/* Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include <assert.h>

#include <stdlib.h>

#include <apr_lib.h>

#include <apr_strings.h>

#include <apr_buckets.h>

#include <apr_hash.h>

#include <apr_uri.h>

#include "md.h"

#include "md_crypt.h"

#include "md_json.h"

#include "md_jws.h"

#include "md_http.h"

#include "md_log.h"

#include "md_reg.h"

#include "md_store.h"

#include "md_util.h"

#include "md_acme.h"

#include "md_acme_acct.h"

#include "md_acme_authz.h"

typedef struct {

    md_proto_driver_t *driver;

    const char *phase;

    int complete;

    md_pkey_t *privkey;              /* the new private key */

    apr_array_header_t *pubcert;     /* the new certificate + chain certs */

    md_cert_t *cert;                 /* the new certificate */

    apr_array_header_t *chain;       /* the chain certificates */

    const char *next_up_link;        /* where the next chain cert is */

    md_acme_t *acme;

    md_t *md;

    const md_creds_t *ncreds;

    apr_array_header_t *ca_challenges;

    md_acme_authz_set_t *authz_set;

    apr_interval_time_t authz_monitor_timeout;

    const char *csr_der_64;

    apr_interval_time_t cert_poll_timeout;

} md_acme_driver_t;

/**************************************************************************************************/

/* account setup */

static apr_status_t ad_set_acct(md_proto_driver_t *d) 

{

    md_acme_driver_t *ad = d->baton;

    md_t *md = ad->md;

    apr_status_t rv = APR_SUCCESS;

    int update = 0, acct_installed = 0;

    ad->phase = "setup acme";

    if (!ad->acme 

        && APR_SUCCESS != (rv = md_acme_create(&ad->acme, d->p, md->ca_url, d->proxy_url))) {

        goto out;

    }

    ad->phase = "choose account";

    /* Do we have a staged (modified) account? */

    if (APR_SUCCESS == (rv = md_acme_use_acct_staged(ad->acme, d->store, md, d->p))) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "re-using staged account");

        md->ca_account = MD_ACME_ACCT_STAGED;

        acct_installed = 1;

    }

    else if (APR_STATUS_IS_ENOENT(rv)) {

        rv = APR_SUCCESS;

    }

    /* Get an account for the ACME server for this MD */

    if (md->ca_account && !acct_installed) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "re-use account '%s'", md->ca_account);

        rv = md_acme_use_acct(ad->acme, d->store, d->p, md->ca_account);

        if (APR_STATUS_IS_ENOENT(rv) || APR_STATUS_IS_EINVAL(rv)) {

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "rejected %s", md->ca_account);

            md->ca_account = NULL;

            update = 1;

            rv = APR_SUCCESS;

        }

    }

    if (APR_SUCCESS == rv && !md->ca_account) {

        /* Find a local account for server, store at MD */ 

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: looking at existing accounts",

                      d->proto->protocol);

        if (APR_SUCCESS == md_acme_find_acct(ad->acme, d->store, d->p)) {

            md->ca_account = md_acme_get_acct_id(ad->acme);

            update = 1;

        }

    }

    if (APR_SUCCESS == rv && !md->ca_account) {

        /* 2.2 No local account exists, create a new one */

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: creating new account", 

                      d->proto->protocol);

        if (!ad->md->contacts || apr_is_empty_array(md->contacts)) {

            md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p, 

                          "no contact information for md %s", md->name);            

            rv = APR_EINVAL;

            goto out;

        }

        if (APR_SUCCESS == (rv = md_acme_create_acct(ad->acme, d->p, md->contacts, 

                                                     md->ca_agreement))

            && APR_SUCCESS == (rv = md_acme_acct_save_staged(ad->acme, d->store, md, d->p))) {

            md->ca_account = MD_ACME_ACCT_STAGED;

            update = 1;

        }

    }

out:

    if (APR_SUCCESS == rv) {

        const char *agreement = md_acme_get_agreement(ad->acme);

        /* Persist the account chosen at the md so we use the same on future runs */

        if (agreement && !md->ca_agreement) { 

            md->ca_agreement = agreement;

            update = 1;

        }

        if (update) {

            rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);

        }

    }

    return rv;

}

/**************************************************************************************************/

/* authz/challenge setup */

/**

 * Pre-Req: we have an account for the ACME server that has accepted the current license agreement

 * For each domain in MD: 

 * - check if there already is a valid AUTHZ resource

 * - if ot, create an AUTHZ resource with challenge data 

 */

static apr_status_t ad_setup_authz(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv;

    md_t *md = ad->md;

    md_acme_authz_t *authz;

    int i, changed;

    assert(ad->md);

    assert(ad->acme);

    ad->phase = "check authz";

    /* For each domain in MD: AUTHZ setup

     * if an AUTHZ resource is known, check if it is still valid

     * if known AUTHZ resource is not valid, remove, goto 4.1.1

     * if no AUTHZ available, create a new one for the domain, store it

     */

    rv = md_acme_authz_set_load(d->store, MD_SG_STAGING, md->name, &ad->authz_set, d->p);

    if (!ad->authz_set || APR_STATUS_IS_ENOENT(rv)) {

        ad->authz_set = md_acme_authz_set_create(d->p);

        rv = APR_SUCCESS;

    }

    else if (APR_SUCCESS != rv) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: loading authz data", md->name);

        md_acme_authz_set_purge(d->store, MD_SG_STAGING, d->p, md->name);

        return APR_EAGAIN;

    }

    /* Remove anything we no longer need */

    for (i = 0; i < ad->authz_set->authzs->nelts; ++i) {

        authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);

        if (!md_contains(md, authz->domain, 0)) {

            md_acme_authz_set_remove(ad->authz_set, authz->domain);

            changed = 1;

        }

    }

    /* Add anything we do not already have */

    for (i = 0; i < md->domains->nelts && APR_SUCCESS == rv; ++i) {

        const char *domain = APR_ARRAY_IDX(md->domains, i, const char *);

        changed = 0;

        authz = md_acme_authz_set_get(ad->authz_set, domain);

        if (authz) {

            /* check valid */

            rv = md_acme_authz_update(authz, ad->acme, d->store, d->p);

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: updated authz for %s", 

                          md->name, domain);

            if (APR_SUCCESS != rv) {

                md_acme_authz_set_remove(ad->authz_set, domain);

                authz = NULL;

                changed = 1;

            }

        }

        if (!authz) {

            /* create new one */

            rv = md_acme_authz_register(&authz, ad->acme, d->store, domain, d->p);

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: created authz for %s", 

                          md->name, domain);

            if (APR_SUCCESS == rv) {

                rv = md_acme_authz_set_add(ad->authz_set, authz);

                changed = 1;

            }

        }

    }

    /* Save any changes */

    if (APR_SUCCESS == rv && changed) {

        rv = md_acme_authz_set_save(d->store, d->p, MD_SG_STAGING, md->name, ad->authz_set, 0);

        md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, "%s: saved", md->name);

    }

    return rv;

}

/**

 * Pre-Req: all domains have a AUTHZ resources at the ACME server

 * For each domain in MD: 

 * - if AUTHZ resource is 'valid' -> continue

 * - if AUTHZ resource is 'pending':

 *   - find preferred challenge choice

 *   - calculate challenge data for httpd to find

 *   - POST challenge start to ACME server

 * For each domain in MD where AUTHZ is 'pending', until overall timeout: 

 *   - wait a certain time, check status again

 * If not all AUTHZ are valid, fail

 */

static apr_status_t ad_start_challenges(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv = APR_SUCCESS;

    md_acme_authz_t *authz;

    int i, changed = 0;

    assert(ad->md);

    assert(ad->acme);

    assert(ad->authz_set);

    ad->phase = "start challenges";

    for (i = 0; i < ad->authz_set->authzs->nelts && APR_SUCCESS == rv; ++i) {

        authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: check AUTHZ for %s", 

                      ad->md->name, authz->domain);

        if (APR_SUCCESS != (rv = md_acme_authz_update(authz, ad->acme, d->store, d->p))) {

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, "%s: check authz for %s",

                          ad->md->name, authz->domain);

            break;

        }

        switch (authz->state) {

            case MD_ACME_AUTHZ_S_VALID:

                break;

            case MD_ACME_AUTHZ_S_PENDING:

                rv = md_acme_authz_respond(authz, ad->acme, d->store, ad->ca_challenges, 

                                           d->md->pkey_spec, d->p);

                changed = 1;

                break;

            default:

                rv = APR_EINVAL;

                md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, 

                              "%s: unexpected AUTHZ state %d at %s", 

                              authz->domain, authz->state, authz->location);

                break;

        }

    }

    if (APR_SUCCESS == rv && changed) {

        rv = md_acme_authz_set_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->authz_set, 0);

        md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, "%s: saved", ad->md->name);

    }

    return rv;

}

static apr_status_t check_challenges(void *baton, int attempt)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    md_acme_authz_t *authz;

    apr_status_t rv = APR_SUCCESS;

    int i;

    for (i = 0; i < ad->authz_set->authzs->nelts && APR_SUCCESS == rv; ++i) {

        authz = APR_ARRAY_IDX(ad->authz_set->authzs, i, md_acme_authz_t*);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: check AUTHZ for %s(%d. attempt)", 

                      ad->md->name, authz->domain, attempt);

        if (APR_SUCCESS == (rv = md_acme_authz_update(authz, ad->acme, d->store, d->p))) {

            switch (authz->state) {

                case MD_ACME_AUTHZ_S_VALID:

                    break;

                case MD_ACME_AUTHZ_S_PENDING:

                    rv = APR_EAGAIN;

                    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, 

                                  "%s: status pending at %s", authz->domain, authz->location);

                    break;

                default:

                    rv = APR_EINVAL;

                    md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, 

                                  "%s: unexpected AUTHZ state %d at %s", 

                                  authz->domain, authz->state, authz->location);

                    break;

            }

        }

    }

    return rv;

}

static apr_status_t ad_monitor_challenges(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv;

    assert(ad->md);

    assert(ad->acme);

    assert(ad->authz_set);

    ad->phase = "monitor challenges";

    rv = md_util_try(check_challenges, d, 0, ad->authz_monitor_timeout, 0, 0, 1);

    md_log_perror(MD_LOG_MARK, MD_LOG_INFO, rv, d->p, 

                  "%s: checked all domain authorizations", ad->md->name);

    return rv;

}

/**************************************************************************************************/

/* poll cert */

static void get_up_link(md_proto_driver_t *d, apr_table_t *headers)

{

    md_acme_driver_t *ad = d->baton;

    ad->next_up_link = md_link_find_relation(headers, d->p, "up");

    if (ad->next_up_link) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, 

                      "server reports up link as %s", ad->next_up_link);

    }

} 

static apr_status_t read_http_cert(md_cert_t **pcert, apr_pool_t *p,

                                   const md_http_response_t *res)

{

    apr_status_t rv = APR_SUCCESS;

    if (APR_SUCCESS != (rv = md_cert_read_http(pcert, p, res))

        && APR_STATUS_IS_ENOENT(rv)) {

        rv = APR_EAGAIN;

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, p, 

                      "cert not in response from %s", res->req->url);

    }

    return rv;

}

static apr_status_t on_got_cert(md_acme_t *acme, const md_http_response_t *res, void *baton)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv = APR_SUCCESS;

    (void)acme;

    if (APR_SUCCESS == (rv = read_http_cert(&ad->cert, d->p, res))) {

        rv = md_store_save(d->store, d->p, MD_SG_STAGING, ad->md->name, MD_FN_CERT, 

                           MD_SV_CERT, ad->cert, 0);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "cert parsed and saved");

        if (APR_SUCCESS == rv) {

            get_up_link(d, res->headers);

        }

    }

    return rv;

}

static apr_status_t get_cert(void *baton, int attempt)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    (void)attempt;

    return md_acme_GET(ad->acme, ad->md->cert_url, NULL, NULL, on_got_cert, d);

}

static apr_status_t ad_cert_poll(md_proto_driver_t *d, int only_once)

{

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv;

    assert(ad->md);

    assert(ad->acme);

    assert(ad->md->cert_url);

    ad->phase = "poll certificate";

    if (only_once) {

        rv = get_cert(d, 0);

    }

    else {

        rv = md_util_try(get_cert, d, 1, ad->cert_poll_timeout, 0, 0, 1);

    }

    md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "poll for cert at %s", ad->md->cert_url);

    return rv;

}

/**************************************************************************************************/

/* cert setup */

static apr_status_t on_init_csr_req(md_acme_req_t *req, void *baton)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    md_json_t *jpayload;

    jpayload = md_json_create(req->p);

    md_json_sets("new-cert", jpayload, MD_KEY_RESOURCE, NULL);

    md_json_sets(ad->csr_der_64, jpayload, MD_KEY_CSR, NULL);

    return md_acme_req_body_init(req, jpayload);

} 

static apr_status_t csr_req(md_acme_t *acme, const md_http_response_t *res, void *baton)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv = APR_SUCCESS;

    (void)acme;

    ad->md->cert_url = apr_table_get(res->headers, "location");

    if (!ad->md->cert_url) {

        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p, 

                      "cert created without giving its location header");

        return APR_EINVAL;

    }

    if (APR_SUCCESS != (rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0))) {

        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, APR_EINVAL, d->p, 

                      "%s: saving cert url %s", ad->md->name, ad->md->cert_url);

        return rv;

    }

    /* Check if it already was sent with this response */

    ad->next_up_link = NULL;

    if (APR_SUCCESS == (rv = md_cert_read_http(&ad->cert, d->p, res))) {

        rv = md_cert_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->cert, 0);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "cert parsed and saved");

        if (APR_SUCCESS == rv) {

            get_up_link(d, res->headers);

        }

    }

    else if (APR_STATUS_IS_ENOENT(rv)) {

        rv = APR_SUCCESS;

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, 

                      "cert not in response, need to poll %s", ad->md->cert_url);

    }

    return rv;

}

/**

 * Pre-Req: all domains have been validated by the ACME server, e.g. all have AUTHZ

 * resources that have status 'valid'

 * - Setup private key, if not already there

 * - Generate a CSR with org, contact, etc

 * - Optionally enable must-staple OCSP extension

 * - Submit CSR, expect 201 with location

 * - POLL location for certificate

 * - store certificate

 * - retrieve cert chain information from cert

 * - GET cert chain

 * - store cert chain

 */

static apr_status_t ad_setup_certificate(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    md_pkey_t *privkey;

    apr_status_t rv;

    ad->phase = "setup cert privkey";

    rv = md_pkey_load(d->store, MD_SG_STAGING, ad->md->name, &privkey, d->p);

    if (APR_STATUS_IS_ENOENT(rv)) {

        if (APR_SUCCESS == (rv = md_pkey_gen(&privkey, d->p, d->md->pkey_spec))) {

            rv = md_pkey_save(d->store, d->p, MD_SG_STAGING, ad->md->name, privkey, 1);

        }

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: generate privkey", ad->md->name);

    }

    if (APR_SUCCESS == rv) {

        ad->phase = "setup csr";

        rv = md_cert_req_create(&ad->csr_der_64, ad->md, privkey, d->p);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: create CSR", ad->md->name);

    }

    if (APR_SUCCESS == rv) {

        ad->phase = "submit csr";

        rv = md_acme_POST(ad->acme, ad->acme->new_cert, on_init_csr_req, NULL, csr_req, d);

    }

    if (APR_SUCCESS == rv) {

        if (!ad->cert) {

            rv = ad_cert_poll(d, 0);

        }

    }

    return rv;

}

/**************************************************************************************************/

/* cert chain retrieval */

static apr_status_t on_add_chain(md_acme_t *acme, const md_http_response_t *res, void *baton)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv = APR_SUCCESS;

    md_cert_t *cert;

    const char *ct;

    (void)acme;

    ct = apr_table_get(res->headers, "Content-Type");

    if (ct && !strcmp("application/x-pkcs7-mime", ct)) {

        /* root cert most likely, end it here */

        return APR_SUCCESS;

    }

    if (APR_SUCCESS == (rv = read_http_cert(&cert, d->p, res))) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "chain cert parsed");

        APR_ARRAY_PUSH(ad->chain, md_cert_t *) = cert;

        if (APR_SUCCESS == rv) {

            get_up_link(d, res->headers);

        }

    }

    return rv;

}

static apr_status_t get_chain(void *baton, int attempt)

{

    md_proto_driver_t *d = baton;

    md_acme_driver_t *ad = d->baton;

    const char *prev_link = NULL;

    apr_status_t rv = APR_SUCCESS;

    while (APR_SUCCESS == rv && ad->chain->nelts < 10) {

        int nelts = ad->chain->nelts;

        if (ad->next_up_link && (!prev_link || strcmp(prev_link, ad->next_up_link))) {

            prev_link = ad->next_up_link;

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, 

                          "next issuer is  %s", ad->next_up_link);

            rv = md_acme_GET(ad->acme, ad->next_up_link, NULL, NULL, on_add_chain, d);

            if (APR_SUCCESS == rv && nelts == ad->chain->nelts) {

                break;

            }

        }

        else {

            rv = APR_SUCCESS;

            break;

        }

    }

    md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, 

                  "got chain with %d certs (%d. attempt)", ad->chain->nelts, attempt);

    return rv;

}

static apr_status_t ad_chain_install(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    apr_status_t rv;

    /* We should have that from initial cert retrieval, but if we restarted

     * or switched child process, we need to retrieve this again from the 

     * certificate resources. */

    if (!ad->next_up_link) {

        if (APR_SUCCESS != (rv = ad_cert_poll(d, 0))) {

            return rv;

        }

        if (!ad->next_up_link) {

            md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, 

                "server reports no link header 'up' for certificate at %s", ad->md->cert_url);

            return APR_EINVAL;

        }

    }

    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, 

                  "chain starts at %s", ad->next_up_link);

    ad->chain = apr_array_make(d->p, 5, sizeof(md_cert_t *));

    if (APR_SUCCESS == (rv = md_util_try(get_chain, d, 0, ad->cert_poll_timeout, 0, 0, 0))) {

        rv = md_store_save(d->store, d->p, MD_SG_STAGING, ad->md->name, MD_FN_CHAIN, 

                           MD_SV_CHAIN, ad->chain, 0);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "chain fetched and saved");

    }

    return rv;

}

/**************************************************************************************************/

/* ACME driver init */

static apr_status_t acme_driver_init(md_proto_driver_t *d)

{

    md_acme_driver_t *ad;

    apr_status_t rv = APR_SUCCESS;

    ad = apr_pcalloc(d->p, sizeof(*ad));

    d->baton = ad;

    ad->driver = d;

    ad->authz_monitor_timeout = apr_time_from_sec(30);

    ad->cert_poll_timeout = apr_time_from_sec(30);

    /* We can only support challenges if the server is reachable from the outside

     * via port 80 and/or 443. These ports might be mapped for httpd to something

     * else, but a mapping needs to exist. */

    ad->ca_challenges = apr_array_make(d->p, 3, sizeof(const char *)); 

    if (d->challenge) {

        /* we have been told to use this type */

        APR_ARRAY_PUSH(ad->ca_challenges, const char*) = apr_pstrdup(d->p, d->challenge);

    }

    else if (d->md->ca_challenges && d->md->ca_challenges->nelts > 0) {

        /* pre-configured set for this managed domain */

        apr_array_cat(ad->ca_challenges, d->md->ca_challenges);

    }

    else {

        /* free to chose. Add all we support and see what we get offered */

        APR_ARRAY_PUSH(ad->ca_challenges, const char*) = MD_AUTHZ_TYPE_HTTP01;

        APR_ARRAY_PUSH(ad->ca_challenges, const char*) = MD_AUTHZ_TYPE_TLSSNI01;

    }

    if (!d->can_http && !d->can_https) {

        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, d->p, "%s: the server seems neither "

                      "reachable via http (port 80) nor https (port 443). The ACME protocol "

                      "needs at least one of those so the CA can talk to the server and verify "

                      "a domain ownership.", d->md->name);

        return APR_EGENERAL;

    }

    if (!d->can_http) {

        ad->ca_challenges = md_array_str_remove(d->p, ad->ca_challenges, MD_AUTHZ_TYPE_HTTP01, 0);

    }

    if (!d->can_https) {

        ad->ca_challenges = md_array_str_remove(d->p, ad->ca_challenges, MD_AUTHZ_TYPE_TLSSNI01, 0);

    }

    if (apr_is_empty_array(ad->ca_challenges)) {

        md_log_perror(MD_LOG_MARK, MD_LOG_ERR, 0, d->p, "%s: specific CA challenge methods "

                      "have been configured, but the server is unable to use any of those. "

                      "For 'http-01' it needs to be reachable on port 80, for 'tls-sni-01'"

                      " port 443 is needed.", d->md->name);

        return APR_EGENERAL;

    }

    md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, 0, d->p, "%s: init driver", d->md->name);

    return rv;

}

/**************************************************************************************************/

/* ACME staging */

static apr_status_t acme_stage(md_proto_driver_t *d)

{

    md_acme_driver_t *ad = d->baton;

    int reset_staging = d->reset;

    apr_status_t rv = APR_SUCCESS;

    int renew = 1;

    if (md_log_is_level(d->p, MD_LOG_DEBUG)) {

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, 0, d->p, "%s: staging started, "

                      "state=%d, can_http=%d, can_https=%d, challenges='%s'",

                      d->md->name, d->md->state, d->can_http, d->can_https,

                      apr_array_pstrcat(d->p, ad->ca_challenges, ' '));

    }

    if (!reset_staging) {

        rv = md_load(d->store, MD_SG_STAGING, d->md->name, &ad->md, d->p);

        if (APR_SUCCESS == rv) {

            /* So, we have a copy in staging, but is it a recent or an old one? */

            if (md_is_newer(d->store, MD_SG_DOMAINS, MD_SG_STAGING, d->md->name, d->p)) {

                reset_staging = 1;

            }

        }

        else if (APR_STATUS_IS_ENOENT(rv)) {

            reset_staging = 1;

            rv = APR_SUCCESS;

        }

        md_log_perror(MD_LOG_MARK, MD_LOG_TRACE1, rv, d->p, 

                      "%s: checked staging area, will%s reset",

                      d->md->name, reset_staging? "" : " not");

    }

    if (reset_staging) {

        /* reset the staging area for this domain */

        rv = md_store_purge(d->store, d->p, MD_SG_STAGING, d->md->name);

        if (APR_SUCCESS != rv && !APR_STATUS_IS_ENOENT(rv)) {

            return rv;

        }

        rv = APR_SUCCESS;

        ad->md = NULL;

    }

    if (ad->md && ad->md->state == MD_S_MISSING) {

        /* There is config information missing. It makes no sense to drive this MD further */

        rv = APR_INCOMPLETE;

        goto out;

    }

    if (ad->md) {

        /* staging in progress. look for new ACME account information collected there */

        rv = md_reg_creds_get(&ad->ncreds, d->reg, MD_SG_STAGING, d->md, d->p);

        md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: checked creds", d->md->name);

        if (APR_STATUS_IS_ENOENT(rv)) {

            rv = APR_SUCCESS;

        }

    }

    /* Find out where we're at with this managed domain */

    if (ad->ncreds && ad->ncreds->privkey && ad->ncreds->pubcert) {

        /* There is a full set staged, to be loaded */

        md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: all data staged", d->md->name);

        renew = 0;

    }

    if (renew) {

        if (APR_SUCCESS != (rv = md_acme_create(&ad->acme, d->p, d->md->ca_url, d->proxy_url)) 

            || APR_SUCCESS != (rv = md_acme_setup(ad->acme))) {

            md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, "%s: setup ACME(%s)", 

                          d->md->name, d->md->ca_url);

            return rv;

        }

        if (!ad->md) {

            /* re-initialize staging */

            md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: setup staging", d->md->name);

            md_store_purge(d->store, d->p, MD_SG_STAGING, d->md->name);

            ad->md = md_copy(d->p, d->md);

            ad->md->cert_url = NULL; /* do not retrieve the old cert */

            rv = md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);

            md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: save staged md", 

                          ad->md->name);

        }

        if (APR_SUCCESS == rv && !ad->cert) {

            md_cert_load(d->store, MD_SG_STAGING, ad->md->name, &ad->cert, d->p);

        }

        if (APR_SUCCESS == rv && !ad->cert) {

            ad->phase = "get certificate";

            md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, "%s: need certificate", d->md->name);

            /* Chose (or create) and ACME account to use */

            rv = ad_set_acct(d);

            /* Check that the account agreed to the terms-of-service, otherwise

             * requests for new authorizations are denied. ToS may change during the

             * lifetime of an account */

            if (APR_SUCCESS == rv) {

                const char *required;

                ad->phase = "check agreement";

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: check Terms-of-Service agreement", d->md->name);

                rv = md_acme_check_agreement(ad->acme, d->p, ad->md->ca_agreement, &required);

                if (APR_STATUS_IS_INCOMPLETE(rv) && required) {

                    /* The CA wants the user to agree to Terms-of-Services. Until the user

                     * has reconfigured and restarted the server, this MD cannot be

                     * driven further */

                    ad->md->state = MD_S_MISSING;

                    md_save(d->store, d->p, MD_SG_STAGING, ad->md, 0);

                    md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, d->p, 

                                  "%s: the CA requires you to accept the terms-of-service "

                                  "as specified in <%s>. "

                                  "Please read the document that you find at that URL and, "

                                  "if you agree to the conditions, configure "

                                  "\"MDCertificateAgreement url\" "

                                  "with exactly that URL in your Apache. "

                                  "Then (graceful) restart the server to activate.", 

                                  ad->md->name, required);

                    goto out;

                }

            }

            /* If we know a cert's location, try to get it. Previous download might

             * have failed. If server 404 it, we clear our memory of it. */

            if (APR_SUCCESS == rv && ad->md->cert_url) {

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: polling certificate", d->md->name);

                rv = ad_cert_poll(d, 1);

                if (APR_STATUS_IS_ENOENT(rv)) {

                    /* Server reports to know nothing about it. */

                    ad->md->cert_url = NULL;

                    rv = md_reg_update(d->reg, d->p, ad->md->name, ad->md, MD_UPD_CERT_URL);

                }

            }

            if (APR_SUCCESS == rv && !ad->cert) {

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: setup new authorization", d->md->name);

                if (APR_SUCCESS != (rv = ad_setup_authz(d))) {

                    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: setup authz resource", 

                                  ad->md->name);

                    goto out;

                }

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: setup new challenges", d->md->name);

                if (APR_SUCCESS != (rv = ad_start_challenges(d))) {

                    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: start challenges", 

                                  ad->md->name);

                    goto out;

                }

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: monitoring challenge status", d->md->name);

                if (APR_SUCCESS != (rv = ad_monitor_challenges(d))) {

                    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: monitor challenges", 

                                  ad->md->name);

                    goto out;

                }

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: creating certificate request", d->md->name);

                if (APR_SUCCESS != (rv = ad_setup_certificate(d))) {

                    md_log_perror(MD_LOG_MARK, MD_LOG_DEBUG, rv, d->p, "%s: setup certificate", 

                                  ad->md->name);

                    goto out;

                }

                md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                              "%s: received certificate", d->md->name);

            }

        }

        if (APR_SUCCESS == rv && !ad->chain) {

            /* have we created this already? */

            md_chain_load(d->store, MD_SG_STAGING, ad->md->name, &ad->chain, d->p);

        }

        if (APR_SUCCESS == rv && !ad->chain) {

            ad->phase = "install chain";

            md_log_perror(MD_LOG_MARK, MD_LOG_INFO, 0, d->p, 

                          "%s: retrieving certificate chain", d->md->name);

            rv = ad_chain_install(d);

        }

        if (APR_SUCCESS == rv && !ad->pubcert) {

            /* have we created this already? */

            md_pubcert_load(d->store, MD_SG_STAGING, ad->md->name, &ad->pubcert, d->p);

        }

        if (APR_SUCCESS == rv && !ad->pubcert) {

            /* combine cert + chain into the pubcert */

            ad->pubcert = apr_array_make(d->p, ad->chain->nelts + 1, sizeof(md_cert_t*));

            APR_ARRAY_PUSH(ad->pubcert, md_cert_t *) = ad->cert;

            apr_array_cat(ad->pubcert, ad->chain);

            rv = md_pubcert_save(d->store, d->p, MD_SG_STAGING, ad->md->name, ad->pubcert, 0);

        }

        if (APR_SUCCESS == rv && ad->cert) {

            apr_time_t now = apr_time_now();

            apr_interval_time_t max_delay, delay_activation; 

            /* determine when this cert should be activated */

            d->stage_valid_from = md_cert_get_not_before(ad->cert);

            if (d->md->state == MD_S_COMPLETE && d->md->expires > now) {            

                /**

                 * The MD is complete and un-expired. This is a renewal run.