again."
+    return 1
+  fi
+
+  #save the api addr and key to the account conf file.
+  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
+  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
+  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
+  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
+  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+
+  if ! _opns_rest "GET" "/general/get";then
+    _err "Can't Access OPNsense"
+    return 1
+  fi
+  return 0
+}

From dfb4883c936bed4377424aa3df3bb4a5a4576c2c Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:17:32 +0200
Subject: [PATCH 11/68] Some fixes

---
 dnsapi/dns_opnsense.sh | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index aa12354..8b7942a 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -7,7 +7,7 @@
 #OPNs_Port="443"
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=1     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -74,8 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null
-  then
+  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -103,8 +102,8 @@ rm_record() {
   _uuid=""
   if _existingchallenge "$_domain" "$_host" "$new_challenge"; then
     # Delete
-    if _opns_rest "POST" "/record/delRecord/${_uuid}"  "\{\}"; then
-      if echo "$_return_str" | _egrep_o "result":"deleted" >/dev/null; then
+    if _opns_rest "POST" "/record/delRecord/${_uuid}" "\{\}"; then
+      if echo "$_return_str" | _egrep_o "\"result\":\"deleted\"" >/dev/null; then
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
@@ -112,8 +111,8 @@ rm_record() {
         return 1
       fi
     else
-        _err "Error delteting record $fulldomain"
-        return 1
+      _err "Error delteting record $fulldomain"
+      return 1
     fi
   else
     _info "Record not found, nothing to remove"
@@ -126,7 +125,7 @@ rm_record() {
 #_acme-challenge.www.domain.com
 #returns
 # _domainid=domid
- #_domain=domain.com
+#_domain=domain.com
 _get_root() {
   domain=$1
   i=2
@@ -144,9 +143,9 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo $_domain_response| _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1  | cut -d '"' -f 2 )
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
 
-    if [ -n "$id" ];then
+    if [ -n "$id" ]; then
       _debug id "$id"
       _host=$(printf "%s" "$domain" | cut -d . -f 1-$p)
       _domain="${h}"
@@ -166,8 +165,8 @@ _opns_rest() {
   ep=$2
   data=$3
   #Percent encode user and token
-  key=$(echo $OPNs_Key | tr -d "\n\r" | _url_encode )
-  token=$(echo $OPNs_Token| tr -d "\n\r" | _url_encode )
+  key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
+  token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
   export _H1="Content-Type: application/json"
@@ -200,9 +199,9 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo $_record_response| _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2  | cut -d '"' -f 2 )
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
 
-  if [ -n "$_uuid" ];then
+  if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"
     return 0
   fi
@@ -254,7 +253,7 @@ _opns_check_auth() {
   _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
-  if ! _opns_rest "GET" "/general/get";then
+  if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1
   fi

From ec654d2355b47571f6d6fc1cbfcc3a8e808491c3 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 17:24:00 +0200
Subject: [PATCH 12/68] More space removing

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 8b7942a..ac8be53 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -74,7 +74,7 @@ set_record() {
     fi
   fi
 
-  if echo "$_return_str" | _egrep_o  "\"result\":\"saved\"" >/dev/null; then
+  if echo "$_return_str" | _egrep_o "\"result\":\"saved\"" >/dev/null; then
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
@@ -143,7 +143,7 @@ _get_root() {
       return 1
     fi
     _debug h "$h"
-    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':'  -f 1 | cut -d '"' -f 2)
+    id=$(echo "$_domain_response" | _egrep_o "\"[^\"]*\":{\"enabled\":\"1\",\"type\":{\"master\":{\"value\":\"master\",\"selected\":1},\"slave\":{\"value\":\"slave\",\"selected\":0}},\"masterip\":\"[^\"]*\",\"domainname\":\"${h}\"" | cut -d ':' -f 1 | cut -d '"' -f 2)
 
     if [ -n "$id" ]; then
       _debug id "$id"
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':'  -f 2 | cut -d '"' -f 2)
+  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From bfa6e52470de86363112c4e265721cd36ed2e400 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 12 Sep 2019 20:50:20 +0200
Subject: [PATCH 13/68] another whitespace

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ac8be53..ff6f8a5 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -199,7 +199,7 @@ _existingchallenge() {
     return 1
   fi
   _uuid=""
-  _uuid=$( echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
+  _uuid=$(echo "$_record_response" | _egrep_o "\"uuid\":\"[^\"]*\",\"enabled\":\"[01]\",\"domain\":\"$1\",\"name\":\"$2\",\"type\":\"TXT\",\"value\":\"$3\"" | cut -d ':' -f 2 | cut -d '"' -f 2)
 
   if [ -n "$_uuid" ]; then
     _debug uuid "$_uuid"

From c0449a3ed22e102cd68f959460619dd9ceff18cc Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:04:20 +0200
Subject: [PATCH 14/68] Only save Attributes if it is set

---
 dnsapi/dns_opnsense.sh | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ff6f8a5..ea9677b 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -220,22 +220,32 @@ _opns_check_auth() {
   if [ -z "$OPNs_Host" ]; then
     OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
+    return 1
+  else
+    _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
   if [ -z "$OPNs_Port" ]; then
     OPNs_Port="443"
-    _err "You don't specify OPNsense Port."
+  else
+    _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
+  else
+  #save the api addr and key to the account conf file.
+    _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
+  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
     OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
@@ -243,15 +253,10 @@ _opns_check_auth() {
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1
+  else
+    _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-  #save the api addr and key to the account conf file.
-  _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
-  _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
-  _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
-  _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
-  _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
 
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"

From 430956d3043d0a958fa696fe51a1d88f5c77d48d Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:13:35 +0200
Subject: [PATCH 15/68] Fix whitespaces

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index ea9677b..abd85ab 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -234,7 +234,7 @@ _opns_check_auth() {
   if [ -z "$OPNs_Api_Insecure" ]; then
     OPNs_Api_Insecure="0"
   else
-  #save the api addr and key to the account conf file.
+    #save the api addr and key to the account conf file.
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
   export HTTPS_INSECURE="${OPNs_Api_Insecure}"

From b85c1a88614b531698133565643e618482904f06 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 25 Oct 2019 08:22:15 +0200
Subject: [PATCH 16/68] Fix additional line

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index abd85ab..0f7cdea 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -257,7 +257,6 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
-
   if ! _opns_rest "GET" "/general/get"; then
     _err "Can't Access OPNsense"
     return 1

From 0b3ae1f9727787f46eec66ce796e030a5474a845 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:10:30 +0100
Subject: [PATCH 17/68] Add suggestions

---
 dnsapi/dns_opnsense.sh | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 0f7cdea..97f18d1 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,15 +4,19 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443"
+#OPNs_Port="443" (optional, defaults to 443 if unset)
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0     # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
 #fulldomain
 #txtvalue
+OPNs_DefaultPort=443
+OPNs_DefaultApi_Insecure=0
+
+
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2
@@ -168,7 +172,7 @@ _opns_rest() {
   key=$(echo "$OPNs_Key" | tr -d "\n\r" | _url_encode)
   token=$(echo "$OPNs_Token" | tr -d "\n\r" | _url_encode)
 
-  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port}/api/bind${ep}"
+  opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
@@ -218,29 +222,30 @@ _opns_check_auth() {
   OPNs_Api_Insecure="${OPNs_Api_Insecure:-$(_readaccountconf_mutable OPNs_Api_Insecure)}"
 
   if [ -z "$OPNs_Host" ]; then
-    OPNs_Host="localhost"
     _err "You don't specify OPNsense address."
     return 1
   else
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if [ -z "$OPNs_Port" ]; then
-    OPNs_Port="443"
+  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+    _err 'OPNs_Port specified but not numeric value'
+    return 1
+  elif [ -z "$OPNs_Port" ]; then
+    _info "OPNSense port not specified. Defaulting to using port $OPNs_DefaultPort"
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-
-  if [ -z "$OPNs_Api_Insecure" ]; then
-    OPNs_Api_Insecure="0"
-  else
-    #save the api addr and key to the account conf file.
+  
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+    _err 'OPNs_Api_Insecure specified but not 0/1 value'
+    return 1
+  elif [ -n "$OPNs_Api_Insecure" ]; then
     _saveaccountconf_mutable OPNs_Api_Insecure "$OPNs_Api_Insecure"
   fi
-  export HTTPS_INSECURE="${OPNs_Api_Insecure}"
+  export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    OPNs_Key=""
     _err "You don't specify OPNsense api key id."
     _err "Please set you OPNs_Key and try again."
     return 1
@@ -249,7 +254,6 @@ _opns_check_auth() {
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    OPNs_Token=""
     _err "You don't specify OPNsense token."
     _err "Please create you OPNs_Token and try again."
     return 1

From afdf8a78c0a42e22265309c522ee3cda4993e227 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:18:09 +0100
Subject: [PATCH 18/68] fix space

---
 dnsapi/dns_opnsense.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 97f18d1..afd96c3 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -236,7 +236,7 @@ _opns_check_auth() {
   else
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
-  
+
   if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1

From fc8d9df5162bdec5e401edc4e8d6faba80e92d89 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Thu, 7 Nov 2019 14:33:38 +0100
Subject: [PATCH 19/68] fix newline

---
 dnsapi/dns_opnsense.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index afd96c3..6dde12a 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -16,7 +16,6 @@
 OPNs_DefaultPort=443
 OPNs_DefaultApi_Insecure=0
 
-
 dns_opnsense_add() {
   fulldomain=$1
   txtvalue=$2

From 18fc42e63b5f4491502b8a2203036c93b1c4eaba Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <langenbachs@gmail.com>
Date: Thu, 7 Nov 2019 22:06:32 +0100
Subject: [PATCH 20/68] typos and integrate suggestions from stilez

---
 dnsapi/dns_opnsense.sh | 35 ++++++++++++++++++++---------------
 1 file changed, 20 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 6dde12a..4fbe944 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -4,10 +4,13 @@
 #https://docs.opnsense.org/development/api.html
 #
 #OPNs_Host="opnsense.example.com"
-#OPNs_Port="443" (optional, defaults to 443 if unset)
+#OPNs_Port="443"
+# optional, defaults to 443 if unset
 #OPNs_Key="qocfU9RSbt8vTIBcnW8bPqCrpfAHMDvj5OzadE7Str+rbjyCyk7u6yMrSCHtBXabgDDXx/dY0POUp7ZA"
 #OPNs_Token="pZEQ+3ce8dDlfBBdg3N8EpqpF5I1MhFqdxX06le6Gl8YzyQvYCfCzNaFX9O9+IOSyAs7X71fwdRiZ+Lv"
-#OPNs_Api_Insecure=0 (optional, defaults to 0 if unset) # Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
+#OPNs_Api_Insecure=0
+# optional, defaults to 0 if unset
+# Set 1 for insecure and 0 for secure -> difference is whether ssl cert is checked for validity (0) or whether it is just accepted (1)
 
 ########  Public functions #####################
 #Usage: add _acme-challenge.www.domain.com "123456789ABCDEF0000000000000000000000000000000000000"
@@ -44,15 +47,16 @@ dns_opnsense_rm() {
 }
 
 set_record() {
-  _info "Adding record"
   fulldomain=$1
   new_challenge=$2
+  _info "Adding record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
     _err "invalid domain"
     return 1
   fi
+
   _debug _domain "$_domain"
   _debug _host "$_host"
   _debug _domainid "$_domainid"
@@ -81,7 +85,7 @@ set_record() {
     _opns_rest "POST" "/service/reconfigure" "{}"
     _debug "Record created"
   else
-    _err "Error createing record $_record_string"
+    _err "Error creating record $_record_string"
     return 1
   fi
 
@@ -89,9 +93,9 @@ set_record() {
 }
 
 rm_record() {
-  _info "Remove record"
   fulldomain=$1
   new_challenge="$2"
+  _info "Remove record $fulldomain with challenge: $new_challenge"
 
   _debug "Detect root zone"
   if ! _get_root "$fulldomain"; then
@@ -110,18 +114,18 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error delteting record $fulldomain"
+        _err "Error deleting record $host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error delteting record $fulldomain"
+      _err "Error deleting record $host from domain $fulldomain"
       return 1
     fi
   else
     _info "Record not found, nothing to remove"
   fi
 
-  return 0
+  return 0  
 }
 
 ####################  Private functions below ##################################
@@ -173,6 +177,7 @@ _opns_rest() {
 
   opnsense_url="https://${key}:${token}@${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   export _H1="Content-Type: application/json"
+  _debug2 "Try to call api: https://${OPNs_Host}:${OPNs_Port:-$OPNs_DefaultPort}/api/bind${ep}"
   if [ ! "$method" = "GET" ]; then
     _debug data "$data"
     export _H1="Content-Type: application/json"
@@ -227,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep -q '^[0-9]*$'; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -236,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep -q '^[01]$'; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then
@@ -245,23 +250,23 @@ _opns_check_auth() {
   export HTTPS_INSECURE="${OPNs_Api_Insecure:-$OPNs_DefaultApi_Insecure}"
 
   if [ -z "$OPNs_Key" ]; then
-    _err "You don't specify OPNsense api key id."
-    _err "Please set you OPNs_Key and try again."
+    _err "you have not specified your OPNsense api key id."
+    _err "Please set OPNs_Key and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Key "$OPNs_Key"
   fi
 
   if [ -z "$OPNs_Token" ]; then
-    _err "You don't specify OPNsense token."
-    _err "Please create you OPNs_Token and try again."
+    _err "you have not specified your OPNsense token."
+    _err "Please create OPNs_Token and try again."
     return 1
   else
     _saveaccountconf_mutable OPNs_Token "$OPNs_Token"
   fi
 
   if ! _opns_rest "GET" "/general/get"; then
-    _err "Can't Access OPNsense"
+    _err "Call to OPNsense API interface failed. Unable to access OPNsense API."
     return 1
   fi
   return 0

From 0c76890572932edc06bf3fb39c9e329b2ceec326 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:52:10 +0100
Subject: [PATCH 21/68] whitespace fix

---
 dnsapi/dns_opnsense.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 4fbe944..9e4af15 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -125,7 +125,7 @@ rm_record() {
     _info "Record not found, nothing to remove"
   fi
 
-  return 0  
+  return 0
 }
 
 ####################  Private functions below ##################################
@@ -232,7 +232,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Host "$OPNs_Host"
   fi
 
-  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Port" | grep '^[0-9]*$' >/dev/null; then
     _err 'OPNs_Port specified but not numeric value'
     return 1
   elif [ -z "$OPNs_Port" ]; then
@@ -241,7 +241,7 @@ _opns_check_auth() {
     _saveaccountconf_mutable OPNs_Port "$OPNs_Port"
   fi
 
-  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null ; then
+  if ! printf '%s' "$OPNs_Api_Insecure" | grep '^[01]$' >/dev/null; then
     _err 'OPNs_Api_Insecure specified but not 0/1 value'
     return 1
   elif [ -n "$OPNs_Api_Insecure" ]; then

From 9cb328966c63d86565276e3ccc7d7e53d5101514 Mon Sep 17 00:00:00 2001
From: Jesai Langenbach <j.langenbach@kdz-ws.net>
Date: Fri, 8 Nov 2019 08:58:51 +0100
Subject: [PATCH 22/68] typo

---
 dnsapi/dns_opnsense.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_opnsense.sh b/dnsapi/dns_opnsense.sh
index 9e4af15..b2a3746 100755
--- a/dnsapi/dns_opnsense.sh
+++ b/dnsapi/dns_opnsense.sh
@@ -114,11 +114,11 @@ rm_record() {
         _opns_rest "POST" "/service/reconfigure" "{}"
         _debug "Record deleted"
       else
-        _err "Error deleting record $host from domain $fulldomain"
+        _err "Error deleting record $_host from domain $fulldomain"
         return 1
       fi
     else
-      _err "Error deleting record $host from domain $fulldomain"
+      _err "Error deleting record $_host from domain $fulldomain"
       return 1
     fi
   else

From ec1f9841b21cd9aa7ca96aac4589472f3624f4eb Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:22:26 +0100
Subject: [PATCH 23/68] Replace grep -A.

---
 dnsapi/dns_kas.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 14c0b37..bf01fef 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -69,13 +69,13 @@ dns_kas_rm() {
   _get_record_name "$_fulldomain"
   _get_record_id
 
-  # If there is a record_id, delete the entry   
+  # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
     params="$params&kas_auth_type=$KAS_Authtype"
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
-    
+
     # split it into a seperated list, if there where multiples entries made
     records=($_record_id)
     for i in "${records[@]}"
@@ -150,7 +150,7 @@ _get_record_id() {
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
-  _record_id="$(echo "$response" | grep -A 4  "$_record_name" | grep "record_id" | cut -f2 -d">" | xargs)"
+  _record_id="$(echo "$response"  | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
-}
\ No newline at end of file
+}

From c641b61b26f20771b044bf838ce5943fc163d8f7 Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:46:44 +0100
Subject: [PATCH 24/68] Fix a few snytax issues

---
 dnsapi/dns_kas.sh | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index bf01fef..759b3aa 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -78,8 +78,7 @@ dns_kas_rm() {
 
     # split it into a seperated list, if there where multiples entries made
     records=($_record_id)
-    for i in "${records[@]}"
-    do
+    for i in "${records[@]}"; do
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."
@@ -95,7 +94,7 @@ dns_kas_rm() {
     _err "No record_id found that can be deleted. Please check manually."
     return 1
   fi
-return 0
+  return 0
 }
 
 ########################## PRIVATE FUNCTIONS ###########################

From 953a9b17681a456ed4538f82e071eca3f713199d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Fri, 29 Nov 2019 22:51:23 +0100
Subject: [PATCH 25/68] Remove obsolete blank.

---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 759b3aa..4f2b1d5 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -149,7 +149,7 @@ _get_record_id() {
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
-  _record_id="$(echo "$response"  | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
 }

From c22705a59392f11007bdd18b086520399794b6e6 Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Wed, 11 Dec 2019 17:13:11 +0100
Subject: [PATCH 26/68] Add DNS API support for Constellix.

---
 dnsapi/dns_constellix.sh | 137 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)
 create mode 100644 dnsapi/dns_constellix.sh

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
new file mode 100644
index 0000000..bc55231
--- /dev/null
+++ b/dnsapi/dns_constellix.sh
@@ -0,0 +1,137 @@
+#!/usr/bin/env sh
+
+# Author: Wout Decre <wout@rambla.be>
+
+CONSTELLIX_API="https://api.dns.constellix.com/v1"
+#CONSTELLIX_KEY="XXX"
+#CONSTELLIX_SECRET="XXX"
+
+########  Public functions #####################
+
+dns_constellix_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
+  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+
+  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+    _err "You did not specify the Contellix API key and secret yet."
+    return 1
+  fi
+
+  _saveaccountconf_mutable CONSTELLIX_KEY "$CONSTELLIX_KEY"
+  _saveaccountconf_mutable CONSTELLIX_SECRET "$CONSTELLIX_SECRET"
+
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _info "Adding TXT record"
+  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"add\":true,\"set\":{\"name\":\"${_sub_domain}\",\"ttl\":120,\"roundRobin\":[{\"value\":\"${txtvalue}\"}]}}]"; then
+    if printf -- "%s" "$response" | grep "{\"success\":\"1 record(s) added, 0 record(s) updated, 0 record(s) deleted\"}" >/dev/null; then
+      _info "Added"
+      return 0
+    else
+      _err "Error adding TXT record"
+      return 1
+    fi
+  fi
+}
+
+dns_constellix_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
+  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+
+  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+    _err "You did not specify the Contellix API key and secret yet."
+    return 1
+  fi
+
+  if ! _get_root "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _info "Removing TXT record"
+  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"delete\":true,\"filter\":{\"field\":\"name\",\"op\":\"eq\",\"value\":\"${_sub_domain}\"}}]"; then
+    if printf -- "%s" "$response" | grep "{\"success\":\"0 record(s) added, 0 record(s) updated, 1 record(s) deleted\"}" >/dev/null; then
+      _info "Removed"
+      return 0
+    else
+      _err "Error removing TXT record"
+      return 1
+    fi
+  fi
+}
+
+####################  Private functions below ##################################
+
+_get_root() {
+  domain=$1
+  i=2
+  p=1
+  _debug "Detecting root zone"
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if ! _constellix_rest GET "domains"; then
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*" | head -n 1 | cut -d ':' -f 2 | tr -d '}')
+      if [ "$_domain_id" ]; then
+        _sub_domain=$(printf "%s" "$domain" | cut -d '.' -f 1-$p)
+        _domain="$h"
+
+        _debug _domain_id "$_domain_id"
+        _debug _sub_domain "$_sub_domain"
+        _debug _domain "$_domain"
+        return 0
+      fi
+      return 1
+    fi
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}
+
+_constellix_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  rdate=$(date +"%s")"000"
+  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_SECRET" | _hex_dump | tr -d ' ')" | _base64)
+
+  export _H1="x-cnsdns-apiKey: $CONSTELLIX_KEY"
+  export _H2="x-cnsdns-requestDate: $rdate"
+  export _H3="x-cnsdns-hmac: $hmac"
+  export _H4="Accept: application/json"
+  export _H5="Content-Type: application/json"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$CONSTELLIX_API/$ep" "" "$m")"
+  else
+    response="$(_get "$CONSTELLIX_API/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "Error $ep"
+    return 1
+  fi
+
+  _debug response "$response"
+  return 0
+}

From e8e6feeb0ffd273c20328bfa11a36f3f916c997a Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Wed, 11 Dec 2019 17:15:35 +0100
Subject: [PATCH 27/68] Use different e-mail.

---
 dnsapi/dns_constellix.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index bc55231..55f4a71 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env sh
 
-# Author: Wout Decre <wout@rambla.be>
+# Author: Wout Decre <wout@canodus.be>
 
 CONSTELLIX_API="https://api.dns.constellix.com/v1"
 #CONSTELLIX_KEY="XXX"

From 3ccac629bcbb9f94602a7338891ec56ad9a1501d Mon Sep 17 00:00:00 2001
From: Martin Kammerlander <martin.kammerlander@phlegx.com>
Date: Thu, 12 Dec 2019 16:23:42 +0100
Subject: [PATCH 28/68] Change the loop for sh.

---
 dnsapi/dns_kas.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 4f2b1d5..a2dc0d5 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -76,9 +76,7 @@ dns_kas_rm() {
     params="$params&kas_auth_data=$KAS_Authdata"
     params="$params&kas_action=delete_dns_settings"
 
-    # split it into a seperated list, if there where multiples entries made
-    records=($_record_id)
-    for i in "${records[@]}"; do
+    for i in $_record_id; do
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."

From 594b83e7a646e6d5a8176e50712c688da31a8d6a Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 11:58:21 +0100
Subject: [PATCH 29/68] Update dns_kas.sh

remove "rev" command
fix "Error removing txt for domain:_acme-challenge.foo"
---
 dnsapi/dns_kas.sh | 46 +++++++++++++++++++++++++---------------------
 1 file changed, 25 insertions(+), 21 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index a2dc0d5..19bfd6b 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -12,8 +12,7 @@
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
-# TODO: Does not work with Domains that have double endings like i.e. 'co.uk'
-#       => Get all root zones and compare once the provider offers that.
+########################################################################
 
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
 
@@ -26,8 +25,7 @@ dns_kas_add() {
   _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_fulldomain"
-  _get_record_name "$_fulldomain"
+  _get_zone_and_record_name "$_fulldomain"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -65,8 +63,7 @@ dns_kas_rm() {
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
 
   _check_and_save
-  _get_zone "$_fulldomain"
-  _get_record_name "$_fulldomain"
+  _get_zone_and_record_name "$_fulldomain"
   _get_record_id
 
   # If there is a record_id, delete the entry
@@ -116,20 +113,28 @@ _check_and_save() {
   return 0
 }
 
-# Gets back the base domain/zone.
-# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
+# Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_zone() {
-  _zone=$(echo "$1" | rev | cut -d . -f1-2 | rev).
-  return 0
-}
-
-# Removes the domain/subdomain from the entry since kasserver
-# cannot handle _fulldomain
-# TODO Get a list of all possible root zones and compare (Currently not possible via provider)
-# See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_record_name() {
-  _record_name=$(echo "$1" | rev | cut -d"." -f3- | rev)
+_get_zone_and_record_name()() {
+  _zonen="$( cat testfile.txt  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+  _domain="$1"
+  if _endswith "$_domain" "."; then
+    _domain="$(echo "$_domain" | sed 's/.$//')"
+  fi
+  _rootzone="$_domain"
+  for i in $_zonen; do
+    l1=${#_rootzone}
+    l2=${#i}
+    if _endswith "$_domain" "$i" && [ "$l1" -ge "$l2" ]; then
+      _rootzone="$i"
+    fi
+  done
+  _zone="$_rootzone"
+  _debug2 "zone:" "$_zone"
+
+  l3=$((${#_domain}-l1-1))
+  _record_name="$(echo "$_domain" | cut -c -"$l3")"
+  _debug2 "record_name:" "$_record_name"
   return 0
 }
 
@@ -146,8 +151,7 @@ _get_record_id() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-
-  _record_id="$(echo "$response" | tr -d "\n\r" | sed "s/=> Array/\n=> Array/g" | tr -d " " | tr '[]' '<>' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
   _debug2 _record_id "$_record_id"
   return 0
 }

From 99c47dd50a7a41fa8ef519c23ee5fc94644135bf Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 22:42:51 +0100
Subject: [PATCH 30/68] Update dns_kas.sh

only bash needed
---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 19bfd6b..a39f8c9 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -1,4 +1,4 @@
-#!/usr/bin/env sh
+#!/bin/bash
 ########################################################################
 # All-inkl Kasserver hook script for acme.sh
 #

From a138425417fe76deb6eade981a6e4c240f9afc41 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sat, 28 Dec 2019 23:42:46 +0100
Subject: [PATCH 31/68] Update dns_kas.sh

sorry for this commit.  ;)
Fix NewBeMistakes
---
 dnsapi/dns_kas.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index a39f8c9..437422b 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -115,8 +115,8 @@ _check_and_save() {
 
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
-_get_zone_and_record_name()() {
-  _zonen="$( cat testfile.txt  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+_get_zone_and_record_name() {
+  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
   _domain="$1"
   if _endswith "$_domain" "."; then
     _domain="$(echo "$_domain" | sed 's/.$//')"

From 2214507db01f547520fbed05afb3ecc1035c6fd3 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Sun, 29 Dec 2019 10:59:28 +0100
Subject: [PATCH 32/68] Revert "Update dns_kas.sh"

This reverts commit 99c47dd50a7a41fa8ef519c23ee5fc94644135bf.
---
 dnsapi/dns_kas.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 437422b..5c7cd9e 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env sh
 ########################################################################
 # All-inkl Kasserver hook script for acme.sh
 #

From 8dd1df71cc6cf59eaedbe9b2fd0a40279cb98f60 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Thu, 2 Jan 2020 17:10:36 +0100
Subject: [PATCH 33/68] Update dns_kas.sh

tested and works now
---
 dnsapi/dns_kas.sh | 46 ++++++++++++++++++++++++++++------------------
 1 file changed, 28 insertions(+), 18 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 5c7cd9e..b17eeee 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -13,19 +13,18 @@
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 ########################################################################
-
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
-
 ########  Public functions #####################
-
-dns_kas_add() {
+dns_kas_add(){
   _fulldomain=$1
   _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-
+  _info "Check and Save Props"
   _check_and_save
+  _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
+  _info "Getting Record ID"
   _get_record_id
 
   _info "Creating TXT DNS record"
@@ -61,11 +60,14 @@ dns_kas_rm() {
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-
+   
+  _info "Check and Save Props"
   _check_and_save
+  _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
+  _info "Getting Record ID"
   _get_record_id
-
+  
   # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
@@ -116,11 +118,19 @@ _check_and_save() {
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone_and_record_name() {
-  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | cut -d '>' -f 3)"
+ 
+  params="?kas_login=$KAS_Login"
+  params="$params&kas_auth_type=$KAS_Authtype"
+  params="$params&kas_auth_data=$KAS_Authdata"
+  params="$params&kas_action=get_domains"
+
+  _debug2 "Wait for 10 seconds by default before calling KAS API."
+  sleep 10
+  response="$(_get "$KAS_Api$params")"
+  _debug2 "response" "$response"
+  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
   _domain="$1"
-  if _endswith "$_domain" "."; then
-    _domain="$(echo "$_domain" | sed 's/.$//')"
-  fi
+  _temp_domain="$(echo "$1" |  sed 's/\.$//')"
   _rootzone="$_domain"
   for i in $_zonen; do
     l1=${#_rootzone}
@@ -129,12 +139,12 @@ _get_zone_and_record_name() {
       _rootzone="$i"
     fi
   done
-  _zone="$_rootzone"
-  _debug2 "zone:" "$_zone"
-
-  l3=$((${#_domain}-l1-1))
-  _record_name="$(echo "$_domain" | cut -c -"$l3")"
-  _debug2 "record_name:" "$_record_name"
+  _zone="${_rootzone}."
+  _temp_record_name="$(echo "$_temp_domain" | sed "s/"$_rootzone"//g")"
+  _record_name="$(echo "$_temp_record_name" |  sed 's/\.$//')"
+  _debug2 "Zone:" "$_zone"
+  _debug2 "Domain:" "$_domain"
+  _debug2 "Record_Name:" "$_record_name"
   return 0
 }
 
@@ -151,7 +161,7 @@ _get_record_id() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | cut -d '>' -f 3)"
+  _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | sed "s/record_id>=>//g")"
   _debug2 _record_id "$_record_id"
   return 0
 }

From f01936ca4fac5499d90787098c2eec3a6359ab56 Mon Sep 17 00:00:00 2001
From: helbgd <helmut.angerer@googlemail.com>
Date: Tue, 14 Jan 2020 15:19:37 +0100
Subject: [PATCH 34/68] Server Name not correct

the servername of the server that has the upd.php file was not correct
---
 dnsapi/dns_ddnss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ddnss.sh b/dnsapi/dns_ddnss.sh
index 903b961..1bf258f 100644
--- a/dnsapi/dns_ddnss.sh
+++ b/dnsapi/dns_ddnss.sh
@@ -12,7 +12,7 @@
 # --
 #
 
-DDNSS_DNS_API="https://ddnss.de/upd.php"
+DDNSS_DNS_API="https://www.ddnss.de/upd.php"
 
 ########  Public functions #####################
 

From b1ce6ffcc79da2d0b458a4195c10d1fd45a59182 Mon Sep 17 00:00:00 2001
From: helbgd <helmut.angerer@googlemail.com>
Date: Tue, 14 Jan 2020 15:27:35 +0100
Subject: [PATCH 35/68] www is incorrect as well

use ip4 and not www, if you use www it deletes the ip4 address of the host and updates only the ip6 address
---
 dnsapi/dns_ddnss.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_ddnss.sh b/dnsapi/dns_ddnss.sh
index 1bf258f..53781d0 100644
--- a/dnsapi/dns_ddnss.sh
+++ b/dnsapi/dns_ddnss.sh
@@ -12,7 +12,7 @@
 # --
 #
 
-DDNSS_DNS_API="https://www.ddnss.de/upd.php"
+DDNSS_DNS_API="https://ip4.ddnss.de/upd.php"
 
 ########  Public functions #####################
 

From 024619676b73e2cf20527471c6209c924d63c0e4 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Wed, 15 Jan 2020 13:56:01 +0100
Subject: [PATCH 36/68] Update dns_kas.sh

fixing 4 Travis style
---
 dnsapi/dns_kas.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index b17eeee..31d68e6 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -9,17 +9,18 @@
 #  - $KAS_Authdata (Kasserver API auth data.)
 #
 # Author: Martin Kammerlander, Phlegx Systems OG <martin.kammerlander@phlegx.com>
+# Updated by: Marc-Oliver Lange <git@die-lang.es>
 # Credits: Inspired by dns_he.sh. Thanks a lot man!
 # Git repo: https://github.com/phlegx/acme.sh
 # TODO: Better Error handling
 ########################################################################
 KAS_Api="https://kasapi.kasserver.com/dokumentation/formular.php"
-########  Public functions #####################
-dns_kas_add(){
+########  Public functions  #####################
+dns_kas_add() {
   _fulldomain=$1
   _txtvalue=$2
   _info "Using DNS-01 All-inkl/Kasserver hook"
-  _info "Adding or Updating $_fulldomain DNS TXT entry on All-inkl/Kasserver"
+  _info "Adding $_fulldomain DNS TXT entry on All-inkl/Kasserver"
   _info "Check and Save Props"
   _check_and_save
   _info "Checking Zone and Record_Name"
@@ -128,9 +129,9 @@ _get_zone_and_record_name() {
   sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
-  _zonen="$( echo "$response"  | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
+  _zonen="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
   _domain="$1"
-  _temp_domain="$(echo "$1" |  sed 's/\.$//')"
+  _temp_domain="$(echo "$1" | sed 's/\.$//')"
   _rootzone="$_domain"
   for i in $_zonen; do
     l1=${#_rootzone}
@@ -140,8 +141,8 @@ _get_zone_and_record_name() {
     fi
   done
   _zone="${_rootzone}."
-  _temp_record_name="$(echo "$_temp_domain" | sed "s/"$_rootzone"//g")"
-  _record_name="$(echo "$_temp_record_name" |  sed 's/\.$//')"
+  _temp_record_name="$(echo "$_temp_domain" | sed "s/$_rootzone//g")"
+  _record_name="$(echo "$_temp_record_name" | sed 's/\.$//')"
   _debug2 "Zone:" "$_zone"
   _debug2 "Domain:" "$_domain"
   _debug2 "Record_Name:" "$_record_name"

From 431c53efcf6f8ee4ae011b572729b624c9c86ace Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Wed, 15 Jan 2020 17:48:30 +0100
Subject: [PATCH 37/68] Update dns_kas.sh

Removing spaces in empty lines
---
 dnsapi/dns_kas.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 31d68e6..9540168 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -61,14 +61,14 @@ dns_kas_rm() {
   _info "Using DNS-01 All-inkl/Kasserver hook"
   _info "Cleaning up after All-inkl/Kasserver hook"
   _info "Removing $_fulldomain DNS TXT entry on All-inkl/Kasserver"
-   
+
   _info "Check and Save Props"
   _check_and_save
   _info "Checking Zone and Record_Name"
   _get_zone_and_record_name "$_fulldomain"
   _info "Getting Record ID"
   _get_record_id
-  
+
   # If there is a record_id, delete the entry
   if [ -n "$_record_id" ]; then
     params="?kas_login=$KAS_Login"
@@ -119,7 +119,7 @@ _check_and_save() {
 # Gets back the base domain/zone and record name.
 # See: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
 _get_zone_and_record_name() {
- 
+  params="?kas_login=$KAS_Login"
   params="?kas_login=$KAS_Login"
   params="$params&kas_auth_type=$KAS_Authtype"
   params="$params&kas_auth_data=$KAS_Authdata"

From 0f54cf83f4f24f037e1adf52be37c9e809df4825 Mon Sep 17 00:00:00 2001
From: StefanAbl <thorn.st57@gmail.com>
Date: Sat, 18 Jan 2020 13:48:29 +0100
Subject: [PATCH 38/68] fixed dynv6 dns validation

---
 dnsapi/dns_dynv6.sh | 125 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 125 insertions(+)
 create mode 100644 dnsapi/dns_dynv6.sh

diff --git a/dnsapi/dns_dynv6.sh b/dnsapi/dns_dynv6.sh
new file mode 100644
index 0000000..b1fa765
--- /dev/null
+++ b/dnsapi/dns_dynv6.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env sh
+#Author StefanAbl
+#Usage specify a private keyfile to use with dynv6 'export KEY="path/to/keyfile"'
+#if no keyfile is specified, you will be asked if you want to create one in /home/$USER/.ssh/dynv6 and /home/$USER/.ssh/dynv6.pub
+########  Public functions #####################
+# Please Read this guide first: https://github.com/Neilpang/acme.sh/wiki/DNS-API-Dev-Guide
+#Usage: dns_myapi_add  _acme-challenge.www.domain.com  "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_dynv6_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using dynv6 api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  _get_keyfile
+  
+  _info "using keyfile $dynv6_keyfile"
+  _get_domain "$fulldomain"
+  _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
+  if ! _contains "$_your_hosts" "$_host"; then
+    _debug "The host is $_host and the record $_record"
+    _debug "Dynv6 returned $_your_hosts"
+    _err "The host $_host does not exists on your dynv6 account"
+    return 1
+  fi
+  _debug "found host on your account"
+  returnval="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts \""$_host"\" records set \""$_record"\" txt data \""$txtvalue"\")"
+  _debug "Dynv6 returend this after record was added: $returnval"
+  if _contains "$returnval" "created"; then
+    return 0
+  elif _contains "$returnval" "updated"; then
+    return 0
+  else
+    _err "Something went wrong! it does not seem like the record was added succesfully"
+    return 1
+  fi
+  return 1
+}
+#Usage: fulldomain txtvalue
+#Remove the txt record after validation.
+dns_dynv6_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _info "Using dynv6 api"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+  _get_keyfile
+  _info "using keyfile $dynv6_keyfile"
+  _get_domain "$fulldomain"
+  _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
+  if ! _contains "$_your_hosts" "$_host"; then
+    _debug "The host is $_host and the record $_record"
+    _debug "Dynv6 returned $_your_hosts"
+    _err "The host $_host does not exists on your dynv6 account"
+    return 1
+  fi
+  _debug "found host on your account"
+  _info "$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts "\"$_host\"" records del "\"$_record\"" txt)"
+  return 0
+
+}
+#################### Private functions below ##################################
+#Usage: No Input required
+#returns
+#dynv6_keyfile the path to the new keyfile that has been generated
+_generate_new_key() {
+  dynv6_keyfile="$(eval echo ~"$USER")/.ssh/dynv6"
+  _info "Path to key file used: $dynv6_keyfile"
+  if [ ! -f "$dynv6_keyfile" ] && [ ! -f "$dynv6_keyfile.pub" ]; then
+    _debug "generating key in $dynv6_keyfile and $dynv6_keyfile.pub"
+    ssh-keygen -f "$dynv6_keyfile" -t ssh-ed25519 -N ''
+  else
+    _err "There is already a file in $dynv6_keyfile or $dynv6_keyfile.pub"
+    return 1
+  fi
+
+}
+#Usage: _acme-challenge.www.example.dynv6.net
+#returns
+#_host= example.dynv6.net
+#_record=_acme-challenge.www
+#aborts if not a valid domain
+_get_domain() {
+  _full_domain="$1"
+  _debug "getting domain for $_full_domain"
+  if ! _contains "$_full_domain" 'dynv6.net' && ! _contains "$_full_domain" 'dns.army' && ! _contains "$_full_domain" 'dns.navy'; then
+    _err "The hosts does not seem to be a dynv6 host"
+    return 1
+  fi
+  _record="${_full_domain%.*}"
+  _record="${_record%.*}"
+  _record="${_record%.*}"
+  _debug "The record we are ging to use is $_record"
+  _host="$_full_domain"
+  while [ "$(echo "$_host" | grep -o '\.' | wc -l)" != "2" ]; do
+    _host="${_host#*.}"
+  done
+  _debug "And the host is $_host"
+  return 0
+
+}
+
+# Usage: No input required
+#returns
+#dynv6_keyfile path to the key that will be used
+_get_keyfile() {
+	_debug "get keyfile method called"
+  dynv6_keyfile="${dynv6_keyfile:-$(_readaccountconf_mutable dynv6_keyfile)}"
+  _debug Your key is "$dynv6_keyfile"
+  if [ -z "$dynv6_keyfile" ]; then
+    if [ -z "$KEY" ]; then
+      _err "You did not specify a key to use with dynv6"
+      _info "Creating new dynv6 api key to add to dynv6.com"
+      _generate_new_key
+      _info "Please add this key to dynv6.com $(cat "$dynv6_keyfile.pub")"
+      _info "Hit Enter to contiue"
+      read _
+      #save the credentials to the account conf file.
+    else
+      dynv6_keyfile="$KEY"
+    fi
+    _saveaccountconf_mutable dynv6_keyfile "$dynv6_keyfile"
+  fi
+
+
+}

From 6e3ba3ca45daaa47f2afe901647585bb6d5c2010 Mon Sep 17 00:00:00 2001
From: StefanAbl <thorn.st57@gmail.com>
Date: Sat, 18 Jan 2020 13:53:26 +0100
Subject: [PATCH 39/68] travis

---
 dnsapi/dns_dynv6.sh | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_dynv6.sh b/dnsapi/dns_dynv6.sh
index b1fa765..cf39282 100644
--- a/dnsapi/dns_dynv6.sh
+++ b/dnsapi/dns_dynv6.sh
@@ -12,7 +12,6 @@ dns_dynv6_add() {
   _debug fulldomain "$fulldomain"
   _debug txtvalue "$txtvalue"
   _get_keyfile
-  
   _info "using keyfile $dynv6_keyfile"
   _get_domain "$fulldomain"
   _your_hosts="$(ssh -i "$dynv6_keyfile" api@dynv6.com hosts)"
@@ -72,7 +71,6 @@ _generate_new_key() {
     _err "There is already a file in $dynv6_keyfile or $dynv6_keyfile.pub"
     return 1
   fi
-
 }
 #Usage: _acme-challenge.www.example.dynv6.net
 #returns
@@ -103,7 +101,7 @@ _get_domain() {
 #returns
 #dynv6_keyfile path to the key that will be used
 _get_keyfile() {
-	_debug "get keyfile method called"
+  _debug "get keyfile method called"
   dynv6_keyfile="${dynv6_keyfile:-$(_readaccountconf_mutable dynv6_keyfile)}"
   _debug Your key is "$dynv6_keyfile"
   if [ -z "$dynv6_keyfile" ]; then
@@ -113,13 +111,11 @@ _get_keyfile() {
       _generate_new_key
       _info "Please add this key to dynv6.com $(cat "$dynv6_keyfile.pub")"
       _info "Hit Enter to contiue"
-      read _
+      read -r _
       #save the credentials to the account conf file.
     else
       dynv6_keyfile="$KEY"
     fi
     _saveaccountconf_mutable dynv6_keyfile "$dynv6_keyfile"
   fi
-
-
 }

From 3c98fae4f286f0ed1f68ae86ec8781b471be23d6 Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Wed, 22 Jan 2020 20:00:04 +0100
Subject: [PATCH 40/68] Updated/fixed some entries in --help output

---
 acme.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/acme.sh b/acme.sh
index b5f80b3..9b33fc7 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6202,7 +6202,7 @@ Parameters:
   --force, -f                       Used to force to install or force to renew a cert immediately.
   --staging, --test                 Use staging server, just for test.
   --debug                           Output debug info.
-  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for secure.
+  --output-insecure                 Output all the sensitive messages. By default all the credentials/sensitive messages are hidden from the output/debug/log for security.
   --webroot, -w  /path/to/webroot   Specifies the web root folder for web root mode.
   --standalone                      Use standalone mode.
   --alpn                            Use standalone alpn mode.
@@ -6211,7 +6211,7 @@ Parameters:
   --dns [dns_cf|dns_dp|dns_cx|/path/to/api/file]   Use dns mode or dns api.
   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
 
-  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384.
+  --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
   --accountkeylength, -ak [2048]    Specifies the account key length.
   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
   --log-level 1|2                   Specifies the log level, default is 1.
@@ -6226,7 +6226,7 @@ Parameters:
 
   --reloadcmd \"service nginx reload\" After issue/renew, it's used to reload the server.
 
-  --server SERVER                   ACME Directory Resource URI. (default: https://acme-v01.api.letsencrypt.org/directory)
+  --server SERVER                   ACME Directory Resource URI. (default: $DEFAULT_CA)
   --accountconf                     Specifies a customized account config file.
   --home                            Specifies the home dir for $PROJECT_NAME.
   --cert-home                       Specifies the home dir to save all the certs, only valid for '--install' command.

From b6552aff7502c5ef183fdee8a91cd7cb143eea2e Mon Sep 17 00:00:00 2001
From: xpac1985 <xpac1985@users.noreply.github.com>
Date: Wed, 22 Jan 2020 21:21:38 +0100
Subject: [PATCH 41/68] Added maximum account key length to --help output

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 9b33fc7..dae4271 100755
--- a/acme.sh
+++ b/acme.sh
@@ -6212,7 +6212,7 @@ Parameters:
   --dnssleep  [$DEFAULT_DNS_SLEEP]                  The time in seconds to wait for all the txt records to take effect in dns api mode. Default $DEFAULT_DNS_SLEEP seconds.
 
   --keylength, -k [2048]            Specifies the domain key length: 2048, 3072, 4096, 8192 or ec-256, ec-384, ec-521.
-  --accountkeylength, -ak [2048]    Specifies the account key length.
+  --accountkeylength, -ak [2048]    Specifies the account key length: 2048, 3072, 4096
   --log    [/path/to/logfile]       Specifies the log file. The default is: \"$DEFAULT_LOG_FILE\" if you don't give a file path here.
   --log-level 1|2                   Specifies the log level, default is 1.
   --syslog [0|3|6|7]                Syslog level, 0: disable syslog, 3: error, 6: info, 7: debug.

From 6613ae57b0a08dbae9e1f089d948c832a6b00074 Mon Sep 17 00:00:00 2001
From: Marco4223 <mol1@gmx.de>
Date: Thu, 23 Jan 2020 19:20:44 +0100
Subject: [PATCH 42/68] Update dns_kas.sh

sleep 10 to _sleep 10
---
 dnsapi/dns_kas.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/dnsapi/dns_kas.sh b/dnsapi/dns_kas.sh
index 9540168..2cb0b43 100755
--- a/dnsapi/dns_kas.sh
+++ b/dnsapi/dns_kas.sh
@@ -44,7 +44,7 @@ dns_kas_add() {
   params="$params&var5=zone_host"
   params="$params&wert5=$_zone"
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
 
@@ -80,7 +80,7 @@ dns_kas_rm() {
       params2="$params&var1=record_id"
       params2="$params2&wert1=$i"
       _debug2 "Wait for 10 seconds by default before calling KAS API."
-      sleep 10
+      _sleep 10
       response="$(_get "$KAS_Api$params2")"
       _debug2 "response" "$response"
       if ! _contains "$response" "TRUE"; then
@@ -126,7 +126,7 @@ _get_zone_and_record_name() {
   params="$params&kas_action=get_domains"
 
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
   _zonen="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "domain_name" | tr '<' '\n' | grep "domain_name" | sed "s/domain_name>=>//g")"
@@ -159,7 +159,7 @@ _get_record_id() {
   params="$params&wert1=$_zone"
 
   _debug2 "Wait for 10 seconds by default before calling KAS API."
-  sleep 10
+  _sleep 10
   response="$(_get "$KAS_Api$params")"
   _debug2 "response" "$response"
   _record_id="$(echo "$response" | tr -d "\n\r" | tr -d " " | tr '[]' '<>' | sed "s/=>Array/\n=> Array/g" | tr ' ' '\n' | grep "=>$_record_name<" | grep '>TXT<' | tr '<' '\n' | grep record_id | sed "s/record_id>=>//g")"

From d9a9695fe089f07e81199fcfb9ebb75fe6def7be Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 5 Feb 2020 14:29:01 -0800
Subject: [PATCH 43/68] Deploy certificates to Palo Alto Network Firewalls

---
 deploy/panos.sh | 144 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 144 insertions(+)
 create mode 100644 deploy/panos.sh

diff --git a/deploy/panos.sh b/deploy/panos.sh
new file mode 100644
index 0000000..8a288e7
--- /dev/null
+++ b/deploy/panos.sh
@@ -0,0 +1,144 @@
+#!/usr/bin/env sh
+
+# Script to deploy certificates to Palo Alto Networks PANOS via API
+# Note PANOS API KEY and IP address needs to be set prior to running.
+# The following variables exported from environment will be used.
+# If not set then values previously saved in domain.conf file are used.
+#
+# Firewall admin with superuser and IP address is required.
+#
+# export PANOS_USER=""  # required
+# export PANOS_PASS=""  # required
+# export PANOS_HOST=""  # required
+
+# This function is to parse the XML
+parse_response() {
+  status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
+  message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  return 0
+}
+
+deployer() {
+  type=$1 # Types are cert, key, commit
+  _debug "**** Deploying $type *****"
+
+  #Generate DEIM
+  delim="-----MultipartDelimiter$(date "+%s%N")"
+  nl="\015\012"
+  #Set Header
+  _H1="Content-Type: multipart/form-data; boundary=$delim"
+  if [ $type = 'cert' ]; then
+    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
+  fi
+  if [ $type = 'key' ]; then
+    #Add key
+    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
+  fi
+  #Close multipart
+  content="$content${nl}--$delim--${nl}"
+  #Convert CRLF
+  content=$(printf %b "$content")
+
+  if [ $type = 'cert' ]; then
+    panos_url="https://$_panos_host/api/?type=import&category=certificate&certificate-name=$_cdomain&format=pem&key=$_panos_key"
+  fi
+  
+  if [ $type = 'key' ]; then
+    panos_url="https://$_panos_host/api/?type=import&category=private-key&certificate-name=$_cdomain&format=pem&passphrase=none&key=$_panos_key"
+  fi
+  if [ $type = 'commit' ]; then
+    cmd=$(_url_encode "<commit><partial><$_panos_user></$_panos_user></partial></commit>")
+    panos_url="https://$_panos_host/api/?type=commit&cmd=$cmd&key=$_panos_key"
+  fi
+
+  if [ $type = 'key' ] || [ $type = 'cert' ]; then
+    response=$(_post "$content" "$panos_url" "" "POST")
+  else
+    response=$(_get $panos_url)
+  fi
+  _debug panos_url $panos_url 
+  _debug "RESPONSE $response"
+  parse_response "$response"
+  _debug "STATUS IS $status"
+  _debug "MESSAGE IS $message"
+  # Saving response to variables
+  response_status=$status
+  # Check for cert upload error and handle gracefully.
+
+  #DEBUG
+  _debug header "$_H1"
+  # _debug content "$content"
+  _debug response_status "$response_status"
+  if [ "$response_status" = "success" ]; then
+    _debug "Successfully deployed $type"
+    return 0
+  else
+    _err "Deploy of type $type failed. Try deploying with --debug to troubleshoot."
+    _debug "$message"
+    return 1
+  fi
+}
+
+# This is the main function that will call the other functions to deploy everything.
+panos_deploy() {
+  _cdomain="$1"
+  _ckey="$2"
+  _cfullchain="$5"
+  # PANOS HOST is required to make API calls to the PANOS/Panorama
+  if [ -z "$PANOS_HOST" ]; then
+    if [ -z "$_panos_host" ]; then
+      _err "PANOS_HOST not defined."
+      return 1
+    fi
+  else
+    _debug "PANOS HOST is set. Save to domain conf."
+    _panos_host="$PANOS_HOST"
+    _savedomainconf _panos_host "$_panos_host"
+  fi
+  # Retrieve stored variables
+  _panos_user="$(_readaccountconf_mutable PANOS_USER)"
+  _panos_pass="$(_readaccountconf_mutable PANOS_PASS)"
+  # PANOS Credentials check
+  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ]; then
+    _debug "PANOS_USER, PANOS_PASS is not defined"
+    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ]; then
+      _err "No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables."
+      return 1
+    else
+      _debug "ok"
+    fi
+  else
+    _debug "Saving environment variables"
+    # Encrypt and save user
+    _saveaccountconf_mutable PANOS_USER "$PANOS_USER"
+    _saveaccountconf_mutable PANOS_PASS "$PANOS_PASS"
+    _panos_user="$PANOS_USER"
+    _panos_pass="$PANOS_PASS"
+  fi
+  _debug "Let's use username and pass to generate token."
+  if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then
+    _err "Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST"
+    return 1
+  else
+    _debug "Getting PANOS KEY"
+    panos_key_response=$(_get "https://$_panos_host/api/?type=keygen&user=$_panos_user&password=$_panos_pass")
+    _debug "PANOS KEY FULL RESPONSE $panos_key_response"
+    status=$(echo "$panos_key_response" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
+    _debug "STATUS IS $status"
+    if [ "$status" = "success" ]; then
+      panos_key=$(echo "$panos_key_response" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
+      _panos_key=$panos_key
+    else
+      _err "PANOS Key could not be set. Deploy with --debug to troubleshoot"
+      return 1
+    fi
+    if [ -z "$_panos_host" ] && [ -z "$_panos_key" ] && [ -z "$_panos_user" ]; then
+      _err "Missing host, apikey, user."
+      return 1
+    else
+      deployer cert
+      deployer key
+      deployer commit
+    fi
+  fi
+}
\ No newline at end of file

From 2cc50a2b65d4e443d7469675c5639999a27f8f19 Mon Sep 17 00:00:00 2001
From: Wout <wout@t440s.canodus.be>
Date: Sat, 8 Feb 2020 12:27:19 +0100
Subject: [PATCH 44/68] Cosmetic fixes.

---
 dnsapi/dns_constellix.sh | 34 +++++++++++++++++++---------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 55f4a71..c47ede4 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -2,26 +2,28 @@
 
 # Author: Wout Decre <wout@canodus.be>
 
-CONSTELLIX_API="https://api.dns.constellix.com/v1"
-#CONSTELLIX_KEY="XXX"
-#CONSTELLIX_SECRET="XXX"
+CONSTELLIX_Api="https://api.dns.constellix.com/v1"
+#CONSTELLIX_Key="XXX"
+#CONSTELLIX_Secret="XXX"
 
 ########  Public functions #####################
 
+# Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
 dns_constellix_add() {
   fulldomain=$1
   txtvalue=$2
 
-  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
-  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+  CONSTELLIX_Key="${CONSTELLIX_Key:-$(_readaccountconf_mutable CONSTELLIX_Key)}"
+  CONSTELLIX_Secret="${CONSTELLIX_Secret:-$(_readaccountconf_mutable CONSTELLIX_Secret)}"
 
-  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+  if [ -z "$CONSTELLIX_Key" ] || [ -z "$CONSTELLIX_Secret" ]; then
     _err "You did not specify the Contellix API key and secret yet."
     return 1
   fi
 
-  _saveaccountconf_mutable CONSTELLIX_KEY "$CONSTELLIX_KEY"
-  _saveaccountconf_mutable CONSTELLIX_SECRET "$CONSTELLIX_SECRET"
+  _saveaccountconf_mutable CONSTELLIX_Key "$CONSTELLIX_Key"
+  _saveaccountconf_mutable CONSTELLIX_Secret "$CONSTELLIX_Secret"
 
   if ! _get_root "$fulldomain"; then
     _err "Invalid domain"
@@ -40,14 +42,16 @@ dns_constellix_add() {
   fi
 }
 
+# Usage: fulldomain txtvalue
+# Used to remove the txt record after validation
 dns_constellix_rm() {
   fulldomain=$1
   txtvalue=$2
 
-  CONSTELLIX_KEY="${CONSTELLIX_KEY:-$(_readaccountconf_mutable CONSTELLIX_KEY)}"
-  CONSTELLIX_SECRET="${CONSTELLIX_SECRET:-$(_readaccountconf_mutable CONSTELLIX_SECRET)}"
+  CONSTELLIX_Key="${CONSTELLIX_Key:-$(_readaccountconf_mutable CONSTELLIX_Key)}"
+  CONSTELLIX_Secret="${CONSTELLIX_Secret:-$(_readaccountconf_mutable CONSTELLIX_Secret)}"
 
-  if [ -z "$CONSTELLIX_KEY" ] || [ -z "$CONSTELLIX_SECRET" ]; then
+  if [ -z "$CONSTELLIX_Key" ] || [ -z "$CONSTELLIX_Secret" ]; then
     _err "You did not specify the Contellix API key and secret yet."
     return 1
   fi
@@ -112,9 +116,9 @@ _constellix_rest() {
   _debug "$ep"
 
   rdate=$(date +"%s")"000"
-  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_SECRET" | _hex_dump | tr -d ' ')" | _base64)
+  hmac=$(printf "%s" "$rdate" | _hmac sha1 "$(printf "%s" "$CONSTELLIX_Secret" | _hex_dump | tr -d ' ')" | _base64)
 
-  export _H1="x-cnsdns-apiKey: $CONSTELLIX_KEY"
+  export _H1="x-cnsdns-apiKey: $CONSTELLIX_Key"
   export _H2="x-cnsdns-requestDate: $rdate"
   export _H3="x-cnsdns-hmac: $hmac"
   export _H4="Accept: application/json"
@@ -122,9 +126,9 @@ _constellix_rest() {
 
   if [ "$m" != "GET" ]; then
     _debug data "$data"
-    response="$(_post "$data" "$CONSTELLIX_API/$ep" "" "$m")"
+    response="$(_post "$data" "$CONSTELLIX_Api/$ep" "" "$m")"
   else
-    response="$(_get "$CONSTELLIX_API/$ep")"
+    response="$(_get "$CONSTELLIX_Api/$ep")"
   fi
 
   if [ "$?" != "0" ]; then

From 8189a34d145050a3ffb5598d330e6bcdd4cadf02 Mon Sep 17 00:00:00 2001
From: Blfrg <i3lfrg@gmail.com>
Date: Sat, 8 Feb 2020 16:43:23 -0600
Subject: [PATCH 45/68] fix dns_me id parse

The API seems to have changed and the ID is no longer in the same location.
---
 dnsapi/dns_me.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_me.sh b/dnsapi/dns_me.sh
index 98a5841..302603e 100644
--- a/dnsapi/dns_me.sh
+++ b/dnsapi/dns_me.sh
@@ -114,7 +114,7 @@ _get_root() {
     fi
 
     if _contains "$response" "\"name\":\"$h\""; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[^,]*" | head -n 1 | cut -d : -f 2 | tr -d '}')
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+}$" | head -n 1 | cut -d : -f 2 | tr -d '}')
       if [ "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
         _domain="$h"

From 555e0de9e45f36ddd2507975a0368eaab9141074 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sat, 29 Jun 2019 21:47:24 -0600
Subject: [PATCH 46/68] Initial support for Synology DSM

This allows you to update a key on a Synology DSM using the existing API.
Handles restarting the necessary services the certificate is attached to and all other internal stuff (copying the certificate around, etc.)

This is way less error prone than most articles I've found on how to update a Synology DSM certificate.
---
 deploy/synology_dsm.sh | 145 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 145 insertions(+)
 create mode 100644 deploy/synology_dsm.sh

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
new file mode 100644
index 0000000..45eab33
--- /dev/null
+++ b/deploy/synology_dsm.sh
@@ -0,0 +1,145 @@
+#!/usr/bin/env sh
+
+# Here is a script to deploy cert to Synology DSM vault
+# (https://www.vaultproject.io/)
+#
+# it requires the jq and curl are in the $PATH and the following
+# environment variables must be set:
+#
+# SYNO_Username - Synology Username to login (must be an administrator)
+# SYNO_Password - Synology Password to login
+# SYNO_Certificate - Certificate description to target for replacement
+#
+# The following environmental variables may be set if you don't like their
+# default values:
+#
+# SYNO_Scheme - defaults to http
+# SYNO_Hostname - defaults to localhost
+# SYNO_Port - defaults to 5000
+#
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+synology_dsm_deploy() {
+
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+
+  _debug _cdomain "$_cdomain"
+
+  # Get Username and Password, but don't save until we successfully authenticate
+  SYNO_Username="${SYNO_Username:-$(_readaccountconf_mutable SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_readaccountconf_mutable SYNO_Password)}"
+  if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
+    SYNO_Username=""
+    SYNO_Password=""
+    _err "SYNO_Username & SYNO_Password must be set"
+    return 1
+  fi
+  _debug2 SYNO_Username "$SYNO_Username"
+  _secure_debug2 SYNO_Password "$SYNO_Password"
+
+  # Optional scheme, hostname, and port for Synology DSM
+  SYNO_Scheme="${SYNO_Scheme:-$(_readaccountconf_mutable SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_readaccountconf_mutable SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_readaccountconf_mutable SYNO_Port)}"
+  _saveaccountconf_mutable SYNO_Scheme "$SYNO_Scheme"
+  _saveaccountconf_mutable SYNO_Hostname "$SYNO_Hostname"
+  _saveaccountconf_mutable SYNO_Port "$SYNO_Port"
+
+  # default vaules for scheme, hostname, and port
+  # defaulting to localhost and http because it's localhost...
+  [ -n "${SYNO_Scheme}" ] || SYNO_Scheme="http"
+  [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost"
+  [ -n "${SYNO_Port}" ] || SYNO_Port="5000"
+
+  _debug2 SYNO_Scheme "$SYNO_Scheme"
+  _debug2 SYNO_Hostname "$SYNO_Hostname"
+  _debug2 SYNO_Port "$SYNO_Port"
+
+  # Get the certificate description, but don't save it until we verfiy it's real
+  _getdeployconf SYNO_Certificate
+  if [ -z "${SYNO_Certificate}" ]; then
+    _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
+    return 1
+  fi
+  _debug SYNO_Certificate "$SYNO_Certificate"
+
+  # We can't use _get or _post because they lack support for cookies
+  # use jq because I'm too lazy to figure out what is required to parse json
+  # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
+  for x in curl jq; do
+      if ! _exists "$x"; then
+        _err "Please install $x first."
+        _err "We need $x to work."
+        return 1
+      fi
+  done
+
+  _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
+  _debug _base_url "$_base_url"
+
+  _cookie_jar="$(_mktemp)"
+  _debug _cookie_jar "$_cookie_jar"
+
+  # Login, get the token from JSON and session id from cookie
+  _debug "Logging into $SYNO_Hostname:$SYNO_Port"
+  token=$(curl -sk -c $_cookie_jar "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
+  if [ $token = "null" ]; then
+    _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
+    _err "Check your username and password."
+    rm "$_cookie_jar"
+    return 1
+  fi
+
+  # Now that we know the username and password are good, save them
+  _saveaccountconf_mutable SYNO_Username "$SYNO_Username"
+  _saveaccountconf_mutable SYNO_Password "$SYNO_Password"
+  _secure_debug2 token "$token"
+
+  # Use token and session id to get the list of certificates
+  response=$(curl -sk -b $_cookie_jar $_base_url/webapi/entry.cgi -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  _debug3 response "$response"
+  # select the first certificate matching our description
+  cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
+  _debug3 cert "$cert"
+
+  if [ "$cert" = "null" ]; then
+    _err "Unable to find certificate: $SYNO_Certificate"
+    rm "$_cookie_jar"
+    return 1
+  fi
+
+  # we've verified this certificate description is a thing, so save it
+  _savedeployconf SYNO_Certificate "$SYNO_Certificate"
+
+  id=$(echo $cert | jq -r ".id")
+  default=$(echo "$cert" | jq -r ".is_default")
+  _debug2 id "$id"
+  _debug2 default "$default"
+
+  # This is the heavy lifting, make the API call to update a certificate in place
+  response=$(curl -sk -b $_cookie_jar "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F key=@$_ckey -F cert=@$_ccert -F inter_cert=@$_cca -F id=$id -F desc=$SYNO_Certificate -F as_default=$default)
+  _debug3 response "$response"
+  success=$(echo "$response" | jq -r ".success")
+  _debug2 success "$success"
+  rm "$_cookie_jar"
+
+  if [ "$success" = "true" ]; then
+    restarted=$(echo "$response" | jq -r ".data.restart_httpd")
+    if [ "$restarted" = "true" ]; then
+        _info "http services were restarted"
+    else
+        _info "http services were NOT restarted"
+    fi
+    return 0;
+  else
+    code=$(echo "$response" | jq -r ".error.code")
+    _err "Unable to update certificate, error code $code"
+    return 1
+  fi
+}

From 548f83c3adf4533140980774892cc484937960ac Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:13:07 -0600
Subject: [PATCH 47/68] Cleanup shellcheck errors

---
 deploy/synology_dsm.sh | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 45eab33..d131e9c 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -63,6 +63,7 @@ synology_dsm_deploy() {
 
   # Get the certificate description, but don't save it until we verfiy it's real
   _getdeployconf SYNO_Certificate
+  # shellcheck disable=SC2154
   if [ -z "${SYNO_Certificate}" ]; then
     _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
     return 1
@@ -88,8 +89,8 @@ synology_dsm_deploy() {
 
   # Login, get the token from JSON and session id from cookie
   _debug "Logging into $SYNO_Hostname:$SYNO_Port"
-  token=$(curl -sk -c $_cookie_jar "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
-  if [ $token = "null" ]; then
+  token=$(curl -sk -c "$_cookie_jar" "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
+  if [ "$token" = "null" ]; then
     _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
     _err "Check your username and password."
     rm "$_cookie_jar"
@@ -102,7 +103,7 @@ synology_dsm_deploy() {
   _secure_debug2 token "$token"
 
   # Use token and session id to get the list of certificates
-  response=$(curl -sk -b $_cookie_jar $_base_url/webapi/entry.cgi -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi" -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
   _debug3 response "$response"
   # select the first certificate matching our description
   cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
@@ -117,13 +118,13 @@ synology_dsm_deploy() {
   # we've verified this certificate description is a thing, so save it
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
-  id=$(echo $cert | jq -r ".id")
+  id=$(echo "$cert" | jq -r ".id")
   default=$(echo "$cert" | jq -r ".is_default")
   _debug2 id "$id"
   _debug2 default "$default"
 
   # This is the heavy lifting, make the API call to update a certificate in place
-  response=$(curl -sk -b $_cookie_jar "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F key=@$_ckey -F cert=@$_ccert -F inter_cert=@$_cca -F id=$id -F desc=$SYNO_Certificate -F as_default=$default)
+  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F "key=@$_ckey" -F "cert=@$_ccert" -F "inter_cert=@$_cca" -F "id=$id" -F "desc=$SYNO_Certificate" -F "as_default=$default")
   _debug3 response "$response"
   success=$(echo "$response" | jq -r ".success")
   _debug2 success "$success"

From 6459ccb18517c3f9f6c87410df8d76a0082020e3 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:13:45 -0600
Subject: [PATCH 48/68] Cleanup shfmt warnings

---
 deploy/synology_dsm.sh | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index d131e9c..7fab47d 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -74,11 +74,11 @@ synology_dsm_deploy() {
   # use jq because I'm too lazy to figure out what is required to parse json
   # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
   for x in curl jq; do
-      if ! _exists "$x"; then
-        _err "Please install $x first."
-        _err "We need $x to work."
-        return 1
-      fi
+    if ! _exists "$x"; then
+      _err "Please install $x first."
+      _err "We need $x to work."
+      return 1
+    fi
   done
 
   _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
@@ -133,11 +133,11 @@ synology_dsm_deploy() {
   if [ "$success" = "true" ]; then
     restarted=$(echo "$response" | jq -r ".data.restart_httpd")
     if [ "$restarted" = "true" ]; then
-        _info "http services were restarted"
+      _info "http services were restarted"
     else
-        _info "http services were NOT restarted"
+      _info "http services were NOT restarted"
     fi
-    return 0;
+    return 0
   else
     code=$(echo "$response" | jq -r ".error.code")
     _err "Unable to update certificate, error code $code"

From 8e8cda132c0ab64548122478ab59f6eea7262dba Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 30 Jun 2019 00:30:35 -0600
Subject: [PATCH 49/68] Remove boilerplate from what I used for template

---
 deploy/synology_dsm.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 7fab47d..e37d7d4 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env sh
 
-# Here is a script to deploy cert to Synology DSM vault
-# (https://www.vaultproject.io/)
+# Here is a script to deploy cert to Synology DSM
 #
 # it requires the jq and curl are in the $PATH and the following
 # environment variables must be set:

From b3b00b6700e7bc960d96ddd0f2abf1315cab0e03 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Mon, 30 Sep 2019 14:06:04 -0600
Subject: [PATCH 50/68] Using domainconf instead of account

---
 deploy/synology_dsm.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index e37d7d4..25b6376 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -31,8 +31,8 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_readaccountconf_mutable SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_readaccountconf_mutable SYNO_Password)}"
+  SYNO_Username="${SYNO_Username:-$(_readdomainconf SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_readdomainconf SYNO_Password)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -43,12 +43,12 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_readaccountconf_mutable SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_readaccountconf_mutable SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_readaccountconf_mutable SYNO_Port)}"
-  _saveaccountconf_mutable SYNO_Scheme "$SYNO_Scheme"
-  _saveaccountconf_mutable SYNO_Hostname "$SYNO_Hostname"
-  _saveaccountconf_mutable SYNO_Port "$SYNO_Port"
+  SYNO_Scheme="${SYNO_Scheme:-$(_readdomainconf SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_readdomainconf SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_readdomainconf SYNO_Port)}"
+  _savedomainconf SYNO_Scheme "$SYNO_Scheme"
+  _savedomainconf SYNO_Hostname "$SYNO_Hostname"
+  _savedomainconf SYNO_Port "$SYNO_Port"
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -97,8 +97,8 @@ synology_dsm_deploy() {
   fi
 
   # Now that we know the username and password are good, save them
-  _saveaccountconf_mutable SYNO_Username "$SYNO_Username"
-  _saveaccountconf_mutable SYNO_Password "$SYNO_Password"
+  _savedomainconf SYNO_Username "$SYNO_Username"
+  _savedomainconf SYNO_Password "$SYNO_Password"
   _secure_debug2 token "$token"
 
   # Use token and session id to get the list of certificates

From 52a168b96160d5c407e54067181bedebe2c9aad9 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sat, 8 Feb 2020 16:27:18 -0800
Subject: [PATCH 51/68] Stop using jq/curl directly

This is a lot more fragile then the previous code due to treating JSON as just a string
---
 deploy/synology_dsm.sh | 103 ++++++++++++++++++++++-------------------
 1 file changed, 55 insertions(+), 48 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 25b6376..8264582 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -20,6 +20,12 @@
 
 ########  Public functions #####################
 
+_syno_get_cookie_data() {
+  _debug2 Cookie "$1"
+  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';' )"
+  grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
+}
+
 #domain keyfile certfile cafile fullchain
 synology_dsm_deploy() {
 
@@ -31,8 +37,8 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_readdomainconf SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_readdomainconf SYNO_Password)}"
+  SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
+  SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -43,12 +49,12 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_readdomainconf SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_readdomainconf SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_readdomainconf SYNO_Port)}"
-  _savedomainconf SYNO_Scheme "$SYNO_Scheme"
-  _savedomainconf SYNO_Hostname "$SYNO_Hostname"
-  _savedomainconf SYNO_Port "$SYNO_Port"
+  SYNO_Scheme="${SYNO_Scheme:-$(_getdeployconf SYNO_Scheme)}"
+  SYNO_Hostname="${SYNO_Hostname:-$(_getdeployconf SYNO_Hostname)}"
+  SYNO_Port="${SYNO_Port:-$(_getdeployconf SYNO_Port)}"
+  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
+  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
+  _savedeployconf SYNO_Port "$SYNO_Port"
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -69,77 +75,78 @@ synology_dsm_deploy() {
   fi
   _debug SYNO_Certificate "$SYNO_Certificate"
 
-  # We can't use _get or _post because they lack support for cookies
-  # use jq because I'm too lazy to figure out what is required to parse json
-  # by hand.  Also it seems to be in place for Synology DSM (6.2.1 at least)
-  for x in curl jq; do
-    if ! _exists "$x"; then
-      _err "Please install $x first."
-      _err "We need $x to work."
-      return 1
-    fi
-  done
-
   _base_url="$SYNO_Scheme://$SYNO_Hostname:$SYNO_Port"
   _debug _base_url "$_base_url"
 
-  _cookie_jar="$(_mktemp)"
-  _debug _cookie_jar "$_cookie_jar"
-
   # Login, get the token from JSON and session id from cookie
-  _debug "Logging into $SYNO_Hostname:$SYNO_Port"
-  token=$(curl -sk -c "$_cookie_jar" "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes" | jq -r .SynoToken)
-  if [ "$token" = "null" ]; then
+  _info "Logging into $SYNO_Hostname:$SYNO_Port"
+  response=$(_get "$_base_url/webman/login.cgi?username=$SYNO_Username&passwd=$SYNO_Password&enable_syno_token=yes")
+  token=$(echo "$response" | grep "SynoToken" | sed -n 's/.*"SynoToken" *: *"\([^"]*\).*/\1/p')
+  _debug3 response "$response"
+
+  if [ -z "$token" ]; then
     _err "Unable to authenticate to $SYNO_Hostname:$SYNO_Port using $SYNO_Scheme."
     _err "Check your username and password."
-    rm "$_cookie_jar"
     return 1
   fi
 
+  _H1="Cookie: $(_syno_get_cookie_data "id"); $(_syno_get_cookie_data "smid")"
+  _H2="X-SYNO-TOKEN: $token"
+  export _H1
+  export _H2
+  _debug3 H1 "${_H1}"
+  _debug3 H2 "${_H2}"
+
   # Now that we know the username and password are good, save them
-  _savedomainconf SYNO_Username "$SYNO_Username"
-  _savedomainconf SYNO_Password "$SYNO_Password"
+  _savedeployconf SYNO_Username "$SYNO_Username"
+  _savedeployconf SYNO_Password "$SYNO_Password"
   _secure_debug2 token "$token"
 
-  # Use token and session id to get the list of certificates
-  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi" -H "X-SYNO-TOKEN: $token" -d api=SYNO.Core.Certificate.CRT -d method=list -d version=1)
+  _info "Getting certificates in Synology DSM"
+  response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")
   _debug3 response "$response"
-  # select the first certificate matching our description
-  cert=$(echo "$response" | jq -r ".data.certificates | map(select(.desc == \"$SYNO_Certificate\"))[0]")
-  _debug3 cert "$cert"
+  id=$(printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
+  _debug2 id "$id"
 
-  if [ "$cert" = "null" ]; then
+  if [ -z "$id" ]; then
     _err "Unable to find certificate: $SYNO_Certificate"
-    rm "$_cookie_jar"
     return 1
   fi
 
   # we've verified this certificate description is a thing, so save it
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
-  id=$(echo "$cert" | jq -r ".id")
-  default=$(echo "$cert" | jq -r ".is_default")
-  _debug2 id "$id"
+  default=false
+  if printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+      default=true
+  fi
   _debug2 default "$default"
 
-  # This is the heavy lifting, make the API call to update a certificate in place
-  response=$(curl -sk -b "$_cookie_jar" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" -F "key=@$_ckey" -F "cert=@$_ccert" -F "inter_cert=@$_cca" -F "id=$id" -F "desc=$SYNO_Certificate" -F "as_default=$default")
+  _info "Generate form POST request"
+  nl="\015\012"
+  delim="--------------------------$(date +%Y%m%d%H%M%S)"
+  content="--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"cert\"; filename=\"$(basename "$_ccert")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ccert")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"inter_cert\"; filename=\"$(basename "$_cca")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cca")\012"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"id\"${nl}${nl}$id"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"desc\"${nl}${nl}${SYNO_Certificate}"
+  content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}${default}"
+  content="$content${nl}--$delim--${nl}"
+  content="$(printf "%b_" "$content")";content="${content%_}" # protect trailing \n
+
+  _info "Upload certificate to the Synology DSM"
+  response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
   _debug3 response "$response"
-  success=$(echo "$response" | jq -r ".success")
-  _debug2 success "$success"
-  rm "$_cookie_jar"
 
-  if [ "$success" = "true" ]; then
-    restarted=$(echo "$response" | jq -r ".data.restart_httpd")
-    if [ "$restarted" = "true" ]; then
+  if ! printf "$response" | grep -q '"error":'; then
+    if printf "$response" | grep -q '"restart_httpd":true'; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"
     fi
     return 0
   else
-    code=$(echo "$response" | jq -r ".error.code")
-    _err "Unable to update certificate, error code $code"
+    _err "Unable to update certificate, error code $response"
     return 1
   fi
 }

From 95769de464b6e21a3b31c644febd262738d0f63c Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:01:26 -0800
Subject: [PATCH 52/68] Fix shfmt/shellcheck issues

---
 deploy/synology_dsm.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 8264582..7d71393 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -22,7 +22,7 @@
 
 _syno_get_cookie_data() {
   _debug2 Cookie "$1"
-  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';' )"
+  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';')"
   grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
 }
 
@@ -105,7 +105,7 @@ synology_dsm_deploy() {
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")
   _debug3 response "$response"
-  id=$(printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
+  id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
   if [ -z "$id" ]; then
@@ -117,8 +117,8 @@ synology_dsm_deploy() {
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
   default=false
-  if printf "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
-      default=true
+  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+    default=true
   fi
   _debug2 default "$default"
 
@@ -132,14 +132,15 @@ synology_dsm_deploy() {
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"desc\"${nl}${nl}${SYNO_Certificate}"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"as_default\"${nl}${nl}${default}"
   content="$content${nl}--$delim--${nl}"
-  content="$(printf "%b_" "$content")";content="${content%_}" # protect trailing \n
+  content="$(printf "%b_" "$content")"
+  content="${content%_}" # protect trailing \n
 
   _info "Upload certificate to the Synology DSM"
   response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
   _debug3 response "$response"
 
-  if ! printf "$response" | grep -q '"error":'; then
-    if printf "$response" | grep -q '"restart_httpd":true'; then
+  if ! echo "$response" | grep -q '"error":'; then
+    if echo "$response" | grep -q '"restart_httpd":true'; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"

From de25232a7345d8dfe221d1d1a131419182989ca6 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:26:55 -0800
Subject: [PATCH 53/68] Allow creating new certificates when certificate is not
 found

---
 deploy/synology_dsm.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 7d71393..71d9e7d 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -39,6 +39,7 @@ synology_dsm_deploy() {
   # Get Username and Password, but don't save until we successfully authenticate
   SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
   SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
+  SYNO_Create="${SYNO_Create:-$(_getdeployconf SYNO_Create)}"
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -108,8 +109,8 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
-  if [ -z "$id" ]; then
-    _err "Unable to find certificate: $SYNO_Certificate"
+  if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
+    _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1
   fi
 

From 5d3bc95ac529550077505189b4e2cc07ca4b5155 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 02:50:29 -0800
Subject: [PATCH 54/68] Fix some debug output

---
 deploy/synology_dsm.sh | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 71d9e7d..bb49f27 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -21,8 +21,6 @@
 ########  Public functions #####################
 
 _syno_get_cookie_data() {
-  _debug2 Cookie "$1"
-  _debug3 grep "$(grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';')"
   grep "\W$1=" "$HTTP_HEADER" | grep "^Set-Cookie:" | _tail_n 1 | _egrep_o "$1=[^;]*;" | tr -d ';'
 }
 
@@ -95,13 +93,13 @@ synology_dsm_deploy() {
   _H2="X-SYNO-TOKEN: $token"
   export _H1
   export _H2
-  _debug3 H1 "${_H1}"
-  _debug3 H2 "${_H2}"
+  _debug2 H1 "${_H1}"
+  _debug2 H2 "${_H2}"
 
   # Now that we know the username and password are good, save them
   _savedeployconf SYNO_Username "$SYNO_Username"
   _savedeployconf SYNO_Password "$SYNO_Password"
-  _secure_debug2 token "$token"
+  _debug token "$token"
 
   _info "Getting certificates in Synology DSM"
   response=$(_post "api=SYNO.Core.Certificate.CRT&method=list&version=1" "$_base_url/webapi/entry.cgi")

From 1259341095f2b15946f0db39ce53f821b194c00f Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 03:10:11 -0800
Subject: [PATCH 55/68] Use deployconf properly

---
 deploy/synology_dsm.sh | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index bb49f27..13728d6 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -35,9 +35,9 @@ synology_dsm_deploy() {
   _debug _cdomain "$_cdomain"
 
   # Get Username and Password, but don't save until we successfully authenticate
-  SYNO_Username="${SYNO_Username:-$(_getdeployconf SYNO_Username)}"
-  SYNO_Password="${SYNO_Password:-$(_getdeployconf SYNO_Password)}"
-  SYNO_Create="${SYNO_Create:-$(_getdeployconf SYNO_Create)}"
+  _getdeployconf SYNO_Username
+  _getdeployconf SYNO_Password
+  _getdeployconf SYNO_Create
   if [ -z "$SYNO_Username" ] || [ -z "$SYNO_Password" ]; then
     SYNO_Username=""
     SYNO_Password=""
@@ -48,12 +48,9 @@ synology_dsm_deploy() {
   _secure_debug2 SYNO_Password "$SYNO_Password"
 
   # Optional scheme, hostname, and port for Synology DSM
-  SYNO_Scheme="${SYNO_Scheme:-$(_getdeployconf SYNO_Scheme)}"
-  SYNO_Hostname="${SYNO_Hostname:-$(_getdeployconf SYNO_Hostname)}"
-  SYNO_Port="${SYNO_Port:-$(_getdeployconf SYNO_Port)}"
-  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
-  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
-  _savedeployconf SYNO_Port "$SYNO_Port"
+  _getdeployconf SYNO_Scheme
+  _getdeployconf SYNO_Hostname
+  _getdeployconf SYNO_Port
 
   # default vaules for scheme, hostname, and port
   # defaulting to localhost and http because it's localhost...
@@ -61,6 +58,10 @@ synology_dsm_deploy() {
   [ -n "${SYNO_Hostname}" ] || SYNO_Hostname="localhost"
   [ -n "${SYNO_Port}" ] || SYNO_Port="5000"
 
+  _savedeployconf SYNO_Scheme "$SYNO_Scheme"
+  _savedeployconf SYNO_Hostname "$SYNO_Hostname"
+  _savedeployconf SYNO_Port "$SYNO_Port"
+
   _debug2 SYNO_Scheme "$SYNO_Scheme"
   _debug2 SYNO_Hostname "$SYNO_Hostname"
   _debug2 SYNO_Port "$SYNO_Port"
@@ -107,6 +108,7 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
+  # shellcheck disable=SC2154
   if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
     _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1

From 79637097bada83f251c68159df4baa657f16d7ad Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 11:50:50 -0800
Subject: [PATCH 56/68] Use _utc_date

---
 deploy/synology_dsm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index 13728d6..dd26e3d 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -125,7 +125,7 @@ synology_dsm_deploy() {
 
   _info "Generate form POST request"
   nl="\015\012"
-  delim="--------------------------$(date +%Y%m%d%H%M%S)"
+  delim="--------------------------$(_utc_date | tr -d -- '-: ')"
   content="--$delim${nl}Content-Disposition: form-data; name=\"key\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")\012"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"cert\"; filename=\"$(basename "$_ccert")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ccert")\012"
   content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"inter_cert\"; filename=\"$(basename "$_cca")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cca")\012"

From d07172a52843b8eeb412e85f2cdfc9a527c646c6 Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Sun, 9 Feb 2020 12:06:13 -0800
Subject: [PATCH 57/68] Replace disabled linter with variable substituion

---
 deploy/synology_dsm.sh | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index dd26e3d..f1c08c3 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -68,8 +68,7 @@ synology_dsm_deploy() {
 
   # Get the certificate description, but don't save it until we verfiy it's real
   _getdeployconf SYNO_Certificate
-  # shellcheck disable=SC2154
-  if [ -z "${SYNO_Certificate}" ]; then
+  if [ -z "${SYNO_Certificate:?}" ]; then
     _err "SYNO_Certificate needs to be defined (with the Certificate description name)"
     return 1
   fi
@@ -108,8 +107,7 @@ synology_dsm_deploy() {
   id=$(echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\"id\":\"\([^\"]*\).*/\1/p")
   _debug2 id "$id"
 
-  # shellcheck disable=SC2154
-  if [ -z "$id" ] && [ -z "$SYNO_Create" ]; then
+  if [ -z "$id" ] && [ -z "${SYNO_Create:?}" ]; then
     _err "Unable to find certificate: $SYNO_Certificate and \$SYNO_Create is not set"
     return 1
   fi

From eb49127b9ec75472c663eaaebb6370ab95a3f357 Mon Sep 17 00:00:00 2001
From: Blfrg <i3lfrg@gmail.com>
Date: Sun, 9 Feb 2020 14:50:29 -0600
Subject: [PATCH 58/68] improve id parse

Locate only the outer most "id" property
---
 dnsapi/dns_me.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_me.sh b/dnsapi/dns_me.sh
index 302603e..db51cc7 100644
--- a/dnsapi/dns_me.sh
+++ b/dnsapi/dns_me.sh
@@ -114,7 +114,7 @@ _get_root() {
     fi
 
     if _contains "$response" "\"name\":\"$h\""; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+}$" | head -n 1 | cut -d : -f 2 | tr -d '}')
+      _domain_id=$(printf "%s\n" "$response" | cut -c 2- | head -c -2 | sed 's/{.*}//' | sed -r 's/^.*"id":([0-9]+).*$/\1/')
       if [ "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
         _domain="$h"

From 1b475cf9f3997c27aae49ab578dd7070d9169b3d Mon Sep 17 00:00:00 2001
From: Brian Hartvigsen <brian.andrew@brianandjenny.com>
Date: Mon, 10 Feb 2020 21:02:27 -0700
Subject: [PATCH 59/68] Remove -q from greps

---
 deploy/synology_dsm.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/synology_dsm.sh b/deploy/synology_dsm.sh
index f1c08c3..0c2b118 100644
--- a/deploy/synology_dsm.sh
+++ b/deploy/synology_dsm.sh
@@ -116,7 +116,7 @@ synology_dsm_deploy() {
   _savedeployconf SYNO_Certificate "$SYNO_Certificate"
 
   default=false
-  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -q -- 'is_default":true'; then
+  if echo "$response" | sed -n "s/.*\"desc\":\"$SYNO_Certificate\",\([^{]*\).*/\1/p" | grep -- 'is_default":true' >/dev/null; then
     default=true
   fi
   _debug2 default "$default"
@@ -138,8 +138,8 @@ synology_dsm_deploy() {
   response=$(_post "$content" "$_base_url/webapi/entry.cgi?api=SYNO.Core.Certificate&method=import&version=1&SynoToken=$token" "" "POST" "multipart/form-data; boundary=${delim}")
   _debug3 response "$response"
 
-  if ! echo "$response" | grep -q '"error":'; then
-    if echo "$response" | grep -q '"restart_httpd":true'; then
+  if ! echo "$response" | grep '"error":' >/dev/null; then
+    if echo "$response" | grep '"restart_httpd":true' >/dev/null; then
       _info "http services were restarted"
     else
       _info "http services were NOT restarted"

From c2812896f8947c29117fe3a8b0832965aabdabeb Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 18:15:10 -0800
Subject: [PATCH 60/68] Update deployer

---
 deploy/panos.sh | 112 +++++++++++++++++++++++++-----------------------
 1 file changed, 58 insertions(+), 54 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 8a288e7..ca03706 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -13,61 +13,75 @@
 
 # This function is to parse the XML
 parse_response() {
-  status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
-  message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  type=$2
+  if [ $type = 'keygen' ]; then
+    status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
+    if [ "$status" = "success" ]; then
+      panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
+      _panos_key=$panos_key
+      message='PAN-OS key is set.' 
+    else
+      message="PAN-OS Key could not be set."
+    fi
+  else
+    status=$(echo "$1" | sed 's/^.*"\([a-z]*\)".*/\1/g')
+    message=$(echo "$1" | sed 's/^.*<result>\(.*\)<\/result.*/\1/g')
+  fi
   return 0
 }
 
 deployer() {
-  type=$1 # Types are cert, key, commit
+  type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
-
-  #Generate DEIM
-  delim="-----MultipartDelimiter$(date "+%s%N")"
-  nl="\015\012"
-  #Set Header
-  _H1="Content-Type: multipart/form-data; boundary=$delim"
-  if [ $type = 'cert' ]; then
-    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
-  fi
-  if [ $type = 'key' ]; then
-    #Add key
-    content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
-  fi
-  #Close multipart
-  content="$content${nl}--$delim--${nl}"
-  #Convert CRLF
-  content=$(printf %b "$content")
-
-  if [ $type = 'cert' ]; then
-    panos_url="https://$_panos_host/api/?type=import&category=certificate&certificate-name=$_cdomain&format=pem&key=$_panos_key"
-  fi
+  panos_url="https://$_panos_host/api/"
   
-  if [ $type = 'key' ]; then
-    panos_url="https://$_panos_host/api/?type=import&category=private-key&certificate-name=$_cdomain&format=pem&passphrase=none&key=$_panos_key"
+  if [ $type = 'keygen' ]; then
+    _H1="Content-Type: application/x-www-form-urlencoded"
+    content="type=keygen&user=$_panos_user&password=$_panos_pass"
+    # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
-  if [ $type = 'commit' ]; then
-    cmd=$(_url_encode "<commit><partial><$_panos_user></$_panos_user></partial></commit>")
-    panos_url="https://$_panos_host/api/?type=commit&cmd=$cmd&key=$_panos_key"
+
+  if [ $type = 'cert' ] || [ $type = 'key' ]; then
+      #Generate DEIM
+      delim="-----MultipartDelimiter$(date "+%s%N")"
+      nl="\015\012"
+        #Set Header
+      _H1="Content-Type: multipart/form-data; boundary=$delim"
+      
+    if [ $type = 'cert' ]; then
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
+    fi
+    if [ $type = 'key' ]; then
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\nnone"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
+    fi
+    #Close multipart
+    content="$content${nl}--$delim--${nl}"
+    #Convert CRLF
+    content=$(printf %b "$content")
   fi
 
-  if [ $type = 'key' ] || [ $type = 'cert' ]; then
-    response=$(_post "$content" "$panos_url" "" "POST")
-  else
-    response=$(_get $panos_url)
+  if [ $type = 'commit' ]; then
+   _H1="Content-Type: application/x-www-form-urlencoded"
+    cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
+    content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
-  _debug panos_url $panos_url 
-  _debug "RESPONSE $response"
-  parse_response "$response"
-  _debug "STATUS IS $status"
-  _debug "MESSAGE IS $message"
+  
+  response=$(_post "$content" "$panos_url" "" "POST")
+  parse_response "$response" $type
   # Saving response to variables
   response_status=$status
-  # Check for cert upload error and handle gracefully.
-
   #DEBUG
-  _debug header "$_H1"
-  # _debug content "$content"
   _debug response_status "$response_status"
   if [ "$response_status" = "success" ]; then
     _debug "Successfully deployed $type"
@@ -121,18 +135,8 @@ panos_deploy() {
     return 1
   else
     _debug "Getting PANOS KEY"
-    panos_key_response=$(_get "https://$_panos_host/api/?type=keygen&user=$_panos_user&password=$_panos_pass")
-    _debug "PANOS KEY FULL RESPONSE $panos_key_response"
-    status=$(echo "$panos_key_response" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
-    _debug "STATUS IS $status"
-    if [ "$status" = "success" ]; then
-      panos_key=$(echo "$panos_key_response" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
-      _panos_key=$panos_key
-    else
-      _err "PANOS Key could not be set. Deploy with --debug to troubleshoot"
-      return 1
-    fi
-    if [ -z "$_panos_host" ] && [ -z "$_panos_key" ] && [ -z "$_panos_user" ]; then
+    deployer keygen
+    if [ -z "$_panos_key" ]; then
       _err "Missing host, apikey, user."
       return 1
     else

From 71bc993e3ddf72d497b16a2a9ee598bcc0f92847 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:23:10 -0800
Subject: [PATCH 61/68] Fixed Shellchecks

---
 deploy/panos.sh | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index ca03706..b2c3b1d 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -14,7 +14,7 @@
 # This function is to parse the XML
 parse_response() {
   type=$2
-  if [ $type = 'keygen' ]; then
+  if [ $type = "keygen" ]; then
     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
@@ -35,20 +35,20 @@ deployer() {
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
   
-  if [ $type = 'keygen' ]; then
+  if [ $type = "keygen" ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
 
-  if [ $type = 'cert' ] || [ $type = 'key' ]; then
+  if [ $type = "cert" ] || [ $type = "key" ]; then
       #Generate DEIM
       delim="-----MultipartDelimiter$(date "+%s%N")"
       nl="\015\012"
         #Set Header
-      _H1="Content-Type: multipart/form-data; boundary=$delim"
+      export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
-    if [ $type = 'cert' ]; then
+    if [ $type = "cert" ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -56,7 +56,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
     fi
-    if [ $type = 'key' ]; then
+    if [ $type = "key" ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -71,14 +71,14 @@ deployer() {
     content=$(printf %b "$content")
   fi
 
-  if [ $type = 'commit' ]; then
-   _H1="Content-Type: application/x-www-form-urlencoded"
+  if [ $type = "commit" ]; then
+    export _H1="Content-Type: application/x-www-form-urlencoded"
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
   
   response=$(_post "$content" "$panos_url" "" "POST")
-  parse_response "$response" $type
+  parse_response "$response" "$type"
   # Saving response to variables
   response_status=$status
   #DEBUG

From 5dcb4176769321555f953f44a046258dc1096294 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:26:48 -0800
Subject: [PATCH 62/68] ShellCheck fixes

---
 deploy/panos.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index b2c3b1d..8e00fd6 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -14,7 +14,7 @@
 # This function is to parse the XML
 parse_response() {
   type=$2
-  if [ $type = "keygen" ]; then
+  if [ "$type" = 'keygen' ]; then
     status=$(echo "$1" | sed 's/^.*\(['\'']\)\([a-z]*\)'\''.*/\2/g')
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
@@ -35,20 +35,20 @@ deployer() {
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
   
-  if [ $type = "keygen" ]; then
+  if [ "$type" = 'keygen' ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
     # content="$content${nl}--$delim${nl}Content-Disposition: form-data; type=\"keygen\"; user=\"$_panos_user\"; password=\"$_panos_pass\"${nl}Content-Type: application/octet-stream${nl}${nl}"
   fi
 
-  if [ $type = "cert" ] || [ $type = "key" ]; then
+  if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
       #Generate DEIM
       delim="-----MultipartDelimiter$(date "+%s%N")"
       nl="\015\012"
         #Set Header
       export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
-    if [ $type = "cert" ]; then
+    if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -56,7 +56,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_cfullchain")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_cfullchain")"
     fi
-    if [ $type = "key" ]; then
+    if [ "$type" = 'key' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\nprivate-key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
@@ -71,7 +71,7 @@ deployer() {
     content=$(printf %b "$content")
   fi
 
-  if [ $type = "commit" ]; then
+  if [ "$type" = 'commit' ]; then
     export _H1="Content-Type: application/x-www-form-urlencoded"
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"

From cbdb8bd9b96a8370051f952806fa24dc13d80f9b Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:34:55 -0800
Subject: [PATCH 63/68] Fixing gitdiff

---
 deploy/panos.sh | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 8e00fd6..c199caf 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -42,11 +42,11 @@ deployer() {
   fi
 
   if [ "$type" = 'cert' ] || [ "$type" = 'key' ]; then
-      #Generate DEIM
-      delim="-----MultipartDelimiter$(date "+%s%N")"
-      nl="\015\012"
-        #Set Header
-      export _H1="Content-Type: multipart/form-data; boundary=$delim"
+    #Generate DEIM
+    delim="-----MultipartDelimiter$(date "+%s%N")"
+    nl="\015\012"
+    #Set Header
+    export _H1="Content-Type: multipart/form-data; boundary=$delim"
       
     if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
@@ -76,7 +76,6 @@ deployer() {
     cmd=$(printf "%s" "<commit><partial><$_panos_user></$_panos_user></partial></commit>" | _url_encode)
     content="type=commit&key=$_panos_key&cmd=$cmd"
   fi
-  
   response=$(_post "$content" "$panos_url" "" "POST")
   parse_response "$response" "$type"
   # Saving response to variables
@@ -145,4 +144,4 @@ panos_deploy() {
       deployer commit
     fi
   fi
-}
\ No newline at end of file
+}

From 2077a70d03a548dfbb5501a5b4388948b93db9f7 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:44:51 -0800
Subject: [PATCH 64/68] Fixing gitdiff

---
 deploy/panos.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index c199caf..3806f14 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -34,7 +34,6 @@ deployer() {
   type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
-  
   if [ "$type" = 'keygen' ]; then
     _H1="Content-Type: application/x-www-form-urlencoded"
     content="type=keygen&user=$_panos_user&password=$_panos_pass"
@@ -47,7 +46,6 @@ deployer() {
     nl="\015\012"
     #Set Header
     export _H1="Content-Type: multipart/form-data; boundary=$delim"
-      
     if [ "$type" = 'cert' ]; then
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"type\"\r\n\r\n\r\nimport"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"category\"\r\n\r\n\r\ncertificate"

From 930e16b64a25e60fbb6998d3f27749a257111939 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Tue, 11 Feb 2020 22:50:05 -0800
Subject: [PATCH 65/68] fix gitdiff

---
 deploy/panos.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 3806f14..eaa19c8 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -19,7 +19,6 @@ parse_response() {
     if [ "$status" = "success" ]; then
       panos_key=$(echo "$1" | sed 's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g')
       _panos_key=$panos_key
-      message='PAN-OS key is set.' 
     else
       message="PAN-OS Key could not be set."
     fi

From 1fe3d80838d2aab564ad15aca7c2342b29e04f97 Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 12 Feb 2020 14:57:31 -0800
Subject: [PATCH 66/68] Updated to use saveconf function and base64encode.

---
 deploy/panos.sh | 43 +++++++++++++++++++------------------------
 1 file changed, 19 insertions(+), 24 deletions(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index eaa19c8..627a59d 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -94,36 +94,31 @@ panos_deploy() {
   _cdomain="$1"
   _ckey="$2"
   _cfullchain="$5"
-  # PANOS HOST is required to make API calls to the PANOS/Panorama
-  if [ -z "$PANOS_HOST" ]; then
-    if [ -z "$_panos_host" ]; then
-      _err "PANOS_HOST not defined."
-      return 1
-    fi
-  else
-    _debug "PANOS HOST is set. Save to domain conf."
-    _panos_host="$PANOS_HOST"
-    _savedomainconf _panos_host "$_panos_host"
-  fi
-  # Retrieve stored variables
-  _panos_user="$(_readaccountconf_mutable PANOS_USER)"
-  _panos_pass="$(_readaccountconf_mutable PANOS_PASS)"
-  # PANOS Credentials check
-  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ]; then
-    _debug "PANOS_USER, PANOS_PASS is not defined"
-    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ]; then
-      _err "No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables."
+  
+  # PANOS ENV VAR check
+  if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ] || [ -z "$PANOS_HOST" ]; then
+    _debug "No ENV variables found lets check for saved variables"
+    _getdeployconf PANOS_USER
+    _getdeployconf PANOS_PASS
+    _getdeployconf PANOS_HOST
+    _panos_user=$PANOS_USER
+    _panos_pass=$PANOS_PASS
+    _panos_host=$PANOS_HOST
+    if [ -z "$_panos_user" ] && [ -z "$_panos_pass" ] && [ -z "$_panos_host" ]; then
+      _err "No host, user and pass found.. If this is the first time deploying please set PANOS_HOST, PANOS_USER and PANOS_PASS in environment variables. Delete them after you have succesfully deployed certs."
       return 1
     else
-      _debug "ok"
+      _debug "Using saved env variables."
     fi
   else
-    _debug "Saving environment variables"
+    _debug "Detected ENV variables to be saved to the deploy conf."
     # Encrypt and save user
-    _saveaccountconf_mutable PANOS_USER "$PANOS_USER"
-    _saveaccountconf_mutable PANOS_PASS "$PANOS_PASS"
+    _savedeployconf PANOS_USER "$PANOS_USER" 1
+    _savedeployconf PANOS_PASS "$PANOS_PASS" 1
+    _savedeployconf PANOS_HOST "$PANOS_HOST" 1
     _panos_user="$PANOS_USER"
     _panos_pass="$PANOS_PASS"
+    _panos_host="$PANOS_HOST"
   fi
   _debug "Let's use username and pass to generate token."
   if [ -z "$_panos_user" ] || [ -z "$_panos_pass" ] || [ -z "$_panos_host" ]; then
@@ -133,7 +128,7 @@ panos_deploy() {
     _debug "Getting PANOS KEY"
     deployer keygen
     if [ -z "$_panos_key" ]; then
-      _err "Missing host, apikey, user."
+      _err "Missing apikey."
       return 1
     else
       deployer cert

From c355b25bb1eea5fbf1b5d08185bc52032b60cabd Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Wed, 12 Feb 2020 15:00:23 -0800
Subject: [PATCH 67/68] Fixed line formatting

---
 deploy/panos.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index 627a59d..a550d87 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -94,7 +94,6 @@ panos_deploy() {
   _cdomain="$1"
   _ckey="$2"
   _cfullchain="$5"
-  
   # PANOS ENV VAR check
   if [ -z "$PANOS_USER" ] || [ -z "$PANOS_PASS" ] || [ -z "$PANOS_HOST" ]; then
     _debug "No ENV variables found lets check for saved variables"

From 21450a08c27af39e3788526464c249a41c3db61f Mon Sep 17 00:00:00 2001
From: Paul Nguyen <panguyen@paloaltonetworks.com>
Date: Thu, 13 Feb 2020 18:01:27 -0800
Subject: [PATCH 68/68] Fixed 6 character requirement.

---
 deploy/panos.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/deploy/panos.sh b/deploy/panos.sh
index a550d87..6316784 100644
--- a/deploy/panos.sh
+++ b/deploy/panos.sh
@@ -30,6 +30,7 @@ parse_response() {
 }
 
 deployer() {
+  content=""
   type=$1 # Types are keygen, cert, key, commit
   _debug "**** Deploying $type *****"
   panos_url="https://$_panos_host/api/"
@@ -59,7 +60,7 @@ deployer() {
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"certificate-name\"\r\n\r\n\r\n$_cdomain"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"key\"\r\n\r\n\r\n$_panos_key"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"format\"\r\n\r\n\r\npem"
-      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\nnone"
+      content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"passphrase\"\r\n\r\n\r\n123456"
       content="$content${nl}--$delim${nl}Content-Disposition: form-data; name=\"file\"; filename=\"$(basename "$_ckey")\"${nl}Content-Type: application/octet-stream${nl}${nl}$(cat "$_ckey")"
     fi
     #Close multipart