From 17f5e557ed07dfcc65d7ea808d2e27fbfc0acf7f Mon Sep 17 00:00:00 2001
From: czeming <loser_wind@163.com>
Date: Sat, 20 Feb 2021 17:16:33 +0800
Subject: [PATCH 01/29] Update dns_dp.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

没有encode中文字符会导致提交失败
---
 dnsapi/dns_dp.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_dp.sh b/dnsapi/dns_dp.sh
index 033fa5aa..9b8b7a8b 100755
--- a/dnsapi/dns_dp.sh
+++ b/dnsapi/dns_dp.sh
@@ -89,7 +89,7 @@ add_record() {
 
   _info "Adding record"
 
-  if ! _rest POST "Record.Create" "login_token=$DP_Id,$DP_Key&format=json&lang=en&domain_id=$_domain_id&sub_domain=$_sub_domain&record_type=TXT&value=$txtvalue&record_line=默认"; then
+  if ! _rest POST "Record.Create" "login_token=$DP_Id,$DP_Key&format=json&lang=en&domain_id=$_domain_id&sub_domain=$_sub_domain&record_type=TXT&value=$txtvalue&record_line=%E9%BB%98%E8%AE%A4"; then
     return 1
   fi
 

From a730a08161def8358a68a1662149e670e1af02f3 Mon Sep 17 00:00:00 2001
From: Geert Hendrickx <geert@hendrickx.be>
Date: Tue, 23 Feb 2021 10:28:17 +0100
Subject: [PATCH 02/29] No need to include EC parameters explicitly with the
 private key. (they are embedded)

---
 acme.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/acme.sh b/acme.sh
index 757ed7a5..3c66250e 100755
--- a/acme.sh
+++ b/acme.sh
@@ -1124,7 +1124,7 @@ _createkey() {
 
   if _isEccKey "$length"; then
     _debug "Using ec name: $eccname"
-    if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -genkey 2>/dev/null)"; then
+    if _opkey="$(${ACME_OPENSSL_BIN:-openssl} ecparam -name "$eccname" -noout -genkey 2>/dev/null)"; then
       echo "$_opkey" >"$f"
     else
       _err "error ecc key name: $eccname"

From c5100219d15137f65799b1fb315affd1a6831218 Mon Sep 17 00:00:00 2001
From: Kristian Johansson <kristian.johansson86@gmail.com>
Date: Wed, 24 Feb 2021 08:53:35 +0100
Subject: [PATCH 03/29] Fixes response handling and thereby allow issuing of
 subdomain certs

---
 dnsapi/dns_simply.sh | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_simply.sh b/dnsapi/dns_simply.sh
index d053dcf6..b38d0ed3 100644
--- a/dnsapi/dns_simply.sh
+++ b/dnsapi/dns_simply.sh
@@ -6,7 +6,7 @@
 #SIMPLY_ApiKey="apikey"
 #
 #SIMPLY_Api="https://api.simply.com/1/[ACCOUNTNAME]/[APIKEY]"
-
+SIMPLY_SUCCESS_CODE='"status": 200'
 SIMPLY_Api_Default="https://api.simply.com/1"
 
 ########  Public functions #####################
@@ -171,7 +171,7 @@ _get_root() {
       return 1
     fi
 
-    if _contains "$response" '"code":"NOT_FOUND"'; then
+    if ! _contains "$response" "$SIMPLY_SUCCESS_CODE"; then
       _debug "$h not found"
     else
       _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
@@ -196,6 +196,12 @@ _simply_add_record() {
     return 1
   fi
 
+  if ! _contains "$response" "$SIMPLY_SUCCESS_CODE"; then
+    _err "Call to API not sucessfull, see below message for more details"
+    _err "$response"
+    return 1
+  fi
+
   return 0
 }
 
@@ -211,6 +217,12 @@ _simply_delete_record() {
     return 1
   fi
 
+  if ! _contains "$response" "$SIMPLY_SUCCESS_CODE"; then
+    _err "Call to API not sucessfull, see below message for more details"
+    _err "$response"
+    return 1
+  fi
+
   return 0
 }
 

From 1917c4b04a17de47d5dc6e08946df6b5bf1b137f Mon Sep 17 00:00:00 2001
From: Kristian Johansson <kristian.johansson86@gmail.com>
Date: Wed, 24 Feb 2021 17:34:28 +0100
Subject: [PATCH 04/29] Adds comment

---
 dnsapi/dns_simply.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_simply.sh b/dnsapi/dns_simply.sh
index b38d0ed3..e0e05017 100644
--- a/dnsapi/dns_simply.sh
+++ b/dnsapi/dns_simply.sh
@@ -6,9 +6,11 @@
 #SIMPLY_ApiKey="apikey"
 #
 #SIMPLY_Api="https://api.simply.com/1/[ACCOUNTNAME]/[APIKEY]"
-SIMPLY_SUCCESS_CODE='"status": 200'
 SIMPLY_Api_Default="https://api.simply.com/1"
 
+#This is used for determining success of REST call
+SIMPLY_SUCCESS_CODE='"status": 200'
+
 ########  Public functions #####################
 #Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
 dns_simply_add() {

From 9a90fe37944ce23ecee6425a4b11f0594bb2165e Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 25 Feb 2021 07:45:22 +0800
Subject: [PATCH 05/29] fix
 https://github.com/acmesh-official/acme.sh/issues/3402

---
 acme.sh | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 3c66250e..24cda9c4 100755
--- a/acme.sh
+++ b/acme.sh
@@ -562,8 +562,16 @@ if _exists xargs && [ "$(printf %s '\\x41' | xargs printf)" = 'A' ]; then
 fi
 
 _h2b() {
-  if _exists xxd && xxd -r -p 2>/dev/null; then
-    return
+  if _exists xxd; then
+    if _contains "$(xxd --help 2>&1)" "assumes -c30"; then
+      if xxd -r -p -c 9999 2>/dev/null; then
+        return
+      fi
+    else
+      if xxd -r -p 2>/dev/null; then
+        return
+      fi
+    fi
   fi
 
   hex=$(cat)

From 5eb1469dbfe6c9f998817a7947e90bb942d8f87d Mon Sep 17 00:00:00 2001
From: Lukas Brocke <lukas@brocke.net>
Date: Tue, 23 Feb 2021 19:49:58 +0100
Subject: [PATCH 06/29] dnsapi/ionos: Use POST instead of PATCH for adding TXT
 record

The API now supports a POST route for adding records. Therefore
checking for already existing records and including them in a PATCH
request is no longer necessary.
---
 dnsapi/dns_ionos.sh | 28 +++-------------------------
 1 file changed, 3 insertions(+), 25 deletions(-)

diff --git a/dnsapi/dns_ionos.sh b/dnsapi/dns_ionos.sh
index e6bd5000..aaf8580f 100755
--- a/dnsapi/dns_ionos.sh
+++ b/dnsapi/dns_ionos.sh
@@ -24,20 +24,9 @@ dns_ionos_add() {
     return 1
   fi
 
-  _new_record="{\"name\":\"$_sub_domain.$_domain\",\"type\":\"TXT\",\"content\":\"$txtvalue\",\"ttl\":$IONOS_TXT_TTL,\"prio\":$IONOS_TXT_PRIO,\"disabled\":false}"
+  _body="[{\"name\":\"$_sub_domain.$_domain\",\"type\":\"TXT\",\"content\":\"$txtvalue\",\"ttl\":$IONOS_TXT_TTL,\"prio\":$IONOS_TXT_PRIO,\"disabled\":false}]"
 
-  # As no POST route is supported by the API, check for existing records and include them in the PATCH request in order not delete them.
-  # This is required to support ACME v2 wildcard certificate creation, where two TXT records for the same domain name are created.
-
-  _ionos_get_existing_records "$fulldomain" "$_zone_id"
-
-  if [ "$_existing_records" ]; then
-    _body="[$_new_record,$_existing_records]"
-  else
-    _body="[$_new_record]"
-  fi
-
-  if _ionos_rest PATCH "$IONOS_ROUTE_ZONES/$_zone_id" "$_body" && [ -z "$response" ]; then
+  if _ionos_rest POST "$IONOS_ROUTE_ZONES/$_zone_id/records" "$_body" && [ -z "$response" ]; then
     _info "TXT record has been created successfully."
     return 0
   fi
@@ -125,17 +114,6 @@ _get_root() {
   return 1
 }
 
-_ionos_get_existing_records() {
-  fulldomain=$1
-  zone_id=$2
-
-  if _ionos_rest GET "$IONOS_ROUTE_ZONES/$zone_id?recordName=$fulldomain&recordType=TXT"; then
-    response="$(echo "$response" | tr -d "\n")"
-
-    _existing_records="$(printf "%s\n" "$response" | _egrep_o "\"records\":\[.*\]" | _head_n 1 | cut -d '[' -f 2 | sed 's/]//')"
-  fi
-}
-
 _ionos_get_record() {
   fulldomain=$1
   zone_id=$2
@@ -168,7 +146,7 @@ _ionos_rest() {
     export _H2="Accept: application/json"
     export _H3="Content-Type: application/json"
 
-    response="$(_post "$data" "$IONOS_API$route" "" "$method")"
+    response="$(_post "$data" "$IONOS_API$route" "" "$method" "application/json")"
   else
     export _H2="Accept: */*"
 

From 0f494c9dd62fbbd27d03c6e6603cb96023910a01 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Mon, 1 Mar 2021 18:13:50 +0800
Subject: [PATCH 07/29] fix
 https://github.com/acmesh-official/acme.sh/issues/3433

---
 acme.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/acme.sh b/acme.sh
index 24cda9c4..748363e8 100755
--- a/acme.sh
+++ b/acme.sh
@@ -2133,6 +2133,12 @@ _send_signed_request() {
         _sleep $_sleep_retry_sec
         continue
       fi
+      if _contains "$_body" "The Replay Nonce is not recognized"; then
+        _info "The replay Nonce is not valid, let's get a new one, Sleeping $_sleep_retry_sec seconds."
+        _CACHED_NONCE=""
+        _sleep $_sleep_retry_sec
+        continue
+      fi
     fi
     return 0
   done

From 3817ddef412d31daf00170c8f3afeadc4aa08e68 Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 4 Mar 2021 21:38:51 +0800
Subject: [PATCH 08/29] fix
 https://github.com/acmesh-official/acme.sh/issues/3019

---
 dnsapi/dns_namecheap.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index 7ce39fa9..5e1f4791 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -208,7 +208,7 @@ _namecheap_parse_host() {
   _hostid=$(echo "$_host" | _egrep_o ' HostId="[^"]*' | cut -d '"' -f 2)
   _hostname=$(echo "$_host" | _egrep_o ' Name="[^"]*' | cut -d '"' -f 2)
   _hosttype=$(echo "$_host" | _egrep_o ' Type="[^"]*' | cut -d '"' -f 2)
-  _hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2)
+  _hostaddress=$(echo "$_host" | _egrep_o ' Address="[^"]*' | cut -d '"' -f 2 | _xml_decode)
   _hostmxpref=$(echo "$_host" | _egrep_o ' MXPref="[^"]*' | cut -d '"' -f 2)
   _hostttl=$(echo "$_host" | _egrep_o ' TTL="[^"]*' | cut -d '"' -f 2)
 
@@ -405,3 +405,11 @@ _namecheap_set_tld_sld() {
   done
 
 }
+
+_xml_decode() {
+  sed 's/&quot;/"/g'
+}
+
+
+
+

From 52cfb9a041a4d00f0fe88a34f27e9c2e4b71715e Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Thu, 4 Mar 2021 21:50:54 +0800
Subject: [PATCH 09/29] fix format

---
 dnsapi/dns_namecheap.sh | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index 5e1f4791..e3dc7997 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -410,6 +410,3 @@ _xml_decode() {
   sed 's/&quot;/"/g'
 }
 
-
-
-

From 89bb7e6b0ea5796da06ae47cefa847ff23e5523a Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 10 Mar 2021 16:18:07 +0100
Subject: [PATCH 10/29] Add wildcard certificate support for dns_constellix

---
 dnsapi/dns_constellix.sh | 39 +++++++++++++++++++++++++++++++--------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 42df710d..d0d3132a 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -30,16 +30,38 @@ dns_constellix_add() {
     return 1
   fi
 
-  _info "Adding TXT record"
-  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"add\":true,\"set\":{\"name\":\"${_sub_domain}\",\"ttl\":120,\"roundRobin\":[{\"value\":\"${txtvalue}\"}]}}]"; then
-    if printf -- "%s" "$response" | grep "{\"success\":\"1 record(s) added, 0 record(s) updated, 0 record(s) deleted\"}" >/dev/null; then
-      _info "Added"
-      return 0
+  # To support wildcard certificates, try to find existig TXT record and update it.
+  _info "Search existing TXT record"
+  if _constellix_rest GET "domains/${_domain_id}/records/TXT/search?exact=${_sub_domain}"; then
+    if printf -- "%s" "$response" | grep "{\"errors\":\[\"Requested record was not found\"\]}" >/dev/null; then
+      _info "Adding TXT record"
+      if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"add\":true,\"set\":{\"name\":\"${_sub_domain}\",\"ttl\":60,\"roundRobin\":[{\"value\":\"${txtvalue}\"}]}}]"; then
+        if printf -- "%s" "$response" | grep "{\"success\":\"1 record(s) added, 0 record(s) updated, 0 record(s) deleted\"}" >/dev/null; then
+          _info "Added"
+           return 0
+        else
+          _err "Error adding TXT record"
+        fi
+      fi
     else
-      _err "Error adding TXT record"
-      return 1
+      _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+" | cut -d ':' -f 2)
+      if _constellix_rest GET "domains/${_domain_id}/records/TXT/${_record_id}"; then
+        _new_rr_values=$(printf "%s\n" "$response" | _egrep_o "\"roundRobin\":\[.*?\]" | sed "s/\]$/,{\"value\":\"${txtvalue}\"}]/")
+        _debug _new_rr_values $_new_rr_values
+        _info "Updating TXT record"
+        if _constellix_rest PUT "domains/${_domain_id}/records/TXT/${_record_id}" "{\"name\":\"${_sub_domain}\",\"ttl\":60,${_new_rr_values}}"; then
+          if printf -- "%s" "$response" | grep "{\"success\":\"Record.*updated successfully\"}" >/dev/null; then
+            _info "Updated"
+            return 0
+          else
+            _err "Error updating TXT record"
+          fi
+        fi
+      fi
     fi
   fi
+
+  return 1
 }
 
 # Usage: fulldomain txtvalue
@@ -68,9 +90,10 @@ dns_constellix_rm() {
       return 0
     else
       _err "Error removing TXT record"
-      return 1
     fi
   fi
+
+  return 1
 }
 
 ####################  Private functions below ##################################

From 494a6e6090e4a8b3980f3c92d6d86ce3772e3da2 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 10 Mar 2021 16:32:09 +0100
Subject: [PATCH 11/29] Fix checks

---
 dnsapi/dns_constellix.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index d0d3132a..5c20a917 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -38,7 +38,7 @@ dns_constellix_add() {
       if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"add\":true,\"set\":{\"name\":\"${_sub_domain}\",\"ttl\":60,\"roundRobin\":[{\"value\":\"${txtvalue}\"}]}}]"; then
         if printf -- "%s" "$response" | grep "{\"success\":\"1 record(s) added, 0 record(s) updated, 0 record(s) deleted\"}" >/dev/null; then
           _info "Added"
-           return 0
+          return 0
         else
           _err "Error adding TXT record"
         fi
@@ -47,7 +47,7 @@ dns_constellix_add() {
       _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+" | cut -d ':' -f 2)
       if _constellix_rest GET "domains/${_domain_id}/records/TXT/${_record_id}"; then
         _new_rr_values=$(printf "%s\n" "$response" | _egrep_o "\"roundRobin\":\[.*?\]" | sed "s/\]$/,{\"value\":\"${txtvalue}\"}]/")
-        _debug _new_rr_values $_new_rr_values
+        _debug _new_rr_values "$_new_rr_values"
         _info "Updating TXT record"
         if _constellix_rest PUT "domains/${_domain_id}/records/TXT/${_record_id}" "{\"name\":\"${_sub_domain}\",\"ttl\":60,${_new_rr_values}}"; then
           if printf -- "%s" "$response" | grep "{\"success\":\"Record.*updated successfully\"}" >/dev/null; then

From 8fdfe673e8ccd69dfe8cfcd8acff641dd84dae24 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 10 Mar 2021 23:34:21 +0100
Subject: [PATCH 12/29] Improve the remove handling so it does not print errors

---
 dnsapi/dns_constellix.sh | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 5c20a917..fb4e278e 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -30,8 +30,8 @@ dns_constellix_add() {
     return 1
   fi
 
-  # To support wildcard certificates, try to find existig TXT record and update it.
-  _info "Search existing TXT record"
+  # The TXT record might already exist when working with wilcard certificates. In that case, update the record by adding the new value.
+  _debug "Search TXT record"
   if _constellix_rest GET "domains/${_domain_id}/records/TXT/search?exact=${_sub_domain}"; then
     if printf -- "%s" "$response" | grep "{\"errors\":\[\"Requested record was not found\"\]}" >/dev/null; then
       _info "Adding TXT record"
@@ -83,13 +83,22 @@ dns_constellix_rm() {
     return 1
   fi
 
-  _info "Removing TXT record"
-  if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"delete\":true,\"filter\":{\"field\":\"name\",\"op\":\"eq\",\"value\":\"${_sub_domain}\"}}]"; then
-    if printf -- "%s" "$response" | grep "{\"success\":\"0 record(s) added, 0 record(s) updated, 1 record(s) deleted\"}" >/dev/null; then
+  # The TXT record might have been removed already when working with some wildcard certificates.
+  _debug "Search TXT record"
+  if _constellix_rest GET "domains/${_domain_id}/records/TXT/search?exact=${_sub_domain}"; then
+    if printf -- "%s" "$response" | grep "{\"errors\":\[\"Requested record was not found\"\]}" >/dev/null; then
       _info "Removed"
       return 0
     else
-      _err "Error removing TXT record"
+      _info "Removing TXT record"
+      if _constellix_rest POST "domains/${_domain_id}/records" "[{\"type\":\"txt\",\"delete\":true,\"filter\":{\"field\":\"name\",\"op\":\"eq\",\"value\":\"${_sub_domain}\"}}]"; then
+        if printf -- "%s" "$response" | grep "{\"success\":\"0 record(s) added, 0 record(s) updated, 1 record(s) deleted\"}" >/dev/null; then
+          _info "Removed"
+          return 0
+        else
+          _err "Error removing TXT record"
+        fi
+      fi
     fi
   fi
 

From 928aa74e89b7aac0f1cddcb3e103a1b151aa34d7 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 10 Mar 2021 23:36:34 +0100
Subject: [PATCH 13/29] Fix typo

---
 dnsapi/dns_constellix.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index fb4e278e..75211a6f 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -30,7 +30,7 @@ dns_constellix_add() {
     return 1
   fi
 
-  # The TXT record might already exist when working with wilcard certificates. In that case, update the record by adding the new value.
+  # The TXT record might already exist when working with wildcard certificates. In that case, update the record by adding the new value.
   _debug "Search TXT record"
   if _constellix_rest GET "domains/${_domain_id}/records/TXT/search?exact=${_sub_domain}"; then
     if printf -- "%s" "$response" | grep "{\"errors\":\[\"Requested record was not found\"\]}" >/dev/null; then

From 8733635638875adfa8b201d4d89990b507ba86e8 Mon Sep 17 00:00:00 2001
From: anom-human <80478363+anom-human@users.noreply.github.com>
Date: Thu, 11 Mar 2021 19:11:02 +0100
Subject: [PATCH 14/29] Update dns_servercow.sh to support wildcard certs

Updated dns_servercow.sh to support txt records with multiple entries. This supports wildcard certificates that require txt records with the same name and different contents.
---
 dnsapi/dns_servercow.sh | 42 +++++++++++++++++++++++++++++++++--------
 1 file changed, 34 insertions(+), 8 deletions(-)

diff --git a/dnsapi/dns_servercow.sh b/dnsapi/dns_servercow.sh
index e73d85b0..39f16396 100755
--- a/dnsapi/dns_servercow.sh
+++ b/dnsapi/dns_servercow.sh
@@ -48,18 +48,44 @@ dns_servercow_add() {
 
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
-
-  if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":\"$txtvalue\",\"ttl\":20}"; then
-    if printf -- "%s" "$response" | grep "ok" >/dev/null; then
-      _info "Added, OK"
-      return 0
+  
+  # check whether a txt record already exists for the subdomain  
+  if printf -- "%s" "$response" | grep "{\"name\":\"$_sub_domain\",\"ttl\":20,\"type\":\"TXT\"" >/dev/null; then
+      _info "A txt record with the same name already exists."
+      # trim the string on the left
+      txtvalue_old=${response#*{\"name\":\"$_sub_domain\",\"ttl\":20,\"type\":\"TXT\",\"content\":\"}
+      # trim the string on the right
+      txtvalue_old=${txtvalue_old%%\"*}
+      
+      _debug txtvalue_old "$txtvalue_old"
+      
+      _info "Add the new txtvalue to the existing txt record."
+      if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":[\"$txtvalue\",\"$txtvalue_old\"],\"ttl\":20}"; then
+        if printf -- "%s" "$response" | grep "ok" >/dev/null; then
+          _info "Added additional txtvalue, OK"
+          return 0
+        else
+          _err "add txt record error."
+        return 1
+        fi
+      fi
+      _err "add txt record error."
+      return 1      
     else
+      _info "There is no txt record with the name yet."
+      if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":\"$txtvalue\",\"ttl\":20}"; then
+        if printf -- "%s" "$response" | grep "ok" >/dev/null; then
+          _info "Added, OK"
+          return 0
+        else
+          _err "add txt record error."
+        return 1
+        fi
+      fi
       _err "add txt record error."
       return 1
-    fi
   fi
-  _err "add txt record error."
-
+  
   return 1
 }
 

From 5c4bfbbd950d47d3fe33d4aee75a70499fd117c0 Mon Sep 17 00:00:00 2001
From: anom-human <80478363+anom-human@users.noreply.github.com>
Date: Thu, 11 Mar 2021 20:25:49 +0100
Subject: [PATCH 15/29] Update dns_servercow.sh to support wildcard certs

Updated dns_servercow.sh to support txt records with multiple entries. This supports wildcard certificates that require txt records with the same name and different contents.
---
 dnsapi/dns_servercow.sh | 64 ++++++++++++++++++++---------------------
 1 file changed, 32 insertions(+), 32 deletions(-)

diff --git a/dnsapi/dns_servercow.sh b/dnsapi/dns_servercow.sh
index 39f16396..f70a2294 100755
--- a/dnsapi/dns_servercow.sh
+++ b/dnsapi/dns_servercow.sh
@@ -48,44 +48,44 @@ dns_servercow_add() {
 
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
-  
-  # check whether a txt record already exists for the subdomain  
+
+  # check whether a txt record already exists for the subdomain
   if printf -- "%s" "$response" | grep "{\"name\":\"$_sub_domain\",\"ttl\":20,\"type\":\"TXT\"" >/dev/null; then
-      _info "A txt record with the same name already exists."
-      # trim the string on the left
-      txtvalue_old=${response#*{\"name\":\"$_sub_domain\",\"ttl\":20,\"type\":\"TXT\",\"content\":\"}
-      # trim the string on the right
-      txtvalue_old=${txtvalue_old%%\"*}
-      
-      _debug txtvalue_old "$txtvalue_old"
-      
-      _info "Add the new txtvalue to the existing txt record."
-      if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":[\"$txtvalue\",\"$txtvalue_old\"],\"ttl\":20}"; then
-        if printf -- "%s" "$response" | grep "ok" >/dev/null; then
-          _info "Added additional txtvalue, OK"
-          return 0
-        else
-          _err "add txt record error."
+    _info "A txt record with the same name already exists."
+    # trim the string on the left
+    txtvalue_old=${response#*{\"name\":\"$_sub_domain\",\"ttl\":20,\"type\":\"TXT\",\"content\":\"}
+    # trim the string on the right
+    txtvalue_old=${txtvalue_old%%\"*}
+
+    _debug txtvalue_old "$txtvalue_old"
+
+    _info "Add the new txtvalue to the existing txt record."
+    if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":[\"$txtvalue\",\"$txtvalue_old\"],\"ttl\":20}"; then
+      if printf -- "%s" "$response" | grep "ok" >/dev/null; then
+        _info "Added additional txtvalue, OK"
+        return 0
+      else
+        _err "add txt record error."
         return 1
-        fi
       fi
-      _err "add txt record error."
-      return 1      
-    else
-      _info "There is no txt record with the name yet."
-      if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":\"$txtvalue\",\"ttl\":20}"; then
-        if printf -- "%s" "$response" | grep "ok" >/dev/null; then
-          _info "Added, OK"
-          return 0
-        else
-          _err "add txt record error."
+    fi
+    _err "add txt record error."
+    return 1
+  else
+    _info "There is no txt record with the name yet."
+    if _servercow_api POST "$_domain" "{\"type\":\"TXT\",\"name\":\"$fulldomain\",\"content\":\"$txtvalue\",\"ttl\":20}"; then
+      if printf -- "%s" "$response" | grep "ok" >/dev/null; then
+        _info "Added, OK"
+        return 0
+      else
+        _err "add txt record error."
         return 1
-        fi
       fi
-      _err "add txt record error."
-      return 1
+    fi
+    _err "add txt record error."
+    return 1
   fi
-  
+
   return 1
 }
 

From 96a95ba9fefa05f88e11f500b98e00706d9c7419 Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Sat, 13 Mar 2021 20:43:25 +0800
Subject: [PATCH 16/29] fix
 https://github.com/acmesh-official/acme.sh/issues/3312

---
 acme.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/acme.sh b/acme.sh
index 748363e8..8d422719 100755
--- a/acme.sh
+++ b/acme.sh
@@ -5287,6 +5287,7 @@ signcsr() {
   _renew_hook="${10}"
   _local_addr="${11}"
   _challenge_alias="${12}"
+  _preferred_chain="${13}"
 
   _csrsubj=$(_readSubjectFromCSR "$_csrfile")
   if [ "$?" != "0" ]; then
@@ -5333,7 +5334,7 @@ signcsr() {
   _info "Copy csr to: $CSR_PATH"
   cp "$_csrfile" "$CSR_PATH"
 
-  issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias"
+  issue "$_csrW" "$_csrsubj" "$_csrdomainlist" "$_csrkeylength" "$_real_cert" "$_real_key" "$_real_ca" "$_reload_cmd" "$_real_fullchain" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_addr" "$_challenge_alias" "$_preferred_chain"
 
 }
 
@@ -7430,7 +7431,7 @@ _process() {
     deploy "$_domain" "$_deploy_hook" "$_ecc"
     ;;
   signcsr)
-    signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias"
+    signcsr "$_csr" "$_webroot" "$_cert_file" "$_key_file" "$_ca_file" "$_reloadcmd" "$_fullchain_file" "$_pre_hook" "$_post_hook" "$_renew_hook" "$_local_address" "$_challenge_alias" "$_preferred_chain"
     ;;
   showcsr)
     showcsr "$_csr" "$_domain"

From 3dbe5d872ba777d6fa5d9eb27d4a6cc7adbb5e0e Mon Sep 17 00:00:00 2001
From: neil <win10@neilpang.com>
Date: Sat, 13 Mar 2021 20:46:12 +0800
Subject: [PATCH 17/29] fix format

---
 dnsapi/dns_namecheap.sh | 1 -
 1 file changed, 1 deletion(-)

diff --git a/dnsapi/dns_namecheap.sh b/dnsapi/dns_namecheap.sh
index e3dc7997..d15d6b0e 100755
--- a/dnsapi/dns_namecheap.sh
+++ b/dnsapi/dns_namecheap.sh
@@ -409,4 +409,3 @@ _namecheap_set_tld_sld() {
 _xml_decode() {
   sed 's/&quot;/"/g'
 }
-

From 8eda5f36fb04df03b74e9c3330cd5e995b0ab840 Mon Sep 17 00:00:00 2001
From: Quentin Dreyer <quentin.dreyer@rgsystem.com>
Date: Fri, 12 Mar 2021 12:03:36 +0100
Subject: [PATCH 18/29] feat: add dns_porkbun

---
 dnsapi/dns_porkbun.sh | 171 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 171 insertions(+)
 create mode 100644 dnsapi/dns_porkbun.sh

diff --git a/dnsapi/dns_porkbun.sh b/dnsapi/dns_porkbun.sh
new file mode 100644
index 00000000..05ecb781
--- /dev/null
+++ b/dnsapi/dns_porkbun.sh
@@ -0,0 +1,171 @@
+#!/usr/bin/env sh
+
+#
+#PORKBUN_API_KEY="pk1_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+#PORKBUN_SECRET_API_KEY="sk1_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
+PORKBUN_Api="https://porkbun.com/api/json/v3"
+
+########  Public functions #####################
+
+#Usage: add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+dns_porkbun_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  PORKBUN_API_KEY="${PORKBUN_API_KEY:-$(_readaccountconf_mutable PORKBUN_API_KEY)}"
+  PORKBUN_SECRET_API_KEY="${PORKBUN_SECRET_API_KEY:-$(_readaccountconf_mutable PORKBUN_SECRET_API_KEY)}"
+
+  if [ -z "$PORKBUN_API_KEY" ] || [ -z "$PORKBUN_SECRET_API_KEY" ]; then
+    PORKBUN_API_KEY=''
+    PORKBUN_SECRET_API_KEY=''
+    _err "You didn't specify a Porkbun api key and secret api key yet."
+    _err "You can get yours from here https://porkbun.com/account/api."
+    return 1
+  fi
+
+  #save the credentials to the account conf file.
+  _saveaccountconf_mutable PORKBUN_API_KEY "$PORKBUN_API_KEY"
+  _saveaccountconf_mutable PORKBUN_SECRET_API_KEY "$PORKBUN_SECRET_API_KEY"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _porkbun_rest POST "dns/retrieve/$_domain"
+
+  if ! echo "$response" | tr -d " " | grep '\"status\":"SUCCESS"' >/dev/null; then
+    _err "Error $response"
+    return 1
+  fi
+
+  # For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
+  # we can not use updating anymore.
+  #  count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
+  #  _debug count "$count"
+  #  if [ "$count" = "0" ]; then
+  _info "Adding record"
+  if _porkbun_rest POST "dns/create/$_domain" "{\"name\":\"$_sub_domain\",\"type\":\"TXT\",\"content\":\"$txtvalue\",\"ttl\":120}"; then
+    if _contains "$response" '\"status\":"SUCCESS"'; then
+      _info "Added, OK"
+      return 0
+    elif _contains "$response" "The record already exists"; then
+      _info "Already exists, OK"
+      return 0
+    else
+      _err "Add txt record error. ($response)"
+      return 1
+    fi
+  fi
+  _err "Add txt record error."
+  return 1
+
+}
+
+#fulldomain txtvalue
+dns_porkbun_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  PORKBUN_API_KEY="${PORKBUN_API_KEY:-$(_readaccountconf_mutable PORKBUN_API_KEY)}"
+  PORKBUN_SECRET_API_KEY="${PORKBUN_SECRET_API_KEY:-$(_readaccountconf_mutable PORKBUN_SECRET_API_KEY)}"
+
+  _debug 'First detect the root zone'
+  if ! _get_root "$fulldomain"; then
+    return 1
+  fi
+  _debug _sub_domain "$_sub_domain"
+  _debug _domain "$_domain"
+
+  _debug "Getting txt records"
+  _porkbun_rest POST "dns/retrieve/$_domain"
+
+  if ! echo "$response" | tr -d " " | grep '\"status\":"SUCCESS"' >/dev/null; then
+    _err "Error: $response"
+    return 1
+  fi
+
+  count=$(echo "$response" | _egrep_o "\"count\": *[^,]*" | cut -d : -f 2 | tr -d " ")
+  _debug count "$count"
+  if [ "$count" = "0" ]; then
+    _info "Don't need to remove."
+  else
+    record_id=$(echo "$response" | tr '{' '\n' | grep "$txtvalue" | cut -d, -f1 | cut -d: -f2 | tr -d \")
+    _debug "record_id" "$record_id"
+    if [ -z "$record_id" ]; then
+      _err "Can not get record id to remove."
+      return 1
+    fi
+    if ! _porkbun_rest POST "dns/delete/$_domain/$record_id"; then
+      _err "Delete record error."
+      return 1
+    fi
+    echo "$response" | tr -d " " | grep '\"status\":"SUCCESS"' >/dev/null
+  fi
+
+}
+
+####################  Private functions below ##################################
+#_acme-challenge.www.domain.com
+#returns
+# _sub_domain=_acme-challenge.www
+# _domain=domain.com
+_get_root() {
+  domain=$1
+  i=1
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      return 1
+    fi
+
+    if _porkbun_rest POST "dns/retrieve/$h"; then
+      if _contains "$response" "\"status\":\"SUCCESS\""; then
+        _sub_domain="$(echo "$fulldomain" | sed "s/\\.$_domain\$//")"
+        _domain=$h
+        return 0
+      else
+        _debug "Go to next level of $_domain"
+      fi
+    else
+      _debug "Go to next level of $_domain"
+    fi
+    i=$(_math "$i" + 1)
+  done
+
+  return 1
+}
+
+_porkbun_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  api_key_trimmed=$(echo "$PORKBUN_API_KEY" | tr -d '"')
+  secret_api_key_trimmed=$(echo "$PORKBUN_SECRET_API_KEY" | tr -d '"')
+
+  test -z "$data" && data="{" || data="$(echo $data | cut -d'}' -f1),"
+  data="$data\"apikey\":\"$api_key_trimmed\",\"secretapikey\":\"$secret_api_key_trimmed\"}"
+
+  export _H1="Content-Type: application/json"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "$PORKBUN_Api/$ep" "" "$m")"
+  else
+    response="$(_get "$PORKBUN_Api/$ep")"
+  fi
+
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug2 response "$response"
+  return 0
+}

From 2e34e11b02bba4243fb6e4578c7f3d4ba364cd47 Mon Sep 17 00:00:00 2001
From: qkdreyer <quentin.dreyer@rgsystem.com>
Date: Sat, 13 Mar 2021 14:53:43 +0100
Subject: [PATCH 19/29] fix: prevent rate limit

---
 dnsapi/dns_porkbun.sh | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/dnsapi/dns_porkbun.sh b/dnsapi/dns_porkbun.sh
index 05ecb781..18da6b2f 100644
--- a/dnsapi/dns_porkbun.sh
+++ b/dnsapi/dns_porkbun.sh
@@ -35,14 +35,6 @@ dns_porkbun_add() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  _debug "Getting txt records"
-  _porkbun_rest POST "dns/retrieve/$_domain"
-
-  if ! echo "$response" | tr -d " " | grep '\"status\":"SUCCESS"' >/dev/null; then
-    _err "Error $response"
-    return 1
-  fi
-
   # For wildcard cert, the main root domain and the wildcard domain have the same txt subdomain name, so
   # we can not use updating anymore.
   #  count=$(printf "%s\n" "$response" | _egrep_o "\"count\":[^,]*" | cut -d : -f 2)
@@ -81,14 +73,6 @@ dns_porkbun_rm() {
   _debug _sub_domain "$_sub_domain"
   _debug _domain "$_domain"
 
-  _debug "Getting txt records"
-  _porkbun_rest POST "dns/retrieve/$_domain"
-
-  if ! echo "$response" | tr -d " " | grep '\"status\":"SUCCESS"' >/dev/null; then
-    _err "Error: $response"
-    return 1
-  fi
-
   count=$(echo "$response" | _egrep_o "\"count\": *[^,]*" | cut -d : -f 2 | tr -d " ")
   _debug count "$count"
   if [ "$count" = "0" ]; then
@@ -162,6 +146,8 @@ _porkbun_rest() {
     response="$(_get "$PORKBUN_Api/$ep")"
   fi
 
+  _sleep 3 # prevent rate limit
+
   if [ "$?" != "0" ]; then
     _err "error $ep"
     return 1

From 5cc0fa7c98566eebc6bd035b4f41e63681d8f14e Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Sun, 14 Mar 2021 15:50:16 +0100
Subject: [PATCH 20/29] Retrigger checks


From cc7e1a72c1385031cf98c1e4f2f7188725576476 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Sun, 14 Mar 2021 15:54:28 +0100
Subject: [PATCH 21/29] Retrigger checks


From a694b46914b5a9ce99bbda9ffb9ecb4b04e3b27d Mon Sep 17 00:00:00 2001
From: neilpang <github@neilpang.com>
Date: Sun, 21 Mar 2021 22:46:35 +0800
Subject: [PATCH 22/29] fix freebsd

---
 .github/workflows/DNS.yml         | 2 +-
 .github/workflows/LetsEncrypt.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/DNS.yml b/.github/workflows/DNS.yml
index ed0426ad..5ff1f8ab 100644
--- a/.github/workflows/DNS.yml
+++ b/.github/workflows/DNS.yml
@@ -184,7 +184,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.1.2
+    - uses: vmactions/freebsd-vm@v0.1.3
       with:
         envs: 'TEST_DNS TestingDomain TEST_DNS_NO_WILDCARD TEST_DNS_SLEEP CASE TEST_LOCAL DEBUG ${{ secrets.TokenName1}} ${{ secrets.TokenName2}} ${{ secrets.TokenName3}} ${{ secrets.TokenName4}} ${{ secrets.TokenName5}}'
         prepare: pkg install -y socat curl
diff --git a/.github/workflows/LetsEncrypt.yml b/.github/workflows/LetsEncrypt.yml
index 7c398c09..7193d88d 100644
--- a/.github/workflows/LetsEncrypt.yml
+++ b/.github/workflows/LetsEncrypt.yml
@@ -111,7 +111,7 @@ jobs:
     - uses: actions/checkout@v2
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
-    - uses: vmactions/freebsd-vm@v0.1.2
+    - uses: vmactions/freebsd-vm@v0.1.3
       with:
         envs: 'NGROK_TOKEN TEST_LOCAL'
         prepare: pkg install -y socat curl

From 8adb8a69866a5a540ce3ee470872188e7c7c58dd Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Tue, 23 Mar 2021 21:20:27 +0100
Subject: [PATCH 23/29] While [0-9]+ is a bit more correct than [0-9]*, the
 former does not seem to work on Solaris.

---
 dnsapi/dns_constellix.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 75211a6f..2c3b3265 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -44,7 +44,7 @@ dns_constellix_add() {
         fi
       fi
     else
-      _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+" | cut -d ':' -f 2)
+      _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]*" | cut -d ':' -f 2)
       if _constellix_rest GET "domains/${_domain_id}/records/TXT/${_record_id}"; then
         _new_rr_values=$(printf "%s\n" "$response" | _egrep_o "\"roundRobin\":\[.*?\]" | sed "s/\]$/,{\"value\":\"${txtvalue}\"}]/")
         _debug _new_rr_values "$_new_rr_values"
@@ -123,7 +123,7 @@ _get_root() {
     fi
 
     if _contains "$response" "\"name\":\"$h\""; then
-      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]+" | cut -d ':' -f 2)
+      _domain_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]*" | cut -d ':' -f 2)
       if [ "$_domain_id" ]; then
         _sub_domain=$(printf "%s" "$domain" | cut -d '.' -f 1-$p)
         _domain="$h"

From 6b7db22981085eb2e0b4473f72261f1a575f6899 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 24 Mar 2021 09:01:54 +0100
Subject: [PATCH 24/29] Catch the situation when the TXT record is updated with
 the same value

---
 dnsapi/dns_constellix.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 2c3b3265..914f79df 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -53,6 +53,9 @@ dns_constellix_add() {
           if printf -- "%s" "$response" | grep "{\"success\":\"Record.*updated successfully\"}" >/dev/null; then
             _info "Updated"
             return 0
+          elif printf -- "%s" "$response" | grep "{\"errors\":\[\"Contents are identical\"\]}" >/dev/null; then
+            _info "Already exists, no need to update"
+            return 0
           else
             _err "Error updating TXT record"
           fi

From 3bfcd18a03e532d150b0076643d457aa7d244368 Mon Sep 17 00:00:00 2001
From: wout <wout@canodus.be>
Date: Wed, 24 Mar 2021 13:56:14 +0100
Subject: [PATCH 25/29] Workaround for Solaris, as it does not support
 non-greedy regex

---
 dnsapi/dns_constellix.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_constellix.sh b/dnsapi/dns_constellix.sh
index 914f79df..69d216f0 100644
--- a/dnsapi/dns_constellix.sh
+++ b/dnsapi/dns_constellix.sh
@@ -46,7 +46,7 @@ dns_constellix_add() {
     else
       _record_id=$(printf "%s\n" "$response" | _egrep_o "\"id\":[0-9]*" | cut -d ':' -f 2)
       if _constellix_rest GET "domains/${_domain_id}/records/TXT/${_record_id}"; then
-        _new_rr_values=$(printf "%s\n" "$response" | _egrep_o "\"roundRobin\":\[.*?\]" | sed "s/\]$/,{\"value\":\"${txtvalue}\"}]/")
+        _new_rr_values=$(printf "%s\n" "$response" | _egrep_o '"roundRobin":\[[^]]*\]' | sed "s/\]$/,{\"value\":\"${txtvalue}\"}]/")
         _debug _new_rr_values "$_new_rr_values"
         _info "Updating TXT record"
         if _constellix_rest PUT "domains/${_domain_id}/records/TXT/${_record_id}" "{\"name\":\"${_sub_domain}\",\"ttl\":60,${_new_rr_values}}"; then

From 1530abbd1aacf5877a7317f24f60d8fab96d9735 Mon Sep 17 00:00:00 2001
From: Jan-Philipp Benecke <jpb@cleverreach.com>
Date: Fri, 26 Mar 2021 15:37:12 +0100
Subject: [PATCH 26/29] Make uploading cert to subaccount possible

---
 deploy/cleverreach.sh | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/deploy/cleverreach.sh b/deploy/cleverreach.sh
index 552d8149..10670f34 100644
--- a/deploy/cleverreach.sh
+++ b/deploy/cleverreach.sh
@@ -25,6 +25,7 @@ cleverreach_deploy() {
 
   _getdeployconf DEPLOY_CLEVERREACH_CLIENT_ID
   _getdeployconf DEPLOY_CLEVERREACH_CLIENT_SECRET
+  _getdeployconf DEPLOY_CLEVERREACH_SUBCLIENT_ID
 
   if [ -z "${DEPLOY_CLEVERREACH_CLIENT_ID}" ]; then
     _err "CleverReach Client ID is not found, please define DEPLOY_CLEVERREACH_CLIENT_ID."
@@ -37,6 +38,7 @@ cleverreach_deploy() {
 
   _savedeployconf DEPLOY_CLEVERREACH_CLIENT_ID "${DEPLOY_CLEVERREACH_CLIENT_ID}"
   _savedeployconf DEPLOY_CLEVERREACH_CLIENT_SECRET "${DEPLOY_CLEVERREACH_CLIENT_SECRET}"
+  _savedeployconf DEPLOY_CLEVERREACH_SUBCLIENT_ID "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}"
 
   _info "Obtaining a CleverReach access token"
 
@@ -50,14 +52,26 @@ cleverreach_deploy() {
   _debug _regex "$_regex"
   _access_token=$(echo "$_auth_result" | _json_decode | sed -n "s/$_regex/\1/p")
 
+  if ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}; then
+    _info "Obtaining token for sub-client"
+    export _H1="Authorization: Bearer ${_access_token}"
+    _subclient_token_result="$(_get "https://rest.cleverreach.com/v3/clients/$DEPLOY_CLEVERREACH_SUBCLIENT_ID}/token")"
+    _access_token=$(echo "$_subclient_token_result" | _json_decode | sed -n "s/$_regex/\1/p")
+
+    _debug "Destroying parent token at CleverReach"
+    _post "" "https://rest.cleverreach.com/v3/oauth/token.json" "" "DELETE" "application/json"
+  fi
+
   _info "Uploading certificate and key to CleverReach"
 
   _certData="{\"cert\":\"$(_json_encode <"$_cfullchain")\", \"key\":\"$(_json_encode <"$_ckey")\"}"
   export _H1="Authorization: Bearer ${_access_token}"
   _add_cert_result="$(_post "$_certData" "https://rest.cleverreach.com/v3/ssl" "" "POST" "application/json")"
 
-  _debug "Destroying token at CleverReach"
-  _post "" "https://rest.cleverreach.com/v3/oauth/token.json" "" "DELETE" "application/json"
+  if ! ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}; then
+    _debug "Destroying token at CleverReach"
+    _post "" "https://rest.cleverreach.com/v3/oauth/token.json" "" "DELETE" "application/json"
+  fi
 
   if ! echo "$_add_cert_result" | grep '"error":' >/dev/null; then
     _info "Uploaded certificate successfully"

From cc90f8346351f3d38617e4186e8edf9b9f17a490 Mon Sep 17 00:00:00 2001
From: Christophe Le Guern <c35sys@gmail.com>
Date: Mon, 29 Mar 2021 15:10:14 +0200
Subject: [PATCH 27/29] Use 'vault kv put' instead of 'vault write'

When using vault_cli with a kv2 path, it isn't working. I have the following error:
```
WARNING! The following warnings were returned from Vault:

  * Invalid path for a versioned K/V secrets engine. See the API docs for the
  appropriate API endpoints to use. If using the Vault CLI, use 'vault kv put'
  for this operation.
```
The new way to write data  is to use `vault kv put`, it is compatible with kv1 and kv2.
Ref: https://www.vaultproject.io/docs/commands#reading-and-writing-data
```
The original version of K/V used the common read and write operations. A more advanced K/V Version 2 engine was released in Vault 0.10 and introduced the kv get and kv put commands.
```
---
 deploy/vault_cli.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/deploy/vault_cli.sh b/deploy/vault_cli.sh
index 8b854137..cbb8cc59 100644
--- a/deploy/vault_cli.sh
+++ b/deploy/vault_cli.sh
@@ -50,12 +50,12 @@ vault_cli_deploy() {
   fi
 
   if [ -n "$FABIO" ]; then
-    $VAULT_CMD write "${VAULT_PREFIX}/${_cdomain}" cert=@"$_cfullchain" key=@"$_ckey" || return 1
+    $VAULT_CMD kv put "${VAULT_PREFIX}/${_cdomain}" cert=@"$_cfullchain" key=@"$_ckey" || return 1
   else
-    $VAULT_CMD write "${VAULT_PREFIX}/${_cdomain}/cert.pem" value=@"$_ccert" || return 1
-    $VAULT_CMD write "${VAULT_PREFIX}/${_cdomain}/cert.key" value=@"$_ckey" || return 1
-    $VAULT_CMD write "${VAULT_PREFIX}/${_cdomain}/chain.pem" value=@"$_cca" || return 1
-    $VAULT_CMD write "${VAULT_PREFIX}/${_cdomain}/fullchain.pem" value=@"$_cfullchain" || return 1
+    $VAULT_CMD kv put "${VAULT_PREFIX}/${_cdomain}/cert.pem" value=@"$_ccert" || return 1
+    $VAULT_CMD kv put "${VAULT_PREFIX}/${_cdomain}/cert.key" value=@"$_ckey" || return 1
+    $VAULT_CMD kv put "${VAULT_PREFIX}/${_cdomain}/chain.pem" value=@"$_cca" || return 1
+    $VAULT_CMD kv put "${VAULT_PREFIX}/${_cdomain}/fullchain.pem" value=@"$_cfullchain" || return 1
   fi
 
 }

From d853a9ebbed913d752faceb86be29edaf82806a0 Mon Sep 17 00:00:00 2001
From: Jan-Philipp Benecke <jpb@cleverreach.com>
Date: Tue, 30 Mar 2021 09:13:32 +0200
Subject: [PATCH 28/29] Make uploading cert to subaccount possible

---
 deploy/cleverreach.sh | 32 ++++++++++++++++++++------------
 1 file changed, 20 insertions(+), 12 deletions(-)

diff --git a/deploy/cleverreach.sh b/deploy/cleverreach.sh
index 10670f34..03fccc74 100644
--- a/deploy/cleverreach.sh
+++ b/deploy/cleverreach.sh
@@ -17,6 +17,8 @@ cleverreach_deploy() {
   _cca="$4"
   _cfullchain="$5"
 
+  _rest_endpoint="https://rest.cleverreach.com"
+
   _debug _cdomain "$_cdomain"
   _debug _ckey "$_ckey"
   _debug _ccert "$_ccert"
@@ -43,7 +45,7 @@ cleverreach_deploy() {
   _info "Obtaining a CleverReach access token"
 
   _data="{\"grant_type\": \"client_credentials\", \"client_id\": \"${DEPLOY_CLEVERREACH_CLIENT_ID}\", \"client_secret\": \"${DEPLOY_CLEVERREACH_CLIENT_SECRET}\"}"
-  _auth_result="$(_post "$_data" "https://rest.cleverreach.com/oauth/token.php" "" "POST" "application/json")"
+  _auth_result="$(_post "$_data" "$_rest_endpoint/oauth/token.php" "" "POST" "application/json")"
 
   _debug _data "$_data"
   _debug _auth_result "$_auth_result"
@@ -52,25 +54,31 @@ cleverreach_deploy() {
   _debug _regex "$_regex"
   _access_token=$(echo "$_auth_result" | _json_decode | sed -n "s/$_regex/\1/p")
 
-  if ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}; then
-    _info "Obtaining token for sub-client"
-    export _H1="Authorization: Bearer ${_access_token}"
-    _subclient_token_result="$(_get "https://rest.cleverreach.com/v3/clients/$DEPLOY_CLEVERREACH_SUBCLIENT_ID}/token")"
-    _access_token=$(echo "$_subclient_token_result" | _json_decode | sed -n "s/$_regex/\1/p")
+  _debug _subclient "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}"
 
-    _debug "Destroying parent token at CleverReach"
-    _post "" "https://rest.cleverreach.com/v3/oauth/token.json" "" "DELETE" "application/json"
+  if ! [ -z "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}" ]; then
+    _info "Obtaining token for sub-client ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}"
+    export _H1="Authorization: Bearer ${_access_token}"
+    _subclient_token_result="$(_get "$_rest_endpoint/v3/clients/$DEPLOY_CLEVERREACH_SUBCLIENT_ID/token")"
+    _access_token=$(echo "$_subclient_token_result" | sed -n "s/\"//p")
+
+    _debug _subclient_token_result "$_access_token"
+
+    _info "Destroying parent token at CleverReach, as it not needed anymore"
+    _destroy_result="$(_post "" "$_rest_endpoint/v3/oauth/token.json" "" "DELETE" "application/json")"
+    _debug _destroy_result "$_destroy_result"
   fi
 
   _info "Uploading certificate and key to CleverReach"
 
   _certData="{\"cert\":\"$(_json_encode <"$_cfullchain")\", \"key\":\"$(_json_encode <"$_ckey")\"}"
   export _H1="Authorization: Bearer ${_access_token}"
-  _add_cert_result="$(_post "$_certData" "https://rest.cleverreach.com/v3/ssl" "" "POST" "application/json")"
+  _add_cert_result="$(_post "$_certData" "$_rest_endpoint/v3/ssl" "" "POST" "application/json")"
 
-  if ! ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}; then
-    _debug "Destroying token at CleverReach"
-    _post "" "https://rest.cleverreach.com/v3/oauth/token.json" "" "DELETE" "application/json"
+  if [ -z "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}" ]; then
+    _info "Destroying token at CleverReach, as it not needed anymore"
+    _destroy_result="$(_post "" "$_rest_endpoint/v3/oauth/token.json" "" "DELETE" "application/json")"
+    _debug _destroy_result "$_destroy_result"
   fi
 
   if ! echo "$_add_cert_result" | grep '"error":' >/dev/null; then

From 2867ec509efae5136bf9cb4572bfd46eb7eba7fa Mon Sep 17 00:00:00 2001
From: Jan-Philipp Benecke <jpb@cleverreach.com>
Date: Tue, 30 Mar 2021 09:18:33 +0200
Subject: [PATCH 29/29] Make CI happy

---
 deploy/cleverreach.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/deploy/cleverreach.sh b/deploy/cleverreach.sh
index 03fccc74..a460a139 100644
--- a/deploy/cleverreach.sh
+++ b/deploy/cleverreach.sh
@@ -56,7 +56,7 @@ cleverreach_deploy() {
 
   _debug _subclient "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}"
 
-  if ! [ -z "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}" ]; then
+  if [ -n "${DEPLOY_CLEVERREACH_SUBCLIENT_ID}" ]; then
     _info "Obtaining token for sub-client ${DEPLOY_CLEVERREACH_SUBCLIENT_ID}"
     export _H1="Authorization: Bearer ${_access_token}"
     _subclient_token_result="$(_get "$_rest_endpoint/v3/clients/$DEPLOY_CLEVERREACH_SUBCLIENT_ID/token")"