// Use this method for listing all server certificates when the server is
    // running, i.e. AFTER TLSSetupServer has been called, and when you don't
    // want to close the server just to manage certificates.
    // Information about the certificates will be added to aList on the format
    // '%s=%s', where the first string is the OID of the subject public key,
    // and the second string is the DNS name (either Subject CN or
    // SubjectAltName DNSName). There might be duplicates. The return value is
    // the number entries that where added to aList.
    function ListTLSServerCertificates(aList: TStrings): Integer;
    // Use this method for validation of server certificates when the server is
    // running, i.e. AFTER TLSSetupServer has been called, and when you don't
    // want to close the server just to manage certificates.
    // The aExpirationDate is the cut-off date time for the notAfter of the
    // server certificate. Information about the soon to expire certificates
    // will be added to aList on the format '%s=%s', where the first string
    // is the OID of the subject public key, and the second string is the
    // DNS name (either Subject CN or SubjectAltName DNSName). There might be
    // be duplicates. The return value is the number entries that where added
    // to aList.
    function FindExpiringTLSServerCertificates(aExpirationDate: TDateTime; aList: TStrings): Integer;
    // Use this method for replacing a server certificate assigned by
    // TLSSetupServer, without having to close the server and reload all
    // keys and certificates from file. The new certificate must have been added
    // to MyCerts prior to the call tp ReplaceTLSServerCertificate, e.g. by a
    // call to ImportFromPFX
    procedure ReplaceTLSServerCertificate(const aCert: iCertificate; const aPriv: iMPPrivateKey);
    procedure AddTLSAcmeALPN(const aPriv: iMPPrivateKey;
                             const aHostName: string;
                             const aAuthorization: tBytes); overload;
    procedure AddTLSAcmeALPN(const aPriv: iMPPrivateKey;
                             const aHostName: string;
                             const aToken: string;
                             const aThumbprint: string); overload;
    procedure AddTLSApplicationLayerProtocolName(const ALPN: OctetString);
    procedure RemoveTLSApplicationLayerProtocolName(const ALPN: OctetString);
    procedure RemoveTLSAcmeALPN;

    procedure AddTLSAcmeALPN(const aPriv: iMPPrivateKey;
                             const aHostName: string;
                             const aToken: string;
                             const aThumbprint: string); overload;

Server_SimpleTLSInternalServer.AddTLSApplicationLayerProtocolName('http/1.1');

  ExecuteACME1.SubjectAltNames.Clear;
  if TLSServer = nil then
    TLSServer := (GetServerCryptPlugin as TRtcSTMTServerPlugin).TLSServer;
  SL := TStringList.Create;
  try
    SL.CaseSensitive := False;
    TLSServer.ListTLSServerCertificates(SL);
    for I := 0 to FDomains.Count-1 do begin
      lStr := Format('%s=%s',[rsaEncryption,LowerCase(FDomains[I])]);
      if SL.IndexOf(lStr) < 0 then
        ExecuteACME1.SubjectAltNames.Add(FDomains[I]);
    end;
    SL.Clear;
    TLSServer.FindExpiringTLSServerCertificates(Now+FExpirationCutOff,SL);
    if SL.Count > 0 then begin
      for I := 0 to SL.Count-1 do begin
        if SL.Names[I] = rsaEncryption then begin
          lStr := LowerCase(SL.ValueFromIndex[I]);
          // Exclude wildcard certificates - can't be requested through ALPN
          if (Pos('*',lStr) = 0) and
             (ExecuteACME1.SubjectAltNames.IndexOf(lStr) < 0) then begin
            ExecuteACME1.SubjectAltNames.Add(lStr);
          end;
        end;
      end;
    end;
  finally
    SL.Free;
  end;

    TLSServer.RemoveTLSAcmeALPN;
    ExecuteACME1.RegisterDomain;

  TLSServer.AddTLSAcmeALPN(tMPPrivateKeyIF.Create(stRSAKey1,nil),Domain,Token,Thumbprint);
  Processed := True;

var
  lMS: tMemoryStream;
  lPwd: iSecretKey;
  lC, lEE: iCertificate;
  lPFX: iPFX;
  lKeyStore: iKeyAndCertStoreEx;
  lName: string;
  I: Integer;
  lIni: TIniFile;
  lStatus: TCertStatusCode;
begin
  Timer2.Enabled := False;
  TLSServer.RemoveTLSAcmeALPN;
  lPwd := tDualSecretKey.CreateForPFX(FDefaultPassword);
  lPFX := tPFX.Create(gcamFirstAssignment);
  lKeyStore := lPFX as iKeyAndCertStoreEx;
  lMS := TMemoryStream.Create;
  try
    Certificate.SaveToStream(lMS,TEncoding.Default);
    lMS.Position := 0;
    for I := 0 to 1 do begin
      lC := tCertificate.Create(gcamFirstAssignment);
      lC.GetStruct.LoadFromStream(lMS,fmtPEM);
      lC.GetStruct.ExpandFull;
      TLSServer.AddCertificate(lC,True,lStatus,False,True);
      if not lC.IsCA then begin
        lName := lC.tbsCertificate.subject.AsRdnSequence.CommonName;
        lEE := lC;
      end;
      lKeyStore.StoreCertificate(lPwd,lC,lC.tbsCertificate.subject.AsRdnSequence.CommonName,lC.PublicKeyIdentifier);
    end;
  finally
    lMS.Free;
  end;
  lKeyStore.StorePrivateKey(lPwd,stRSAKey1,rsaEncryption,lName,'',lEE.PublicKeyIdentifier,True);
  lPFX.ImposeAuthSafeContent(lPwd,True);
  lPFX.Version := tPFXVersion.V3;
  lPFX.GetStruct.SaveToFile(ExtractFilePath(ParamStr(0)) + lName + '.pfx',fmtDER);

  TLSServer.ReplaceTLSServerCertificate(lEE,tMPPrivateKeyIF.Create(stRSAKey1,nil));