Merge pull request #3258 from acmesh-official/dev

sync

.github/workflows/DNS.yml

@@ -143,8 +143,9 @@ jobs:
           C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
       shell: cmd
     - name: Set ENV
+      shell: cmd
       run: |
-          echo '::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
+          echo PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin >> %GITHUB_ENV%
     - name: Clone acmetest
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/
     - name: Run acmetest

.github/workflows/LetsEncrypt.yml

@@ -87,8 +87,13 @@ jobs:
           C:\tools\cygwin\cygwinsetup.exe -qgnNdO -R C:/tools/cygwin -s http://mirrors.kernel.org/sourceware/cygwin/ -P socat,curl,cron,unzip,git
       shell: cmd
     - name: Set ENV
+      shell: cmd
+      run: |
+          echo PATH=C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin >> %GITHUB_ENV%
+    - name: Check ENV
+      shell: cmd
       run: |
-          echo '::set-env name=PATH::C:\tools\cygwin\bin;C:\tools\cygwin\usr\bin'
+          echo "PATH=%PATH%"
     - name: Clone acmetest
       shell: cmd
       run: cd .. && git clone https://github.com/acmesh-official/acmetest.git  && cp -r acme.sh acmetest/

.github/workflows/dockerhub.yml

@@ -63,4 +63,4 @@ jobs:
             --tag ${DOCKER_IMAGE}:${DOCKER_IMAGE_TAG} \
             --output "type=image,push=true" \
             --build-arg AUTO_UPGRADE=${AUTO_UPGRADE} \
-            --platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386 .
+            --platform linux/arm64/v8,linux/amd64,linux/arm/v6,linux/arm/v7,linux/386,linux/ppc64le,linux/s390x .

Dockerfile

@@ -7,6 +7,7 @@ RUN apk update -f \
   coreutils \
   bind-tools \
   curl \
+  sed \
   socat \
   tzdata \
   oath-toolkit-oathtool \

acme.sh

@@ -3993,7 +3993,7 @@ _check_dns_entries() {
 #file
 _get_cert_issuers() {
   _cfile="$1"
-  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7"; then
+  if _contains "$(${ACME_OPENSSL_BIN:-openssl} help crl2pkcs7 2>&1)" "Usage: crl2pkcs7" || _contains "$(${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 help 2>&1)" "unknown option help"; then
     ${ACME_OPENSSL_BIN:-openssl} crl2pkcs7 -nocrl -certfile $_cfile | ${ACME_OPENSSL_BIN:-openssl} pkcs7 -print_certs -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
   else
     ${ACME_OPENSSL_BIN:-openssl} x509 -in $_cfile -text -noout | grep 'Issuer:' | _egrep_o "CN *=[^,]*" | cut -d = -f 2
@@ -5823,7 +5823,7 @@ _deactivate() {
     _URL_NAME="uri"
   fi
 
-  entries="$(echo "$response" | _egrep_o "[^{]*\"type\":\"[^\"]*\", *\"status\": *\"valid\", *\"$_URL_NAME\"[^}]*")"
+  entries="$(echo "$response" | tr '][' '=' | _egrep_o "challenges\": *=[^=]*=" | tr '}{' '\n' | grep "\"status\": *\"valid\"")"
   if [ -z "$entries" ]; then
     _info "No valid entries found."
     if [ -z "$thumbprint" ]; then
@@ -5866,7 +5866,7 @@ _deactivate() {
     _debug _vtype "$_vtype"
     _info "Found $_vtype"
 
-    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*" | cut -d : -f 2,3 | tr -d '"')"
+    uri="$(echo "$entry" | _egrep_o "\"$_URL_NAME\":\"[^\"]*\"" | tr -d '" ' | cut -d : -f 2-)"
     _debug uri "$uri"
 
     if [ "$_d_type" ] && [ "$_d_type" != "$_vtype" ]; then

deploy/fritzbox.sh

@@ -64,9 +64,9 @@ fritzbox_deploy() {
   _info "Log in to the FRITZ!Box"
   _fritzbox_challenge="$(_get "${_fritzbox_url}/login_sid.lua" | sed -e 's/^.*<Challenge>//' -e 's/<\/Challenge>.*$//')"
   if _exists iconv; then
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | md5sum | awk '{print $1}')"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | iconv -f ASCII -t UTF16LE | _digest md5 hex)"
   else
-    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | md5sum | awk '{print $1}')"
+    _fritzbox_hash="$(printf "%s-%s" "${_fritzbox_challenge}" "${_fritzbox_password}" | perl -p -e 'use Encode qw/encode/; print encode("UTF-16LE","$_"); $_="";' | _digest md5 hex)"
   fi
   _fritzbox_sid="$(_get "${_fritzbox_url}/login_sid.lua?sid=0000000000000000&username=${_fritzbox_username}&response=${_fritzbox_challenge}-${_fritzbox_hash}" | sed -e 's/^.*<SID>//' -e 's/<\/SID>.*$//')"
 

deploy/vault.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env sh
+
+# Here is a script to deploy cert to hashicorp vault using curl
+# (https://www.vaultproject.io/)
+#
+# it requires following environment variables:
+#
+# VAULT_PREFIX - this contains the prefix path in vault
+# VAULT_ADDR - vault requires this to find your vault server
+#
+# additionally, you need to ensure that VAULT_TOKEN is avialable
+# to access the vault server
+
+#returns 0 means success, otherwise error.
+
+########  Public functions #####################
+
+#domain keyfile certfile cafile fullchain
+vault_deploy() {
+
+  _cdomain="$1"
+  _ckey="$2"
+  _ccert="$3"
+  _cca="$4"
+  _cfullchain="$5"
+
+  _debug _cdomain "$_cdomain"
+  _debug _ckey "$_ckey"
+  _debug _ccert "$_ccert"
+  _debug _cca "$_cca"
+  _debug _cfullchain "$_cfullchain"
+
+  # validate required env vars
+  _getdeployconf VAULT_PREFIX
+  if [ -z "$VAULT_PREFIX" ]; then
+    _err "VAULT_PREFIX needs to be defined (contains prefix path in vault)"
+    return 1
+  fi
+  _savedeployconf VAULT_PREFIX "$VAULT_PREFIX"
+
+  _getdeployconf VAULT_ADDR
+  if [ -z "$VAULT_ADDR" ]; then
+    _err "VAULT_ADDR needs to be defined (contains vault connection address)"
+    return 1
+  fi
+  _savedeployconf VAULT_ADDR "$VAULT_ADDR"
+
+  # JSON does not allow multiline strings.
+  # So replacing new-lines with "\n" here
+  _ckey=$(sed -z 's/\n/\\n/g' <"$2")
+  _ccert=$(sed -z 's/\n/\\n/g' <"$3")
+  _cca=$(sed -z 's/\n/\\n/g' <"$4")
+  _cfullchain=$(sed -z 's/\n/\\n/g' <"$5")
+
+  URL="$VAULT_ADDR/v1/$VAULT_PREFIX/$_cdomain"
+  export _H1="X-Vault-Token: $VAULT_TOKEN"
+
+  if [ -n "$FABIO" ]; then
+    _post "{\"cert\": \"$_cfullchain\", \"key\": \"$_ckey\"}" "$URL"
+  else
+    _post "{\"value\": \"$_ccert\"}" "$URL/cert.pem"
+    _post "{\"value\": \"$_ckey\"}" "$URL/cert.key"
+    _post "{\"value\": \"$_cca\"}" "$URL/chain.pem"
+    _post "{\"value\": \"$_cfullchain\"}" "$URL/fullchain.pem"
+  fi
+
+}

dnsapi/dns_anx.sh

@@ -0,0 +1,150 @@
+#!/usr/bin/env sh
+
+# Anexia CloudDNS acme.sh hook
+# Author: MA
+
+#ANX_Token="xxxx"
+
+ANX_API='https://engine.anexia-it.com/api/clouddns/v1'
+
+########  Public functions #####################
+
+dns_anx_add() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using ANX CDNS API"
+
+  ANX_Token="${ANX_Token:-$(_readaccountconf_mutable ANX_Token)}"
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  if [ "$ANX_Token" ]; then
+    _saveaccountconf_mutable ANX_Token "$ANX_Token"
+  else
+    _err "You didn't specify a ANEXIA Engine API token."
+    return 1
+  fi
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  # Always add records, wildcard need two records with the same name
+  _anx_rest POST "zone.json/${_domain}/records" "{\"name\":\"$_sub_domain\",\"type\":\"TXT\",\"rdata\":\"$txtvalue\"}"
+  if _contains "$response" "$txtvalue"; then
+    return 0
+  else
+    return 1
+  fi
+}
+
+dns_anx_rm() {
+  fulldomain=$1
+  txtvalue=$2
+
+  _info "Using ANX CDNS API"
+
+  ANX_Token="${ANX_Token:-$(_readaccountconf_mutable ANX_Token)}"
+
+  _debug fulldomain "$fulldomain"
+  _debug txtvalue "$txtvalue"
+
+  _debug "First detect the root zone"
+  if ! _get_root "$fulldomain"; then
+    _err "invalid domain"
+    return 1
+  fi
+
+  _get_record_id
+
+  if _is_uuid "$_record_id"; then
+    if ! _anx_rest DELETE "zone.json/${_domain}/records/$_record_id"; then
+      _err "Delete record"
+      return 1
+    fi
+  else
+    _info "No record found."
+  fi
+  echo "$response" | tr -d " " | grep \"status\":\"OK\" >/dev/null
+}
+
+####################  Private functions below ##################################
+
+_is_uuid() {
+  pattern='^\{?[A-Z0-9a-z]{8}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{4}-[A-Z0-9a-z]{12}\}?$'
+  if echo "$1" | _egrep_o "$pattern" >/dev/null; then
+    return 0
+  fi
+  return 1
+}
+
+_get_record_id() {
+  _debug subdomain "$_sub_domain"
+  _debug domain "$_domain"
+
+  if _anx_rest GET "zone.json/${_domain}/records?name=$_sub_domain&type=TXT"; then
+    _debug response "$response"
+    if _contains "$response" "\"name\":\"$_sub_domain\"" >/dev/null; then
+      _record_id=$(printf "%s\n" "$response" | _egrep_o "\[.\"identifier\":\"[^\"]*\"" | head -n 1 | cut -d : -f 2 | tr -d \")
+    else
+      _record_id=''
+    fi
+  else
+    _err "Search existing record"
+  fi
+}
+
+_anx_rest() {
+  m=$1
+  ep="$2"
+  data="$3"
+  _debug "$ep"
+
+  export _H1="Content-Type: application/json"
+  export _H2="Authorization: Token $ANX_Token"
+
+  if [ "$m" != "GET" ]; then
+    _debug data "$data"
+    response="$(_post "$data" "${ANX_API}/$ep" "" "$m")"
+  else
+    response="$(_get "${ANX_API}/$ep")"
+  fi
+
+  # shellcheck disable=SC2181
+  if [ "$?" != "0" ]; then
+    _err "error $ep"
+    return 1
+  fi
+  _debug response "$response"
+  return 0
+}
+
+_get_root() {
+  domain=$1
+  i=1
+  p=1
+
+  _anx_rest GET "zone.json"
+
+  while true; do
+    h=$(printf "%s" "$domain" | cut -d . -f $i-100)
+    _debug h "$h"
+    if [ -z "$h" ]; then
+      #not valid
+      return 1
+    fi
+
+    if _contains "$response" "\"name\":\"$h\""; then
+      _sub_domain=$(printf "%s" "$domain" | cut -d . -f 1-$p)
+      _domain=$h
+      return 0
+    fi
+
+    p=$i
+    i=$(_math "$i" + 1)
+  done
+  return 1
+}

dnsapi/dns_edgedns.sh

@@ -0,0 +1,466 @@
+#!/usr/bin/env sh
+
+# Akamai Edge DNS v2  API
+# User must provide Open Edgegrid API credentials to the EdgeDNS installation. The remote user in EdgeDNS must have CRUD access to
+# Edge DNS Zones and Recordsets, e.g. DNS—Zone Record Management authorization
+
+# Report bugs to https://control.akamai.com/apps/support-ui/#/contact-support
+
+# Values to export:
+# --EITHER--
+# *** TBD. NOT IMPLEMENTED YET ***
+# specify Edgegrid credentials file and section
+# AKAMAI_EDGERC=<full file path>
+# AKAMAI_EDGERC_SECTION="default"
+## --OR--
+# specify indiviual credentials
+# export AKAMAI_HOST = <host>
+# export AKAMAI_ACCESS_TOKEN = <access token>
+# export AKAMAI_CLIENT_TOKEN = <client token>
+# export AKAMAI_CLIENT_SECRET = <client secret>
+
+ACME_EDGEDNS_VERSION="0.1.0"
+
+########  Public functions #####################
+
+# Usage: dns_edgedns_add  _acme-challenge.www.domain.com   "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to add txt record
+#
+dns_edgedns_add() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug "ENTERING DNS_EDGEDNS_ADD"
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+
+  _debug2 "Add: zone" "$zone"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "$edge_endpoint" "$zone" "$fulldomain")
+  _debug3 "Add URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  _debug3 "_edge_result" "$_edge_result"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
+  fi
+  rdata="\"${txtvalue}\""
+  record_op="POST"
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    record_op="PUT"
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
+    _debug3 "existing TXT found"
+    _debug3 "record data" "$rdlist"
+    # value already there?
+    if _contains "$rdlist" "$txtvalue"; then
+      return 0
+    fi
+    _txt_val=""
+    while [ "$_txt_val" != "$rdlist" ] && [ "${rdlist}" ]; do
+      _txt_val="${rdlist%%,*}"
+      rdlist="${rdlist#*,}"
+      rdata="${rdata},\"${_txt_val}\""
+    done
+  fi
+  # Add the txtvalue TXT Record
+  body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+  _debug3 "Add body '${body}'"
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s added to recordset %s" "$txtvalue" "$fulldomain")"
+    return 0
+  else
+    _err "$(printf "error adding TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
+}
+
+# Usage: dns_edgedns_rm   _acme-challenge.www.domain.com "XKrxpRBosdIKFzxW_CT3KLZNf6q0HG9i01zxXp5CPBs"
+# Used to delete txt record
+#
+dns_edgedns_rm() {
+  fulldomain=$1
+  txtvalue=$2
+  _debug "ENTERING DNS_EDGEDNS_RM"
+  _debug2 "fulldomain" "$fulldomain"
+  _debug2 "txtvalue" "$txtvalue"
+
+  if ! _EDGEDNS_credentials; then
+    _err "$@"
+    return 1
+  fi
+  if ! _EDGEDNS_getZoneInfo "$fulldomain"; then
+    _err "Invalid domain"
+    return 1
+  fi
+  _debug2 "RM: zone" "${zone}"
+  acmeRecordURI=$(printf "%s/%s/names/%s/types/TXT" "${edge_endpoint}" "$zone" "$fulldomain")
+  _debug3 "RM URL" "$acmeRecordURI"
+  # Get existing TXT record
+  _edge_result=$(_edgedns_rest GET "$acmeRecordURI")
+  _api_status="$?"
+  if [ "$_api_status" -ne 0 ]; then
+    if [ "$curResult" = "FATAL" ]; then
+      _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+    fi
+    if [ "$_edge_result" != "404" ]; then
+      _err "$(printf "Failure accessing Akamai Edge DNS API Server. Error: %s" "$_edge_result")"
+      return 1
+    fi
+  fi
+  _debug3 "_edge_result" "$_edge_result"
+  record_op="DELETE"
+  body=""
+  if [ "$_api_status" -eq 0 ]; then
+    # record already exists. Get existing record data and update
+    rdlist="${_edge_result#*\"rdata\":[}"
+    rdlist="${rdlist%%]*}"
+    rdlist=$(echo "$rdlist" | tr -d '"' | tr -d "\\\\")
+    _debug3 "rdlist" "$rdlist"
+    if [ -n "$rdlist" ]; then
+      record_op="PUT"
+      comma=""
+      rdata=""
+      _txt_val=""
+      while [ "$_txt_val" != "$rdlist" ] && [ "$rdlist" ]; do
+        _txt_val="${rdlist%%,*}"
+        rdlist="${rdlist#*,}"
+        _debug3 "_txt_val" "$_txt_val"
+        _debug3 "txtvalue" "$txtvalue"
+        if ! _contains "$_txt_val" "$txtvalue"; then
+          rdata="${rdata}${comma}\"${_txt_val}\""
+          comma=","
+        fi
+      done
+      if [ -z "$rdata" ]; then
+        record_op="DELETE"
+      else
+        # Recreate the txtvalue TXT Record
+        body="{\"name\":\"$fulldomain\",\"type\":\"TXT\",\"ttl\":600, \"rdata\":"[${rdata}]"}"
+        _debug3 "body" "$body"
+      fi
+    fi
+  fi
+  _edge_result=$(_edgedns_rest "$record_op" "$acmeRecordURI" "$body")
+  _api_status="$?"
+  if [ "$_api_status" -eq 0 ]; then
+    _log "$(printf "Text value %s removed from recordset %s" "$txtvalue" "$fulldomain")"
+    return 0
+  else
+    _err "$(printf "error removing TXT record for validation. Error: %s" "$_edge_result")"
+    return 1
+  fi
+}
+
+####################  Private functions below ##################################
+
+_EDGEDNS_credentials() {
+  _debug "GettingEdge DNS credentials"
+  _log "$(printf "ACME DNSAPI Edge DNS version %s" ${ACME_EDGEDNS_VERSION})"
+  args_missing=0
+  if [ -z "$AKAMAI_ACCESS_TOKEN" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_ACCESS_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "$AKAMAI_CLIENT_TOKEN" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_TOKEN is missing"
+    args_missing=1
+  fi
+  if [ -z "$AKAMAI_HOST" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_HOST is missing"
+    args_missing=1
+  fi
+  if [ -z "$AKAMAI_CLIENT_SECRET" ]; then
+    AKAMAI_ACCESS_TOKEN=""
+    AKAMAI_CLIENT_TOKEN=""
+    AKAMAI_HOST=""
+    AKAMAI_CLIENT_SECRET=""
+    _err "AKAMAI_CLIENT_SECRET is missing"
+    args_missing=1
+  fi
+
+  if [ "$args_missing" = 1 ]; then
+    _err "You have not properly specified the EdgeDNS Open Edgegrid API credentials. Please try again."
+    return 1
+  else
+    _saveaccountconf_mutable AKAMAI_ACCESS_TOKEN "$AKAMAI_ACCESS_TOKEN"
+    _saveaccountconf_mutable AKAMAI_CLIENT_TOKEN "$AKAMAI_CLIENT_TOKEN"
+    _saveaccountconf_mutable AKAMAI_HOST "$AKAMAI_HOST"
+    _saveaccountconf_mutable AKAMAI_CLIENT_SECRET "$AKAMAI_CLIENT_SECRET"
+    # Set whether curl should use secure or insecure mode
+  fi
+  export HTTPS_INSECURE=0 # All Edgegrid API calls are secure
+  edge_endpoint=$(printf "https://%s/config-dns/v2/zones" "$AKAMAI_HOST")
+  _debug3 "Edge API Endpoint:" "$edge_endpoint"
+
+}
+
+_EDGEDNS_getZoneInfo() {
+  _debug "Getting Zoneinfo"
+  zoneEnd=false
+  curZone=$1
+  while [ -n "$zoneEnd" ]; do
+    # we can strip the first part of the fulldomain, since its just the _acme-challenge string
+    curZone="${curZone#*.}"
+    # suffix . needed for zone -> domain.tld.
+    # create zone get url
+    get_zone_url=$(printf "%s/%s" "$edge_endpoint" "$curZone")
+    _debug3 "Zone Get: " "${get_zone_url}"
+    curResult=$(_edgedns_rest GET "$get_zone_url")
+    retVal=$?
+    if [ "$retVal" -ne 0 ]; then
+      if [ "$curResult" = "FATAL" ]; then
+        _err "$(printf "Fatal error: acme API function call : %s" "$retVal")"
+      fi
+      if [ "$curResult" != "404" ]; then
+        _err "$(printf "Managed zone validation failed. Error response: %s" "$retVal")"
+        return 1
+      fi
+    fi
+    if _contains "$curResult" "\"zone\":"; then
+      _debug2 "Zone data" "${curResult}"
+      zone=$(echo "${curResult}" | _egrep_o "\"zone\"\\s*:\\s*\"[^\"]*\"" | _head_n 1 | cut -d : -f 2 | tr -d "\"")
+      _debug3 "Zone" "${zone}"
+      zoneEnd=""
+      return 0
+    fi
+
+    if [ "${curZone#*.}" != "$curZone" ]; then
+      _debug3 "$(printf "%s still contains a '.' - so we can check next higher level" "$curZone")"
+    else
+      zoneEnd=true
+      _err "Couldn't retrieve zone data."
+      return 1
+    fi
+  done
+  _err "Failed to  retrieve zone data."
+  return 2
+}
+
+_edgedns_headers=""
+
+_edgedns_rest() {
+  _debug "Handling API Request"
+  m=$1
+  # Assume endpoint is complete path, including query args if applicable
+  ep=$2
+  body_data=$3
+  _edgedns_content_type=""
+  _request_url_path="$ep"
+  _request_body="$body_data"
+  _request_method="$m"
+  _edgedns_headers=""
+  tab=""
+  _edgedns_headers="${_edgedns_headers}${tab}Host: ${AKAMAI_HOST}"
+  tab="\t"
+  # Set in acme.sh _post/_get
+  #_edgedns_headers="${_edgedns_headers}${tab}User-Agent:ACME DNSAPI Edge DNS version ${ACME_EDGEDNS_VERSION}"
+  _edgedns_headers="${_edgedns_headers}${tab}Accept: application/json,*/*"
+  if [ "$m" != "GET" ] && [ "$m" != "DELETE" ]; then
+    _edgedns_content_type="application/json"
+    _debug3 "_request_body" "$_request_body"
+    _body_len=$(echo "$_request_body" | tr -d "\n\r" | awk '{print length}')
+    _edgedns_headers="${_edgedns_headers}${tab}Content-Length: ${_body_len}"
+  fi
+  _edgedns_make_auth_header
+  _edgedns_headers="${_edgedns_headers}${tab}Authorization: ${_signed_auth_header}"
+  _secure_debug2 "Made Auth Header" "$_signed_auth_header"
+  hdr_indx=1
+  work_header="${_edgedns_headers}${tab}"
+  _debug3 "work_header" "$work_header"
+  while [ "$work_header" ]; do
+    entry="${work_header%%\\t*}"
+    work_header="${work_header#*\\t}"
+    export "$(printf "_H%s=%s" "$hdr_indx" "$entry")"
+    _debug2 "Request Header " "$entry"
+    hdr_indx=$((hdr_indx + 1))
+  done
+
+  # clear headers from previous request to avoid getting wrong http code on timeouts
+  : >"$HTTP_HEADER"
+  _debug2 "$ep"
+  if [ "$m" != "GET" ]; then
+    _debug3 "Method data" "$data"
+    # body  url [needbase64] [POST|PUT|DELETE] [ContentType]
+    response=$(_post "$_request_body" "$ep" false "$m" "$_edgedns_content_type")
+  else
+    response=$(_get "$ep")
+  fi
+  _ret="$?"
+  if [ "$_ret" -ne 0 ]; then
+    _err "$(printf "acme.sh API function call failed. Error: %s" "$_ret")"
+    echo "FATAL"
+    return "$_ret"
+  fi
+  _debug2 "response" "${response}"
+  _code="$(grep "^HTTP" "$HTTP_HEADER" | _tail_n 1 | cut -d " " -f 2 | tr -d "\\r\\n")"
+  _debug2 "http response code" "$_code"
+  if [ "$_code" = "200" ] || [ "$_code" = "201" ]; then
+    # All good
+    response="$(echo "${response}" | _normalizeJson)"
+    echo "$response"
+    return 0
+  fi
+
+  if [ "$_code" = "204" ]; then
+    # Success, no body
+    echo "$_code"
+    return 0
+  fi
+
+  if [ "$_code" = "400" ]; then
+    _err "Bad request presented"
+    _log "$(printf "Headers: %s" "$_edgedns_headers")"
+    _log "$(printf "Method: %s" "$_request_method")"
+    _log "$(printf "URL: %s" "$ep")"
+    _log "$(printf "Data: %s" "$data")"
+  fi
+
+  if [ "$_code" = "403" ]; then
+    _err "access denied make sure your Edgegrid cedentials are correct."
+  fi
+
+  echo "$_code"
+  return 1
+}
+
+_edgedns_eg_timestamp() {
+  _debug "Generating signature Timestamp"
+  _debug3 "Retriving ntp time"
+  _timeheaders="$(_get "https://www.ntp.org" "onlyheader")"
+  _debug3 "_timeheaders" "$_timeheaders"
+  _ntpdate="$(echo "$_timeheaders" | grep -i "Date:" | _head_n 1 | cut -d ':' -f 2- | tr -d "\r\n")"
+  _debug3 "_ntpdate" "$_ntpdate"
+  _ntpdate="$(echo "${_ntpdate}" | sed -e 's/^[[:space:]]*//')"
+  _debug3 "_NTPDATE" "$_ntpdate"
+  _ntptime="$(echo "${_ntpdate}" | _head_n 1 | cut -d " " -f 5 | tr -d "\r\n")"
+  _debug3 "_ntptime" "$_ntptime"
+  _eg_timestamp=$(date -u "+%Y%m%dT")
+  _eg_timestamp="$(printf "%s%s+0000" "$_eg_timestamp" "$_ntptime")"
+  _debug "_eg_timestamp" "$_eg_timestamp"
+}
+
+_edgedns_new_nonce() {
+  _debug "Generating Nonce"
+  _nonce=$(echo "EDGEDNS$(_time)" | _digest sha1 hex | cut -c 1-32)
+  _debug3 "_nonce" "$_nonce"
+}
+
+_edgedns_make_auth_header() {
+  _debug "Constructing Auth Header"
+  _edgedns_new_nonce
+  _edgedns_eg_timestamp
+  # "Unsigned authorization header: 'EG1-HMAC-SHA256 client_token=block;access_token=block;timestamp=20200806T14:16:33+0000;nonce=72cde72c-82d9-4721-9854-2ba057929d67;'"
+  _auth_header="$(printf "EG1-HMAC-SHA256 client_token=%s;access_token=%s;timestamp=%s;nonce=%s;" "$AKAMAI_CLIENT_TOKEN" "$AKAMAI_ACCESS_TOKEN" "$_eg_timestamp" "$_nonce")"
+  _secure_debug2 "Unsigned Auth Header: " "$_auth_header"
+
+  _edgedns_sign_request
+  _signed_auth_header="$(printf "%ssignature=%s" "$_auth_header" "$_signed_req")"
+  _secure_debug2 "Signed Auth Header: " "${_signed_auth_header}"
+}
+
+_edgedns_sign_request() {
+  _debug2 "Signing http request"
+  _edgedns_make_data_to_sign "$_auth_header"
+  _secure_debug2 "Returned signed data" "$_mdata"
+  _edgedns_make_signing_key "$_eg_timestamp"
+  _edgedns_base64_hmac_sha256 "$_mdata" "$_signing_key"
+  _signed_req="$_hmac_out"
+  _secure_debug2 "Signed Request" "$_signed_req"
+}
+
+_edgedns_make_signing_key() {
+  _debug2 "Creating sigining key"
+  ts=$1
+  _edgedns_base64_hmac_sha256 "$ts" "$AKAMAI_CLIENT_SECRET"
+  _signing_key="$_hmac_out"
+  _secure_debug2 "Signing Key" "$_signing_key"
+
+}
+
+_edgedns_make_data_to_sign() {
+  _debug2 "Processing data to sign"
+  hdr=$1
+  _secure_debug2 "hdr" "$hdr"
+  _edgedns_make_content_hash
+  path="$(echo "$_request_url_path" | tr -d "\n\r" | sed 's/https\?:\/\///')"
+  path="${path#*$AKAMAI_HOST}"
+  _debug "hier path" "$path"
+  # dont expose headers to sign so use MT string
+  _mdata="$(printf "%s\thttps\t%s\t%s\t%s\t%s\t%s" "$_request_method" "$AKAMAI_HOST" "$path" "" "$_hash" "$hdr")"
+  _secure_debug2 "Data to Sign" "$_mdata"
+}
+
+_edgedns_make_content_hash() {
+  _debug2 "Generating content hash"
+  _hash=""
+  _debug2 "Request method" "${_request_method}"
+  if [ "$_request_method" != "POST" ] || [ -z "$_request_body" ]; then
+    return 0
+  fi
+  _debug2 "Req body" "$_request_body"
+  _edgedns_base64_sha256 "$_request_body"
+  _hash="$_sha256_out"
+  _debug2 "Content hash" "$_hash"
+}
+
+_edgedns_base64_hmac_sha256() {
+  _debug2 "Generating hmac"
+  data=$1
+  key=$2
+  encoded_data="$(echo "$data" | iconv -t utf-8)"
+  encoded_key="$(echo "$key" | iconv -t utf-8)"
+  _secure_debug2 "encoded data" "$encoded_data"
+  _secure_debug2 "encoded key" "$encoded_key"
+
+  encoded_key_hex=$(printf "%s" "$encoded_key" | _hex_dump | tr -d ' ')
+  data_sig="$(echo "$encoded_data" | tr -d "\n\r" | _hmac sha256 "$encoded_key_hex" | _base64)"
+
+  _secure_debug2 "data_sig:" "$data_sig"
+  _hmac_out="$(echo "$data_sig" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "hmac" "$_hmac_out"
+}
+
+_edgedns_base64_sha256() {
+  _debug2 "Creating sha256 digest"
+  trg=$1
+  _secure_debug2 "digest data" "$trg"
+  digest="$(echo "$trg" | tr -d "\n\r" | _digest "sha256")"
+  _sha256_out="$(echo "$digest" | tr -d "\n\r" | iconv -f utf-8)"
+  _secure_debug2 "digest decode" "$_sha256_out"
+}
+
+#_edgedns_parse_edgerc() {
+#  filepath=$1
+#  section=$2
+#}