func revokeByKeyID(s storage.Store, keyID string) error {
	k := s.KeyByID(keyID)
	if k == nil {
		return fmt.Errorf("cannot find certificate or key with given ID: %q", keyID)
	}

	var merr storage.MultiError
	s.VisitCertificates(func(c *storage.Certificate) error {
		if c.Key != k {
			return nil // continue
		}

		err := RevokeByCertificateOrKeyID(s, c.ID())
		if err != nil {
			merr = append(merr, fmt.Errorf("failed to mark %v for revocation: %v", c, err))
		}

		return nil
	})

	if len(merr) > 0 {
		return merr
	}

	return nil
}

func FindBestCertificateSatisfying(s storage.Store, t *storage.Target) (*storage.Certificate, error) {
	var bestCert *storage.Certificate

	err := s.VisitCertificates(func(c *storage.Certificate) error {
		if DoesCertificateSatisfy(c, t) {
			isBetterThan, err := CertificateBetterThan(c, bestCert)
			if err != nil {
				return err
			}

			if isBetterThan {
				log.Tracef("findBestCertificateSatisfying: %v > %v", c, bestCert)
				bestCert = c
			} else {
				log.Tracef("findBestCertificateSatisfying: %v <= %v", c, bestCert)
			}
		}

		return nil
	})
	if err != nil {
		return nil, err
	}

	if bestCert == nil {
		return nil, fmt.Errorf("%v: no certificate satisfies this target", t)
	}

	return bestCert, nil
}

func importLEAccount(s storage.Store, lePath, accountName string) (*storage.Account, error) {
	providerURL, err := getProviderURLFromAccountName(accountName)
	if err != nil {
		return nil, err
	}

	knownProviderURLs[providerURL] = struct{}{}

	pkPath := filepath.Join(lePath, "accounts", accountName, "private_key.json")
	b, err := ioutil.ReadFile(pkPath)
	if err != nil {
		return nil, err
	}

	k := jose.JsonWebKey{}
	err = k.UnmarshalJSON(b)
	if err != nil {
		return nil, err
	}

	acct, err := s.ImportAccount(providerURL, k.Key)
	if err != nil {
		return nil, err
	}

	return acct, nil
}

func importCert(s *storage.Store, filename string) error {
	certURL, err := determineLECertificateURL(filename)
	if err != nil {
		return err
	}

	return s.ImportCertificate(certURL)
}

func importKey(s *storage.Store, filename string) error {
	f, err := os.Open(filename)
	if err != nil {
		return err
	}
	defer f.Close()

	return s.ImportKey(f)
}

func HaveUncachedCertificates(s storage.Store) bool {
	haveUncached := false

	s.VisitCertificates(func(c *storage.Certificate) error {
		if !c.Cached {
			haveUncached = true
		}

		return nil
	})

	return haveUncached
}

func importKey(s storage.Store, filename string) error {
	b, err := ioutil.ReadFile(filename)
	if err != nil {
		return err
	}

	pk, err := acmeutils.LoadPrivateKey(b)
	if err != nil {
		return err
	}

	_, err = s.ImportKey(pk)
	return err
}

func RevokeByCertificateOrKeyID(s storage.Store, id string) error {
	c := s.CertificateByID(id)
	if c == nil {
		return revokeByKeyID(s, id)
	}

	if c.Revoked {
		log.Warnf("%v already revoked", c)
		return nil
	}

	c.RevocationDesired = true
	return s.SaveCertificate(c)
}

// Update targets to remove any mention of hostname from all targets. The
// targets are resaved to disk.
func RemoveTargetHostname(s storage.Store, hostname string) error {
	return s.VisitTargets(func(t *storage.Target) error {
		if !containsName(t.Satisfy.Names, hostname) {
			return nil // continue
		}

		t.Satisfy.Names = removeStringFromList(t.Satisfy.Names, hostname)
		t.Request.Names = removeStringFromList(t.Request.Names, hostname)

		if len(t.Satisfy.Names) == 0 {
			return s.RemoveTarget(t.Filename)
		}

		return s.SaveTarget(t)
	})
}

func Cull(s storage.Store, simulate bool) error {
	certificatesToCull := map[string]*storage.Certificate{}

	// Relink before culling.
	err := Relink(s)
	if err != nil {
		return err
	}

	// Select all certificates.
	s.VisitCertificates(func(c *storage.Certificate) error {
		certificatesToCull[c.ID()] = c
		return nil
	})

	// Unselect any certificate which is currently referenced.
	s.VisitPreferredCertificates(func(hostname string, c *storage.Certificate) error {
		delete(certificatesToCull, c.ID())
		return nil
	})

	// Now delete any certificate which is not generally valid.
	for certID, c := range certificatesToCull {
		if CertificateGenerallyValid(c) {
			continue
		}

		if simulate {
			log.Noticef("would delete certificate %s", certID)
		} else {
			log.Noticef("deleting certificate %s", certID)
			err := s.RemoveCertificate(certID)
			log.Errore(err, "failed to delete certificate ", certID)
		}
	}

	return nil
}

func StatusString(s storage.Store) string {
	var buf bytes.Buffer
	fmt.Fprintf(&buf, "Settings:\n")
	fmt.Fprintf(&buf, "  ACME_STATE_DIR: %s\n", s.Path())
	fmt.Fprintf(&buf, "  ACME_HOOKS_DIR: %s\n", hooks.DefaultPath)
	fmt.Fprintf(&buf, "  Default directory URL: %s\n", s.DefaultTarget().Request.Provider)
	fmt.Fprintf(&buf, "  Preferred key type: %v\n", &s.DefaultTarget().Request.Key)
	fmt.Fprintf(&buf, "  Additional webroots:\n")
	for _, wr := range s.DefaultTarget().Request.Challenge.WebrootPaths {
		fmt.Fprintf(&buf, "    %s\n", wr)
	}

	fmt.Fprintf(&buf, "\nAvailable accounts:\n")
	s.VisitAccounts(func(a *storage.Account) error {
		fmt.Fprintf(&buf, "  %v\n", a)
		thumbprint, _ := acmeutils.Base64Thumbprint(a.PrivateKey)
		fmt.Fprintf(&buf, "    thumbprint: %s\n", thumbprint)
		return nil
	})

	fmt.Fprintf(&buf, "\n")
	s.VisitTargets(func(t *storage.Target) error {
		fmt.Fprintf(&buf, "%v\n", t)

		c, err := storageops.FindBestCertificateSatisfying(s, t)
		if err != nil {
			fmt.Fprintf(&buf, "  error: %v\n", err)
			return nil // continue
		}

		renewStr := ""
		if storageops.CertificateNeedsRenewing(c) {
			renewStr = " needs-renewing"
		}

		fmt.Fprintf(&buf, "  best: %v%s\n", c, renewStr)
		return nil
	})

	if storageops.HaveUncachedCertificates(s) {
		fmt.Fprintf(&buf, "\nThere are uncached certificates.\n")
	}

	return buf.String()
}