How can I change the directory structure of the LE_CONFIG_HOME

[vitoyucepi]

Question

Is it possible to change the certificate directory structure using standard methods?

Details

I'm not feeling happy with the current directory structure.

.
├── account.conf
├── ca
│   └── acme-staging-v02.api.letsencrypt.org
│       └── directory
│           ├── account.json
│           ├── account.key
│           └── ca.conf
├── domain.com
│   ├── ca.cer
│   ├── domain.com.cer
│   ├── domain.com.conf
│   ├── domain.com.csr
│   ├── domain.com.csr.conf
│   ├── domain.com.csr.key
│   └── fullchain.cer
├── domain.com_ecc
│   ├── ca.cer
│   ├── domain.com.cer
│   ├── domain.com.conf
│   ├── domain.com.csr
│   ├── domain.com.csr.conf
│   ├── domain.com.csr.key
│   └── fullchain.cer
└── http.header

I can move 'account.conf' and 'http.header' from this directory. However, I would like to modify the domain infrastructure as follows.

.
├── ca
│   └── acme-staging-v02.api.letsencrypt.org
│       └── directory
│           ├── account.json
│           ├── account.key
│           └── ca.conf
├── certs
│   └── domain.com
│       ├── ca.pem
│       ├── cert.ecc.pem
│       ├── cert.rsa.pem
│       ├── fullchain.ecc.pem
│       └── fullchain.rsa.pem
├── configs
│   └── domain.com
│       ├── ecc.conf
│       └── rsa.conf
└── keys
    └── domain.com
        ├── key.ecc.pem
        └── key.rsa.pem

1. I think that splitting the certs and configs will allow to exclude excess files from various deployment types. Maybe keys and certs should be placed in separate directories.
2. File extensions should accurately represent the type of data stored in a file. Therefore, I renamed all files with the extension cer to pem because this is how it is named in openssl -outform.
3. ECC and RSA can be stored in the same directory, despite their differences.
4. Since the file names already have the same domain name as the directory, it is unnecessary to include the domain in the file names. The only exception would be if someone wanted to store all certificates in a single directory.

How am I planning to use this directory layout

For example nginx.conf

server {
  listen 443 ssl;
  server_name domain.com;

  # RSA certificates
  ssl_certificate /acme.sh/certs/domain.com/fullchain.rsa.pem;        
  ssl_certificate_key /acme.sh/keys/domain.com/key.rsa.pem;
  # ECDSA certificates
  ssl_certificate /acme.sh/certs/domain.com/fullchain.ecc.pem;        
  ssl_certificate_key /acme.sh/keys/domain.com/key.ecc.pem;
}

[Neilpang]

https://github.com/acmesh-official/acme.sh/wiki/How-to-install#4-advanced-installation

[vitoyucepi]

Sorry, it seems that the feature is not working correctly in the container neilpang/acme.sh.
I don't think using the --install option is suitable for me as it only moves files from one location to another without changing the structure.
I think I'll patch the sources somewhere here

acme.sh/acme.sh

Lines 2892 to 2955 in 0da839c

	if [ -z "$DOMAIN_PATH" ]; then
	domainhome="$CERT_HOME/$domain"
	domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
	DOMAIN_PATH="$domainhome"
	if _isEccKey "$_ilength"; then
	DOMAIN_PATH="$domainhomeecc"
	elif [ -z "$__SELECTED_RSA_KEY" ]; then
	if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
	_info "The domain '$domain' seems to have a ECC cert already, lets use ecc cert."
	DOMAIN_PATH="$domainhomeecc"
	fi
	fi
	_debug DOMAIN_PATH "$DOMAIN_PATH"
	export DOMAIN_PATH
	fi
	if [ -z "$DOMAIN_BACKUP_PATH" ]; then
	DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
	fi
	if [ -z "$DOMAIN_CONF" ]; then
	DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
	fi
	if [ -z "$DOMAIN_SSL_CONF" ]; then
	DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
	fi
	if [ -z "$CSR_PATH" ]; then
	CSR_PATH="$DOMAIN_PATH/$domain.csr"
	fi
	if [ -z "$CERT_KEY_PATH" ]; then
	CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
	fi
	if [ -z "$CERT_PATH" ]; then
	CERT_PATH="$DOMAIN_PATH/$domain.cer"
	fi
	if [ -z "$CA_CERT_PATH" ]; then
	CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
	fi
	if [ -z "$CERT_FULLCHAIN_PATH" ]; then
	CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
	fi
	if [ -z "$CERT_PFX_PATH" ]; then
	CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
	fi
	if [ -z "$CERT_PKCS8_PATH" ]; then
	CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
	fi
	if [ -z "$TLS_CONF" ]; then
	TLS_CONF="$DOMAIN_PATH/tls.validation.conf"
	fi
	if [ -z "$TLS_CERT" ]; then
	TLS_CERT="$DOMAIN_PATH/tls.validation.cert"
	fi
	if [ -z "$TLS_KEY" ]; then
	TLS_KEY="$DOMAIN_PATH/tls.validation.key"
	fi
	if [ -z "$TLS_CSR" ]; then
	TLS_CSR="$DOMAIN_PATH/tls.validation.csr"
	fi

[Neilpang]

with docker container, please mount /acme.sh folder.

you can also use docker env variable: "LE_CONFIG_HOME" to define the folder.

Or, you can add --config-home to every docker command you use, eg:

docker  exec -it acme.sh  --issue --config-home /path/to/config  .......

[vitoyucepi]

@Neilpang, I can set the $LE_CONFIG_HOME and $ACCOUNT_CONF_PATH environment variables, but I want to change the directory structure.
I didn't produce a container image yet, but here's my patch. I'll probably test it soon and share the result.

diff --git a/acme.sh b/acme.sh
--- a/acme.sh
+++ b/acme.sh
@@ -2870,55 +2870,54 @@
   fi
 
   if [ -z "$DOMAIN_PATH" ]; then
-    domainhome="$CERT_HOME/$domain"
-    domainhomeecc="$CERT_HOME/$domain$ECC_SUFFIX"
-
-    DOMAIN_PATH="$domainhome"
-
-    if _isEccKey "$_ilength"; then
-      DOMAIN_PATH="$domainhomeecc"
-    elif [ -z "$__SELECTED_RSA_KEY" ]; then
-      if [ ! -d "$domainhome" ] && [ -d "$domainhomeecc" ]; then
-        _info "The domain '$domain' seems to have a ECC cert already, lets use ecc cert."
-        DOMAIN_PATH="$domainhomeecc"
-      fi
-    fi
+    DOMAIN_PATH="$CERT_HOME/configs/$domain"
     _debug DOMAIN_PATH "$DOMAIN_PATH"
     export DOMAIN_PATH
   fi
 
+  if [ -z "$DOMAIN_CERT_PATH" ]; then
+    DOMAIN_CERT_PATH="$CERT_HOME/certs/$domain"
+    _debug DOMAIN_CERT_PATH "$DOMAIN_CERT_PATH"
+  fi
+
+  if _isEccKey "$_ilength"; then
+    _key_algo='ecc'
+  else
+    _key_algo='rsa'
+  fi
+
   if [ -z "$DOMAIN_BACKUP_PATH" ]; then
-    DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup"
+    DOMAIN_BACKUP_PATH="$DOMAIN_PATH/backup.$_key_algo"
   fi
 
   if [ -z "$DOMAIN_CONF" ]; then
-    DOMAIN_CONF="$DOMAIN_PATH/$domain.conf"
+    DOMAIN_CONF="$DOMAIN_PATH/$_key_algo.conf"
   fi
 
   if [ -z "$DOMAIN_SSL_CONF" ]; then
-    DOMAIN_SSL_CONF="$DOMAIN_PATH/$domain.csr.conf"
+    DOMAIN_SSL_CONF="$DOMAIN_PATH/$_key_algo.csr.conf"
   fi
 
   if [ -z "$CSR_PATH" ]; then
-    CSR_PATH="$DOMAIN_PATH/$domain.csr"
+    CSR_PATH="$DOMAIN_PATH/csr.$_key_algo.pem"
   fi
   if [ -z "$CERT_KEY_PATH" ]; then
-    CERT_KEY_PATH="$DOMAIN_PATH/$domain.key"
+    CERT_KEY_PATH="$DOMAIN_CERT_PATH/key.$_key_algo.pem"
   fi
   if [ -z "$CERT_PATH" ]; then
-    CERT_PATH="$DOMAIN_PATH/$domain.cer"
+    CERT_PATH="$DOMAIN_CERT_PATH/cert.$_key_algo.pem"
   fi
   if [ -z "$CA_CERT_PATH" ]; then
-    CA_CERT_PATH="$DOMAIN_PATH/ca.cer"
+    CA_CERT_PATH="$DOMAIN_CERT_PATH/ca.pem"
   fi
   if [ -z "$CERT_FULLCHAIN_PATH" ]; then
-    CERT_FULLCHAIN_PATH="$DOMAIN_PATH/fullchain.cer"
+    CERT_FULLCHAIN_PATH="$DOMAIN_CERT_PATH/fullchain.$_key_algo.pem"
   fi
   if [ -z "$CERT_PFX_PATH" ]; then
-    CERT_PFX_PATH="$DOMAIN_PATH/$domain.pfx"
+    CERT_PFX_PATH="$DOMAIN_CERT_PATH/keystore.$_key_algo.p12"
   fi
   if [ -z "$CERT_PKCS8_PATH" ]; then
-    CERT_PKCS8_PATH="$DOMAIN_PATH/$domain.pkcs8"
+    CERT_PKCS8_PATH="$DOMAIN_CERT_PATH/key.$_key_algo.pkcs8.pem"
   fi
 
   if [ -z "$TLS_CONF" ]; then