update link

LICENSE

@@ -1,202 +1,375 @@
-                                 Apache License
+Copyright 2017-2019 AJ ONeal
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
 
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+Mozilla Public License Version 2.0
+==================================
 
-   1. Definitions.
+1. Definitions
+--------------
 
-      "License" shall mean the terms and conditions for use, reproduction,
+1.1. "Contributor"
-      and distribution as defined by Sections 1 through 9 of this document.
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
 
-      "Licensor" shall mean the copyright owner or entity authorized by
+1.2. "Contributor Version"
-      the copyright owner that is granting the License.
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
 
-      "Legal Entity" shall mean the union of the acting entity and all
+1.3. "Contribution"
-      other entities that control, are controlled by, or are under common
+    means Covered Software of a particular Contributor.
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
 
-      "You" (or "Your") shall mean an individual or Legal Entity
+1.4. "Covered Software"
-      exercising permissions granted by this License.
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
 
-      "Source" form shall mean the preferred form for making modifications,
+1.5. "Incompatible With Secondary Licenses"
-      including but not limited to software source code, documentation
+    means
-      source, and configuration files.
 
-      "Object" form shall mean any form resulting from mechanical
+    (a) that the initial Contributor has attached the notice described
-      transformation or translation of a Source form, including but
+        in Exhibit B to the Covered Software; or
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
 
-      "Work" shall mean the work of authorship, whether in Source or
+    (b) that the Covered Software was made available under the terms of
-      Object form, made available under the License, as indicated by a
+        version 1.1 or earlier of the License, but not also under the
-      copyright notice that is included in or attached to the work
+        terms of a Secondary License.
-      (an example is provided in the Appendix below).
 
-      "Derivative Works" shall mean any work, whether in Source or Object
+1.6. "Executable Form"
-      form, that is based on (or derived from) the Work and for which the
+    means any form of the work other than Source Code Form.
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
 
-      "Contribution" shall mean any work of authorship, including
+1.7. "Larger Work"
-      the original version of the Work and any modifications or additions
+    means a work that combines Covered Software with other material, in
-      to that Work or Derivative Works thereof, that is intentionally
+    a separate file or files, that is not Covered Software.
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
 
-      "Contributor" shall mean Licensor and any individual or Legal Entity
+1.8. "License"
-      on behalf of whom a Contribution has been received by Licensor and
+    means this document.
-      subsequently incorporated within the Work.
 
-   2. Grant of Copyright License. Subject to the terms and conditions of
+1.9. "Licensable"
-      this License, each Contributor hereby grants to You a perpetual,
+    means having the right to grant, to the maximum extent possible,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    whether at the time of the initial grant or subsequently, any and
-      copyright license to reproduce, prepare Derivative Works of,
+    all of the rights conveyed by this License.
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
 
-   3. Grant of Patent License. Subject to the terms and conditions of
+1.10. "Modifications"
-      this License, each Contributor hereby grants to You a perpetual,
+    means any of the following:
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
 
-   4. Redistribution. You may reproduce and distribute copies of the
+    (a) any file in Source Code Form that results from an addition to,
-      Work or Derivative Works thereof in any medium, with or without
+        deletion from, or modification of the contents of Covered
-      modifications, and in Source or Object form, provided that You
+        Software; or
-      meet the following conditions:
 
-      (a) You must give any other recipients of the Work or
+    (b) any new file in Source Code Form that contains any Covered
-          Derivative Works a copy of this License; and
+        Software.
 
-      (b) You must cause any modified files to carry prominent notices
+1.11. "Patent Claims" of a Contributor
-          stating that You changed the files; and
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
 
-      (c) You must retain, in the Source form of any Derivative Works
+1.12. "Secondary License"
-          that You distribute, all copyright, patent, trademark, and
+    means either the GNU General Public License, Version 2.0, the GNU
-          attribution notices from the Source form of the Work,
+    Lesser General Public License, Version 2.1, the GNU Affero General
-          excluding those notices that do not pertain to any part of
+    Public License, Version 3.0, or any later versions of those
-          the Derivative Works; and
+    licenses.
 
-      (d) If the Work includes a "NOTICE" text file as part of its
+1.13. "Source Code Form"
-          distribution, then any Derivative Works that You distribute must
+    means the form of the work preferred for making modifications.
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
 
-      You may add Your own copyright statement to Your modifications and
+1.14. "You" (or "Your")
-      may provide additional or different license terms and conditions
+    means an individual or a legal entity exercising rights under this
-      for use, reproduction, or distribution of Your modifications, or
+    License. For legal entities, "You" includes any entity that
-      for any such Derivative Works as a whole, provided Your use,
+    controls, is controlled by, or is under common control with You. For
-      reproduction, and distribution of the Work otherwise complies with
+    purposes of this definition, "control" means (a) the power, direct
-      the conditions stated in this License.
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
 
-   5. Submission of Contributions. Unless You explicitly state otherwise,
+2. License Grants and Conditions
-      any Contribution intentionally submitted for inclusion in the Work
+--------------------------------
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
 
-   6. Trademarks. This License does not grant permission to use the trade
+2.1. Grants
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
 
-   7. Disclaimer of Warranty. Unless required by applicable law or
+Each Contributor hereby grants You a world-wide, royalty-free,
-      agreed to in writing, Licensor provides the Work (and each
+non-exclusive license:
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
 
-   8. Limitation of Liability. In no event and under no legal theory,
+(a) under intellectual property rights (other than patent or trademark)
-      whether in tort (including negligence), contract, or otherwise,
+    Licensable by such Contributor to use, reproduce, make available,
-      unless required by applicable law (such as deliberate and grossly
+    modify, display, perform, distribute, and otherwise exploit its
-      negligent acts) or agreed to in writing, shall any Contributor be
+    Contributions, either on an unmodified basis, with Modifications, or
-      liable to You for damages, including any direct, indirect, special,
+    as part of a Larger Work; and
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
 
-   9. Accepting Warranty or Additional Liability. While redistributing
+(b) under Patent Claims of such Contributor to make, use, sell, offer
-      the Work or Derivative Works thereof, You may choose to offer,
+    for sale, have made, import, and otherwise transfer either its
-      and charge a fee for, acceptance of support, warranty, indemnity,
+    Contributions or its Contributor Version.
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
 
-   END OF TERMS AND CONDITIONS
+2.2. Effective Date
 
-   APPENDIX: How to apply the Apache License to your work.
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
 
-      To apply the Apache License to your work, attach the following
+2.3. Limitations on Grant Scope
-      boilerplate notice, with the fields enclosed by brackets "{}"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
 
-   Copyright {yyyy} {name of copyright owner}
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
 
-   Licensed under the Apache License, Version 2.0 (the "License");
+(a) for any code that a Contributor has removed from Covered Software;
-   you may not use this file except in compliance with the License.
+    or
-   You may obtain a copy of the License at
 
-       http://www.apache.org/licenses/LICENSE-2.0
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
 
-   Unless required by applicable law or agreed to in writing, software
+(c) under Patent Claims infringed by Covered Software in the absence of
-   distributed under the License is distributed on an "AS IS" BASIS,
+    its Contributions.
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
 
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.

README.md

@@ -1,93 +1,36 @@
-![Greenlock Logo](https://git.coolaj86.com/coolaj86/greenlock.js/raw/branch/master/logo/greenlock-1063x250.png "Greenlock Logo")
+![Greenlock Logo](https://git.rootprojects.org/root/greenlock.js/raw/branch/master/logo/greenlock-1063x250.png "Greenlock Logo")
 
-# Greenlock™ Certificate Manager for Web Servers
+!["Greenlock Function"](https://git.rootprojects.org/root/greenlock.js/raw/branch/master/logo/from-not-secure-to-secure-url-bar.png "from url bar showing not secure to url bar showing secure")
 
-A server-friendly commandline tool for Free SSL, Free Wildcard SSL, and Fully Automated HTTPS
-<small>certificates issued by Let's Encrypt v2 via ACME</small>
 
-Greenlock is also available
+# [Greenlock&trade;](https://git.rootprojects.org/root/greenlock-cli.js) for Web Servers | a [Root](https://rootprojects.org) project
-[for Browsers](https://git.coolaj86.com/coolaj86/greenlock.html),
-[for node.js](https://git.coolaj86.com/coolaj86/greenlock-express.js),
-and [for API integrations](https://git.coolaj86.com/coolaj86/greenlock.js)
 
-Why use Greenlock? Two Reasons:
+Free SSL, Free Wildcard SSL, and Fully Automated HTTPS made dead simple<br>
-===============================
+<small>certificates issued by Let's Encrypt v2 via [ACME](https://git.rootprojects.org/root/acme-v2.js)</small>
 
-One
+!["Lifetime Downloads"](https://img.shields.io/npm/dt/greenlock.svg "Lifetime Download Count can't be shown")
----
+!["Monthly Downloads"](https://img.shields.io/npm/dm/greenlock.svg "Monthly Download Count can't be shown")
+!["Weekly Downloads"](https://img.shields.io/npm/dw/greenlock.svg "Weekly Download Count can't be shown")
+!["Stackoverflow Questions"](https://img.shields.io/stackexchange/stackoverflow/t/greenlock.svg "S.O. Question count can't be shown")
 
-You want to be able to run a command like this:
+| **Greenlock for Web Servers**
+| [Greenlock for Web Browsers](https://git.rootprojects.org/root/greenlock.html)
+| [Greenlock for Express.js](https://git.rootprojects.org/root/greenlock-express.js)
+| [Greenlock&trade;.js](https://git.rootprojects.org/root/greenlock.js)
+|
 
-```bash
+# Features
-sudo greenlock --domains example.com --config /etc/greenlock/greenlock.yml
-```
 
-And then get awesome results like this:
+- [x] Commandline (cli) Certificate Manager (like certbot)
+- [x] Integrated Web Server
+- [x] Free SSL Certificates
+- [x] Automatic certificate renewal before expiration
+- [x] One-off standalone registration / renewal
+- [x] On-the-fly registration / renewal via webroot
 
-```
+# Install
-/etc/ssl/acme
-├── accounts
-│   └── acme-staging-v02.api.letsencrypt.org/directory
-│       └── c07a31a70c691d64f6b4d31f51a6dd9c
-│           ├── meta.json
-│           ├── private_key.json
-│           └── regr.json
-└── live
-    └── example.com               <-- Free SSL like magic! Wow!
-        ├── bundle.pem
-        ├── cert.pem
-        ├── chain.pem
-        ├── fullchain.pem
-        └── privkey.pem
-```
 
-That you use with your existing webserver - Apache, Nginx, HAProxy, node.js, etc
+## Mac & Linux
-
-And install to renew so that you never worry about ssl again.
-
-Two
----
-
-You want to be able to run a command like this:
-
-```bash
-sudo greenlock --install systemd --config /etc/greenlock.yml --webroot '/srv/www/:hostname'
-```
-
-To immediately secure and publish any and all sites you have in a web root like this:
-
-```
-/srv/www/
-├── coolsite.rocks
-├── example.com
-└── whatever.app
-```
-
-Features
-========
-
-  - [x] Works with Windows, Mac, and Linux
-  - [x] Works with Apache, Nginx, node.js, HAProxy, etc
-  - [x] Great for VPS services - AWS, Digital Ocean, Vultr, etc
-  - [x] Great for Tiny Computers - Raspberry Pi, etc
-  - [x] Automatic HTTPS
-    - [x] Free SSL
-    - [x] Free Wildcard SSL
-    - [x] Multiple domain support (up to 100 altnames per SAN)
-    - [x] Virtual Hosting (vhost)
-    - [x] Automatical renewal (10 to 14 days before expiration)
-    - [x] Let's Encrypt v2 ACME API
-  - [x] Extensible via Plugins
-    - [x] HTTP Challenge Plugins - AWS S3, Azure, Consul, etcd
-    - [x] DNS Challenge Plugins - AWS Route53, CloudFlare, Digital Ocean
-    - [x] Account & Certificate Storage Plugins - AWS S3, Redis
-  - [x] Built-in WebServer
-
-Install
-=======
-
-Mac
----
 
 Open Terminal and run this install script:
 
@@ -95,270 +38,186 @@ Open Terminal and run this install script:
 curl -fsS https://get.greenlock.app/ | bash
 ```
 
-Linux
+This will install greenlock to `/opt/greenlock` and put a symlink to
------
+`/opt/greenlock/bin/greenlock` in `/usr/local/bin/greenlock` for convenience.
 
-Open Terminal and run this install script:
+You can customize the installation:
 
 ```bash
+export NODEJS_VER=v8.11.1
+export GREENLOCK_PATH=/opt/greenlock
 curl -fsS https://get.greenlock.app/ | bash
 ```
 
-Windows & Node.js
+This will change which version of node.js is bundled with greenlock
------------------
+and the path to which greenlock installs.
+
+## Windows & Node.js
 
 1. Install [node.js](https://nodejs.org)
 2. Open _Node.js_
 2. Run the command `npm install -g greenlock-cli`
 
-Important: How to Not Get Blocked
+# Usage
-===================
 
-PLEASE READ ALL THREE SENTENCES:
+We have a few different examples of issuing SSL certificates:
 
-  * These examples use the PRODUCTION ENVIRONMENT (where you can be blocked)
+* Standalone (testing): Issue a one-off certificate
-  * If an example DOESN'T WORK on the first try, STOP!
+* Webroot (production): Automatic certificate renewal for Apache, Nginx, HAProxy, etc
-  * UNCOMMENT the `--staging` flag and see the TROUBLESHOOTING SECTION
+* Manual (debugging): Go through the certificate proccess step-by-step
+<!-- * Server (production): Leave it all to Greenlock -->
 
-Quick Examples
+**Important Note**: Staging vs Production
-==============
 
-The most basic options are exposed as commandline flags,
+Each of these examples are using the **staging server**.
-just so that we can do little domes like this.
 
-The config file is explained after the troubleshooting section.
+Once you've successfully gotten certificates with the staging server
+you must **delete** `--config-dir` (i.e. `rm -rf ~/acme`) and then
+switch to the **production server**.
 
-### The Greenlock HTTPS WebServer
+```
-
+--acme-version draft-11 --server https://acme-v02.api.letsencrypt.org/directory \
-Easy to run on your server, nothing else required:
-
-```bash
-sudo greenlock --webserver \
-  --agree-tos --email jon@example.com \
-  --domains example.com,www.example.com \
-  --webroot /srv/www/example.com \
-  --config-dir ~/acme/etc #--staging
 ```
 
-### Add SSL to an Existing WebServer
+## Standalone
 
-For all the Apache, Nginx, and HAProxy fans out there:
+<small>**primarily for testing**</small>
 
-(use your existing webroot)
+You can run in standalone mode **on your server** and get a cert instantly.
+
+Note: No other webserver may be running at the time (use Webroot mode for that).
 
 ```bash
-sudo greenlock --agree-tos --email jon@example.com \
+sudo greenlock certonly --standalone \
-  --domains example.com,www.example.com \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
-  --webroot /srv/www/example.com \
+  --agree-tos --email jon@example.com --domains example.com,www.example.com \
-  --privkey-path /etc/ssl/example.com/privkey.pem \
+  --community-member \
-  --fullchain-path /etc/ssl/example.com/fullchain.pem \
-  --bundle-path /etc/ssl/example.com/bundle.pem \
-  --config-dir /etc/ssl/acme #--staging
-```
-
-### Get SSL Certificates Interactively
-
-Run this manual process on your laptop and copy the certificates
-to you server afterwards:
-
-```bash
-greenlock --agree-tos --email jon@example.com \
-  --domains example.com,www.example.com \
-  --privkey-path /etc/ssl/example.com/privkey.pem \
-  --fullchain-path /etc/ssl/example.com/fullchain.pem \
-  --bundle-path /etc/ssl/example.com/bundle.pem \
-  --manual \
-  --config-dir /etc/ssl/acme #--staging
-```
-
-### Standalone SSL Certificate Retrieval
-
-Run this on a server standalone just to retrieve
-certificates:
-
-```bash
-sudo greenlock --agree-tos --email jon@example.com \
-  --domains example.com,www.example.com \
-  --privkey-path /etc/ssl/example.com/privkey.pem \
-  --fullchain-path /etc/ssl/example.com/fullchain.pem \
-  --bundle-path /etc/ssl/example.com/bundle.pem \
-  --standalone \
-  --config-dir ~/etc/ssl/acme #--staging
-```
-
-Troubleshooting
-===============
-
-Watch the [Troubleshooting Screencast](https://youtu.be/e8vaR4CEZ5s?t=397)
-
-**Note**: Replace `whatever.com` with your domain, use your real email, etc.
-
-0. Use the `--staging` flag while troubleshooting
-1. Do you have a valid A record for `whatever.com`?
-2. When you `ping whatever.com` do you see that same address?
-3. Can you confirm that's your server's address with `ifconfig` or `ipconfig`?
-4. Do you have write access to all of the directories you've specified?
-
-**Important**: Don't forget to delete the directory specified in `--config-dir`
-when you get things figured out and remove `--staging`.
-
-
-Usage
-=====
-
-These commands are shown using the **testing server**.
-
-Want to use the **live server**?
-
-1. change server to `--server https://acme-v02.api.letsencrypt.org/directory`
-
-**Note**: This has really only been tested with single domains so if
-multiple domains doesn't work for you, file a bug.
-
-### Standalone (primarily for testing)
-
-You can run standalone mode to get a cert **on the server**. You either use an
-http-01 challenge (the default) on port 80, or a tls-sni-01 challenge on port
-443 (or 5001). Like so:
-
-```bash
-greenlock certonly \
-  --agree-tos --email john.doe@example.com \
-  --standalone \
-  --domains example.com,www.example.com \
-  --server https://acme-staging-v02.api.letsencrypt.org/directory \
-  --acme-version draft-11
   --config-dir ~/acme/etc
 ```
 
-or
+## WebRoot
+
+<small>**for testing and production**</small>
+
+With this method you must use **your existing http (port 80) server** (Apache, Nginx, HAProxy, etc).
+You will specify the **path or template path** to your `public_html` or `www` webroot.
+
+For example:
+
+  * I want to get an SSL cert for `example.com`
+  * `index.html` lives at `/srv/www/example.com`
+  * I would use this command:
 
 ```bash
-greenlock certonly \
+sudo greenlock certonly --webroot \
-  --agree-tos --email john.doe@example.com \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
-  --standalone --tls-sni-01-port 443 \
+  --agree-tos --email jon@example.com --domains example.com \
-  --domains example.com,www.example.com \
+  --community-member \
-  --server https://acme-staging-v02.api.letsencrypt.org/directory \
+  --root /srv/www/example.com \
-  --acme-version draft-11
   --config-dir ~/acme/etc
 ```
 
-Then you can see your certs at `~/letsencrypt/etc/live`.
+Now let's say that
 
-```
+  * I have many sites in `/srv/www/`, all by their name
-ls ~/letsencrypt/etc/live
+  * I already store my ssl certs in the format `/etc/apache/ssl/:hostname/{key.pem,ssl.crt}`
-```
+  * I'll run this command instead:
-
-This option is great for testing, but since it requires the use of
-the same ports that your webserver needs, it isn't a good choice
-for production.
-
-### WebRoot
-
-You can specify the path to where you keep your `index.html` with `webroot`, as
-long as your server is serving plain HTTP on port 80.
-
-For example, if I want to get a domain for `example.com` and my `index.html` is
-at `/srv/www/example.com`, then I would use this command:
 
 ```bash
-sudo greenlock certonly \
+sudo greenlock certonly --webroot \
-  --agree-tos --email john.doe@example.com \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
-  --webroot --webroot-path /srv/www/example.com \
+  --agree-tos --email jon@example.com --domains example.com,whatever.com,foobar.net \
-  --config-dir /etc/letsencrypt \
+  --community-member \
-  --domains example.com,www.example.com \
+  --root "/srv/www/:hostname" \
-  --server https://acme-staging-v02.api.letsencrypt.org/directory
+  --privkey-path "/etc/apache/ssl/:hostname/key.pem" \
-  --acme-version draft-11
+  --fullchain-path "/etc/apache/ssl/:hostname/ssl.crt" \
+  --config-dir ~/acme/etc
 ```
 
-Note that we use `sudo` because in this example we are using `/etc/letsencrypt`
+### Run with cron
-as the cert directory rather than `~/letsencrypt/etc`, which we used in the previous example.
 
-Then see your brand new shiny certs:
+Those commands are safe to be run **daily** with cron.
+The certificates will automatically renew 2 weeks before expiring.
 
-```
+## Interactive
-ls /etc/letsencrypt/live/
-```
 
-You can use a cron job to run the script above every 80 days (the certificates expire after 90 days)
+<small>**primarily for debugging**</small>
-so that you always have fresh certificates.
-
-### Interactive (for debugging)
 
 The token (for all challenge types) and keyAuthorization (only for https-01)
 will be printed to the screen and you will be given time to copy it wherever
 (file, dns record, database, etc) and the process will complete once you hit `enter`.
 
 ```bash
-sudo greenlock certonly \
+sudo greenlock certonly --manual \
-  --agree-tos --email john.doe@example.com \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
-  --manual
+  --agree-tos --email jon@example.com --domains example.com \
-  --config-dir /etc/acme \
+  --community-member \
-  --domains example.com,www.example.com \
+  --config-dir ~/acme/etc
-  --server https://acme-staging-v02.api.letsencrypt.org/directory
-  --acme-version draft-11
 ```
 
-## Test with a free domain
+# Certificate Locations
+Then you can see your certs at `~/acme/etc/live`.
+
+```
+~/acme/etc/
+└── example.com
+    ├── cert.pem
+    ├── chain.pem
+    ├── fullchain.pem  (Apache, Nginx, node.js)
+    ├── privkey.pem    (Apache, Nginx, node.js)
+    └── bundle.pem     (HAProxy)
+```
+
+
+## Run without root (no sudo)
+
+`sudo` is used to allow greenlock to use port 80 and write to httpd-owned directories.
+
+Allow greenlock to bind on system ports without root:
 
 ```bash
-# Install Daplie DNS
+sudo setcap cap_net_bind_service=+ep /opt/greenlock/bin/node
-npm install -g ddns-cli
-
-# see terms of use
-ddns --help
-
-# agree to terms and get domain
-ddns --random --email user@example.com --agree
-
-# the default is to use the ip address from which
-# you can the command, but you can also assign the
-# ip manually
-ddns --random --email user@example.com --agree -a '127.0.0.1'
 ```
 
-Example domain:
+To allow greenlock to write to folders owned by another user, set it to run as that user.
 
-```
+Otherwise, you can change the permissions on the folders, which is
-rubber-duck-42.daplie.me
+**probably a BAD IDEA**. Probabry a **security risk**.
-```
+But since some of you are going to do it anyway I might as well tell you how:
-
-## Run without Root
-
-If you'd like to allow node.js to use privileged ports `80` and `443`
-(and everything under 1024 really) without being run as `root` or `sudo`,
-you can use `setcap` to do so. (it may need to be run any time you reinstall node as well)
-
-```bash
-sudo setcap cap_net_bind_service=+ep /usr/local/bin/node
-```
-
-By default `node-greenlock` assumes your home directory `~/letsencrypt/`, but if
-you really want to use `/etc/letsencrypt`, `/var/lib/letsencrypt/`, and `/var/log/letsencrypt`
-you could change the permissions on them. **Probably a BAD IDEA**. Probabry a security risk.
 
 ```
 # PROBABLY A BAD IDEA
-sudo chown -R $(whoami) /etc/letsencrypt /var/lib/letsencrypt /var/log/letsencrypt
+sudo chown -R $(whoami) /etc/ssl /etc/acme
 ```
 
-## Command Line Options
+# Command Line Options
 
 ```
 Usage:
   greenlock [OPTIONS] [ARGS]
 
 Options:
-      --server [STRING]         ACME Directory Resource URI. (Default is https://acme-v01.api.letsencrypt.org/directory))
+      --acme-version [STRING]   'draft-11' for Let's Encrypt v2 or 'v01' for Let's Encrypt v1. (default: null)
+
+      --acme-url [URL]          Directory URL for ACME API. Let's Encrypt URLs are:
+                                  draft-11
+                                    https://acme-staging-v02.api.letsencrypt.org/directory
+                                    https://acme-v02.api.letsencrypt.org/directory
+
+                                  v01
+                                    https://acme-staging.api.letsencrypt.org/directory
+                                    https://acme-v01.api.letsencrypt.org/directory
 
       --email EMAIL             Email used for registration and recovery contact. (default: null)
 
       --agree-tos BOOLEAN       Agree to the Let's Encrypt Subscriber Agreement
 
-      --domains URL             Domain names to apply. For multiple domains you can enter a comma
+      --community-member        Submit stats to and receive updates from Greenlock
+
+      --domains HOSTNAME        Domain names to apply. For multiple domains you can enter a comma
                                 separated list of domains as a parameter. (default: [])
 
-      --renew-within [NUMBER]   Renew certificates this many days before expiry. (default: 7)
+      --renew-within [NUMBER]   Renew certificates this many days before expiry. (default: 10)
 
       --cert-path STRING        Path to where new cert.pem is saved
                                 (Default is :conf/live/:hostname/cert.pem)
@@ -369,8 +228,13 @@ Options:
       --chain-path [STRING]     Path to where new chain.pem is saved
                                 (Default is :conf/live/:hostname/chain.pem)
 
+      --bundle-path [STRING]    Path to where new bundle.pem (fullchain + privkey) is saved
+                                (Default is :conf/live/:hostname/bundle.pem)
+
       --domain-key-path STRING  Path to privkey.pem to use for domain (default: generate new)
 
+      --account-key-path STRING Path to privkey.pem to use for account (default: generate new)
+
       --config-dir STRING       Configuration directory. (Default is ~/letsencrypt/etc/)
 
       --http-01-port [NUMBER]   Use HTTP-01 challenge type with this port, used for SimpleHttp challenge. (Default is 80)
@@ -383,13 +247,41 @@ Options:
       --manual [BOOLEAN]        Print the token and key to the screen and wait for you to hit enter,
                                 giving you time to copy it somewhere before continuing. (Default is false)
 
-      --webroot BOOLEAN         Obtain certs by placing files in a webroot directory.
-
-      --webroot-path STRING     public_html / webroot path.
-
       --debug BOOLEAN           show traces and logs
 
   -h, --help                    Display help and usage details
 ```
 
+
+# Certbot Command Line Options
+
+These options are maintained for compatability with certbot:
+
+```
+      --server [STRING]         ACME Directory Resource URI. (Default is https://acme-v01.api.letsencrypt.org/directory))
+
+      --duplicate BOOLEAN       Allow getting a certificate that duplicates an existing one/is
+                                an early renewal.
+
+      --webroot BOOLEAN         Obtain certs by placing files in a webroot directory.
+
+      --webroot-path STRING     public_html / webroot path.
+```
+
 Note: some of the options may not be fully implemented. If you encounter a problem, please report a bug on the issues page.
+
+# Legal &amp; Rules of the Road
+
+Greenlock&trade; and Bluecrypt&trade; are [trademarks](https://rootprojects.org/legal/#trademark) of AJ ONeal
+
+The rule of thumb is "attribute, but don't confuse". For example:
+
+> Built with [Greenlock CLI](https://git.rootprojects.org/root/greenlock-cli.js) (a [Root](https://rootprojects.org) project).
+
+Please [contact us](mailto:aj@therootcompany.com) if you have any questions in regards to our trademark,
+attribution, and/or visible source policies. We want to build great software and a great community.
+
+[Greenlock&trade;](https://git.rootprojects.org/root/greenlock.js) |
+MPL-2.0 |
+[Terms of Use](https://therootcompany.com/legal/#terms) |
+[Privacy Policy](https://therootcompany.com/legal/#privacy)

bin/greenlock.js

@@ -6,68 +6,59 @@ var mkdirp = require('mkdirp');
 
 cli.parse({
   'acme-version':
-    [ false, " v01 (Let's Encrypt v01) or draft-11 (Let's Encrypt v02) (default: draft-11)", 'string'
+    [ false, " ACME / Let's Encrypt version. v01 or draft-11 (aka v02)", 'string', 'draft-11' ]
-    , 'draft-11' ]
 , 'acme-url':
-    [ false, " ACME API Directory URL (default: https://acme-v02.api.letsencrypt.org/directory", 'string'
+    [ false, " ACME Directory Resource URL", 'string', '' ]
-    , 'https://acme-staging-v02.api.letsencrypt.org/directory' ]
-
-, 'aol-keyword-www':
-    [ false, " Travel back in time to 1995 where we redirect bare domains as to have a triple-w prefix", 'string'
-    , false ]
-, config:
-    [ 'c', " Path to configuration file --config /etc/greenlock/greenlock.yml (default: '')", 'string' ]
-, serve:
-    [ false, " Run as webserver (default: false)", 'boolean'
-    , false ]
 , email:
-    [ false, " Email used for registration and recovery contact (default: '')", 'email' ]
+    [ false, " Email used for registration and recovery contact. (default: null)", 'email' ]
-, analytics:
+, 'agree-tos': [ false, " Agree to the Let's Encrypt Subscriber Agreement", 'boolean', false ]
-    [ false, " Share analytics with greenlock (default: false)", 'boolean'
+, 'community-member': [ false, " Submit stats to and get updates from Greenlock", 'boolean', false ]
-    , false ]
-, community:
-    [ false, " Join the greenlock community to get important updates (default: false)", 'boolean'
-    , false ]
-, 'agree-tos':
-    [ false, " Agree to the Let's Encrypt Subscriber Agreement", 'boolean'
-    , false ]
 , domains:
-    [ false, " Comma-separated list of domains to secure (default: [])", 'string' ]
+    [ false, " Domain names to apply. For multiple domains you can enter a comma separated list of domains as a parameter. (default: [])", 'string' ]
-, 'config-dir':
+, 'renew-within': [ false, " Renew certificates this many days before expiry", 'int', 7 ]
-    [ false, " Configuration directory.", 'string'
-    , '~/acme/etc/' ]
 , 'cert-path':
-    [ false, " Path where new cert.pem is saved", 'string'
+    [ false, " Path to where new cert.pem is saved", 'string'
     , ':configDir/live/:hostname/cert.pem' ]
 , 'fullchain-path':
-    [ false, " Path where new fullchain.pem (cert + chain) is saved", 'string'
+    [ false, " Path to where new fullchain.pem (cert + chain) is saved", 'string'
     , ':configDir/live/:hostname/fullchain.pem' ]
-, 'chain-path':
-    [ false, " Path where new chain.pem is saved", 'string'
-    , ':configDir/live/:hostname/chain.pem' ]
 , 'bundle-path':
-    [ false, " Path where new bundle.pem (fullchain + privkey) is saved", 'string'
+    [ false, " Path to where new bundle.pem (fullchain + privkey) is saved", 'string'
     , ':configDir/live/:hostname/bundle.pem' ]
+, 'chain-path':
+    [ false, " Path to where new chain.pem is saved", 'string'
+    , ':configDir/live/:hostname/chain.pem' ]
 , 'privkey-path':
-    [ false, " Path where (new or existing) domain privkey.pem is saved", 'string'
+    [ false, " Path to where privkey.pem is saved", 'string'
     , ':configDir/live/:hostname/privkey.pem' ]
-, 'webroot':
+, 'config-dir':
-    [ false, " public_html / webroot path such as /srv/www/:hostname", 'string' ]
+    [ false, " Configuration directory.", 'string'
-, 'renew-within':
+    , '~/letsencrypt/etc/' ]
-    [ false, " Renew certificates this many days before expiry", 'int'
+, 'http-01-port': [ false, " Use HTTP-01 challenge type with this port (only port 80 is valid with most production servers) (default: 80)", 'int' ]
-    , 11 ]
+, 'dns-01': [ false, " Use DNS-01 challange type", 'boolean', false ]
-, staging:
+, standalone: [ false, " Obtain certs using a \"standalone\" webserver.", 'boolean', false ]
-    [ false, " Use Let's Encrypt v02 staging API", 'boolean'
+, manual: [ false, " Print the token and key to the screen and wait for you to hit enter, giving you time to copy it somewhere before continuing (default: false)", 'boolean', false ]
-    , false ]
+, debug: [ false, " show traces and logs", 'boolean', false ]
-, standalone:
+, 'root': [ false, " public_html / webroot path (may use the :hostname template such as /srv/www/:hostname)", 'string' ]
-    [ false, " Obtain certs using a \"standalone\" webserver", 'boolean'
+
-    , false ]
+//
-, manual:
+// backwards compat
-    [ false, " Print the token and key to the screen and wait for you to hit enter, giving you time to copy it somewhere before continuing (default: false)", 'boolean'
+//
-    , false ]
+, duplicate:
-, debug:
+    [ false, " Allow getting a certificate that duplicates an existing one/is an early renewal", 'boolean', false ]
-    [ false, " show traces and logs", 'boolean'
+, 'rsa-key-size':
-    , false ]
+    [ false, " Size (in bits) of the RSA key.", 'int', 2048 ]
+, server:
+    [ false, " alias of acme-url for certbot compatibility", 'string', '' ]
+, 'domain-key-path':
+    [ false, " Path to privkey.pem to use for domain (default: generate new)", 'string' ]
+, 'account-key-path':
+    [ false, " Path to privkey.pem to use for account (default: generate new)", 'string' ]
+, webroot: [ false, " for certbot compatibility", 'boolean', false ]
+, 'webroot-path': [ false, "alias of '--root' for certbot compatibility", 'string' ]
+//, 'standalone-supported-challenges': [ false, " Supported challenges, order preferences are randomly chosen. (default: http-01,tls-sni-01)", 'string', 'http-01,tls-sni-01']
+, 'work-dir': [ false, "for certbot compatibility (ignored)", 'string', '~/letsencrypt/var/lib/' ]
+, 'logs-dir': [ false, "for certbot compatibility (ignored)", 'string', '~/letsencrypt/var/log/' ]
 });
 
 // ignore certonly and extraneous arguments
@@ -101,20 +92,15 @@ cli.main(function(_, options) {
     args.domains = args.domains.split(',');
   }
 
-  if (!(Array.isArray(args.domains) && args.domains.length) || !args.email || !args.agreeTos) {
+  if (!(Array.isArray(args.domains) && args.domains.length) || !args.email || !args.agreeTos || !args.acmeVersion || (!args.server && !args.acmeUrl)) {
-    console.error("\nUsage: greenlock certonly --standalone --domains example.com --email user@example.com --agree-tos");
+    console.error("\nUsage:\n\ngreenlock certonly --standalone \\");
+    console.error("\t--acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \\");
+    console.error("\t--agree-tos --email user@example.com --domains example.com \\");
+    console.error("\t--config-dir ~/acme/etc \\");
     console.error("\nSee greenlock --help for more details\n");
     return;
   }
 
-  if (args.tlsSni01Port) {
-    // [@agnat]: Coerce to string. cli returns a number although we request a string.
-    args.tlsSni01Port = "" + args.tlsSni01Port;
-    args.tlsSni01Port = args.tlsSni01Port.split(',').map(function (port) {
-      return parseInt(port, 10);
-    });
-  }
-
   if (args.http01Port) {
     // [@agnat]: Coerce to string. cli returns a number although we request a string.
     args.http01Port = "" + args.http01Port;

dist/etc/greenlock/greenlock.example.yml

@@ -1,45 +0,0 @@
-daemon: true
-http_port: 80
-https_port: 443
-version: draft-11
-server: https://acme-staging-v02.api.letsencrypt.org/directory
-webroot_path: /srv/www
-store:
-    module: 'le-store-certbot'
-    options:
-        config_dir: /etc/greenlock/
-domains:
-    '*':
-        check:
-          module: 'fs-exists'
-          options:
-            path: /srv/www/:hostname
-        email: MY_EMAIL
-        agree_tos: MY_AGREE
-        analytics: true
-        challenges:
-            'https-01':
-                module: 'le-challenge-fs'
-    'example.com,www.example.com':
-        path: /srv/www/example.com
-        email: MY_EMAIL
-        agree_tos: MY_AGREE
-        analytics: true
-        challenges:
-            'dns-01':
-                module: 'le-challenge-cloudflare'
-                options:
-                    email: 'jon@example.com'
-                    key: 'xxxxxxxxxxxxxxxxx'
-    '.example.com':
-        check: null
-        path: /srv/www/example.com
-        email: MY_EMAIL
-        agree_tos: MY_AGREE
-        analytics: true
-        challenges:
-            'dns-01':
-                module: 'le-challenge-digitalocean'
-                options:
-                    email: 'jon@example.com'
-                    key: 'xxxxxxxxxxxxxxxxx'

dist/etc/greenlock/greenlock.yml

@@ -1,22 +0,0 @@
-daemon: true
-http_port: 80
-https_port: 443
-version: draft-11
-server: https://acme-staging-v02.api.letsencrypt.org/directory
-webroot_path: /srv/www
-store:
-    module: 'le-store-certbot'
-    options:
-        config_dir: /etc/greenlock/
-domains:
-    '*':
-        email: MY_EMAIL
-        agree_tos: MY_AGREE
-        analytics: true
-        checks:
-            - module: 'greenlock-plugin-approve-fs'
-              options:
-                  www: false
-                  path: /srv/www/:hostname
-        challenges:
-            module: 'le-challenge-fs'

dist/etc/systemd/system/greenlock.service

@@ -1,69 +0,0 @@
-[Unit]
-Description=MY_DESC
-Documentation=MY_DOCS
-After=network-online.target
-Wants=network-online.target systemd-networkd-wait-online.service
-
-[Service]
-# Restart on crash (bad signal), and on 'clean' failure (error exit code)
-# Allow up to 3 restarts within 10 seconds
-# (it's unlikely that a user or properly-running script will do this)
-Restart=on-failure
-StartLimitInterval=10
-StartLimitBurst=3
-
-# The v8 VM will output a "clean" exit for JavaScript errors.
-# If we knew we were never going to accidentally exit cleanly
-# we would use on-abnormal:
-; Restart=on-abnormal
-
-# User and group the process will run as
-# (www-data is the de facto standard on most systems)
-User=MY_USER
-Group=MY_GROUP
-
-# If we need to pass environment variables in the future
-Environment=NODE_PATH=MY_GREENLOCK_PATH/lib/node_modules NPM_CONFIG_PREFIX=MY_GREENLOCK_PATH
-
-# Set a sane working directory, sane flags, and specify how to reload the config file
-WorkingDirectory=MY_GREENLOCK_PATH
-ExecStart=MY_GREENLOCK_PATH/bin/node MY_GREENLOCK_PATH/bin/greenlock --daemon --config MY_CONFIG_PATH
-ExecReload=/bin/kill -USR1 $MAINPID
-
-# Limit the number of file descriptors and processes; see `man systemd.exec` for more limit settings.
-# Unmodified greenlock is not expected to use more than this.
-LimitNOFILE=1048576
-LimitNPROC=64
-
-# Use private /tmp and /var/tmp, which are discarded after greenlock stops.
-PrivateTmp=true
-# Use a minimal /dev
-PrivateDevices=true
-# Hide /home, /root, and /run/user. Nobody will steal your SSH-keys.
-ProtectHome=true
-# Make /usr, /boot, /etc and possibly some more folders read-only.
-ProtectSystem=full
-# … except TLS/SSL, ACME, and Let's Encrypt certificates
-#   and /var/log/greenlock, because we want a place where logs can go.
-#   This merely retains r/w access rights, it does not add any new. Must still be writable on the host!
-ReadWriteDirectories=MY_RW_DIRS
-# you may also want to add other directories such as /opt/greelock /etc/acme /etc/letsencrypt
-
-# Note: in v231 and above ReadWritePaths has been renamed to ReadWriteDirectories
-; ReadWritePaths=/etc/greenlock /var/log/greenlock
-
-# The following additional security directives only work with systemd v229 or later.
-# They further retrict privileges that can be gained.
-# Note that you may have to add capabilities required by any plugins in use.
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-NoNewPrivileges=true
-
-# Caveat: Some plugins need additional capabilities.
-# For example "upload" needs CAP_LEASE
-; CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_LEASE
-; AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_LEASE
-; NoNewPrivileges=true
-
-[Install]
-WantedBy=multi-user.target

examples/server.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-
-greenlock \
-  --agree-tos --email 'john.doe@gmail.com' \
-  --serve
-  --root /root/www/example.com \
-  --domains example.com,www.example.com \
-  --config-dir ~/acme.test/etc

examples/standalone.sh

@@ -1,7 +1,6 @@
 #!/bin/bash
-
+sudo greenlock certonly --standalone \
-greenlock \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
-  --agree-tos --email 'john.doe@gmail.com' \
+  --agree-tos --email jon@example.com --domains example.com,www.example.com \
-  --standalone \
+  --community-member \
-  --domains example.com,www.example.com \
+  --config-dir ~/acme/etc
-  --config-dir ~/acme.test/etc

examples/webroot.sh

@@ -1,7 +1,17 @@
 #!/bin/bash
 
-greenlock \
+## create a quick server if needed
-  --agree-tos --email 'john.doe@gmail.com' \
+# sudo mkdir -p /srv/www/example.com
-  --root /root/www/example.com \
+# pushd /srv/www/example.com
-  --domains example.com,www.example.com \
+#   sudo python -m SimpleHTTPServer 80 &
-  --config-dir ~/acme.test/etc
+#   my_pid=$!
+
+sudo greenlock certonly --webroot \
+  --acme-version draft-11 --acme-url https://acme-staging-v02.api.letsencrypt.org/directory \
+  --agree-tos --email jon@example.com --domains example.com \
+  --community-member \
+  --root /srv/www/example.com \
+  --config-dir ~/acme/etc
+
+#   kill $my_pid
+# popd

index.js

@@ -2,22 +2,21 @@
 
 var DAY = 24 * 60 * 60 * 1000;
 
-var LE = require('greenlock');
+var Greenlock = require('greenlock');
 
 module.exports.run = function (args) {
   var leChallenge;
   var leStore;
   var servers;
   var USE_DNS = {};
-
   var challengeType;
+
+  args.acmeUrl = args.server = (args.acmeUrl || args.server);
+  args.root = args.webrootPath = (args.root || args.webrootPath);
   if (args.dns01) {
     challengeType = 'dns-01';
     args.webrootPath = '';
     args.standalone = USE_DNS;
-  } else if (args.tlsSni01Port || args.hooks) {
-    challengeType = 'tls-sni-01';
-    args.webrootPath = '';
   } else /*if (args.http01Port)*/ {
     challengeType = 'http-01';
   }
@@ -25,57 +24,43 @@ module.exports.run = function (args) {
   if (args.manual) {
     leChallenge = require('le-challenge-manual').create({});
   }
-  else if (args.hooks) {
-    leChallenge = require('le-challenge-hooks').create({
-      hooksPath: args.hooksPath
-    , hooksServer: args.hooksServer
-    , hooksTemplate: args.hooksTemplate
-    , hooksBind: args.hooksBind
-    , hooksPort: args.hooksPort
-    , hooksWebroot: args.hooksWebroot
-    , hooksPreEnable: args.hooksPreEnable
-    , hooksEnable: args.hooksEnable
-    , hooksPreReload: args.hooksPreReload
-    , hooksReload: args.hooksReload
-    , hooksDisable: args.hooksDisable
-    });
-  }
   else if (args.webrootPath) {
     // webrootPath is all that really matters here
     // TODO rename le-challenge-fs to le-challenge-webroot
     leChallenge = require('./lib/webroot').create({ webrootPath: args.webrootPath });
   }
-  else if (args.tlsSni01Port) {
-    leChallenge = require('le-challenge-sni').create({});
-    servers = require('./lib/servers').create(leChallenge);
-  }
   else if (USE_DNS !== args.standalone) {
     leChallenge = require('le-challenge-standalone').create({});
     servers = require('./lib/servers').create(leChallenge);
   }
 
-  var privkeyPath = args.domainKeyPath || ':configDir/live/:hostname/privkey.pem'; //args.privkeyPath
+  var privkeyPath = args.privkeyPath || args.domainKeyPath || ':configDir/live/:hostname/privkey.pem'; //args.privkeyPath
   leStore = require('le-store-certbot').create({
     configDir: args.configDir
   , privkeyPath: privkeyPath
   , fullchainPath: args.fullchainPath
   , certPath: args.certPath
   , chainPath: args.chainPath
-  , webrootPath: args.webrootPath
+  , bundlePath: args.bundlePath
+  , webrootPath: args.root
   , domainKeyPath: args.domainKeyPath
   , accountKeyPath: args.accountKeyPath
   });
 
-  if (!args.server) {
+  if (!args.acmeUrl) {
-    throw new Error("You must specify a server to use with --server");
+    throw new Error("You must specify the ACME server url with --acme-url");
+  }
+  if (!args.acmeVersion) {
+    throw new Error("You must specify the ACME API version with --acme-version");
   }
 
-  // let LE know that we're handling standalone / webroot here
+  // let Greenlock know that we're handling standalone / webroot here
   var leChallenges = {};
   leChallenges[challengeType] = leChallenge;
-  var le = LE.create({
+  var greenlock = Greenlock.create({
     debug: args.debug
-  , server: args.server
+  , server: args.acmeUrl
+  , version: args.acmeVersion
   , store: leStore
   , challenges: leChallenges
   , renewWithin: args.renewWithin * DAY
@@ -86,7 +71,7 @@ module.exports.run = function (args) {
     if (args.tlsSni01Port) {
       servers.startServers(
         [], args.tlsSni01Port
-      , { debug: args.debug, tlsOptions: le.tlsOptions }
+      , { debug: args.debug, tlsOptions: greenlock.tlsOptions }
       );
     }
     else {
@@ -98,10 +83,11 @@ module.exports.run = function (args) {
   }
 
   // Note: can't use args directly as null values will overwrite template values
-  return le.register({
+  return greenlock.register({
     debug: args.debug
   , email: args.email
   , agreeTos: args.agreeTos
+  , communityMember: args.communityMember
   , domains: args.domains
   , rsaKeySize: args.rsaKeySize
   , challengeType: challengeType
@@ -134,10 +120,12 @@ module.exports.run = function (args) {
     console.log('Certificates installed at:');
     console.log(
       [
+      //  args.privkeyPath
         args.certPath
       , args.chainPath
       , args.fullchainPath
-      ].join('\n')
+      , args.bundlePath || ''
+      ].join('\n').replace(/\n+/g, '\n')
       .replace(/:configDir/g, args.configDir)
       .replace(/:hostname/g, args.domains[0])
     );

installer/get.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+#<pre><code>
 
 # This is a 3 step process
 #   1. First we need to figure out whether to use wget or curl for fetching remote files
@@ -123,7 +124,17 @@ $my_node $GREENLOCK_PATH/bin/greenlock.js
 EOF
 chmod a+x $GREENLOCK_PATH/bin/greenlock
 echo "Creating link to 'greenlock' in /usr/local/bin"
-ln -sf $GREENLOCK_PATH/bin/greenlock /usr/local/bin/greenlock
+echo "sudo ln -sf $GREENLOCK_PATH/bin/greenlock /usr/local/bin/greenlock"
+sudo ln -sf $GREENLOCK_PATH/bin/greenlock /usr/local/bin/greenlock
+
+set +e
+if type -p setcap >/dev/null 2>&1; then
+  echo ""
+  echo "Setting permissions to allow Greenlock to run on port 80 and port 443 without sudo or root"
+  echo "sudo setcap cap_net_bind_service=+ep $GREENLOCK_PATH/bin/node"
+  sudo setcap cap_net_bind_service=+ep $GREENLOCK_PATH/bin/node
+fi
+set -e
 
 echo ""
 echo ""

lib/install-systemd.js

@@ -1,31 +0,0 @@
-'use strict';
-
-module.exports.install = function (opts, cb) {
-  var fs = require('fs');
-  var path = require('path');
-  var service = '/etc/systemd/system/greenlock.service';
-  var rwDirs = [ '/etc/greenlock', '/srv/www', '/var/log/greenlock', '/opt/greenlock' ];
-
-  fs.readFile(path.join(__dirname, '../dist', service), 'utf8', function (e, text) {
-    if (e) { throw e; }
-
-    text = text
-      .replace(/MY_DESC/g, opts.description || 'Greenlock Secure Web Server')
-      .replace(/MY_DOCS/g, opts.homepage || 'https://git.coolaj86.com/coolaj86/greenlock-cli.js')
-      .replace(/MY_GREENLOCK_PATH/g, opts.greenlockPath || '/opt/greenlock')
-      .replace(/MY_CONFIG_PATH/g, opts.greenlockPath || '/etc/greenlock/greenlock.yml')
-      .replace(/MY_USER/g, opts.user || 'greenlock')
-      .replace(/MY_GROUP/g, opts.user || 'greenlock')
-      .replace(/MY_RW_DIRS/g, (opts.writableDirs || rwDirs).join(' '))
-      ;
-    fs.writeFile(service, text, 'utf8', function (e) {
-      if (e) { throw e; }
-
-      console.log("Now reload configs and enable to start on boot:");
-      console.log("");
-      console.log("\tsudo systemctl daemon-reload");
-      console.log("\tsudo systemctl enable greenlock");
-      cb(null);
-    });
-  });
-};

lib/servers.js

@@ -7,17 +7,22 @@ module.exports.create = function (challenge) {
     _servers: []
 
   , httpResponder: function (req, res) {
-      console.log('[LE-CLI] httpResponder');
+      console.info(req.method + ' ' + req.headers.host + req.url);
       var acmeChallengePrefix = '/.well-known/acme-challenge/';
 
       if (0 !== req.url.indexOf(acmeChallengePrefix)) {
-        res.end("Let's Encrypt! Command line tool");
+        res.end("Greenlock™ Commandline: https://git.coolaj86.com/coolaj86/greenlock-cli.js");
         return;
       }
 
       var token = req.url.slice(acmeChallengePrefix.length);
 
       challenge.get(NOBJ, req.headers.host.replace(/:.*/, ''), token, function (err, val) {
+        if (val) {
+          console.info("Responding with authorization token '" + val + "'");
+        } else {
+          console.info("No authorization token found");
+        }
         res.end(val || '_ ERROR challenge not found _');
       });
     }
@@ -25,7 +30,7 @@ module.exports.create = function (challenge) {
   , startServers: function (plainPorts, tlsPorts, opts) {
       opts = opts || {};
 
-      var tlsOptions = opts.tlsOptions;
+      var tlsOptions = opts.tlsOptions || {};
       var https = require('https');
       var http = require('http');
 

lib/webroot.js

@@ -39,8 +39,7 @@ module.exports.create = function (defaults) {
 
     // handled as file read by web server
   , get: function (args, domain, token, cb) {
-      // see https://github.com/Daplie/node-letsencrypt/issues/41
+      cb(new Error("get not implemented (on purpose) in gl-cli/lib/webroot.js"));
-      cb(new Error("get not implemented (on purpose) in le-cli/lib/webroot.js"));
     }
 
   , remove: function (args, domain, token, cb) {

package.json

@@ -1,7 +1,8 @@
 {
   "name": "greenlock-cli",
-  "version": "2.2.13",
+  "version": "2.3.3",
-  "description": "CLI for node-greenlock modeled after the official ACME client",
+  "description": "Free SSL and Automated HTTPS from the Greenlock command line, modeled after certbot",
+  "homepage": "https://greenlock.domains",
   "main": "index.js",
   "bin": {
     "greenlock": "bin/greenlock.js"
@@ -11,31 +12,26 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://git.coolaj86.com/coolaj86/greenlock-cli.js.git"
+    "url": "https://git.rootprojects.org/root/greenlock-cli.js.git"
   },
   "keywords": [
-    "node",
+    "Let's Encrypt",
-    "nodejs",
+    "ACME",
-    "acme",
-    "boulder",
     "cli",
     "letsencrypt",
-    "greenlock",
-    "le",
     "ssl",
     "https",
     "tls",
-    "free"
+    "Free SSL"
   ],
-  "author": "AJ ONeal <aj@daplie.com> (https://daplie.com)",
+  "author": "AJ ONeal <solderjs@gmail.com> (https://solderjs.com)",
-  "license": "(MIT OR Apache-2.0)",
+  "license": "MPL-2.0",
   "bugs": {
-    "url": "https://git.coolaj86.com/coolaj86/greenlock-cli.js/issues"
+    "url": "https://git.rootprojects.org/root/greenlock-cli.js/issues"
   },
-  "homepage": "https://git.coolaj86.com/coolaj86/greenlock-cli.js",
   "dependencies": {
     "cli": "^1.0.1",
-    "greenlock": "^2.2.11",
+    "greenlock": "^2.2.15",
     "le-challenge-manual": "^2.1.0",
     "le-challenge-standalone": "^2.1.0",
     "le-store-certbot": "^2.1.0",