WIP: moving to bluecrypt

WIP: breaking into smaller pieces
rebrand Root
2019-05-19 01:10:49 -06:00 · 2019-05-19 00:21:26 -06:00 · 2019-04-09 07:50:34 +00:00 · 2019-04-09 07:46:59 +00:00 · 2019-04-08 19:51:33 +00:00 · 2019-03-16 21:58:16 -07:00
14 changed files with 5182 additions and 4915 deletions
--- a/.prettierrc
+++ b/.prettierrc
@ -1,4 +0,0 @@
-{
-  "trailingComma": "none",
-  "useTabs": true
-}
--- a/README.md
+++ b/README.md
@ -1,8 +1,10 @@
-# Greenlock&trade; in your Browser
+Greenlock&trade; in your Browser
+=========================

 Taking greenlock&trade; (Let's Encrypt v2 / ACME client) where it's never been before: Your browser!

-# Official Site
+Official Site
+=============

 This app is available at <https://greenlock.domains>.

@ -12,12 +14,14 @@ If it doesn't, please open an issue to let us know why.
 We'd much rather improve the app than have a hundred different versions running in the wild.
 However, in keeping to our values we've released the source for others to inspect, improve, and modify.

-# Trademark Notice
+Trademark Notice
+================

 Greenlock&trade; is our trademark. If you do host your own copy of this app,
 please do provide attribution, but please also use your branding.

-# Install
+Install
+=======

 ```bash
 git clone ssh://gitea@git.coolaj86.com:22042/coolaj86/greenlock.html.git
@ -26,7 +30,8 @@ pushd greenlock.html/
 popd
 ```

-# Usage
+Usage
+=====

 Simply host from your webserver.

--- a/app/index.html
+++ b/app/index.html
@ -1,99 +1,67 @@
-<!DOCTYPE html>
 <html>
  <head>
    <title>Greenlock&trade;</title>
-		<meta
-			property="og:image"
-			content="https://greenlock.domains/img/greenlock-mark-400x400.png"
-		/>
+    <meta property="og:image" content="https://greenlock.domains/img/greenlock-mark-400x400.png" />
    <style>
      @font-face {
-				font-family: "Source Sans Pro";
+        font-family: 'Source Sans Pro';
        font-style: normal;
        font-display: block;
        font-weight: 400;
-				src: local("Source Sans Pro Regular"), local("SourceSansPro-Regular"),
-					url(./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2) format("woff2");
-				unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6,
-					U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
-					U+2212, U+2215, U+FEFF, U+FFFD;
+        src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2) format('woff2');
+        unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
      }
      @font-face {
-				font-family: "Source Sans Pro";
+        font-family: 'Source Sans Pro';
        font-style: normal;
        font-weight: 700;
        font-display: block;
-				src: local("Source Sans Pro Bold"), local("SourceSansPro-Bold"),
-					url(./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
-						format("woff2");
-				unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6,
-					U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
-					U+2212, U+2215, U+FEFF, U+FFFD;
+        src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2) format('woff2');
+        unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
      }
      @font-face {
-				font-family: "Source Code Pro";
+        font-family: 'Source Code Pro';
        font-style: normal;
        font-weight: 400;
-				src: local("Source Code Pro"), local("SourceCodePro-Regular"),
-					url(./fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2) format("woff2");
-				unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6,
-					U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
-					U+2212, U+2215, U+FEFF, U+FFFD;
+        src: local('Source Code Pro'), local('SourceCodePro-Regular'), url(./fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2) format('woff2');
+        unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
      }
    </style>

-		<link href="styles/main.css" rel="stylesheet" />
-		<link
-			rel="preload"
-			href="./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
-		<link
-			rel="preload"
-			href="./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
+    <link href="styles/main.css" rel="stylesheet">
+    <link rel="preload" href="./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2" as="font" crossorigin="anonymous">
+    <link rel="preload" href="./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2" as="font" crossorigin="anonymous">
+
+    <link rel="preload" href="./fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2" as="font" crossorigin="anonymous">
+    <link rel="preload" href="./js/bacme.js" as="script">
+    <link rel="preload" href="./js/app.js" as="script">
+    <link rel="preload" href="./js/pkijs.org/v1.3.33/common.js" as="script">
+    <link rel="preload" href="./js/pkijs.org/v1.3.33/asn1.js" as="script">
+    <link rel="preload" href="./js/pkijs.org/v1.3.33/x509_schema.js" as="script">
+    <link rel="preload" href="./js/pkijs.org/v1.3.33/x509_simpl.js" as="script">
+    <link rel="preload" href="./js/browser-csr/v1.0.0-alpha/csr.js" as="script">

-		<link
-			rel="preload"
-			href="./fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
-		<link rel="preload" href="./js/bluecrypt-acme.js" as="script" />
-		<link rel="preload" href="./js/greenlock.js" as="script" />
  </head>
  <body hidden>
    <!-- let's define our SVG that we will reuse -->

-		<svg
-			xmlns="http://www.w3.org/2000/svg"
-			width="0"
-			height="0"
-			viewbox="0 0 24 24"
-		>
+    <svg xmlns="http://www.w3.org/2000/svg" width="0" height="0" viewBox="0 0 24 24">
      <defs>
        <g id="svg-check">
-					<path fill="none" d="M0 0h24v24H0z" />
-					<path d="M9 16.2L4.8 12l-1.4 1.4L9 19 21 7l-1.4-1.4L9 16.2z" />
+          <path fill="none" d="M0 0h24v24H0z"/>
+          <path d="M9 16.2L4.8 12l-1.4 1.4L9 19 21 7l-1.4-1.4L9 16.2z"/>
        </g>
        <g id="svg-checked">
-					<path d="M0 0h24v24H0z" fill="none" />
-					<path
-						d="M19 3H5c-1.11 0-2 .9-2 2v14c0 1.1.89 2 2 2h14c1.11 0 2-.9 2-2V5c0-1.1-.89-2-2-2zm-9 14l-5-5 1.41-1.41L10 14.17l7.59-7.59L19 8l-9 9z"
-					/>
+          <path d="M0 0h24v24H0z" fill="none"/>
+          <path d="M19 3H5c-1.11 0-2 .9-2 2v14c0 1.1.89 2 2 2h14c1.11 0 2-.9 2-2V5c0-1.1-.89-2-2-2zm-9 14l-5-5 1.41-1.41L10 14.17l7.59-7.59L19 8l-9 9z"/>
        </g>
        <g id="svg-unchecked">
-					<path
-						d="M19 5v14H5V5h14m0-2H5c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2V5c0-1.1-.9-2-2-2z"
-					/>
-					<path d="M0 0h24v24H0z" fill="none" />
+          <path d="M19 5v14H5V5h14m0-2H5c-1.1 0-2 .9-2 2v14c0 1.1.9 2 2 2h14c1.1 0 2-.9 2-2V5c0-1.1-.9-2-2-2z"/>
+          <path d="M0 0h24v24H0z" fill="none"/>
        </g>
        <g id="svg-download">
-					<path d="M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z" />
-					<path d="M0 0h24v24H0z" fill="none" />
+          <path d="M19 9h-4V3H9v6H5l7 7 7-7zM5 18v2h14v-2H5z"/>
+          <path d="M0 0h24v24H0z" fill="none"/>
        </g>
      </defs>
    </svg>
@ -102,11 +70,7 @@
        <div id="js-progress-bar" class="progress-bar">
          <div class="progress-bar-step">
            <div class="circle">
-							<svg
-								display="none"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg display="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-check"></use>
              </svg>
            </div>
@ -114,11 +78,7 @@
          </div>
          <div class="progress-bar-step">
            <div class="circle">
-							<svg
-								display="none"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg display="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-check"></use>
              </svg>
            </div>
@ -126,22 +86,16 @@
          </div>
          <div class="progress-bar-step">
            <div class="circle">
-							<svg
-								display="none"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg display="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-check"></use>
              </svg>
            </div>
-						<div class="progress-step-label">
-							<div>Install certificates</div>
-						</div>
+            <div class="progress-step-label"><div>Install certificates</div></div>
          </div>
          <!-- hide until the steps are all updated
          <div class="progress-bar-step">
            <div class="circle">
-              <svg display="none" xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 24">
+              <svg display="none" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-check"></use>
              </svg>
            </div>
@ -149,112 +103,52 @@
          </div>
          -->
        </div>
-				<div class="greenlock-logo-badge">
-					<img src="./img/greenlock-mark-400x400.png" />
-				</div>
+        <div class="greenlock-logo-badge"><img src="./img/greenlock-mark-400x400.png"></div>
        <div class="greenlock-name">Greenlock</div>
      </div>
      <div class="column-row">
        <form class="js-acme-form js-acme-form-domains">
          <h1><label>What's your domain?</label></h1>
          <h4>Certificates are valid for 90 days. Renewal is free :)</h4>
-					<input
-						class="js-acme-domains"
-						type="text"
-						placeholder="example.com,*.example.com"
-						required
-					/>
-					<br />
+          <input class="js-acme-domains" type="text" placeholder="example.com,*.example.com" required>
+          <br>
          <button type="submit">Next</button>

-					<br />
-					<br />
-					<br />
-					<label
-						><input
-							class="js-acme-api-type"
-							name="acme-api-type"
-							type="radio"
-							value="v02"
-							checked
-							required
-						/>
-						Production</label
-					>
-					<label
-						><input
-							class="js-acme-api-type"
-							name="acme-api-type"
-							type="radio"
-							value="staging-v02"
-							required
-						/>
-						Testing</label
-					>
-					<br />
-					<input
-						class="js-acme-directory-url"
-						type="url"
-						placeholder="ACME directory url"
-					/>
+          <br>
+          <br>
+          <br>
+          <label><input class="js-acme-api-type" name="acme-api-type" type="radio" value="v02" checked required>
+            Production</label>
+          <label><input class="js-acme-api-type" name="acme-api-type" type="radio" value="staging-v02" required>
+            Testing</label>
+          <br>
+          <input class="js-acme-directory-url" type="url" placeholder="ACME directory url">
        </form>

        <!-- Step 2 Create Account -->
        <form class="js-acme-form js-acme-form-account">
          <h1><label>What's your email?</label></h1>
-					<input
-						class="js-acme-account-email acme-account-email"
-						type="email"
-						placeholder="john@doe.family"
-						required
-					/>
+          <input class="js-acme-account-email acme-account-email" type="email" placeholder="john@doe.family" required>
          <div class="checkbox-array">
            <label>
-							<input class="js-acme-account-tos" type="checkbox" required />
-							<svg
-								class="icon-checked-box"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <input class="js-acme-account-tos" type="checkbox" required>
+              <svg class="icon-checked-box" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-checked"></use>
              </svg>
-							<svg
-								class="icon-unchecked-box"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg class="icon-unchecked-box"  xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-unchecked"></use>
              </svg>
-							Agree to &nbsp;<a class="js-acme-tos-url" target="acme-tos"
-								>Let's Encrypt&trade; Terms of Service</a
-							>?
+              Agree to &nbsp<a class="js-acme-tos-url" target="acme-tos">Let's Encrypt&trade; Terms of Service</a>?
            </label>
            <label>
-							<input
-								class="js-greenlock-account-tos"
-								type="checkbox"
-								required
-							/>
-							<svg
-								class="icon-checked-box"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <input class="js-greenlock-account-tos" type="checkbox" required>
+              <svg class="icon-checked-box" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-checked"></use>
              </svg>
-							<svg
-								class="icon-unchecked-box"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg class="icon-unchecked-box" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-unchecked"></use>
              </svg>
-							Agree to &nbsp<a
-								class="js-gl-tos"
-								target="_blank"
-								href="/legal/#terms"
-								>Greenlock&trade; Terms of Service</a
-							>?
+              Agree to &nbsp<a class="js-gl-tos" target="_blank" href="/legal/#terms">Greenlock&trade; Terms of Service</a>?
            </label>
          </div>
          <!--
@ -262,124 +156,77 @@
          <br>
          <br>
          -->
-					<button class="button-next js-account-next" type="submit">
-						Next
-					</button>
+          <button class="button-next" type="submit">Next</button>
          <div class="email-usage">
            Why do we need your email? We link your SSL certificates to the
-						email you use so that you'll be notified before the certificate
-						expires and so you can manage your certificates in the future.
+            email you use so you can manage your certificates in the future,
+            and get important email updates about them.
          </div>
        </form>

        <!-- Step 3 Set Challanges -->
        <form class="js-acme-form js-acme-form-challenges">
+
          <h1>Let's verify your domain</h1>
          <div class="js-acme-challenges">
          <div class="tabbed-selector">
            <label>
-								<input
-									class="js-acme-challenge-type"
-									name="acme-challenge-type"
-									type="radio"
-									value="http-01"
-									checked
-									required
-								/>
+              <input class="js-acme-challenge-type" name="acme-challenge-type" type="radio" value="http-01" checked required>
              File Upload
              <div></div>
            </label>
            <label>
-								<input
-									class="js-acme-challenge-type"
-									name="acme-challenge-type"
-									type="radio"
-									value="dns-01"
-									required
-								/>
+              <input class="js-acme-challenge-type" name="acme-challenge-type" type="radio" value="dns-01" required>
              DNS Record
              <div></div>
            </label>
          </div>
-						<div>
            <div class="js-acme-verification-http-01">
-								<h3>Upload each file</h3>
-								<div class="js-acme-http">
+              <h3>Upload this file</h3>
              <div class="http-verification-info file-preview">
                <div class="paper-fold"></div>
                <div>
                  <div class="file-ver-info-header">FILENAME</div>
                  <pre class="js-acme-ver-file-location">...loading</pre>
                </div>
-										<hr />
+                <hr>
                <div>
                  <div class="file-ver-info-header">CONTENTS</div>
                  <pre class="js-acme-ver-content">...loading</pre>
                </div>
+              </div>
              <div class="download-file">
-											<svg
-												class="mdicon icon-download"
-												xmlns="http://www.w3.org/2000/svg"
-												viewbox="0 0 24 24"
-											>
+                <svg class="mdicon icon-download" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                  <use xlink:href="#svg-download"></use>
                </svg>
-											<a
-												class="js-download-verify-link"
-												href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4="
-												download="hello.txt"
-												target="_blank"
-											>
+                <a class="js-download-verify-link" href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4=" download="hello.txt" target="_blank">
                  Download
                </a>
              </div>
-										<hr />
-										<div>
-											<div class="file-ver-info-header">LOCATION</div>
-											<pre class="js-acme-ver-uri">..loading</pre>
-										</div>
-									</div>
-									<br />
-								</div>
+              <h3>To this location</h3>
+              <div class="js-acme-ver-uri" class="acme-ver-uri">..loading</div>
            </div>
            <div class="js-acme-verification-dns-01">
-								<h3>Set each DNS Record</h3>
-								<div class="js-acme-dns">
+              <h3>Set this DNS Record</h3>
+              <div class="acme-ver-dns-label">Hostname</div>
+              <div class="js-acme-ver-hostname">loading...</div>
              <div class="acme-ver-dns-label">TXT Host</div>
              <div class="js-acme-ver-txt-host">loading...</div>
              <div class="acme-ver-dns-label">TXT Value</div>
              <div class="js-acme-ver-txt-value">loading...</div>
-									<br />
-								</div>
-								<p>
-									<strong>Warning</strong>: You should wait at least 30 seconds
-									after setting DNS records before continuing.
-								</p>
-								<p>
-									<strong>Google DNS Users</strong>: You may need to wait up to
-									5 minutes.
-								</p>
-							</div>
            </div>

+          </div>
          <div class="js-acme-wildcard-challenges">
-							<div class="js-acme-verification-wildcard">
-								<h3>Set each DNS Record (for wildcards)</h3>
            <div class="js-acme-wildcard">
+              <div class="js-acme-verification-wildcard">
+                <h3>Set this DNS Record</h3>
+                <div class="acme-ver-dns-label">Hostname</div>
+                <div class="js-acme-ver-hostname">loading...</div>
                <div class="acme-ver-dns-label">TXT Host</div>
                <div class="js-acme-ver-txt-host">loading...</div>
                <div class="acme-ver-dns-label">TXT Value</div>
                <div class="js-acme-ver-txt-value">loading...</div>
-									<br />
-								</div>
-								<p>
-									<strong>Warning</strong>: You should wait at least 30 seconds
-									after setting DNS records before continuing.
-								</p>
-								<p>
-									<strong>Google DNS</strong>: You may need to wait up to 5
-									minutes.
-								</p>
              </div>
            </div>
          </div>
@ -390,12 +237,6 @@
        <!-- Step 4 Process Challanges -->
        <form class="js-acme-form js-acme-form-poll">
          Verifying Domains... (give us 5 seconds or so...)
-					<div class="js-challenge-responses" hidden>
-						Checking
-						<span class="js-challenge-response-altname">&nbsp;</span>
-						using <span class="js-challenge-response-type">&nbsp;</span> :
-						<span class="js-challenge-response-status">&nbsp;</span>
-					</div>

          <!--
          <table class="js-acme-table-verifying">
@ -427,50 +268,34 @@
            <h2><label>privkey.pem</label></h2>
            <div class="acme-result-privkey file-preview">
              <div class="paper-fold"></div>
-							<pre id="js-privkey"></pre>
+              <pre id="js-privkey">
+              </pre>
            </div>
            <div class="download-file">
-							<svg
-								class="mdicon icon-download"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg class="mdicon icon-download" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-download"></use>
              </svg>
-							<a
-								id="js-download-privkey-link"
-								href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4="
-								download="privkey.pem"
-								target="_blank"
-							>
+              <a id="js-download-privkey-link" href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4=" download="privkey.pem" target="_blank">
                Download
              </a>
            </div>
            <h2><label>fullchain.pem</label></h2>
            <div class="acme-result-fullchain file-preview">
              <div class="paper-fold"></div>
-							<pre id="js-fullchain"></pre>
+              <pre id="js-fullchain">
+              </pre>
            </div>
            <div class="download-file">
-							<svg
-								class="mdicon icon-download"
-								xmlns="http://www.w3.org/2000/svg"
-								viewbox="0 0 24 24"
-							>
+              <svg class="mdicon icon-download" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
                <use xlink:href="#svg-download"></use>
              </svg>
-							<a
-								id="js-download-fullchain-link"
-								href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4="
-								download="fullchain.pem"
-								target="_blank"
-							>
+              <a id="js-download-fullchain-link" href="data:text/octet-stream;base64,SGVsbG8gV29ybGQuLi4=" download="fullchain.pem" target="_blank">
                Download
              </a>
            </div>
            <div>
            <h3>node.js https server example</h3>
-							<pre><code>    'use strict';
+            <pre><code>'use strict';

    var https = require('https');
    var server = https.createServer({
@ -497,58 +322,43 @@
          <a href="#">Advanced (copy and paste)</a>
          <br>
          <button type="submit">Start Over</button>
-          --></div>
+          -->
        </form>
+      </div>

+      <div><small><center>
      <div>
-					<small
-						><center>
-							<div>
-								A
-								<a href="https://rootprojects.org/" target="_blank">Root</a>
-								Project |
-								<a
-									href="https://git.coolaj86.com/coolaj86/greenlock.html"
-									target="_blank"
-									>View Source</a
-								>
-								(git) |
-								<a href="https://rootprojects.org/legal/#terms" target="_blank"
-									>Terms of Service</a
-								>
-								|
-								<a
-									href="https://rootprojects.org/legal/#privacy"
-									target="_blank"
-									>Privacy Policy</a
-								>
+          A <a href="https://rootprojects.org/" target="_blank">Root</a> Project
+          | <a href="https://git.coolaj86.com/coolaj86/greenlock.html" target="_blank">View Source</a> (git)
+          | <a href="https://rootprojects.org/legal/#terms" target="_blank">Terms of Service</a>
+          | <a href="https://rootprojects.org/legal/#privacy" target="_blank">Privacy Policy</a>
      </div>
      <!-- or
        <pre><code>git clone https://git.coolaj86.com/coolaj86/greenlock.html.git</code></pre>
        Or view the live site code (same as live-site branch):
        <pre><code>wget https://greenlock.domains --mirror --convert-links --adjust-extension --page-requisites --no-parent</code></pre>
      -->
-						</center></small
-					>
-				</div>
-				<br />
+      </center></small></div>
+      <br>

-				<script src="./js/bluecrypt-acme.js"></script>
-				<script src="./js/greenlock.js"></script>
+
+        <script src="./js/bacme.js"></script>
+        <script src="./js/app.js"></script>
+
+        <script src="./js/pkijs.org/v1.3.33/common.js"></script>
+        <script src="./js/pkijs.org/v1.3.33/asn1.js"></script>
+        <script src="./js/pkijs.org/v1.3.33/x509_schema.js"></script>
+        <script src="./js/pkijs.org/v1.3.33/x509_simpl.js"></script>
+        <script src="./js/browser-csr/v1.0.0-alpha/csr.js"></script>

        <!-- Global site tag (gtag.js) - Google Analytics -->
-				<script
-					async
-					src="https://www.googletagmanager.com/gtag/js?id=UA-118745161-2"
-				></script>
+        <script async src="https://www.googletagmanager.com/gtag/js?id=UA-118745161-2"></script>
        <script>
          window.dataLayer = window.dataLayer || [];
-					function gtag() {
-						dataLayer.push(arguments);
-					}
-					gtag("js", new Date());
+          function gtag(){dataLayer.push(arguments);}
+          gtag('js', new Date());

-					gtag("config", "UA-118745161-2");
+          gtag('config', 'UA-118745161-2');
        </script>
      </div>
    </div>
--- a/app/js/app.js
+++ b/app/js/app.js
@ -0,0 +1,670 @@
+(function () {
+'use strict';
+
+  /*global URLSearchParams,Headers*/
+  var BROWSER_SUPPORTS_ECDSA;
+  var $qs = function (s) { return window.document.querySelector(s); };
+  var $qsa = function (s) { return window.document.querySelectorAll(s); };
+  var info = {};
+  var steps = {};
+  var nonce;
+  var kid;
+  var i = 1;
+  var BACME = window.BACME;
+  var PromiseA = window.Promise;
+  var crypto = window.crypto;
+
+  function testEcdsaSupport() {
+    var opts = {
+      type: 'ECDSA'
+    , bitlength: '256'
+    };
+    return BACME.accounts.generateKeypair(opts).then(function (jwk) {
+      return crypto.subtle.importKey(
+        "jwk"
+      , jwk
+      , { name: "ECDSA", namedCurve: "P-256" }
+      , true
+      , ["sign"]
+      ).then(function (privateKey) {
+        return window.crypto.subtle.exportKey("pkcs8", privateKey);
+      });
+    });
+  }
+  function testRsaSupport() {
+    var opts = {
+      type: 'RSA'
+    , bitlength: '2048'
+    };
+    return BACME.accounts.generateKeypair(opts).then(function (jwk) {
+      return crypto.subtle.importKey(
+        "jwk"
+      , jwk
+      , { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } }
+      , true
+      , ["sign"]
+      ).then(function (privateKey) {
+        return window.crypto.subtle.exportKey("pkcs8", privateKey);
+      });
+    });
+  }
+  function testKeypairSupport() {
+    return testEcdsaSupport().then(function () {
+      console.info("[crypto] ECDSA is supported");
+      BROWSER_SUPPORTS_ECDSA = true;
+      localStorage.setItem('version', '1');
+      return true;
+    }).catch(function () {
+      console.warn("[crypto] ECDSA is NOT fully supported");
+      BROWSER_SUPPORTS_ECDSA = false;
+
+      // fix previous firefox browsers
+      if (!localStorage.getItem('version')) {
+        localStorage.clear();
+        localStorage.setItem('version', '1');
+      }
+
+      return false;
+    });
+  }
+  testKeypairSupport().then(function (ecdsaSupport) {
+    if (ecdsaSupport) {
+      return true;
+    }
+
+    return testRsaSupport().then(function () {
+      console.info('[crypto] RSA is supported');
+    }).catch(function (err) {
+      console.error('[crypto] could not use either EC nor RSA.');
+      console.error(err);
+      window.alert("Your browser is cryptography support (neither RSA or EC is usable). Please use Chrome, Firefox, or Safari.");
+    });
+  });
+
+  var apiUrl = 'https://acme-{{env}}.api.letsencrypt.org/directory';
+  function updateApiType() {
+    console.log("type updated");
+    /*jshint validthis: true */
+    var input = this || Array.prototype.filter.call(
+      $qsa('.js-acme-api-type'), function ($el) { return $el.checked; }
+    )[0];
+    console.log('ACME api type radio:', input.value);
+    $qs('.js-acme-directory-url').value = apiUrl.replace(/{{env}}/g, input.value);
+  }
+  $qsa('.js-acme-api-type').forEach(function ($el) {
+    $el.addEventListener('change', updateApiType);
+  });
+  updateApiType();
+
+  function hideForms() {
+    $qsa('.js-acme-form').forEach(function (el) {
+      el.hidden = true;
+    });
+  }
+
+  function updateProgress(currentStep) {
+    var progressSteps = $qs("#js-progress-bar").children;
+    for(var j = 0; j < progressSteps.length; j++) {
+      if(j < currentStep) {
+        progressSteps[j].classList.add("js-progress-step-complete");
+        progressSteps[j].classList.remove("js-progress-step-started");
+      } else if(j === currentStep) {
+        progressSteps[j].classList.remove("js-progress-step-complete");
+        progressSteps[j].classList.add("js-progress-step-started");
+      } else {
+        progressSteps[j].classList.remove("js-progress-step-complete");
+        progressSteps[j].classList.remove("js-progress-step-started");
+      }
+    }
+  }
+
+  function submitForm(ev) {
+    var j = i;
+    i += 1;
+
+    return PromiseA.resolve(steps[j].submit(ev)).catch(function (err) {
+      console.error(err);
+      window.alert("Something went wrong. It's our fault not yours. Please email aj@rootprojects.org and let him know that 'step " + j + "' failed.");
+    });
+  }
+
+  $qsa('.js-acme-form').forEach(function ($el) {
+    $el.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      submitForm(ev);
+    });
+  });
+
+  function updateChallengeType() {
+    /*jshint validthis: true*/
+    var input = this || Array.prototype.filter.call(
+      $qsa('.js-acme-challenge-type'), function ($el) { return $el.checked; }
+    )[0];
+    console.log('ch type radio:', input.value);
+    $qs('.js-acme-verification-wildcard').hidden = true;
+    $qs('.js-acme-verification-http-01').hidden = true;
+    $qs('.js-acme-verification-dns-01').hidden = true;
+    if (info.challenges.wildcard) {
+      $qs('.js-acme-verification-wildcard').hidden = false;
+    }
+    if (info.challenges[input.value]) {
+      $qs('.js-acme-verification-' + input.value).hidden = false;
+    }
+  }
+  $qsa('.js-acme-challenge-type').forEach(function ($el) {
+    $el.addEventListener('change', updateChallengeType);
+  });
+
+  function saveContact(email, domains) {
+    // to be used for good, not evil
+    return window.fetch('https://api.rootprojects.org/api/rootprojects.org/public/community', {
+      method: 'POST'
+    , cors: true
+    , headers: new Headers({ 'Content-Type': 'application/json' })
+    , body: JSON.stringify({
+        address: email
+      , project: 'greenlock-domains@rootprojects.org'
+      , domain: domains.join(',')
+      })
+    }).catch(function (err) {
+      console.error(err);
+    });
+  }
+
+  steps[1] = function () {
+    updateProgress(0);
+    hideForms();
+    $qs('.js-acme-form-domains').hidden = false;
+  };
+  steps[1].submit = function () {
+    info.identifiers = $qs('.js-acme-domains').value.split(/\s*,\s*/g).map(function (hostname) {
+      return { type: 'dns', value: hostname.toLowerCase().trim() };
+    }).slice(0,1); //Disable multiple values for now.  We'll just take the first and work with it.
+    info.identifiers.sort(function (a, b) {
+      if (a === b) { return 0; }
+      if (a < b) { return 1; }
+      if (a > b) { return -1; }
+    });
+
+    return BACME.directory({ directoryUrl: $qs('.js-acme-directory-url').value }).then(function (directory) {
+      $qs('.js-acme-tos-url').href = directory.meta.termsOfService;
+      return BACME.nonce().then(function (_nonce) {
+        nonce = _nonce;
+
+        console.log("MAGIC STEP NUMBER in 1 is:", i);
+        steps[i]();
+      });
+    });
+  };
+
+  steps[2] = function () {
+    updateProgress(0);
+    hideForms();
+    $qs('.js-acme-form-account').hidden = false;
+  };
+  steps[2].submit = function () {
+    var email = $qs('.js-acme-account-email').value.toLowerCase().trim();
+
+    info.contact = [ 'mailto:' + email ];
+    info.agree = $qs('.js-acme-account-tos').checked;
+    info.greenlockAgree = $qs('.js-gl-tos').checked;
+    // TODO
+    // options for
+    // * regenerate key
+    // * ECDSA / RSA / bitlength
+
+    // TODO ping with version and account creation
+    setTimeout(saveContact, 100, email, info.identifiers.map(function (ident) { return ident.value; }));
+
+    var jwk = JSON.parse(localStorage.getItem('account:' + email) || 'null');
+    var p;
+
+    function createKeypair() {
+      var opts;
+
+      if(BROWSER_SUPPORTS_ECDSA) {
+        opts = {
+          type: 'ECDSA'
+        , bitlength: '256'
+        };
+      } else {
+        opts = {
+          type: 'RSA'
+        , bitlength: '2048'
+        };
+      }
+
+      return BACME.accounts.generateKeypair(opts).then(function (jwk) {
+        localStorage.setItem('account:' + email, JSON.stringify(jwk));
+        return jwk;
+      });
+    }
+
+    if (jwk) {
+      p = PromiseA.resolve(jwk);
+    } else {
+      p = testKeypairSupport().then(createKeypair);
+    }
+
+    function createAccount(jwk) {
+      console.log('account jwk:');
+      console.log(jwk);
+      delete jwk.key_ops;
+      info.jwk = jwk;
+      return BACME.accounts.sign({
+        jwk: jwk
+      , contacts: [ 'mailto:' + email ]
+      , agree: info.agree
+      , nonce: nonce
+      , kid: kid
+      }).then(function (signedAccount) {
+        return BACME.accounts.set({
+          signedAccount: signedAccount
+        }).then(function (account) {
+          console.log('account:');
+          console.log(account);
+          kid = account.kid;
+          return kid;
+        });
+      });
+    }
+
+    return p.then(function (_jwk) {
+      jwk = _jwk;
+      kid = JSON.parse(localStorage.getItem('account-kid:' + email) || 'null');
+      var p2;
+
+      // TODO save account id rather than always retrieving it
+      if (kid) {
+        p2 = PromiseA.resolve(kid);
+      } else {
+        p2 = createAccount(jwk);
+      }
+
+      return p2.then(function (_kid) {
+        kid = _kid;
+        info.kid = kid;
+        return BACME.orders.sign({
+          jwk: jwk
+        , identifiers: info.identifiers
+        , kid: kid
+        }).then(function (signedOrder) {
+          return BACME.orders.create({
+            signedOrder: signedOrder
+          }).then(function (order) {
+            info.finalizeUrl = order.finalize;
+            info.orderUrl = order.url; // from header Location ???
+            return BACME.thumbprint({ jwk: jwk }).then(function (thumbprint) {
+              return BACME.challenges.all().then(function (claims) {
+                console.log('claims:');
+                console.log(claims);
+                var obj = { 'dns-01': [], 'http-01': [], 'wildcard': [] };
+                info.challenges = obj;
+                var map = {
+                  'http-01': '.js-acme-verification-http-01'
+                , 'dns-01': '.js-acme-verification-dns-01'
+                , 'wildcard': '.js-acme-verification-wildcard'
+                };
+
+                /*
+                var tpls = {};
+                Object.keys(map).forEach(function (k) {
+                  var sel = map[k] + ' tbody';
+                  console.log(sel);
+                  tpls[k] = $qs(sel).innerHTML;
+                  $qs(map[k] + ' tbody').innerHTML = '';
+                });
+                */
+
+                // TODO make Promise-friendly
+                return PromiseA.all(claims.map(function (claim) {
+                  var hostname = claim.identifier.value;
+                  return PromiseA.all(claim.challenges.map(function (c) {
+                    var keyAuth = BACME.challenges['http-01']({
+                      token: c.token
+                    , thumbprint: thumbprint
+                    , challengeDomain: hostname
+                    });
+                    return BACME.challenges['dns-01']({
+                      keyAuth: keyAuth.value
+                    , challengeDomain: hostname
+                    }).then(function (dnsAuth) {
+                      var data = {
+                        type: c.type
+                      , hostname: hostname
+                      , url: c.url
+                      , token: c.token
+                      , keyAuthorization: keyAuth
+                      , httpPath: keyAuth.path
+                      , httpAuth: keyAuth.value
+                      , dnsType: dnsAuth.type
+                      , dnsHost: dnsAuth.host
+                      , dnsAnswer: dnsAuth.answer
+                      };
+
+                      console.log('');
+                      console.log('CHALLENGE');
+                      console.log(claim);
+                      console.log(c);
+                      console.log(data);
+                      console.log('');
+
+                      if (claim.wildcard) {
+                        obj.wildcard.push(data);
+                        let verification = $qs(".js-acme-verification-wildcard");
+                        verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname;
+                        verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost;
+                        verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer;
+
+                      } else if(obj[data.type]) {
+
+                        obj[data.type].push(data);
+
+                        if ('dns-01' === data.type) {
+                          let verification = $qs(".js-acme-verification-dns-01");
+                          verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname;
+                          verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost;
+                          verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer;
+                        } else if ('http-01' === data.type) {
+                          $qs(".js-acme-ver-file-location").innerHTML = data.httpPath.split("/").slice(-1);
+                          $qs(".js-acme-ver-content").innerHTML = data.httpAuth;
+                          $qs(".js-acme-ver-uri").innerHTML = data.httpPath;
+                          $qs(".js-download-verify-link").href =
+                            "data:text/octet-stream;base64," + window.btoa(data.httpAuth);
+                          $qs(".js-download-verify-link").download = data.httpPath.split("/").slice(-1);
+                        }
+                      }
+
+                    });
+
+                  }));
+                })).then(function () {
+
+                  // hide wildcard if no wildcard
+                  // hide http-01 and dns-01 if only wildcard
+                  if (!obj.wildcard.length) {
+                    $qs('.js-acme-wildcard-challenges').hidden = true;
+                  }
+                  if (!obj['http-01'].length) {
+                    $qs('.js-acme-challenges').hidden = true;
+                  }
+
+                  updateChallengeType();
+
+                  console.log("MAGIC STEP NUMBER in 2 is:", i);
+                  steps[i]();
+                });
+
+              });
+            });
+          });
+        });
+      });
+    }).catch(function (err) {
+      console.error('Step \'\' Error:');
+      console.error(err, err.stack);
+      window.alert("An error happened at Step " + i + ", but it's not your fault. Email aj@rootprojects.org and let him know.");
+    });
+  };
+
+  steps[3] = function () {
+    updateProgress(1);
+    hideForms();
+    $qs('.js-acme-form-challenges').hidden = false;
+  };
+  steps[3].submit = function () {
+    var chType;
+    Array.prototype.some.call($qsa('.js-acme-challenge-type'), function ($el) {
+      if ($el.checked) {
+        chType = $el.value;
+        return true;
+      }
+    });
+    console.log('chType is:', chType);
+    var chs = [];
+
+    // do each wildcard, if any
+    // do each challenge, by selected type only
+    [ 'wildcard', chType].forEach(function (typ) {
+      info.challenges[typ].forEach(function (ch) {
+        // { jwk, challengeUrl, accountId (kid) }
+        chs.push({
+          jwk: info.jwk
+        , challengeUrl: ch.url
+        , accountId: info.kid
+        });
+      });
+    });
+    console.log("INFO.challenges !!!!!", info.challenges);
+
+    var results = [];
+    function nextChallenge() {
+      var ch = chs.pop();
+      if (!ch) { return results; }
+      return BACME.challenges.accept(ch).then(function (result) {
+        results.push(result);
+        return nextChallenge();
+      });
+    }
+
+    // for now just show the next page immediately (its a spinner)
+    steps[i]();
+    return nextChallenge().then(function (results) {
+      console.log('challenge status:', results);
+      var polls = results.slice(0);
+      var allsWell = true;
+
+      function checkPolls() {
+        return new PromiseA(function (resolve) {
+          setTimeout(resolve, 1000);
+        }).then(function () {
+          return PromiseA.all(polls.map(function (poll) {
+            return BACME.challenges.check({ challengePollUrl: poll.url });
+          })).then(function (polls) {
+            console.log(polls);
+
+            polls = polls.filter(function (poll) {
+              //return 'valid' !== poll.status && 'invalid' !== poll.status;
+              if ('pending' === poll.status) {
+                return true;
+              }
+
+              if ('invalid' === poll.status) {
+                allsWell = false;
+                window.alert("verification failed:" + poll.error.detail);
+                return;
+              }
+
+              if (poll.error) {
+                window.alert("verification failed:" + poll.error.detail);
+                return;
+              }
+
+              if ('valid' !== poll.status) {
+                allsWell = false;
+                console.warn('BAD POLL STATUS', poll);
+                window.alert("unknown error: " + JSON.stringify(poll, null, 2));
+              }
+              // TODO show status in HTML
+            });
+
+            if (polls.length) {
+              return checkPolls();
+            }
+            return true;
+          });
+        });
+      }
+
+      return checkPolls().then(function () {
+        if (allsWell) {
+          return submitForm();
+        }
+      });
+    });
+  };
+
+  // https://stackoverflow.com/questions/40314257/export-webcrypto-key-to-pem-format
+  function spkiToPEM(keydata, pemName){
+      var keydataS = arrayBufferToString(keydata);
+      var keydataB64 = window.btoa(keydataS);
+      var keydataB64Pem = formatAsPem(keydataB64, pemName);
+      return keydataB64Pem;
+  }
+
+  function arrayBufferToString( buffer ) {
+      var binary = '';
+      var bytes = new Uint8Array( buffer );
+      var len = bytes.byteLength;
+      for (var i = 0; i < len; i++) {
+          binary += String.fromCharCode( bytes[ i ] );
+      }
+      return binary;
+  }
+
+
+  function formatAsPem(str, pemName) {
+      var finalString = '-----BEGIN ' + pemName + ' PRIVATE KEY-----\n';
+
+      while(str.length > 0) {
+          finalString += str.substring(0, 64) + '\n';
+          str = str.substring(64);
+      }
+
+      finalString = finalString + '-----END ' + pemName + ' PRIVATE KEY-----';
+
+      return finalString;
+  }
+
+  // spinner
+  steps[4] = function () {
+    updateProgress(1);
+    hideForms();
+    $qs('.js-acme-form-poll').hidden = false;
+  };
+  steps[4].submit = function () {
+    console.log('Congrats! Auto advancing...');
+
+    var key = info.identifiers.map(function (ident) { return ident.value; }).join(',');
+    var serverJwk = JSON.parse(localStorage.getItem('server:' + key) || 'null');
+    var p;
+
+    function createKeypair() {
+      var opts;
+
+      if (BROWSER_SUPPORTS_ECDSA) {
+        opts = { type: 'ECDSA', bitlength: '256' };
+      } else {
+        opts = { type: 'RSA', bitlength: '2048' };
+      }
+
+      return BACME.domains.generateKeypair(opts).then(function (serverJwk) {
+        localStorage.setItem('server:' + key, JSON.stringify(serverJwk));
+        return serverJwk;
+      });
+    }
+
+    if (serverJwk) {
+      p = PromiseA.resolve(serverJwk);
+    } else {
+      p = createKeypair();
+    }
+
+    return p.then(function (_serverJwk) {
+      serverJwk = _serverJwk;
+      info.serverJwk = serverJwk;
+      // { serverJwk, domains }
+      return BACME.orders.generateCsr({
+        serverJwk: serverJwk
+      , domains: info.identifiers.map(function (ident) {
+          return ident.value;
+        })
+      }).then(function (csrweb64) {
+        return BACME.orders.finalize({
+          csr: csrweb64
+        , jwk: info.jwk
+        , finalizeUrl: info.finalizeUrl
+        , accountId: info.kid
+        });
+      }).then(function () {
+        function checkCert() {
+          return new PromiseA(function (resolve) {
+            setTimeout(resolve, 1000);
+          }).then(function () {
+            return BACME.orders.check({ orderUrl: info.orderUrl });
+          }).then(function (reply) {
+            if ('processing' === reply) {
+              return checkCert();
+            }
+            return reply;
+          });
+        }
+
+        return checkCert();
+      }).then(function (reply) {
+        return BACME.orders.receive({ certificateUrl: reply.certificate });
+      }).then(function (certs) {
+        console.log('WINNING!');
+        console.log(certs);
+        $qs('#js-fullchain').innerHTML = certs;
+        $qs("#js-download-fullchain-link").href =
+          "data:text/octet-stream;base64," + window.btoa(certs);
+
+        var wcOpts;
+        var pemName;
+        if (/^R/.test(info.serverJwk.kty)) {
+          pemName = 'RSA';
+          wcOpts = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+        } else {
+          pemName = 'EC';
+          wcOpts = { name: "ECDSA", namedCurve: "P-256" };
+        }
+        return crypto.subtle.importKey(
+          "jwk"
+        , info.serverJwk
+        , wcOpts
+        , true
+        , ["sign"]
+        ).then(function (privateKey) {
+          return window.crypto.subtle.exportKey("pkcs8", privateKey);
+        }).then (function (keydata) {
+          var pem = spkiToPEM(keydata, pemName);
+          $qs('#js-privkey').innerHTML = pem;
+          $qs("#js-download-privkey-link").href =
+            "data:text/octet-stream;base64," + window.btoa(pem);
+          steps[i]();
+        });
+      });
+    }).catch(function (err) {
+      console.error(err.toString());
+      window.alert("An error happened in the final step, but it's not your fault. Email aj@rootprojects.org and let him know.");
+    });
+  };
+
+  steps[5] = function () {
+    updateProgress(2);
+    hideForms();
+    $qs('.js-acme-form-download').hidden = false;
+  };
+  steps[1]();
+
+  var params = new URLSearchParams(window.location.search);
+  var apiType = params.get('acme-api-type') || "staging-v02";
+
+  if(params.has('acme-domains')) {
+    console.log("acme-domains param: ", params.get('acme-domains'));
+    $qs('.js-acme-domains').value = params.get('acme-domains');
+
+    $qsa('.js-acme-api-type').forEach(function(ele) {
+      if(ele.value === apiType) {
+        ele.checked = true;
+      }
+    });
+
+    updateApiType();
+    steps[2]();
+    submitForm();
+  }
+
+  $qs('body').hidden = false;
+}());
--- a/app/js/bacme.js
+++ b/app/js/bacme.js
@ -0,0 +1,699 @@
+/*global CSR*/
+// CSR takes a while to load after the page load
+(function (exports) {
+'use strict';
+
+var BACME = exports.BACME = {};
+var webFetch = exports.fetch;
+var webCrypto = exports.crypto;
+var Promise = exports.Promise;
+
+var directoryUrl = 'https://acme-staging-v02.api.letsencrypt.org/directory';
+var directory;
+
+var nonceUrl;
+var nonce;
+
+var accountKeypair;
+var accountJwk;
+
+var accountUrl;
+
+BACME.challengePrefixes = {
+  'http-01': '/.well-known/acme-challenge'
+, 'dns-01': '_acme-challenge'
+};
+
+BACME._logHeaders = function (resp) {
+  console.log('Headers:');
+  Array.from(resp.headers.entries()).forEach(function (h) { console.log(h[0] + ': ' + h[1]); });
+};
+
+BACME._logBody = function (body) {
+  console.log('Body:');
+  console.log(JSON.stringify(body, null, 2));
+  console.log('');
+};
+
+BACME.directory = function (opts) {
+  return webFetch(opts.directoryUrl || directoryUrl, { mode: 'cors' }).then(function (resp) {
+    BACME._logHeaders(resp);
+    return resp.json().then(function (reply) {
+      if (/error/.test(reply.type)) {
+        return Promise.reject(new Error(reply.detail || reply.type));
+      }
+      directory = reply;
+      nonceUrl = directory.newNonce || 'https://acme-staging-v02.api.letsencrypt.org/acme/new-nonce';
+      accountUrl = directory.newAccount || 'https://acme-staging-v02.api.letsencrypt.org/acme/new-account';
+      orderUrl = directory.newOrder || "https://acme-staging-v02.api.letsencrypt.org/acme/new-order";
+      BACME._logBody(reply);
+      return reply;
+    });
+  });
+};
+
+BACME.nonce = function () {
+  return webFetch(nonceUrl, { mode: 'cors' }).then(function (resp) {
+    BACME._logHeaders(resp);
+    nonce = resp.headers.get('replay-nonce');
+    console.log('Nonce:', nonce);
+    // resp.body is empty
+    return resp.headers.get('replay-nonce');
+  });
+};
+
+BACME.accounts = {};
+
+// type = ECDSA
+// bitlength = 256
+BACME.accounts.generateKeypair = function (opts) {
+  return BACME.generateKeypair(opts).then(function (result) {
+    accountKeypair = result;
+
+    return webCrypto.subtle.exportKey(
+      "jwk"
+    , result.privateKey
+    ).then(function (privJwk) {
+
+      accountJwk = privJwk;
+      console.log('private jwk:');
+      console.log(JSON.stringify(privJwk, null, 2));
+
+      return privJwk;
+      /*
+      return webCrypto.subtle.exportKey(
+        "pkcs8"
+      , result.privateKey
+      ).then(function (keydata) {
+        console.log('pkcs8:');
+        console.log(Array.from(new Uint8Array(keydata)));
+
+        return privJwk;
+        //return accountKeypair;
+      });
+      */
+    });
+  });
+};
+
+// json to url-safe base64
+BACME._jsto64 = function (json) {
+  return btoa(JSON.stringify(json)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+};
+
+var textEncoder = new TextEncoder();
+
+BACME._importKey = function (jwk) {
+  var alg; // I think the 256 refers to the hash
+  var wcOpts = {};
+  var extractable = true; // TODO make optionally false?
+  var priv = jwk;
+  var pub;
+
+  // ECDSA
+  if (/^EC/i.test(jwk.kty)) {
+    wcOpts.name = 'ECDSA';
+    wcOpts.namedCurve = jwk.crv;
+    alg = 'ES256';
+    pub = {
+      crv: priv.crv
+    , kty: priv.kty
+    , x: priv.x
+    , y: priv.y
+    };
+    if (!priv.d) {
+      priv = null;
+    }
+  }
+
+  // RSA
+  if (/^RS/i.test(jwk.kty)) {
+    wcOpts.name = 'RSASSA-PKCS1-v1_5';
+    wcOpts.hash = { name: "SHA-256" };
+    alg = 'RS256';
+    pub = {
+      e: priv.e
+    , kty: priv.kty
+    , n: priv.n
+    };
+    if (!priv.p) {
+      priv = null;
+    }
+  }
+
+  return window.crypto.subtle.importKey(
+    "jwk"
+  , pub
+  , wcOpts
+  , extractable
+  , [ "verify" ]
+  ).then(function (publicKey) {
+    function give(privateKey) {
+      return {
+        wcPub: publicKey
+      , wcKey: privateKey
+      , wcKeypair: { publicKey: publicKey, privateKey: privateKey }
+      , meta: {
+          alg: alg
+        , name: wcOpts.name
+        , hash: wcOpts.hash
+        }
+      , jwk: jwk
+      };
+    }
+    if (!priv) {
+      return give();
+    }
+    return window.crypto.subtle.importKey(
+      "jwk"
+    , priv
+    , wcOpts
+    , extractable
+    , [ "sign"/*, "verify"*/ ]
+    ).then(give);
+  });
+};
+BACME._sign = function (opts) {
+  var wcPrivKey = opts.abstractKey.wcKeypair.privateKey;
+  var wcOpts = opts.abstractKey.meta;
+  var alg = opts.abstractKey.meta.alg; // I think the 256 refers to the hash
+  var signHash;
+
+  console.log('kty', opts.abstractKey.jwk.kty);
+  signHash = { name: "SHA-" + alg.replace(/[a-z]+/ig, '') };
+
+  var msg = textEncoder.encode(opts.protected64 + '.' + opts.payload64);
+  console.log('msg:', msg);
+  return window.crypto.subtle.sign(
+    { name: wcOpts.name, hash: signHash }
+  , wcPrivKey
+  , msg
+  ).then(function (signature) {
+    //console.log('sig1:', signature);
+    //console.log('sig2:', new Uint8Array(signature));
+    //console.log('sig3:', Array.prototype.slice.call(new Uint8Array(signature)));
+    // convert buffer to urlsafe base64
+    var sig64 = btoa(Array.prototype.map.call(new Uint8Array(signature), function (ch) {
+      return String.fromCharCode(ch);
+    }).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+
+    console.log('[1] URL-safe Base64 Signature:');
+    console.log(sig64);
+
+    var signedMsg = {
+      protected: opts.protected64
+    , payload: opts.payload64
+    , signature: sig64
+    };
+
+    console.log('Signed Base64 Msg:');
+    console.log(JSON.stringify(signedMsg, null, 2));
+
+    return signedMsg;
+  });
+};
+// email = john.doe@gmail.com
+// jwk = { ... }
+// agree = true
+BACME.accounts.sign = function (opts) {
+
+  return BACME._importKey(opts.jwk).then(function (abstractKey) {
+
+    var payloadJson =
+      { termsOfServiceAgreed: opts.agree
+      , onlyReturnExisting: false
+      , contact: opts.contacts || [ 'mailto:' + opts.email ]
+      };
+    console.log('payload:');
+    console.log(payloadJson);
+    var payload64 = BACME._jsto64(
+      payloadJson
+    );
+
+    var protectedJson =
+      { nonce: opts.nonce
+      , url: accountUrl
+      , alg: abstractKey.meta.alg
+      , jwk: null
+      };
+
+    if (/EC/i.test(opts.jwk.kty)) {
+      protectedJson.jwk = {
+        crv: opts.jwk.crv
+      , kty: opts.jwk.kty
+      , x: opts.jwk.x
+      , y: opts.jwk.y
+      };
+    } else if (/RS/i.test(opts.jwk.kty)) {
+      protectedJson.jwk = {
+        e: opts.jwk.e
+      , kty: opts.jwk.kty
+      , n: opts.jwk.n
+      };
+    } else {
+      return Promise.reject(new Error("[acme.accounts.sign] unsupported key type '" + opts.jwk.kty + "'"));
+    }
+
+    console.log('protected:');
+    console.log(protectedJson);
+    var protected64 = BACME._jsto64(
+      protectedJson
+    );
+
+    // Note: this function hashes before signing so send data, not the hash
+    return BACME._sign({
+      abstractKey: abstractKey
+    , payload64: payload64
+    , protected64: protected64
+    });
+  });
+};
+
+var accountId;
+
+BACME.accounts.set = function (opts) {
+  nonce = null;
+  return window.fetch(accountUrl, {
+    mode: 'cors'
+  , method: 'POST'
+  , headers: { 'Content-Type': 'application/jose+json' }
+  , body: JSON.stringify(opts.signedAccount)
+  }).then(function (resp) {
+    BACME._logHeaders(resp);
+    nonce = resp.headers.get('replay-nonce');
+    accountId = resp.headers.get('location');
+    console.log('Next nonce:', nonce);
+    console.log('Location/kid:', accountId);
+
+    if (!resp.headers.get('content-type')) {
+     console.log('Body: <none>');
+
+     return { kid: accountId };
+    }
+
+    return resp.json().then(function (result) {
+      if (/^Error/i.test(result.detail)) {
+        return Promise.reject(new Error(result.detail));
+      }
+      result.kid = accountId;
+      BACME._logBody(result);
+
+      return result;
+    });
+  });
+};
+
+var orderUrl;
+
+BACME.orders = {};
+
+// identifiers = [ { type: 'dns', value: 'example.com' }, { type: 'dns', value: '*.example.com' } ]
+// signedAccount
+BACME.orders.sign = function (opts) {
+  var payload64 = BACME._jsto64({ identifiers: opts.identifiers });
+
+  return BACME._importKey(opts.jwk).then(function (abstractKey) {
+    var protected64 = BACME._jsto64(
+      { nonce: nonce, alg: abstractKey.meta.alg/*'ES256'*/, url: orderUrl, kid: opts.kid }
+    );
+    console.log('abstractKey:');
+    console.log(abstractKey);
+    return BACME._sign({
+      abstractKey: abstractKey
+    , payload64: payload64
+    , protected64: protected64
+    }).then(function (sig) {
+      if (!sig) {
+        throw new Error('sig is undefined... nonsense!');
+      }
+      console.log('newsig', sig);
+      return sig;
+    });
+  });
+};
+
+var currentOrderUrl;
+var authorizationUrls;
+var finalizeUrl;
+
+BACME.orders.create = function (opts) {
+  nonce = null;
+  return window.fetch(orderUrl, {
+    mode: 'cors'
+  , method: 'POST'
+  , headers: { 'Content-Type': 'application/jose+json' }
+  , body: JSON.stringify(opts.signedOrder)
+  }).then(function (resp) {
+    BACME._logHeaders(resp);
+    currentOrderUrl = resp.headers.get('location');
+    nonce = resp.headers.get('replay-nonce');
+    console.log('Next nonce:', nonce);
+
+    return resp.json().then(function (result) {
+      if (/^Error/i.test(result.detail)) {
+        return Promise.reject(new Error(result.detail));
+      }
+      authorizationUrls = result.authorizations;
+      finalizeUrl = result.finalize;
+      BACME._logBody(result);
+
+      result.url = currentOrderUrl;
+      return result;
+    });
+  });
+};
+
+BACME.challenges = {};
+BACME.challenges.all = function () {
+  var challenges = [];
+
+  function next() {
+    if (!authorizationUrls.length) {
+      return challenges;
+    }
+
+    return BACME.challenges.view().then(function (challenge) {
+      challenges.push(challenge);
+      return next();
+    });
+  }
+
+  return next();
+};
+BACME.challenges.view = function () {
+  var authzUrl = authorizationUrls.pop();
+  var token;
+  var challengeDomain;
+  var challengeUrl;
+
+  return window.fetch(authzUrl, {
+    mode: 'cors'
+  }).then(function (resp) {
+    BACME._logHeaders(resp);
+
+    return resp.json().then(function (result) {
+      // Note: select the challenge you wish to use
+      var challenge = result.challenges.slice(0).pop();
+      token = challenge.token;
+      challengeUrl = challenge.url;
+      challengeDomain = result.identifier.value;
+
+      BACME._logBody(result);
+
+      return {
+        challenges: result.challenges
+      , expires: result.expires
+      , identifier: result.identifier
+      , status: result.status
+      , wildcard: result.wildcard
+      //, token: challenge.token
+      //, url: challenge.url
+      //, domain: result.identifier.value,
+      };
+    });
+  });
+};
+
+var thumbprint;
+var keyAuth;
+var httpPath;
+var dnsAuth;
+var dnsRecord;
+
+BACME.thumbprint = function (opts) {
+  // https://stackoverflow.com/questions/42588786/how-to-fingerprint-a-jwk
+
+  var accountJwk = opts.jwk;
+  var keys;
+
+  if (/^EC/i.test(opts.jwk.kty)) {
+    keys = [ 'crv', 'kty', 'x', 'y' ];
+  } else if (/^RS/i.test(opts.jwk.kty)) {
+    keys = [ 'e', 'kty', 'n' ];
+  }
+
+  var accountPublicStr = '{' + keys.map(function (key) {
+    return '"' + key + '":"' + accountJwk[key] + '"';
+  }).join(',') + '}';
+
+  return window.crypto.subtle.digest(
+    { name: "SHA-256" } // SHA-256 is spec'd, non-optional
+  , textEncoder.encode(accountPublicStr)
+  ).then(function (hash) {
+    thumbprint = btoa(Array.prototype.map.call(new Uint8Array(hash), function (ch) {
+      return String.fromCharCode(ch);
+    }).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+
+    console.log('Thumbprint:');
+    console.log(opts);
+    console.log(accountPublicStr);
+    console.log(thumbprint);
+
+    return thumbprint;
+  });
+};
+
+// { token, thumbprint, challengeDomain }
+BACME.challenges['http-01'] = function (opts) {
+  // The contents of the key authorization file
+  keyAuth = opts.token + '.' + opts.thumbprint;
+
+  // Where the key authorization file goes
+  httpPath = 'http://' + opts.challengeDomain + '/.well-known/acme-challenge/' + opts.token;
+
+  console.log("echo '" + keyAuth + "' > '" + httpPath + "'");
+
+  return {
+    path: httpPath
+  , value: keyAuth
+  };
+};
+
+// { keyAuth }
+BACME.challenges['dns-01'] = function (opts) {
+  console.log('opts.keyAuth for DNS:');
+  console.log(opts.keyAuth);
+  return window.crypto.subtle.digest(
+    { name: "SHA-256", }
+  , textEncoder.encode(opts.keyAuth)
+  ).then(function (hash) {
+    dnsAuth = btoa(Array.prototype.map.call(new Uint8Array(hash), function (ch) {
+      return String.fromCharCode(ch);
+    }).join('')).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
+
+    dnsRecord = '_acme-challenge.' + opts.challengeDomain;
+
+    console.log('DNS TXT Auth:');
+    // The name of the record
+    console.log(dnsRecord);
+    // The TXT record value
+    console.log(dnsAuth);
+
+    return {
+      type: 'TXT'
+    , host: dnsRecord
+    , answer: dnsAuth
+    };
+  });
+};
+
+var challengePollUrl;
+
+// { jwk, challengeUrl, accountId (kid) }
+BACME.challenges.accept = function (opts) {
+  var payload64 = BACME._jsto64({});
+
+  return BACME._importKey(opts.jwk).then(function (abstractKey) {
+    var protected64 = BACME._jsto64(
+      { nonce: nonce, alg: abstractKey.meta.alg/*'ES256'*/, url: opts.challengeUrl, kid: opts.accountId }
+    );
+    return BACME._sign({
+      abstractKey: abstractKey
+    , payload64: payload64
+    , protected64: protected64
+    });
+  }).then(function (signedAccept) {
+
+    nonce = null;
+    return window.fetch(
+      opts.challengeUrl
+    , { mode: 'cors'
+      , method: 'POST'
+      , headers: { 'Content-Type': 'application/jose+json' }
+      , body: JSON.stringify(signedAccept)
+      }
+    ).then(function (resp) {
+      BACME._logHeaders(resp);
+      nonce = resp.headers.get('replay-nonce');
+      console.log("ACCEPT NONCE:", nonce);
+
+      return resp.json().then(function (reply) {
+        challengePollUrl = reply.url;
+
+        console.log('Challenge ACK:');
+        console.log(JSON.stringify(reply));
+        return reply;
+      });
+    });
+  });
+};
+
+BACME.challenges.check = function (opts) {
+  return window.fetch(opts.challengePollUrl, { mode: 'cors' }).then(function (resp) {
+    BACME._logHeaders(resp);
+
+    return resp.json().then(function (reply) {
+      if (/error/.test(reply.type)) {
+        return Promise.reject(new Error(reply.detail || reply.type));
+      }
+      challengePollUrl = reply.url;
+
+      BACME._logBody(reply);
+
+      return reply;
+    });
+  });
+};
+
+var domainKeypair;
+var domainJwk;
+
+BACME.generateKeypair = function (opts) {
+  var wcOpts = {};
+
+  // ECDSA has only the P curves and an associated bitlength
+  if (/^EC/i.test(opts.type)) {
+    wcOpts.name = 'ECDSA';
+    if (/256/.test(opts.bitlength)) {
+      wcOpts.namedCurve = 'P-256';
+    }
+  }
+
+  // RSA-PSS is another option, but I don't think it's used for Let's Encrypt
+  // I think the hash is only necessary for signing, not generation or import
+  if (/^RS/i.test(opts.type)) {
+    wcOpts.name = 'RSASSA-PKCS1-v1_5';
+    wcOpts.modulusLength = opts.bitlength;
+    if (opts.bitlength < 2048) {
+      wcOpts.modulusLength = opts.bitlength * 8;
+    }
+    wcOpts.publicExponent = new Uint8Array([0x01, 0x00, 0x01]);
+    wcOpts.hash = { name: "SHA-256" };
+  }
+  var extractable = true;
+  return window.crypto.subtle.generateKey(
+    wcOpts
+  , extractable
+  , [ 'sign', 'verify' ]
+  );
+};
+BACME.domains = {};
+// TODO factor out from BACME.accounts.generateKeypair even more
+BACME.domains.generateKeypair = function (opts) {
+  return BACME.generateKeypair(opts).then(function (result) {
+    domainKeypair = result;
+
+    return window.crypto.subtle.exportKey(
+      "jwk"
+    , result.privateKey
+    ).then(function (privJwk) {
+
+      domainJwk = privJwk;
+      console.log('private jwk:');
+      console.log(JSON.stringify(privJwk, null, 2));
+
+      return privJwk;
+    });
+  });
+};
+
+// { serverJwk, domains }
+BACME.orders.generateCsr = function (opts) {
+  return BACME._importKey(opts.serverJwk).then(function (abstractKey) {
+    return Promise.resolve(CSR.generate({ keypair: abstractKey.wcKeypair, domains: opts.domains }));
+  });
+};
+
+var certificateUrl;
+
+// { csr, jwk, finalizeUrl, accountId }
+BACME.orders.finalize = function (opts) {
+  var payload64 = BACME._jsto64(
+    { csr: opts.csr }
+  );
+
+  return BACME._importKey(opts.jwk).then(function (abstractKey) {
+    var protected64 = BACME._jsto64(
+      { nonce: nonce, alg: abstractKey.meta.alg/*'ES256'*/, url: opts.finalizeUrl, kid: opts.accountId }
+    );
+    return BACME._sign({
+      abstractKey: abstractKey
+    , payload64: payload64
+    , protected64: protected64
+    });
+  }).then(function (signedFinal) {
+
+    nonce = null;
+    return window.fetch(
+      opts.finalizeUrl
+    , { mode: 'cors'
+      , method: 'POST'
+      , headers: { 'Content-Type': 'application/jose+json' }
+      , body: JSON.stringify(signedFinal)
+      }
+    ).then(function (resp) {
+      BACME._logHeaders(resp);
+      nonce = resp.headers.get('replay-nonce');
+
+      return resp.json().then(function (reply) {
+        if (/error/.test(reply.type)) {
+          return Promise.reject(new Error(reply.detail || reply.type));
+        }
+        certificateUrl = reply.certificate;
+        BACME._logBody(reply);
+
+        return reply;
+      });
+    });
+  });
+};
+
+BACME.orders.receive = function (opts) {
+  return window.fetch(
+    opts.certificateUrl
+  , { mode: 'cors'
+    , method: 'GET'
+    }
+  ).then(function (resp) {
+    BACME._logHeaders(resp);
+    nonce = resp.headers.get('replay-nonce');
+
+    return resp.text().then(function (reply) {
+      BACME._logBody(reply);
+
+      return reply;
+    });
+  });
+};
+
+BACME.orders.check = function (opts) {
+  return window.fetch(
+    opts.orderUrl
+  , { mode: 'cors'
+    , method: 'GET'
+    }
+  ).then(function (resp) {
+    BACME._logHeaders(resp);
+
+    return resp.json().then(function (reply) {
+      if (/error/.test(reply.type)) {
+        return Promise.reject(new Error(reply.detail || reply.type));
+      }
+      BACME._logBody(reply);
+
+      return reply;
+    });
+  });
+};
+
+}(window));
--- a/app/js/bluecrypt-acme.js
+++ b/app/js/bluecrypt-acme.js
--- a/app/js/greenlock.js
+++ b/app/js/greenlock.js
@ -1,54 +1,38 @@
-(function() {
-	"use strict";
+(function () {
+'use strict';

  /*global URLSearchParams,Headers*/
-	var PromiseA = window.Promise;
-	var VERSION = "2";
+  var VERSION = '2';
 	// ACME recommends ECDSA P-256, but RSA 2048 is still required by some old servers (like what replicated.io uses )
 	// ECDSA P-384, P-521, and RSA 3072, 4096 are NOT recommend standards (and not properly supported)
-	var BROWSER_SUPPORTS_RSA = false;
-	var ECDSA_OPTS = { kty: "EC", namedCurve: "P-256" };
-	var RSA_OPTS = { kty: "RSA", modulusLength: 2048 };
+  var BROWSER_SUPPORTS_RSA;
+	var ECDSA_OPTS = { kty: 'EC', namedCurve: 'P-256' };
+	var RSA_OPTS = { kty: 'RSA', modulusLength: 2048 };
  var Promise = window.Promise;
  var Keypairs = window.Keypairs;
  var ACME = window.ACME;
  var CSR = window.CSR;
-	var $qs = function(s) {
-		return window.document.querySelector(s);
-	};
-	var $qsa = function(s) {
-		return window.document.querySelectorAll(s);
-	};
+  var $qs = function (s) { return window.document.querySelector(s); };
+  var $qsa = function (s) { return window.document.querySelectorAll(s); };
 	var acme;
+	var accountStuff;
  var info = {};
  var steps = {};
  var i = 1;
-	var apiUrl = "https://acme-{{env}}.api.letsencrypt.org/directory";
-
-	// fix previous browsers
-	var isCurrent = localStorage.getItem("version") === VERSION;
-	if (!isCurrent) {
-		localStorage.clear();
-		localStorage.setItem("version", VERSION);
-	}
-	localStorage.setItem("version", VERSION);
+  var apiUrl = 'https://acme-{{env}}.api.letsencrypt.org/directory';

  function updateApiType() {
+    console.log("type updated");
    /*jshint validthis: true */
-		var input =
-			this ||
-			Array.prototype.filter.call($qsa(".js-acme-api-type"), function($el) {
-				return $el.checked;
-			})[0];
-		//#console.log('ACME api type radio:', input.value);
-		$qs(".js-acme-directory-url").value = apiUrl.replace(
-			/{{env}}/g,
-			input.value
-		);
+    var input = this || Array.prototype.filter.call(
+      $qsa('.js-acme-api-type'), function ($el) { return $el.checked; }
+    )[0];
+    console.log('ACME api type radio:', input.value);
+    $qs('.js-acme-directory-url').value = apiUrl.replace(/{{env}}/g, input.value);
  }

  function hideForms() {
-		$qsa(".js-acme-form").forEach(function(el) {
+    $qsa('.js-acme-form').forEach(function (el) {
      el.hidden = true;
    });
  }
@ -70,100 +54,51 @@
    }
  }

-	function newAlert(str) {
-		return new Promise(function() {
-			setTimeout(function() {
-				window.alert(str);
-				if (window.confirm("Start over?")) {
-					document.location.href = document.location.href.replace(
-						/\/app.*/,
-						"/"
-					);
-				}
-			}, 10);
-		});
-	}
-
  function submitForm(ev) {
    var j = i;
    i += 1;

-		return PromiseA.resolve()
-			.then(function() {
-				return steps[j].submit(ev);
-			})
-			.catch(function(err) {
-				var ourfault = true;
+    return PromiseA.resolve(steps[j].submit(ev)).catch(function (err) {
      console.error(err);
-				if (/failed to fetch/i.test(err.message)) {
-					return newAlert("Network connection failure.");
-				}
-
-				if ("E_ACME_CHALLENGE" === err.code) {
-					if ("dns-01" === err.type) {
-						ourfault = false;
-						return newAlert(
-							"It looks like the DNS record you set for " +
-								err.altname +
-								" was incorrect or did not propagate. " +
-								"The error message was '" +
-								err.message +
-								"'"
-						);
-					} else if ("http-01" === err.type) {
-						ourfault = false;
-						return newAlert(
-							"It looks like the file you uploaded for " +
-								err.altname +
-								" was incorrect or could not be downloaded. " +
-								"The error message was '" +
-								err.message +
-								"'"
-						);
-					}
-				}
-
-				if (ourfault) {
-					err.auth = undefined;
-					window.alert(
-						"Something went wrong. It's probably our fault, not yours." +
-							" Please email aj@rootprojects.org to let him know. The error message is: \n" +
-							JSON.stringify(err, null, 2)
-					);
-					return new Promise(function() {});
-				}
+      window.alert("Something went wrong. It's our fault not yours. Please email aj@rootprojects.org and let him know that 'step " + j + "' failed.");
    });
  }

+  function testEcdsaSupport() {
+		/*
+			var opts = {
+				kty: $('input[name="kty"]:checked').value
+			, namedCurve: $('input[name="ec-crv"]:checked').value
+			, modulusLength: $('input[name="rsa-len"]:checked').value
+			};
+		*/
+  }
+  function testRsaSupport() {
+		return Keypairs.generate(RSA_OPTS);
+  }
  function testKeypairSupport() {
-		return Keypairs.generate(RSA_OPTS)
-			.then(function() {
+		// fix previous browsers
+		var isCurrent = (localStorage.getItem('version') === VERSION);
+		if (!isCurrent) {
+			localStorage.clear();
+			localStorage.setItem('version', VERSION);
+		}
+		localStorage.setItem('version', VERSION);
+
+    return testRsaSupport().then(function () {
      console.info("[crypto] RSA is supported");
      BROWSER_SUPPORTS_RSA = true;
-			})
-			.catch(function() {
-				console.warn("[crypto] RSA is NOT supported");
-				return Keypairs.generate(ECDSA_OPTS)
-					.then(function() {
-						console.info("[crypto] ECDSA is supported");
-					})
-					.catch(function(e) {
-						console.warn("[crypto] EC is NOT supported");
-						throw e;
-					});
+      return BROWSER_SUPPORTS_RSA;
+    }).catch(function () {
+      console.warn("[crypto] RSA is NOT fully supported");
+      BROWSER_SUPPORTS_RSA = false;
+      return BROWSER_SUPPORTS_RSA;
    });
  }

  function getServerKeypair() {
-		var sortedAltnames = info.identifiers
-			.map(function(ident) {
-				return ident.value;
-			})
-			.sort()
-			.join(",");
-		var serverJwk = JSON.parse(
-			localStorage.getItem("server:" + sortedAltnames) || "null"
-		);
+    var sortedAltnames = info.identifiers.map(function (ident) { return ident.value; }).sort().join(',');
+    var serverJwk = JSON.parse(localStorage.getItem('server:' + sortedAltnames) || 'null');
    if (serverJwk) {
      return PromiseA.resolve(serverJwk);
    }
@ -176,434 +111,384 @@
      keypairOpts = ECDSA_OPTS;
    }

-		return Keypairs.generate(RSA_OPTS)
-			.catch(function(err) {
-				console.error(
-					"[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):"
-				);
+    return Keypairs.generate(RSA_OPTS).catch(function (err) {
+      console.error("[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):");
      throw err;
-			})
-			.then(function(pair) {
-				localStorage.setItem(
-					"server:" + sortedAltnames,
-					JSON.stringify(pair.private)
-				);
+		}).then(function (pair) {
+			localStorage.setItem('server:'+sortedAltnames, JSON.stringify(pair.private));
 			return pair.private;
 		});
  }

 	function getAccountKeypair(email) {
-		var json = localStorage.getItem("account:" + email);
+		var json = localStorage.getItem('account:'+email);
 		if (json) {
 			return Promise.resolve(JSON.parse(json));
 		}

-		return Keypairs.generate(ECDSA_OPTS)
-			.catch(function(err) {
-				console.warn(
-					"[Error] Keypairs.generate(" + JSON.stringify(ECDSA_OPTS) + "):\n",
-					err
-				);
-				return Keypairs.generate(RSA_OPTS).catch(function(err) {
-					console.error(
-						"[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):"
-					);
+		return Keypairs.generate(ECDSA_OPTS).catch(function (err) {
+			console.warn("[Error] Keypairs.generate(" + JSON.stringify(ECDSA_OPTS) + "):\n", err);
+			return Keypairs.generate(RSA_OPTS).catch(function (err) {
+				console.error("[Error] Keypairs.generate(" + JSON.stringify(RSA_OPTS) + "):");
 				throw err;
 			});
-			})
-			.then(function(pair) {
-				localStorage.setItem("account:" + email, JSON.stringify(pair.private));
+		}).then(function (pair) {
+			localStorage.setItem('account:'+email, JSON.stringify(pair.private));
 			return pair.private;
 		});
 	}

  function updateChallengeType() {
    /*jshint validthis: true*/
-		var input =
-			this ||
-			Array.prototype.filter.call($qsa(".js-acme-challenge-type"), function(
-				$el
-			) {
-				return $el.checked;
-			})[0];
-		$qs(".js-acme-verification-wildcard").hidden = true;
-		$qs(".js-acme-verification-http-01").hidden = true;
-		$qs(".js-acme-verification-dns-01").hidden = true;
+    var input = this || Array.prototype.filter.call(
+      $qsa('.js-acme-challenge-type'), function ($el) { return $el.checked; }
+    )[0];
+    console.log('ch type radio:', input.value);
+    $qs('.js-acme-verification-wildcard').hidden = true;
+    $qs('.js-acme-verification-http-01').hidden = true;
+    $qs('.js-acme-verification-dns-01').hidden = true;
    if (info.challenges.wildcard) {
-			$qs(".js-acme-verification-wildcard").hidden = false;
+      $qs('.js-acme-verification-wildcard').hidden = false;
    }
    if (info.challenges[input.value]) {
-			$qs(".js-acme-verification-" + input.value).hidden = false;
+      $qs('.js-acme-verification-' + input.value).hidden = false;
    }
  }

  function saveContact(email, domains) {
    // to be used for good, not evil
-		return window
-			.fetch(
-				"https://api.rootprojects.org/api/rootprojects.org/public/community",
-				{
-					method: "POST",
-					cors: true,
-					headers: new Headers({ "Content-Type": "application/json" }),
-					body: JSON.stringify({
-						address: email,
-						project: "greenlock-domains@rootprojects.org",
-						timezone: new Intl.DateTimeFormat().resolvedOptions().timeZone,
-						domain: domains.join(",")
+    return window.fetch('https://api.rootprojects.org/api/rootprojects.org/public/community', {
+      method: 'POST'
+    , cors: true
+    , headers: new Headers({ 'Content-Type': 'application/json' })
+    , body: JSON.stringify({
+        address: email
+      , project: 'greenlock-domains@rootprojects.org'
+			, timezone: new Intl.DateTimeFormat().resolvedOptions().timeZone
+      , domain: domains.join(',')
      })
-				}
-			)
-			.catch(function(err) {
+    }).catch(function (err) {
      console.error(err);
    });
  }

-	steps[1] = function() {
-		console.info("\n1. Show domains form");
+  steps[1] = function () {
    updateProgress(0);
    hideForms();
-		$qs(".js-acme-form-domains").hidden = false;
+    $qs('.js-acme-form-domains').hidden = false;
  };
-	steps[1].submit = function() {
-		console.info(
-			"[submit] 1. Process domains, create ACME client",
-			info.domains
-		);
-		info.domains = $qs(".js-acme-domains")
-			.value.replace(/https?:\/\//g, " ")
-			.replace(/[,+]/g, " ")
-			.trim()
-			.split(/\s+/g);
-		console.info("[domains]", info.domains.join(" "));
-
-		info.identifiers = info.domains.map(function(hostname) {
-			return { type: "dns", value: hostname.toLowerCase().trim() };
-		});
-		info.identifiers.sort(function(a, b) {
-			if (a === b) {
-				return 0;
-			}
-			if (a < b) {
-				return 1;
-			}
-			if (a > b) {
-				return -1;
-			}
+  steps[1].submit = function () {
+    info.identifiers = $qs('.js-acme-domains').value.split(/\s*,\s*/g).map(function (hostname) {
+      return { type: 'dns', value: hostname.toLowerCase().trim() };
+    }).slice(0,1); //Disable multiple values for now.  We'll just take the first and work with it.
+    info.identifiers.sort(function (a, b) {
+      if (a === b) { return 0; }
+      if (a < b) { return 1; }
+      if (a > b) { return -1; }
    });

-		var acmeDirectoryUrl = $qs(".js-acme-directory-url").value;
+		var acmeDirectoryUrl = $qs('.js-acme-directory-url').value;
 		acme = ACME.create({ Keypairs: Keypairs, CSR: CSR });
-		return acme.init(acmeDirectoryUrl).then(function(directory) {
-			$qs(".js-acme-tos-url").href = directory.meta.termsOfService;
-			return steps[i]();
+		return acme.init(acmeDirectoryUrl).then(function (directory) {
+      $qs('.js-acme-tos-url').href = directory.meta.termsOfService;
+			console.log("MAGIC STEP NUMBER in 1 is:", i);
+			steps[i]();
    });
  };

-	steps[2] = function() {
-		console.info("\n2. Show account (email, ToS) form");
-
+  steps[2] = function () {
    updateProgress(0);
    hideForms();
-		$qs(".js-acme-form-account").hidden = false;
+    $qs('.js-acme-form-account').hidden = false;
  };
-	steps[2].submit = function() {
-		console.info("[submit] 2. Create ACME account (get Key ID)");
+  steps[2].submit = function () {
+    var email = $qs('.js-acme-account-email').value.toLowerCase().trim();

-		var email = $qs(".js-acme-account-email")
-			.value.toLowerCase()
-			.trim();
-		info.email = email;
-		info.contact = ["mailto:" + email];
-		info.agree = $qs(".js-acme-account-tos").checked;
+    info.contact = [ 'mailto:' + email ];
+    info.agree = $qs('.js-acme-account-tos').checked;
    //info.greenlockAgree = $qs('.js-gl-tos').checked;

    // TODO ping with version and account creation
-		setTimeout(saveContact, 100, email, info.domains);
+    setTimeout(saveContact, 100, email, info.identifiers.map(function (ident) { return ident.value; }));

-		$qs(".js-account-next").disabled = true;
+		function checkTos(tos) {
+			if (info.agree) {
+				return tos;
+			} else {
+				return '';
+			}
+		}

-		return info.cryptoCheck
-			.then(function() {
-				return getAccountKeypair(email).then(function(jwk) {
+    return getAccountKeypair(email).then(function (jwk) {
      // TODO save account id rather than always retrieving it?
-					console.info("[accounts] upsert for", email);
-					return acme.accounts
-						.create({
-							email: email,
-							agreeToTerms: info.agree && true,
-							accountKeypair: { privateKeyJwk: jwk }
-						})
-						.then(function(account) {
-							console.info("[accounts] result:", account);
-							info.account = account;
-							info.privateJwk = jwk;
-							info.email = email;
-						})
-						.catch(function(err) {
-							console.error("[accounts] failed to upsert account:");
+			return acme.accounts.create({
+				email: email
+			, agreeToTerms: checkTos
+			, accountKeypair: { privateKeyJwk: jwk }
+			}).then(function (account) {
+				console.log("account created result:", account);
+				accountStuff.account = account;
+				accountStuff.privateJwk = jwk;
+				accountStuff.email = email;
+				accountStuff.acme = acme; // TODO XXX remove
+			}).catch(function (err) {
+				console.error("A bad thing happened:");
 				console.error(err);
-							return newAlert(err.message || JSON.stringify(err, null, 2));
+				window.alert(err.message || JSON.stringify(err, null, 2));
+				return new Promise(function () {
+ 					// stop the process cold
+					console.warn('TODO: resume at ask email?');
 				});
 			});
-			})
-			.then(function() {
-				var jwk = info.privateJwk;
-				var account = info.account;
+		}).then(function () {
+      var jwk = accountStuff.privateJwk;
+      var account = accountStuff.account;

-				console.info("[orders] requesting");
-				return acme.orders
-					.request({
-						account: account,
-						accountKeypair: { privateKeyJwk: jwk },
-						domains: info.domains
-					})
-					.then(function(order) {
-						info.order = order;
-						console.info("[orders] created ", order);
+			return acme.orders.create({
+			  account: account
+			, accountKeypair: { privateKeyJwk: jwk }
+			, identifiers: info.identifiers
+			}).then(function (order) {
+				return acme.orders.create({
+					signedOrder: signedOrder
+				}).then(function (order) {
+					accountStuff.order = order;
+          var claims = order.challenges;
+          console.log('claims:');
+          console.log(claims);

-						var claims = order.claims;
-
-						var obj = { "dns-01": [], "http-01": [], wildcard: [] };
+          var obj = { 'dns-01': [], 'http-01': [], 'wildcard': [] };
          info.challenges = obj;
-
-						var $httpList = $qs(".js-acme-http");
-						var $dnsList = $qs(".js-acme-dns");
-						var $wildList = $qs(".js-acme-wildcard");
-						var httpTpl = $httpList.innerHTML;
-						var dnsTpl = $dnsList.innerHTML;
-						var wildTpl = $wildList.innerHTML;
-						$httpList.innerHTML = "";
-						$dnsList.innerHTML = "";
-						$wildList.innerHTML = "";
-
-						claims.forEach(function(claim) {
-							//#console.log("claims[i]", claim);
-							var hostname = claim.identifier.value;
-							claim.challenges.forEach(function(c) {
-								var auth = c;
-								var data = {
-									type: c.type,
-									hostname: hostname,
-									url: c.url,
-									token: c.token,
-									httpPath: auth.challengeUrl,
-									httpAuth: auth.keyAuthorization,
-									dnsType: "TXT",
-									dnsHost: auth.dnsHost,
-									dnsAnswer: auth.keyAuthorizationDigest
+          var map = {
+            'http-01': '.js-acme-verification-http-01'
+          , 'dns-01': '.js-acme-verification-dns-01'
+          , 'wildcard': '.js-acme-verification-wildcard'
          };
-								//#console.log("claims[i].challenge", data);
+          options.challengePriority = [ 'http-01', 'dns-01' ];
+
+          // TODO make Promise-friendly
+          return PromiseA.all(claims.map(function (claim) {
+            var hostname = claim.identifier.value;
+            return PromiseA.all(claim.challenges.map(function (c) {
+              var keyAuth = BACME.challenges['http-01']({
+                token: c.token
+              , thumbprint: thumbprint
+              , challengeDomain: hostname
+              });
+              return BACME.challenges['dns-01']({
+                keyAuth: keyAuth.value
+              , challengeDomain: hostname
+              }).then(function (dnsAuth) {
+                var data = {
+                  type: c.type
+                , hostname: hostname
+                , url: c.url
+                , token: c.token
+                , keyAuthorization: keyAuth
+                , httpPath: keyAuth.path
+                , httpAuth: keyAuth.value
+                , dnsType: dnsAuth.type
+                , dnsHost: dnsAuth.host
+                , dnsAnswer: dnsAuth.answer
+                };
+
+                console.log('');
+                console.log('CHALLENGE');
+                console.log(claim);
+                console.log(c);
+                console.log(data);
+                console.log('');

-								var $tpl = document.createElement("div");
                if (claim.wildcard) {
                  obj.wildcard.push(data);
-									$tpl.innerHTML = wildTpl;
-									$tpl.querySelector(".js-acme-ver-txt-host").innerHTML =
-										data.dnsHost;
-									$tpl.querySelector(".js-acme-ver-txt-value").innerHTML =
-										data.dnsAnswer;
-									$wildList.appendChild($tpl);
-								} else if (obj[data.type]) {
+                  let verification = $qs(".js-acme-verification-wildcard");
+                  verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname;
+                  verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost;
+                  verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer;
+
+                } else if(obj[data.type]) {
+
                  obj[data.type].push(data);

-									if ("dns-01" === data.type) {
-										$tpl.innerHTML = dnsTpl;
-										$tpl.querySelector(".js-acme-ver-txt-host").innerHTML =
-											data.dnsHost;
-										$tpl.querySelector(".js-acme-ver-txt-value").innerHTML =
-											data.dnsAnswer;
-										$dnsList.appendChild($tpl);
-									} else if ("http-01" === data.type) {
-										$tpl.innerHTML = httpTpl;
-										$tpl.querySelector(
-											".js-acme-ver-file-location"
-										).innerHTML = data.httpPath.split("/").slice(-1);
-										$tpl.querySelector(".js-acme-ver-content").innerHTML =
-											data.httpAuth;
-										$tpl.querySelector(".js-acme-ver-uri").innerHTML =
-											data.httpPath;
-										$tpl.querySelector(".js-download-verify-link").href =
-											"data:text/octet-stream;base64," +
-											window.btoa(data.httpAuth);
-										$tpl.querySelector(
-											".js-download-verify-link"
-										).download = data.httpPath.split("/").slice(-1);
-										$httpList.appendChild($tpl);
+                  if ('dns-01' === data.type) {
+                    let verification = $qs(".js-acme-verification-dns-01");
+                    verification.querySelector(".js-acme-ver-hostname").innerHTML = data.hostname;
+                    verification.querySelector(".js-acme-ver-txt-host").innerHTML = data.dnsHost;
+                    verification.querySelector(".js-acme-ver-txt-value").innerHTML = data.dnsAnswer;
+                  } else if ('http-01' === data.type) {
+                    $qs(".js-acme-ver-file-location").innerHTML = data.httpPath.split("/").slice(-1);
+                    $qs(".js-acme-ver-content").innerHTML = data.httpAuth;
+                    $qs(".js-acme-ver-uri").innerHTML = data.httpPath;
+                    $qs(".js-download-verify-link").href =
+                      "data:text/octet-stream;base64," + window.btoa(data.httpAuth);
+                    $qs(".js-download-verify-link").download = data.httpPath.split("/").slice(-1);
                  }
                }
+
              });
-						});
+
+            }));
+          })).then(function () {

            // hide wildcard if no wildcard
            // hide http-01 and dns-01 if only wildcard
            if (!obj.wildcard.length) {
-							$qs(".js-acme-wildcard-challenges").hidden = true;
+              $qs('.js-acme-wildcard-challenges').hidden = true;
            }
-						if (!obj["http-01"].length) {
-							$qs(".js-acme-challenges").hidden = true;
+            if (!obj['http-01'].length) {
+              $qs('.js-acme-challenges').hidden = true;
            }

-						console.info("[housekeeping] challenges", info.challenges);
-
            updateChallengeType();
-						return steps[i]();
-					})
-					.catch(function(err) {
-						if (err.detail || err.urn) {
-							console.error("(Probably) User Error:");
-							console.error(err);
-							return newAlert(
-								"There was an error, probably with your email or domain:\n" +
-									err.message
-							);
-						}
-						throw err;
+
+            console.log("MAGIC STEP NUMBER in 2 is:", i);
+            steps[i]();
          });
-			})
-			.catch(function(err) {
-				console.error("Step '' Error:");
+
+        });
+      });
+    }).catch(function (err) {
+      console.error('Step \'\' Error:');
      console.error(err, err.stack);
-				return newAlert(
-					"An error happened (but it's not your fault)." +
-						" Email aj@rootprojects.org to let him know that 'order and get challenges' failed."
-				);
+      window.alert("An error happened at Step " + i + ", but it's not your fault. Email aj@rootprojects.org and let him know.");
    });
  };

-	steps[3] = function() {
-		console.info("\n3. Present challenge options");
+  steps[3] = function () {
    updateProgress(1);
    hideForms();
-		$qs(".js-acme-form-challenges").hidden = false;
+    $qs('.js-acme-form-challenges').hidden = false;
  };
-	steps[3].submit = function() {
-		console.info("[submit] 3. Fulfill challenges, fetch certificate");
-
-		var challengePriority = ["dns-01"];
-		if ("http-01" === $qs(".js-acme-challenge-type:checked").value) {
-			challengePriority.unshift("http-01");
+  steps[3].submit = function () {
+    options.challengeTypes = [ 'dns-01' ];
+    if ('http-01' === $qs('.js-acme-challenge-type:checked').value) {
+      options.challengeTypes.unshift('http-01');
    }
-		console.info("[challenge] selected ", challengePriority[0]);
+    console.log('primary challenge type is:', options.challengeTypes[0]);

+    return getAccountKeypair(email).then(function (jwk) {
      // for now just show the next page immediately (its a spinner)
-		steps[i]();
-
-		return getAccountKeypair(info.email).then(function(jwk) {
      // TODO put a test challenge in the list
-			// info.order.claims.push(...)
      // TODO warn about wait-time if DNS
-			return getServerKeypair().then(function(serverJwk) {
-				return acme.orders
-					.complete({
-						account: info.account,
-						accountKeypair: { privateKeyJwk: jwk },
-						order: info.order,
-						domains: info.domains,
-						domainKeypair: { privateKeyJwk: serverJwk },
-						challengePriority: challengePriority,
-						challenges: false,
-						onChallengeStatus: function(details) {
-							$qs(".js-challenge-responses").hidden = false;
-							$qs(".js-challenge-response-type").innerText = details.type;
-							$qs(".js-challenge-response-status").innerText = details.status;
-							$qs(".js-challenge-response-altname").innerText = details.altname;
-						}
-					})
-					.then(function(certs) {
-						return Keypairs.export({ jwk: serverJwk }).then(function(keyPem) {
-							console.info("WINNING!");
-							console.info(certs);
-							var fullChainText = [
-								certs.cert.trim() + "\n",
-								certs.chain + "\n"
-							].join("\n");
-
-							$qs("#js-fullchain").innerHTML = fullChainText;
+      steps[i]();
+		  return getServerKeypair().then(function () {
+        return acme.orders.finalize({
+          account: accountStuff.account
+        , accountKeypair: { privateKeyJwk: jwk }
+        , order: accountStuff.order
+        , domainKeypair: 'TODO'
+        });
+      }).then(function (certs) {
+        console.log('WINNING!');
+        console.log(certs);
+        $qs('#js-fullchain').innerHTML = certs;
        $qs("#js-download-fullchain-link").href =
-								"data:text/octet-stream;base64," + window.btoa(fullChainText);
+          "data:text/octet-stream;base64," + window.btoa(certs);

-							$qs("#js-privkey").innerHTML = keyPem;
+        var wcOpts;
+        var pemName;
+        if (/^R/.test(info.serverJwk.kty)) {
+          pemName = 'RSA';
+          wcOpts = { name: "RSASSA-PKCS1-v1_5", hash: { name: "SHA-256" } };
+        } else {
+          pemName = 'EC';
+          wcOpts = { name: "ECDSA", namedCurve: "P-256" };
+        }
+        return crypto.subtle.importKey(
+          "jwk"
+        , info.serverJwk
+        , wcOpts
+        , true
+        , ["sign"]
+        ).then(function (privateKey) {
+          return window.crypto.subtle.exportKey("pkcs8", privateKey);
+        }).then (function (keydata) {
+          var pem = spkiToPEM(keydata, pemName);
+          $qs('#js-privkey').innerHTML = pem;
          $qs("#js-download-privkey-link").href =
-								"data:text/octet-stream;base64," + window.btoa(keyPem);
+            "data:text/octet-stream;base64," + window.btoa(pem);
+          steps[i]();
+        });
+      });
+    }).then(function () {
      return submitForm();
    });
-					});
-			});
-		});
  };

  // spinner
-	steps[4] = function() {
-		console.info("\n4. Show loading spinner");
+  steps[4] = function () {
    updateProgress(1);
    hideForms();
-		$qs(".js-acme-form-poll").hidden = false;
+    $qs('.js-acme-form-poll').hidden = false;
  };
-	steps[4].submit = function() {
-		console.info("[submit] 4. Order complete");
+  steps[4].submit = function () {
+    console.log('Congrats! Auto advancing...');

-		return steps[i]();
+
+    }).catch(function (err) {
+      console.error(err.toString());
+      window.alert("An error happened in the final step, but it's not your fault. Email aj@rootprojects.org and let him know.");
+    });
  };

-	steps[5] = function() {
-		console.info("\n5. Present certificates (yay!)");
+  steps[5] = function () {
    updateProgress(2);
    hideForms();
-		$qs(".js-acme-form-download").hidden = false;
+    $qs('.js-acme-form-download').hidden = false;
  };
-
-	function init() {
-		$qsa(".js-acme-api-type").forEach(function($el) {
-			$el.addEventListener("change", updateApiType);
-		});
-		updateApiType();
-
-		$qsa(".js-acme-form").forEach(function($el) {
-			$el.addEventListener("submit", function(ev) {
-				ev.preventDefault();
-				return submitForm(ev);
-			});
-		});
-
-		$qsa(".js-acme-challenge-type").forEach(function($el) {
-			$el.addEventListener("change", updateChallengeType);
-		});
+  steps[1]();

  var params = new URLSearchParams(window.location.search);
-		var apiType = params.get("acme-api-type") || "staging-v02";
-		if (params.has("acme-domains")) {
-			$qs(".js-acme-domains").value = params.get("acme-domains");
+  var apiType = params.get('acme-api-type') || "staging-v02";

-			$qsa(".js-acme-api-type").forEach(function(ele) {
-				if (ele.value === apiType) {
+  $qsa('.js-acme-api-type').forEach(function ($el) {
+    $el.addEventListener('change', updateApiType);
+  });
+
+  updateApiType();
+
+  $qsa('.js-acme-form').forEach(function ($el) {
+    $el.addEventListener('submit', function (ev) {
+      ev.preventDefault();
+      submitForm(ev);
+    });
+  });
+
+
+  $qsa('.js-acme-challenge-type').forEach(function ($el) {
+    $el.addEventListener('change', updateChallengeType);
+  });
+
+  if(params.has('acme-domains')) {
+    console.log("acme-domains param: ", params.get('acme-domains'));
+    $qs('.js-acme-domains').value = params.get('acme-domains');
+
+    $qsa('.js-acme-api-type').forEach(function(ele) {
+      if(ele.value === apiType) {
        ele.checked = true;
      }
    });

    updateApiType();
    steps[2]();
-			return submitForm();
-		} else {
-			steps[1]();
-		}
+    submitForm();
  }

-	init();
-	$qs("body").hidden = false;
+  $qs('body').hidden = false;

-	// in the background
-	info.cryptoCheck = testKeypairSupport()
-		.then(function() {
-			console.info("[crypto] self-check: passed");
-		})
-		.catch(function(err) {
-			console.error("[crypto] could not use either RSA nor EC.");
+  return testKeypairSupport().then(function (rsaSupport) {
+    if (rsaSupport) {
+      return true;
+    }
+
+    return testRsaSupport().then(function () {
+      console.info('[crypto] RSA is supported');
+    }).catch(function (err) {
+      console.error('[crypto] could not use either RSA nor EC.');
      console.error(err);
-			window.alert(
-				"Generating secure certificates requires a browser with cryptography support." +
-					"Please consider a recent version of Chrome, Firefox, or Safari."
-			);
+      window.alert("Generating secure certificates requires a browser with cryptography support."
+				+ "Please consider a recent version of Chrome, Firefox, or Safari.");
 			throw err;
    });
-})();
+  });
+}());
--- a/app/styles/main.css
+++ b/app/styles/main.css
@ -15,8 +15,7 @@ a {
    color: #1a1a1a;
 }

-input[type="email"],
-input[type="text"] {
+input[type=email], input[type=text] {
    font-size: 1em;
    padding: 0.444444444em 0.888889em;
    width: 100%;
@ -90,6 +89,7 @@ pre {
    text-align: center;
    position: absolute;
    left: 50%;
+    =: block font-size: ;
    top: 139%;
    font-size: 0.722222222em;
    white-space: nowrap;
@ -111,8 +111,7 @@ pre {
    padding: 1.6em 2.9333em 1.6em 1.6em;
 }

-.js-progress-step-complete > .circle,
-.js-progress-step-started > .circle {
+.js-progress-step-complete > .circle, .js-progress-step-started > .circle {
    background-color: #5bc17f;
 }

@ -128,29 +127,28 @@ pre {
    padding: 1em 0;
 }

-.checkbox-array input[type="checkbox"] {
+.checkbox-array input[type=checkbox] {
    opacity: 0;
    position: absolute;
 }

-.checkbox-array input[type="checkbox"] ~ .icon-checked-box {
+.checkbox-array input[type=checkbox] ~ .icon-checked-box {
    display: none;
 }

-.checkbox-array input[type="checkbox"] ~ .icon-unchecked-box {
+.checkbox-array input[type=checkbox] ~ .icon-unchecked-box {
    display: initial;
 }

-.checkbox-array input[type="checkbox"]:checked ~ .icon-checked-box {
+.checkbox-array input[type=checkbox]:checked ~ .icon-checked-box {
    display: initial;
 }

-.checkbox-array input[type="checkbox"]:checked ~ .icon-unchecked-box {
+.checkbox-array input[type=checkbox]:checked ~ .icon-unchecked-box {
    display: none;
 }

-.checkbox-array .icon-checked-box,
-.checkbox-array .icon-unchecked-box {
+.checkbox-array .icon-checked-box, .checkbox-array .icon-unchecked-box {
    width: 1.333333333em;
    fill: #5bc17f;
    margin-right: 0.666666667em;
@ -163,8 +161,7 @@ pre {
    margin: 0.4em 0;
 }

-.checkbox-array input[type="checkbox"]:focus ~ .icon-checked-box,
-.checkbox-array input[type="checkbox"]:focus ~ .icon-unchecked-box {
+.checkbox-array input[type=checkbox]:focus ~ .icon-checked-box, .checkbox-array input[type=checkbox]:focus ~ .icon-unchecked-box {
    background: #5bc17f52;
 }

@ -184,10 +181,6 @@ pre {
    margin: 1em 0;
 }

-button {
-	cursor: pointer;
-}
-
 .tabbed-selector label {
    width: 50%;
    padding: 0.5em 0;
@ -199,7 +192,7 @@ button {
    text-align: center;
 }

-.tabbed-selector input[type="radio"] {
+.tabbed-selector input[type=radio] {
    display: none;
 }

@ -229,13 +222,7 @@ button {
    border-bottom: solid #d9d9d9 1px;
    right: 0;
    top: 0;
-	background: linear-gradient(
-		45deg,
-		#f7f7f7 0%,
-		#f7f7f7 50%,
-		#ffffff 50%,
-		#ffffff 100%
-	);
+    background: linear-gradient(45deg, #f7f7f7 0%,#f7f7f7 50%,#ffffff 50%,#ffffff 100%);
 }

 .file-ver-info-header {
@ -269,6 +256,8 @@ button {
    word-break: break-all;
 }

+
 .cert-download-container {
    margin: 0 -31%;
 }
+
--- a/index.html
+++ b/index.html
@ -1,137 +1,73 @@
 <html>
  <head>
    <title>Greenlock&trade;</title>
-		<meta
-			property="og:image"
-			content="https://greenlock.domains/img/greenlock-mark-400x400.png"
-		/>
-		<link href="styles/main.css" rel="stylesheet" />
+    <meta property="og:image" content="https://greenlock.domains/img/greenlock-mark-400x400.png" />
+    <link href="styles/main.css" rel="stylesheet">
    <style>
      @font-face {
-				font-family: "Source Sans Pro";
+        font-family: 'Source Sans Pro';
        font-style: normal;
        font-display: block;
        font-weight: 400;
-				src: local("Source Sans Pro Regular"), local("SourceSansPro-Regular"),
-					url(./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2) format("woff2");
-				unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6,
-					U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
-					U+2212, U+2215, U+FEFF, U+FFFD;
+        src: local('Source Sans Pro Regular'), local('SourceSansPro-Regular'), url(./fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2) format('woff2');
+        unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
      }
      @font-face {
-				font-family: "Source Sans Pro";
+        font-family: 'Source Sans Pro';
        font-style: normal;
        font-weight: 700;
        font-display: block;
-				src: local("Source Sans Pro Bold"), local("SourceSansPro-Bold"),
-					url(./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2)
-						format("woff2");
-				unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6,
-					U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193,
-					U+2212, U+2215, U+FEFF, U+FFFD;
+        src: local('Source Sans Pro Bold'), local('SourceSansPro-Bold'), url(./fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2) format('woff2');
+        unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+2000-206F, U+2074, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
      }
    </style>
-		<link
-			rel="preload"
-			href="./app/fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
-		<link
-			rel="preload"
-			href="./app/fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
-		<link
-			rel="prefetch"
-			href="./app/fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2"
-			as="font"
-			crossorigin="anonymous"
-		/>
-		<link rel="prefetch" href="./app/js/bluecrypt-acme.js" as="script" />
-		<link rel="prefetch" href="./app/js/greenlock.js" as="script" />
-		<link rel="prefetch" href="./js/app.js" as="script" />
+    <link rel="preload" href="./app/fonts/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdu.woff2" as="font" crossorigin="anonymous">
+    <link rel="preload" href="./app/fonts/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2" as="font" crossorigin="anonymous">
+
+    <link rel="prefetch" href="./app/fonts/HI_SiYsKILxRpg3hIP6sJ7fM7PqlPevW.woff2" as="font" crossorigin="anonymous">
+    <link rel="prefetch" href="./app/js/app.js">
+    <link rel="prefetch" href="./app/js/bacme.js">
+    <link rel="prefetch" href="./app/js/pkijs.org/v1.3.33/common.js">
+    <link rel="prefetch" href="./app/js/pkijs.org/v1.3.33/asn1.js">
+    <link rel="prefetch" href="./app/js/pkijs.org/v1.3.33/x509_schema.js">
+    <link rel="prefetch" href="./app/js/pkijs.org/v1.3.33/x509_simpl.js">
+    <link rel="prefetch" href="./app/js/browser-csr/v1.0.0-alpha/csr.js">
  </head>
  <body class="js-app-ready">
    <script>
-			document.querySelector("body").classList.remove("js-app-ready");
+      document.querySelector('body').classList.remove("js-app-ready");
    </script>
    <div class="column-container wide">
+
      <div class="column-row">
-				<img alt="Greenlock logo" src="img/greenlock-146.png" />
+        <img src="img/greenlock-146.png">
      </div>
      <div class="column-row">
        <h1>Get the green lock for your website</h1>
      </div>
      <div class="column-row">
        <div class="js-javascript-warning">
-					Greenlock will process the CSR in the browser and request the
-					certificates directly from letsencrypt.org. Please enable Javascript
-					before continuing.
+          Greenlock will process the CSR in the browser and request the certificates directly from letsencrypt.org.  Please enable Javascript before continuing.
        </div>
-				<form id="js-acme-form" action="./app/" method="GET">
+        <form id="js-acme-form" action="./app/" method=>
          <div class="domain-psuedo-input">
-						<span class="secure-green">Secure</span> |
-						<span class="secure-green">https:</span>//<input
-							aria-label="domains to secure"
-							id="acme-domains"
-							type="text"
-							name="acme-domains"
-							placeholder="Your domain name"
-							required
-						/>
+            <span class="secure-green">Secure</span> | <span class="secure-green">https:</span>//<input aria-label="domains to secure" id="acme-domains" type="text" name="acme-domains" placeholder="Your domain name" required>
          </div>
          <button type="submit">Go</button>
-					<div class="domain-subtext">
-						Domain, subdomain, or wildcard domain
-					</div>
+          <div class="domain-subtext">Domain, subdomain, or wildcard domain</div>

          <div class="acme-advanced-fields">
-						<label
-							><input
-								name="acme-api-type"
-								type="radio"
-								value="v02"
-								checked
-								required
-							/>
+            <label><input name="acme-api-type" type="radio" value="v02" checked required>
              Production
            </label>
-						<label
-							><input
-								name="acme-api-type"
-								type="radio"
-								value="staging-v02"
-								required
-							/>
-							Testing</label
-						>
-						<input
-							id="js-acme-api-url"
-							type="url"
-							placeholder="ACME directory url"
-						/>
-						<br />
-						API Compatibility: Let's Encrypt v2 / ACME draft 15
+            <label><input name="acme-api-type" type="radio" value="staging-v02" required>
+              Testing</label>
+            <input id="js-acme-api-url" type="url" placeholder="ACME directory url">
            <div>
-							<br />
-							A
-							<a href="https://rootprojects.org/" target="_blank">Root</a>
-							Project |
-							<a
-								href="https://git.coolaj86.com/coolaj86/greenlock.html"
-								target="_blank"
-								>View Source</a
-							>
-							(git) |
-							<a href="https://rootprojects.org/legal/#terms" target="_blank"
-								>Terms of Service</a
-							>
-							|
-							<a href="https://rootprojects.org/legal/#privacy" target="_blank"
-								>Privacy Policy</a
-							>
+              A <a href="https://rootprojects.org/" target="_blank">Root</a> Project
+              | <a href="https://git.coolaj86.com/coolaj86/greenlock.html" target="_blank">View Source</a> (git)
+              | <a href="https://rootprojects.org/legal/#terms" target="_blank">Terms of Service</a>
+              | <a href="https://rootprojects.org/legal/#privacy" target="_blank">Privacy Policy</a>
            </div>
          </div>
        </form>
@ -139,9 +75,7 @@
      <div class="column-row">
        <div class="why-you-need">
          <h2>Why you need HTTPS</h2>
-					SSL Certificates are required for secure login, accepting payments,
-					and for browsers like Google Chrome to stop showing security warnings
-					to your users.
+          SSL Certificates are required for secure login, accepting payments, and for browsers like Google Chrome to stop showing security warnings to your users.
        </div>
      </div>
      <!-- or
@ -153,18 +87,13 @@
      <script src="./js/app.js"></script>

      <!-- Global site tag (gtag.js) - Google Analytics -->
-			<script
-				async
-				src="https://www.googletagmanager.com/gtag/js?id=UA-118745161-2"
-			></script>
+      <script async src="https://www.googletagmanager.com/gtag/js?id=UA-118745161-2"></script>
      <script>
        window.dataLayer = window.dataLayer || [];
-				function gtag() {
-					dataLayer.push(arguments);
-				}
-				gtag("js", new Date());
+        function gtag(){dataLayer.push(arguments);}
+        gtag('js', new Date());

-				gtag("config", "UA-118745161-2");
+        gtag('config', 'UA-118745161-2');
      </script>
    </div>
  </body>
--- a/install.bat
+++ b/install.bat
@ -1,4 +0,0 @@
-
-mkdir -p app\js\
-bitsadmin.exe /transfer "JobName" https://rootprojects.org/acme/bluecrypt-acme.js "%cd%\app\js\bluecrypt-acme.js"
-bitsadmin.exe /transfer "JobName" https://rootprojects.org/acme/bluecrypt-acme.min.js "%cd%\app\js\bluecrypt-acme.min.js"
--- a/install.sh
+++ b/install.sh
@ -1,7 +1,14 @@
 #!/bin/bash

-mkdir -p app/js/
-pushd app/js/
-  wget -c https://rootprojects.org/acme/bluecrypt-acme.js
-  wget -c https://rootprojects.org/acme/bluecrypt-acme.min.js
+mkdir -p app/js/pkijs.org/v1.3.33/
+pushd app/js/pkijs.org/v1.3.33/
+  wget -c https://raw.githubusercontent.com/PeculiarVentures/PKI.js/41b63af760cacb565dd850fb3466ada4ca163eff/org/pkijs/common.js
+  wget -c https://raw.githubusercontent.com/PeculiarVentures/PKI.js/41b63af760cacb565dd850fb3466ada4ca163eff/org/pkijs/x509_schema.js
+  wget -c https://raw.githubusercontent.com/PeculiarVentures/PKI.js/41b63af760cacb565dd850fb3466ada4ca163eff/org/pkijs/x509_simpl.js
+  wget -c https://raw.githubusercontent.com/PeculiarVentures/ASN1.js/f7181c21c61e53a940ea24373ab489ad86d51bc1/org/pkijs/asn1.js
+popd
+
+mkdir -p app/js/browser-csr/v1.0.0-alpha/
+pushd app/js/browser-csr/v1.0.0-alpha/
+  wget -c https://git.coolaj86.com/coolaj86/browser-csr.js/raw/commit/01cdc0e91b5bf03f12e1b25b4129e3cde927987c/csr.js
 popd
--- a/js/app.js
+++ b/js/app.js
@ -1,39 +1,30 @@
-(function() {
-	"use strict";
+(function () {
+'use strict';

-	var $qs = function(s) {
-		return window.document.querySelector(s);
-	};
+  var $qs = function (s) { return window.document.querySelector(s); };
+  var $qsa = function (s) { return window.document.querySelectorAll(s); };

-	$qs(".js-javascript-warning").hidden = true;
-
-	var apiUrl = "https://acme-{{env}}.api.letsencrypt.org/directory";
+  $qs('.js-javascript-warning').hidden = true;

+  var apiUrl = 'https://acme-{{env}}.api.letsencrypt.org/directory';
  function updateApiType() {
    var formData = new FormData($qs("#js-acme-form"));

-		console.log("ACME api type radio:");
+    console.log('ACME api type radio:');

    var value = formData.get("acme-api-type");
-		$qs("#js-acme-api-url").value = apiUrl.replace(/{{env}}/g, value);
+    $qs('#js-acme-api-url').value = apiUrl.replace(/{{env}}/g, value);
  }
-
-	$qs("#js-acme-form").addEventListener("change", updateApiType);
-	//$qs('#js-acme-form').addEventListener('submit', prettyRedirect);
+  $qs('#js-acme-form').addEventListener('change', updateApiType);

  updateApiType();
  try {
-		document.fonts
-			.load()
-			.then(function() {
-				$qs("body").classList.add("js-app-ready");
-			})
-			.catch(function(e) {
-				$qs("body").classList.add("js-app-ready");
+    document.fonts.load().then(function() {
+      $qs('body').classList.add("js-app-ready");
+    }).catch(function(error) {
+      $qs('body').classList.add("js-app-ready");
    });
-	} catch (e) {
-		setTimeout(function() {
-			$qs("body").classList.add("js-app-ready");
-		}, 200);
+  } catch(e) {
+    setTimeout(function() {$qs('body').classList.add("js-app-ready");}, 200);
  }
-})();
+}());
--- a/legal.html
+++ b/legal.html
@ -1,315 +1,201 @@
-<!DOCTYPE html>
-<html>
-	<head>
-		<title>Root Legal</title>
-	</head>
-	<body>
-		<h1>Greetings!</h1>
+<h1>Greetings!</h1>

-		<p>
-			I, AJ ONeal, am not a big fan of legalize, but I am a fan of communicating
-			clearly. I hope that this accomplish both defining some legal boundaries
-			as well as communicating in a friendly and clear way, at least to the
-			degree that suits our needs for the current stage of our products and
-			services.
-		</p>
+<p>I, AJ ONeal, am not a big fan of legalize, but I am a fan of communicating
+clearly. I hope that this accomplish both defining some legal boundaries as well
+as communicating in a friendly and clear way, at least to the degree that suits
+our needs for the current stage of our products and services.

-		<p>
-			This is important because it is our intent to create sustainable open
-			source projects, which means that we do want to create brand value, grow
-			community, and, eventually, be able to work full time on creating more
-			great software and services.
-		</p>
+<p>This is important because it is our intent to create sustainable open source
+projects, which means that we do want to create brand value, grow community,
+and, eventually, be able to work full time on creating more great software and services.

-		<p>
-			If you'd like to contact me, especially if you feel that I (or we) have
-			made a mistake in how we operate, please do so:
-		</p>
+<p>If you'd like to contact me, especially if you feel that I (or we) have made
+a mistake in how we operate, please do so:

-		<ul>
+<ul>
  <li><a href="mailto:coolaj86@gmail.com">coolaj86@gmail.com</a></li>
  <li><a href="tel:+13852360466">+1 (385) 236-0466</a></li>
  <li><a href="http://coolaj86.com">https://coolaj86.com</a></li>
-		</ul>
+</ul>

-		<h1>Contents</h1>
-		<p>Here's what I've worked through so far:</p>
+<h1>Contents</h1>
+<p>Here's what I've worked through so far:

-		<ul>
+<ul>
  <li><a href="#greenlock">Greelock Domains</a></li>
  <li><a href="#licensing">Licensing</a></li>
  <li><a href="#terms">Terms of Service</a></li>
  <li><a href="#trademark">Trademark</a></li>
  <li><a href="#privacy">Privacy</a></li>
-		</ul>
+</ul>

-		<h1 id="greenlock">Greenlock Domains&trade;</h1>
+<h1 id="greenlock">Greenlock Domains&trade;</h1>

-		<p>
-			Greenlock Domains is a service provided by
-			<em
-				><a href="https://coolaj86.com">AJ</a>, Brian,
-				<a href="https://jshaver.net">John</a>, &amp; Josh</em
-			>
-			(collectively <a href="https://therootcompany.com">Root</a>) for automated
-			TLS, SSL, and HTTPS.
-		</p>
+<p>Greenlock Domains is a service provided by
+<em><a href="https://coolaj86.com">AJ</a>, Brian,
+  <a href="https://jshaver.net">John</a>, &amp; Josh</em>
+(collectively <a href="https://therootcompany.com">Root</a>)
+for automated TLS, SSL, and HTTPS.

-		<ul>
-			<li>
-				<a href="https://greenlock.domains" target="_blank">
-					https://greenlock.domains</a
-				>
-			</li>
+<ul>
+  <li><a href="https://greenlock.domains" target="_blank">
+    https://greenlock.domains</a></li>

-			<li>
-				<a
-					href="https://git.coolaj86.com/coolaj86/greenlock-express.js"
-					target="_blank"
-				>
-					https://git.coolaj86.com/coolaj86/greenlock-express.js</a
-				>
-			</li>
+  <li><a href="https://git.coolaj86.com/coolaj86/greenlock-express.js" target="_blank">
+    https://git.coolaj86.com/coolaj86/greenlock-express.js</a></li>

-			<li>
-				<a
-					href="https://git.coolaj86.com/coolaj86/greenlock.js"
-					target="_blank"
-				>
-					https://git.coolaj86.com/coolaj86/greenlock.js</a
-				>
-			</li>
+  <li><a href="https://git.coolaj86.com/coolaj86/greenlock.js" target="_blank">
+    https://git.coolaj86.com/coolaj86/greenlock.js</a></li>

-			<li>
-				<a
-					href="https://git.coolaj86.com/coolaj86/greenlock.html"
-					target="_blank"
-				>
-					https://git.coolaj86.com/coolaj86/greenlock.html</a
-				>
-			</li>
-		</ul>
+  <li><a href="https://git.coolaj86.com/coolaj86/greenlock.html" target="_blank">
+    https://git.coolaj86.com/coolaj86/greenlock.html</a></li>
+</ul>

-		<p>
-			Greenlock Domains is an important product / service combo to us because
-			it's a huge milestone on the path to a more decentralized web. We believe
-			in
-			<em>ownership</em> and <em>control</em> and we're building a
-			<a href="https://therootcompany.com">Home Server</a> because we envision a
-			world in which everyone is empowered to make the choice of whether to rent
-			or own their stuff.
-		</p>
+<p>Greenlock Domains is an important product / service combo to us
+because it's a huge milestone on the path to a more decentralized web.
+We believe in <em>ownership</em> and <em>control</em> and we're
+building a <a href="https://therootcompany.com">Home Server</a>
+because we envision a world in which everyone is empowered to make
+the choice of whether to rent or own their stuff.

-		<p>
-			If we don't do this, well, with the way the cloud is headed, renting may
-			be the only option in the future.
-		</p>
+<p>If we don't do this, well, with the way the cloud is headed,
+renting may be the only option in the future.

-		<p>We need <em>Root</em> because we want ownership.</p>
+<p>We need <em>Root</em> because we want ownership.

-		<p>
-			If at any time you feel that any of our messaging or practices are in
-			conflict with our mission or these values, please let us know.
-		</p>
+<p>If at any time you feel that any of our messaging or practices
+are in conflict with our mission or these values, please let us know.

-		<h1 id="licensing">Licensing</h1>
+<h1 id="licensing">Licensing</h1>

-		<p>
-			Each of our products comes with its own LICENSE file and the license(s)
-			may alse be in some sort of manifest file (such as package.json).
-		</p>
+<p>Each of our products comes with its own LICENSE file and the license(s)
+may alse be in some sort of manifest file (such as package.json).

-		<p>
-			We typically use the MIT and Apache-2.0 licenses for libraries that we
-			actively want others to copy, modify, use and redistribute.
-		</p>
+<p>We typically use the MIT and Apache-2.0 licenses for libraries that we
+actively want others to copy, modify, use and redistribute.

-		<p>
-			We typically use ISC and MPL-2.0 with products for which we're a little
-			more concerned about branding or about which we have particularly strong
-			opinions.
-		</p>
+<p>We typically use ISC and MPL-2.0 with products for which we're a little more
+concerned about branding or about which we have particularly strong opinions.

-		<p>
-			Although we do keep some of our software proprietary and we do use
-			trademarks, because we believe in empowerment and choice we do our best to
-			provide usable self-service forms of our products and services for
-			personal use.
-		</p>
+<p>Although we do keep some of our software proprietary and we do use trademarks,
+because we believe in empowerment and choice we do our best to provide usable
+self-service forms of our products and services for personal use.

-		<p>
-			If at any time you feel that our Licensing is in conflict with our mission
-			or values, please let us know.
-		</p>
+<p>If at any time you feel that our Licensing is in conflict with our mission or values,
+please let us know.

-		<h1 id="terms">Terms of Service</h1>
+<h1 id="terms">Terms of Service</h1>

-		<p>
-			We want to make the world a better place. Everyone has a different
-			definition of what "a better place" means, so the purpose of our terms is
-			to rule out some things that we think makes the world (and particularly
-			our world) a worse place:
-		</p>
+<p>We want to make the world a better place.
+Everyone has a different definition of what "a better place" means,
+so the purpose of our terms is to rule out some things that
+we think makes the world (and particularly our world) a worse place:

-		<p>
-			You agree that you will use the Greenlock&trade; service, code, libraries,
-			documentation, etc (provided by <a href="#greenlock">us</a>) primarily for
-			securing network connections for yourself, your customers, on your and
-			your customer's devices on internets, intranets, and... other nets.
-		</p>
+<p>You agree that you will use the Greenlock&trade; service, code, libraries,
+documentation, etc (provided by <a href="#greenlock">us</a>)
+primarily for securing network connections for yourself, your customers,
+on your and your customer's devices on internets, intranets, and... other nets.

-		<p>
-			You agree that you will take reasonable measures to keep up-to-date with
-			security releases.
-		</p>
+<p>You agree that you will take reasonable measures to keep up-to-date with security
+releases.

-		<p>
-			You agree to not use our products or services in a way that would cause
-			unusual or undue burden on our servers or services, our partners servers
-			or services, or our customers servers or services, or in a way that harms
-			or misrepresents the reputation or brand value (including causing brand
-			confusion) of the aforementioned parties (or really anybody).
-		</p>
+<p>You agree to not use our products or services in a way that would cause unusual
+or undue burden on our servers or services, our partners servers or services, or our
+customers servers or services, or in a way that harms or misrepresents the reputation
+or brand value (including causing brand confusion) of the aforementioned parties
+(or really anybody).

-		<p>
-			This is not to say that you can't publicly have a negative opinion, but
-			don't bite the hand that feeds and don't be vicious or misrepresentative.
-		</p>
+<p>This is not to say that you can't publicly have a negative opinion, but don't
+bite the hand that feeds and don't be vicious or misrepresentative.

-		<p>
-			If you have a use case that may be in violation of these terms
-			(particularly the part about undue burden), but you feel contributes to
-			making the world a better place, we're here to help (assuming it also
-			aligns with our values). Although it may not be appropriate to use our
-			services, but perhaps we can help you with a solution based on our
-			no-cost, low-cost or open source products.
-		</p>
+<p>If you have a use case that may be in violation of these terms (particularly
+the part about undue burden), but you feel contributes to making the world a better
+place, we're here to help (assuming it also aligns with our values).
+Although it may not be appropriate to use our services, but perhaps we can help
+you with a solution based on our no-cost, low-cost or open source products.

-		<p>
-			If at any time you feel that our Terms of Service are in conflict with our
-			mission or values, please let us know.
-		</p>
+<p>If at any time you feel that our Terms of Service are in conflict with our
+mission or values, please let us know.

-		<h1 id="trademark">Trademark</h1>
+<h1 id="trademark">Trademark</h1>

-		<p>
-			"Greenlock" and the "green G lock" mark are Trademarks of
-			<a href="https://coolaj86.com" target="_blank">AJ ONeal</a>.
-		</p>
+<p>"Greenlock" and the "green G lock" mark are Trademarks of
+<a href="https://coolaj86.com" target="_blank">AJ ONeal</a>.

-		<p>
-			We'll be coming out with a brand guide as to how you should use the marks.
-			In the meantime: don't change the proportions, colors (excepting the case
-			of greyscale and black and white).
-		</p>
+<p>We'll be coming out with a brand guide as to how you should use
+the marks. In the meantime: don't change the proportions, colors
+(excepting the case of greyscale and black and white).

-		<p>
-			It is appropriate to use the trademark in a way that promotes the brand
-			with proper attribution, linking to the official project repositories,
-			etc.
-		</p>
+<p>It is appropriate to use the trademark in a way that promotes the
+brand with proper attribution, linking to the official project repositories, etc.

-		<p>
-			It is appropriate use the name greenlock in a plugin for Greenlock&trade;,
-			as long as it is clear that it is a community contribution.
-		</p>
+<p>It is appropriate use the name greenlock in a plugin for Greenlock&trade;,
+as long as it is clear that it is a community contribution.

-		<p>
-			If you create a "hard" fork of our code or any products or services, you
-			should give your fork its own name, and not use ours. That sound, we
-			gladly welcome your suggestiosn and pull requests.
-		</p>
+<p>If you create a "hard" fork of our code or any products or services,
+you should give your fork its own name, and not use ours.
+That sound, we gladly welcome your suggestiosn and pull requests.

-		<p>
-			If you mirror our code you should make it clear that it is a mirror and
-			link to the official repository. in association with usand the disclose
-			that you use Greenlock
-		</p>
+<p>If you mirror our code you should make it clear that it is a mirror
+and link to the official repository.
+in association with usand the disclose that you use Greenlock

-		<p>
-			If at any time you feel that our Trademark policies are in conflict with
-			our values, please let us know.
-		</p>
+<p>If at any time you feel that our Trademark policies are in conflict with our
+values, please let us know.

-		<h1 id="privacy">Privacy Policy</h1>
+<h1 id="privacy">Privacy Policy</h1>

-		<p>What we collect and (more importantly) <em>Why</em>:</p>
+<p>What we collect and (more importantly) <em>Why</em>:

-		<p><strong>Name</strong>:</p>
-		<p>
-			In the cases that we collect your name, it's because we want to know how
-			to address you. All four of us want to be personable if and when we reach
-			out.
-		</p>
+<p><strong>Name</strong>:
+<p>In the cases that we collect your name, it's because we want to know how to address you.
+All four of us want to be personable if and when we reach out.

-		<p><strong>Email</strong>:</p>
-		<p>
-			There are three main purposes for which we may use your email address:
-		</p>
+<p><strong>Email</strong>:
+<p>There are three main purposes for which we may use your email address:

-		<p>
-			1. A one-time outreach to ask if you were able to do what you intended to
-			do. We want to make a great product. Although open source projects
-			traditionally have a <em>reactive</em> approach to communication (i.e. you
-			file a bug and wait for a response), we believe that creating sustainable
-			open source requires a <em>proactive</em> approach.
-		</p>
+<p>1. A one-time outreach to ask if you were able to do what you intended to do.
+We want to make a great product. Although open source projects traditionally have
+a <em>reactive</em> approach to communication (i.e. you file a bug and wait for a response),
+we believe that creating sustainable open source requires a <em>proactive</em> approach.

-		<p>
-			2. Security and legal notifications. It's important that we have a way to
-			contact you if we've made a mistake or discover a mistake that needs to be
-			addressed. This may include vulnerabilities as well as mandatory upgrades
-			(such as when a significant change to the Let's Encrypt API is made).
-			Making sure that our products work and are secure aligns with our values
-			and contributes to our brand identity.
-		</p>
+<p>2. Security and legal notifications. It's important that we have a way to contact you
+if we've made a mistake or discover a mistake that needs to be addressed. This
+may include vulnerabilities as well as mandatory upgrades (such as when a
+significant change to the Let's Encrypt API is made). Making sure that our products
+work and are secure aligns with our values and contributes to our brand identity.

-		<p>
-			3. Opt-in updates. Many of you want to know when we have significant
-			feature updates or when we have something that we believe is really
-			valuable to share. We've created an opt-in avenue for that. And you can
-			always opt-out as well.
-		</p>
+<p>3. Opt-in updates. Many of you want to know when we have significant feature updates
+or when we have something that we believe is really valuable to share. We've created an
+opt-in avenue for that. And you can always opt-out as well.

-		<p><strong>Telemetry</strong>:</p>
-		<p>
-			We believe that the current open source model needs improvement - it often
-			relies heavily on large centralized platforms which aggregate a lot of
-			user information for the platform without appropriately targeting the
-			relationship between authors and users of projcts (i.e. npm, github, etc).
-			We believe that making open source sustainable means a greater focus on
-			empowering authors and users. We've learned from other projects (Caddy,
-			Heroku, and others) which use telemetry as part of a proactive approach to
-			open source and we believe that it can be a great avenue for us to be
-			proactive as well.
-		</p>
+<p><strong>Telemetry</strong>:
+<p>We believe that the current open source model needs improvement - it often
+relies heavily on large centralized platforms which aggregate a lot of user
+information for the platform without appropriately targeting the relationship
+between authors and users of projcts (i.e. npm, github, etc). We believe that
+making open source sustainable means a greater focus on empowering authors
+and users. We've learned from other projects (Caddy, Heroku, and others) which
+use telemetry as part of a proactive approach to open source and we believe that
+it can be a great avenue for us to be proactive as well.

-		<p>
-			We may use telemetry about operating system, browser, node version, code
-			version, and other system-level information to better understand how we
-			can serve our users (you) and proactively solve problems that we might not
-			otherwise hear about. For example, if we see many page visits in a certain
-			browser (or installs with a new version of node), but few successful
-			registrations, we know that something is wrong.
-		</p>
+<p>We may use telemetry about operating system, browser, node version, code version,
+and other system-level information to better understand how we can serve our users (you)
+and proactively solve problems that we might not otherwise hear about. For example, if
+we see many page visits in a certain browser (or installs with a new version of node),
+but few successful registrations, we know that something is wrong.

-		<p><strong>Other</strong>:</p>
-		<p>
-			We also use Google Analytics on our web sites for basic functionality.
-			Other than that, nothing else comes to mind right now. As we consider what
-			we will do in the future, it will be measured against our mission and
-			values. We never want to come across as spammy or forceful. We want to do
-			things that help us build our brand, acknowledge our customers; things
-			that are proactive, and that promote sustainable source.
-		</p>
+<p><strong>Other</strong>:
+<p>We also use Google Analytics on our web sites for basic functionality.
+Other than that, nothing else comes to mind right now.
+As we consider what we will do in the future, it will be measured against our mission and values.
+We never want to come across as spammy or forceful. We want to do things that help us build
+our brand, acknowledge our customers; things that are proactive, and that
+promote sustainable source.

-		<p>
-			If at any time you feel that our Privacy policy is in conflict with our
-			mission or values, please let us know.
-		</p>
+<p>If at any time you feel that our Privacy policy is in conflict with our mission or values,
+please let us know.

-		<br />
-		<br />
-		<p>Copyright 2018 AJ ONeal</p>
-	</body>
-</html>
+<br>
+<br>
+<p>Copyright 2018 AJ ONeal
--- a/styles/main.css
+++ b/styles/main.css
@ -10,7 +10,7 @@ body {
  margin-top: 5.777777778em;
  min-height: 36em;
  font-size: 18px;
-	font-family: "Source Sans Pro", sans-serif;
+  font-family: 'Source Sans Pro', sans-serif;
  font-stretch: normal;
  line-height: 1.33;
  letter-spacing:  -0.4px;
@ -46,7 +46,6 @@ button {
  color: white;
  height: 40px;
  line-height: 1.13;
-	cursor: pointer;
 }

 .acme-advanced-fields {
@ -69,7 +68,7 @@ input#acme-domains:before {

 .domain-psuedo-input {
  display: inline-block;
-	margin-right: 0.6666667em;
+  margin-right: .6666667em;
  border: solid #d9d9d9 1px;
  border-radius: 2px;
  padding: 0.44444444em;
@ -112,4 +111,5 @@ body.js-app-ready {
  margin: 0.6em;
  padding: 0.5em 1em;
  width: 30em;
-}
+ }
+
Author	SHA1	Message	Date
AJ ONeal	7484ffcd11	WIP: moving to bluecrypt	2019-05-19 01:10:49 -06:00
AJ ONeal	98c8db8973	WIP: breaking into smaller pieces	2019-05-19 00:21:26 -06:00
AJ ONeal	8ce44bc414	rebrand Root	2019-04-09 07:50:34 +00:00
AJ ONeal	ab67741604	rebrand Root	2019-04-09 07:46:59 +00:00
AJ ONeal	b7dd224426	update to rootprojects.org	2019-04-08 19:51:33 +00:00
John Shaver	65974b57c1	Merge branch 'live-site' of ssh://git.coolaj86.com:22042/coolaj86/greenlock.html into live-site	2019-03-16 21:58:16 -07:00
John Shaver	b1fc2bcc14	fix wildcard certificate verification	2019-03-16 21:51:41 -07:00
AJ ONeal	8d31bf7754	GA -> web-only	2018-11-16 05:50:15 +00:00
AJ ONeal	1c57a342d0	reposition	2018-11-15 06:57:35 +00:00
AJ ONeal	f27b386ba4	update legal link (and link to 'us')	2018-11-15 06:55:10 +00:00
AJ ONeal	55a30888ff	add privacy policy	2018-11-15 06:50:37 +00:00
AJ ONeal	95e807be73	test key support BEFORE creating keys	2018-11-10 18:50:05 +00:00
AJ ONeal	268f83b49e	tested working in firefox	2018-11-10 09:18:59 +00:00
AJ ONeal	09ff0b3adc	use the opts we built, duh	2018-11-10 07:58:02 +00:00
AJ ONeal	8a7183ed9c	don't eager assign CSR	2018-11-10 07:20:53 +00:00
AJ ONeal	a7462db2c8	test ecdsa support, spaces for whitespace	2018-11-09 21:21:40 -07:00
AJ ONeal	2cc5a41268	lint and fix and use domains.generateKeypair	2018-11-09 21:05:53 -07:00
AJ ONeal	d63d8e1aed	lint	2018-11-09 20:41:41 -07:00
John Shaver	6f188cefb8	Now uses RSA keys for firefox browser.	2018-11-09 13:57:59 -08:00
AJ ONeal	bddf85dfe6	Merge branch 'live-site' of ssh://git.coolaj86.com:22042/coolaj86/greenlock.html into live-site	2018-09-17 05:14:03 +00:00
AJ ONeal	c6052bcf73	update contact info	2018-09-17 05:13:55 +00:00
John Shaver	78515f165c	Fix legal link and preloading files	2018-09-12 09:29:04 -07:00
John Shaver	68253cbe54	You can now tab select check boxes.	2018-09-10 23:39:49 -07:00
John Shaver	9143545389	Added download links for certs and changed some formatting.	2018-08-21 14:15:09 -07:00
John Shaver	3e865a2fb7	Added styling to key/cert page.	2018-08-21 13:10:18 -07:00
John Shaver	6ce81beaec	Fixed link to hosted app.	2018-08-21 13:06:27 -07:00
John Shaver	c6c06b06f0	First 2 steps down.	2018-08-17 22:21:12 -07:00
John Shaver	a32287c3f8	Added a terrible temorary fix to the tables.	2018-08-16 20:24:51 -07:00
John Shaver	6a05569ab5	Some style chages on first/second step.	2018-08-16 20:01:51 -07:00
John Shaver	c3c9696799	Progress bar is in place.	2018-08-11 22:15:06 -07:00
John Shaver	b86074920a	Added Javascript needed warning.	2018-07-26 14:36:47 -07:00
John Shaver	8610baf0e0	fixed blink on loading strait to step2	2018-07-26 13:38:07 -07:00
John Shaver	3cfbc9339b	Tied in new homepage with the rest of the app.	2018-07-26 12:55:31 -07:00
John Shaver	62f3d28a71	Some styling updates and created a separate front page.	2018-07-23 14:23:10 -07:00
John Shaver	430b589038	Center, shrink logo.	2018-07-20 14:41:34 -07:00
John Shaver	6d3c3a9e61	No longer fails due to new challenge types.	2018-07-19 15:50:27 -07:00
AJ ONeal	61b2c76822	Merge branch 'master' into live-site	2018-05-14 19:31:54 +00:00
AJ ONeal	d0ea6822ea	Merge branch 'master' into live-site	2018-05-14 19:26:52 +00:00
AJ ONeal	4bfef46295	Merge branch 'master' into live-site	2018-05-14 18:56:59 +00:00
AJ ONeal	42a589f5c0	add google analytics	2018-05-14 18:55:21 +00:00
AJ ONeal	5d07cec7a3	Merge branch 'master' into live-site	2018-05-14 18:54:05 +00:00
AJ ONeal	ceb109e652	fix typo	2018-05-05 04:42:17 +00:00
AJ ONeal	ed2739cb20	add line break	2018-05-05 00:01:54 +00:00
AJ ONeal	2be09788ce	Merge branch 'master' into live-site	2018-05-05 00:01:03 +00:00
AJ ONeal	3854e6b430	save contact	2018-05-04 23:59:05 +00:00