certapi 0.4.2__tar.gz → 0.4.4__tar.gz

{certapi-0.4.2 → certapi-0.4.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: certapi
-Version: 0.4.2
+Version: 0.4.4
 Summary: Python Package for managing keys, request SSL certificates from ACME.
 Home-page: https://github.com/mesudip/certapi
 Author: Sudip Bhattarai
@@ -30,12 +30,12 @@ pip install certapi
 
 ```python
 import json
-from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeSolver, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
-challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/
+challenge_solver = FileSystemChallengeSolver("./acme-challenges")  # this should be where your web server hosts the .well-known/
 
-certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority = CertAuthority(challenge_solver, key_store)
 certAuthority.setup()
 
 (response,_) = certAuthority.obtainCert("example.com")

{certapi-0.4.2 → certapi-0.4.4}/README.md

@@ -17,12 +17,12 @@ pip install certapi
 
 ```python
 import json
-from certapi import FileSystemChallengeStore, FilesystemKeyStore, CertAuthority
+from certapi import FileSystemChallengeSolver, FilesystemKeyStore, CertAuthority
 
 key_store = FilesystemKeyStore("data")
-challenge_store = FileSystemChallengeStore("./acme-challenges")  # this should be where your web server hosts the .well-known/
+challenge_solver = FileSystemChallengeSolver("./acme-challenges")  # this should be where your web server hosts the .well-known/
 
-certAuthority = CertAuthority(challenge_store, key_store)
+certAuthority = CertAuthority(challenge_solver, key_store)
 certAuthority.setup()
 
 (response,_) = certAuthority.obtainCert("example.com")

{certapi-0.4.2 → certapi-0.4.4}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.4.2",
+    version="0.4.4",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.4.2 → certapi-0.4.4}/src/certapi/__init__.py

@@ -1,7 +1,7 @@
 from .acme.Acme import Acme, Order, AcmeNetworkError, AcmeHttpError, Challenge
 from .manager.acme_cert_manager import AcmeCertManager
 from .http.types import CertificateResponse, IssuedCert
-
+from .errors import CertApiException
 from .crypto import (
     Certificate,
     CertificateSigningRequest,
@@ -13,11 +13,11 @@ from .crypto import (
     EllipticCurvePrivateKey,
 )
 from .keystore import FileSystemKeystore, SqliteKeyStore, PostgresKeyStore, KeyStore
-from .challenge_store import (
-    ChallengeStore,
-    InMemoryChallengeStore,
-    FileSystemChallengeStore,
-    CloudflareChallengeStore,
-    DigitalOceanChallengeStore,
+from .challenge_solver import (
+    ChallengeSolver,
+    InMemoryChallengeSolver,
+    FilesystemChallengeSolver,
+    CloudflareChallengeSolver,
+    DigitalOceanChallengeSolver,
 )
-from .issuers import SelfCertIssuer
+from .issuers import CertIssuer,SelfCertIssuer,AcmeCertIssuer

{certapi-0.4.2 → certapi-0.4.4}/src/certapi/acme/Acme.py

@@ -9,7 +9,8 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509 import CertificateSigningRequest, Certificate
 from certapi.crypto import crypto
 import requests
-from certapi.crypto import sign, digest_sha256, csr_to_der, jwk, get_algorithm_name, sign_for_jws, Key
+from certapi.crypto import Key
+from certapi.crypto.crypto_classes import ECDSAKey, RSAKey
 from certapi.util import b64_encode, b64_string
 from .AcmeError import *
 from .http import *
@@ -22,11 +23,12 @@ class Acme:
     URL_STAGING = "https://acme-staging-v02.api.letsencrypt.org/directory"
     URL_PROD = "https://acme-v02.api.letsencrypt.org/directory"
 
-    def __init__(self, account_key: Union[RSAPrivateKey, EllipticCurvePrivateKey | Key], url=URL_STAGING):
-        self.account_key = account_key.key if isinstance(account_key, Key) else account_key
+    def __init__(self, account_key: Key, url=URL_STAGING):
+        self.account_key: Key = account_key
 
         # json web key format for public key
-        self.jwk = jwk(self.account_key)
+        self.jwk = account_key.jwk()
+        self.alg_name = account_key.algorithm_name()
         print(self.jwk)
         self.nonce = []
         self.acme_url = url if url else os.environ.get("ACME_API_URL", self.URL_STAGING)
@@ -72,7 +74,7 @@ class Acme:
 
         protected = {
             "url": url,
-            "alg": get_algorithm_name(self.account_key),
+            "alg": self.alg_name,
             "nonce": self.get_nonce(step),
         }
 
@@ -80,11 +82,12 @@ class Acme:
             protected["kid"] = self.key_id
         else:
             protected["jwk"] = self.jwk
+
         protectedb64 = b64_encode(protected)
         payload = {
             "protected": protectedb64.decode("utf-8"),
             "payload": payload64.decode("utf-8"),
-            "signature": b64_string(sign_for_jws(self.account_key, b".".join([protectedb64, payload64]))),
+            "signature": b64_string(self.account_key.jws_sign(b".".join([protectedb64, payload64]))),
         }
         try:
 

{certapi-0.4.2 → certapi-0.4.4}/src/certapi/acme/AcmeError.py

@@ -1,17 +1,13 @@
+import re
 import requests
+from certapi.errors import CertApiException
 
 
-class AcmeError(Exception):
+class AcmeError(CertApiException):
     def __init__(self, message, detail, step):
-        super().__init__(step, message)
-        self.message: str = message
-        self.step: str = step
-        self.detail: dict = detail
+        super().__init__(message, detail, step)
         self.can_retry = False
 
-    def json_obj(self) -> dict:
-        return {"message": self.message, "step": self.step, "detail": self.detail}
-
 
 class AcmeNetworkError(AcmeError, requests.RequestException):
     """
@@ -22,7 +18,6 @@ class AcmeNetworkError(AcmeError, requests.RequestException):
         # Initialize both parent classes
         requests.RequestException.__init__(self, request=request)
         AcmeError.__init__(self, message, detail, step)
-        requests.RequestException.__init__(self, request=request)  # Pass message to RequestException
         self.can_retry = True
 
 
@@ -47,6 +42,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                     failed_challenge: dict = [x for x in res_json["challenges"] if x["status"] == "invalid"][0]
                     error = failed_challenge["error"]
                     err_detail: str = error.get("detail")
+                    err_type: str = error.get("type")
                     validation_record: dict = failed_challenge.get("validationRecord")
                     error = {
                         "url": failed_challenge["url"],
@@ -70,7 +66,7 @@ class AcmeHttpError(AcmeError, requests.HTTPError):
                             "resolved": validation_record["addressesResolved"],
                             "used": validation_record["addressUsed"],
                         }
-                        if error["type"] == "urn:ietf:params:acme:error:connection":
+                        if err_type == "urn:ietf:params:acme:error:connection":
                             if "Timeout during connect" in err_detail:
                                 error["connect"] = {"error": "Timeout"}
                                 message = (

{certapi-0.4.2 → certapi-0.4.4}/src/certapi/acme/Challenge.py

@@ -39,7 +39,9 @@ class Challenge:
 
     def verify(self, type: Literal["http-01", "dns-01", "tls-alpn-01"] = None) -> bool:
         if not self.verified:
-            response = self._acme._signed_req(self.get_challenge(type)["url"], {}, step="Verify Challenge", throw=False)
+            response = self._acme._signed_req(
+                self.get_challenge(type)["url"], {}, step=f"Verify Challenge [{self.domain}]", throw=False
+            )
             if response.status_code == 200 and response.json()["status"] == "valid":
                 self.verified = True
                 return True
@@ -49,7 +51,7 @@ class Challenge:
     def self_verify(self) -> Union[bool, requests.Response]:
         identifier = self._data["identifier"]
         if identifier["type"] == "dns":
-            res = get("Self Domain verification", self.url)
+            res = get(f"Self Domain verification [{self.domain}]", self.url)
             if res.status_code == 200 and res.content == self.token.encode():
                 return True
             else:
@@ -60,13 +62,13 @@ class Challenge:
         if self.verified:
             return True
         else:
-            res = self._acme._signed_req(self._auth_url, step="Acme Challenge Verification")
+            res = self._acme._signed_req(self._auth_url, step=f"Query Challenge Status [{self.domain}]")
             res_json = res.json()
             if res_json["status"] == "valid":
                 self.verified = True
                 return True
             elif res_json["status"] == "invalid":
-                raise AcmeInvaliOrderError(res, "Acme Challenge Verification")
+                raise AcmeInvaliOrderError(res, "Query Challenge Status")
             else:
                 return False
 
@@ -81,7 +83,7 @@ class Challenge:
 
         ch_types = [x["type"] for x in self._data["challenges"]]
         raise AcmeError(
-            f"'{type}' not found in challenges. available:{str(ch_types)}",
+            f"'{type}' not found in challenges for {self.domain}, available: {','.join(ch_types)}",
             {"response": self._data["challenges"]},
-            "Acme Challenge Verification",
+            "Query Challenge Status",
         )

certapi-0.4.2/src/certapi/challenge_store/ChallengeStore.py → certapi-0.4.4/src/certapi/challenge_solver/ChallengeSolver.py

@@ -1,9 +1,10 @@
 from abc import ABC, abstractmethod
 import os
 from collections.abc import MutableMapping
+from typing import Literal
 
 
-class ChallengeStore(ABC):
+class ChallengeSolver(ABC):
     """
     Abstract base class for a challenge store.
     """
@@ -24,10 +25,13 @@ class ChallengeStore(ABC):
     def delete_challenge(self, key: str, domain: str = None):
         pass
 
-    def store_details():
-        return {
-            "name": "Abstract Challenge Store",
-        }
+    @abstractmethod
+    def supported_challenge_type(self) -> Literal["http-01", "dns-01", "tls-alpn-01"]:
+        pass
+
+    @abstractmethod
+    def cleanup_old_challenges(self):
+        pass
 
     def __iter__(self):
         raise NotImplementedError("Must implement `__iter__` method.")

certapi-0.4.2/src/certapi/challenge_store/FileSystemChallengeStore.py → certapi-0.4.4/src/certapi/challenge_solver/FileSystemChallengeSolver.py

@@ -1,10 +1,12 @@
-from .ChallengeStore import ChallengeStore
+from typing import Literal
+from .ChallengeSolver import ChallengeSolver
 import os
 
 
-class FileSystemChallengeStore(ChallengeStore):
+class FilesystemChallengeSolver(ChallengeSolver):
     """
-    Filesystem implementation of the ChallengeStore.
+    Filesystem implementation of the ChallengeSolver.
+    This should never be used, but extended for your webserver e.g. nginx, apache etc.
     """
 
     def __init__(self, directory: str):
@@ -12,7 +14,7 @@ class FileSystemChallengeStore(ChallengeStore):
         os.makedirs(self.directory, exist_ok=True)
 
     def supports_domain(self, domain: str) -> bool:
-        return True
+        return "*" not in domain
 
     def save_challenge(self, key: str, value: str, domain: str = None):
         file_path = os.path.join(self.directory, key)
@@ -31,6 +33,15 @@ class FileSystemChallengeStore(ChallengeStore):
         if os.path.exists(file_path):
             os.remove(file_path)
 
+    def supported_challenge_type(self) -> Literal["http-01"]:
+        return "http-01"
+
+    def cleanup_old_challenges(self):
+        for filename in os.listdir(self.directory):
+            file_path = os.path.join(self.directory, filename)
+            if os.path.isfile(file_path):
+                os.remove(file_path)
+
     def __iter__(self):
         return (f for f in os.listdir(self.directory) if os.path.isfile(os.path.join(self.directory, f)))
 

certapi-0.4.2/src/certapi/challenge_store/InmemoryChallengeStore.py → certapi-0.4.4/src/certapi/challenge_solver/InmemoryChallengeSolver.py

@@ -1,14 +1,18 @@
-from .ChallengeStore import ChallengeStore
+from typing import Literal
+from .ChallengeSolver import ChallengeSolver
 
 
-class InMemoryChallengeStore(ChallengeStore):
+class InMemoryChallengeSolver(ChallengeSolver):
     """
-    In-memory implementation of the ChallengeStore.
+    In-memory implementation of the ChallengeSolver.
     """
 
     def __init__(self):
         self.challenges = {}
 
+    def supported_challenge_type(self) -> Literal["http-01"]:
+        return "http-01"
+
     def save_challenge(self, key: str, value: str, domain: str = None):
         self.challenges[key] = value
 

certapi-0.4.4/src/certapi/challenge_solver/__init__.py

@@ -0,0 +1,24 @@
+from .ChallengeSolver import ChallengeSolver
+from .InmemoryChallengeSolver import InMemoryChallengeSolver
+import os
+from .FileSystemChallengeSolver import FilesystemChallengeSolver
+from .dns import CloudflareChallengeSolver, DigitalOceanChallengeSolver
+
+
+def get_challenge_solver():
+    """
+    Factory function to determine the type of store based on environment variables.
+
+    Environment Variables:
+    - `challenge_solver_TYPE`: Can be "memory" or "filesystem".
+    - `challenge_solver_DIR`: Directory for filesystem-based store. Defaults to "./challenges".
+    """
+    store_type = os.getenv("challenge_solver_TYPE", "filesystem").lower()
+    directory = os.getenv("challenge_solver_DIR", "./challenges")
+
+    if store_type == "memory":
+        return InMemoryChallengeSolver()
+    elif store_type == "filesystem":
+        return FilesystemChallengeSolver(directory)
+    else:
+        raise ValueError(f"Unknown challenge_solver_TYPE: {store_type}")

certapi-0.4.4/src/certapi/challenge_solver/dns/__init__.py

@@ -0,0 +1,2 @@
+from .digitalocean.digitalocean_challenge_solver import DigitalOceanChallengeSolver
+from .cloudflare.cloudflare_challenge_solver import CloudflareChallengeSolver

certapi-0.4.4/src/certapi/challenge_solver/dns/cloudflare/cloudflare_challenge_solver.py

@@ -0,0 +1,92 @@
+import os
+import time
+from collections.abc import MutableMapping
+from typing import Literal
+from concurrent.futures import ThreadPoolExecutor
+from ...ChallengeSolver import ChallengeSolver
+from .cloudflare_client import Cloudflare
+from certapi.errors import CertApiException
+
+
+class CloudflareChallengeSolver(ChallengeSolver):
+    def __init__(self, api_key: str = None):
+        self.cloudflare = Cloudflare(api_key)
+        self.challenges_map = {}
+
+    def supported_challenge_type(self) -> Literal["dns-01"]:
+        return "dns-01"
+
+    def supports_domain(self, domain: str) -> bool:
+        """
+        Checks if the Cloudflare account has access to the given domain (or its base domain)
+        as a registered zone.
+        """
+        try:
+            self.cloudflare.determine_registered_domain(domain)
+            return True
+        except CertApiException as e:
+            # Log the exception or handle it as needed, but return False as it doesn't support the domain
+            print(f"CloudflareChallengeSolver.supports_domain: {e.message} - {e.detail}")
+            return False
+            return False
+
+    def save_challenge(self, key: str, value: str, domain=None):
+        # key example: _acme-challenge.sub.example.com
+        # value example: ACME_CHALLENGE_TOKEN
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+
+        record_id = self.cloudflare.create_record(name=key, data=value, domain=base_domain)
+        self.challenges_map[key] = record_id
+        print(f"CloudflareChallengeSolver[{domain}]: Added Record {key}")
+
+    def get_challenge(self, key: str, domain: str) -> str:
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        records = self.cloudflare.list_txt_records(base_domain, name_filter=key)
+        for record in records:
+            if record["name"] == key:
+                return record["content"]
+        return None  # Return None if not found, as per ChallengeSolver's __getitem__ behavior
+
+    def delete_challenge(self, key: str, domain: str):
+        if key not in self.challenges_map:
+            print(f"CloudflareChallengeSolver.delete: Not found Skipping  key={key}  record_id={record_id}")
+            return
+
+        record_id = self.challenges_map[key]
+        base_domain = self.cloudflare.determine_registered_domain(domain)
+        self.cloudflare.delete_record(record=record_id, domain=base_domain)
+        del self.challenges_map[key]
+        print(f"CloudflareChallengeSolver: Deleted challenge for {key} with record ID {record_id}")
+
+    def _cleanup_zone_challenges(self, zone):
+        zone_name = zone["name"]
+        try:
+            # List all TXT records in the zone
+            records = self.cloudflare.list_txt_records(zone_name)
+            for record in records:
+                if record["type"] == "TXT" and record["name"].startswith("_acme-challenge"):
+                    print(f"CloudflareChallengeSolver: Deleting old challenge record {record['name']} in zone {zone_name}")
+                    try:
+                        self.cloudflare.delete_record(record["id"], zone_name)
+                    except CertApiException as e:
+                        print(f"CloudflareChallengeSolver: Warning - Failed to delete record {record['name']} in zone {zone_name}: {e.message} - {e.detail}")
+                    except Exception as e:
+                        print(f"CloudflareChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in zone {zone_name}: {e}")
+        except CertApiException as e:
+            print(f"CloudflareChallengeSolver: Error listing challenges in zone {zone_name}: {e.message} - {e.detail}")
+        except Exception as e:
+            print(f"CloudflareChallengeSolver: An unexpected error occurred while listing challenges in zone {zone_name}: {e}")
+
+    def cleanup_old_challenges(self):
+        zones = self.cloudflare._get_zones()
+        with ThreadPoolExecutor(max_workers=len(zones)) as executor:
+            executor.map(self._cleanup_zone_challenges, zones)
+
+    def __iter__(self):
+        # This is tricky as we can't easily iterate all challenges across all domains
+        # If the user wants a full API-driven iteration, they need to clarify how to get all domains.
+        return iter(self.challenges_map)
+
+    def __len__(self):
+        # Similar to __iter__, this will count challenges managed by this store instance.
+        return len(self.challenges_map)

{certapi-0.4.2/src/certapi/challenge_store → certapi-0.4.4/src/certapi/challenge_solver}/dns/cloudflare/cloudflare_client.py

@@ -2,6 +2,7 @@ import json
 import time
 from os import getenv
 from urllib.request import urlopen, Request
+from certapi.errors import CertApiException
 
 
 class Cloudflare(object):
@@ -13,7 +14,7 @@ class Cloudflare(object):
         if not self.token:
             self.token = getenv("CLOUDFLARE_API_KEY")
             if not self.token:
-                raise Exception("CLOUDFLARE_API_KEY not found in environment")
+                raise CertApiException("CLOUDFLARE_API_KEY not found in environment", step="Cloudflare.__init__")
 
         self._zones_cache = None
         self._zones_cache_time = 0  # Unix timestamp of last cache update
@@ -31,7 +32,11 @@ class Cloudflare(object):
         api_url = "{0}/zones?per_page=50".format(self.api)
         response = urlopen(Request(api_url, headers=request_headers))
         if response.getcode() != 200:
-            raise Exception(json.loads(response.read().decode("utf8")))
+            raise CertApiException(
+                "Cloudflare API error",
+                detail=json.loads(response.read().decode("utf8")),
+                step="Cloudflare._get_zones"
+            )
 
         zones = json.loads(response.read().decode("utf8"))["result"]
         self._zones_cache = zones
@@ -44,7 +49,11 @@ class Cloudflare(object):
         for zone in zones:
             if zone["name"] == domain:
                 return zone["id"]
-        raise Exception("No Cloudflare zone found for domain: {0}".format(domain))
+        raise CertApiException(
+            "No Cloudflare zone found for domain",
+            detail={"domain": domain},
+            step="Cloudflare._get_zone_id"
+        )
 
     def determine_registered_domain(self, domain: str) -> str:
         """
@@ -62,9 +71,13 @@ class Cloudflare(object):
                 err = e
                 continue
         if err:
-            raise err
+            raise CertApiException(str(err), step="Cloudflare.determine_registered_domain")
         else:
-            raise Exception("Could not determine Cloudflare registered domain for: {0}".format(domain))
+            raise CertApiException(
+                "Could not determine Cloudflare registered domain",
+                detail={"domain": domain},
+                step="Cloudflare.determine_registered_domain"
+            )
 
     def list_txt_records(self, domain: str, name_filter: str = None) -> list:
         """
@@ -81,11 +94,20 @@ class Cloudflare(object):
         response = urlopen(Request(api_url, headers=request_headers))
 
         if response.getcode() != 200:
-            raise Exception(json.loads(response.read().decode("utf8")))
+            raise CertApiException(
+                "Cloudflare API error",
+                detail=json.loads(response.read().decode("utf8")),
+                step="Cloudflare.list_txt_records"
+            )
 
         result = json.loads(response.read().decode("utf8"))
         if not result.get("success"):
-            raise Exception(result.get("errors", "Unknown error listing TXT records"))
+            print(f"List TXT record [{response.getcode()}]", result)
+            raise CertApiException(
+                "Unknown error listing TXT records",
+                detail=result.get("errors", "Unknown error listing TXT records"),
+                step="Cloudflare.list_txt_records"
+            )
 
         return result["result"]
 
@@ -111,11 +133,15 @@ class Cloudflare(object):
             "proxied": False,
         }
         response = urlopen(Request(api_url, data=json.dumps(request_data).encode("utf8"), headers=request_headers))
-
-        if response.getcode() != 200:
-            raise Exception(json.loads(response.read().decode("utf8")))
         result = response.read().decode("utf8")
-        print("Cloudflare create record", name, result)
+        if response.getcode() != 200:
+            print(f"Create TXT record [{response.getcode()}]", result)
+            raise CertApiException(
+                "Cloudflare API error",
+                detail=json.loads(result),
+                step="Cloudflare.create_record"
+            )
+
         return json.loads(result)["result"]["id"]
 
     def delete_record(self, record, domain):
@@ -133,6 +159,10 @@ class Cloudflare(object):
         request.get_method = lambda: "DELETE"
         response = urlopen(request)
         result = response.read().decode("utf8")
-        print(f"Delete dns record [{response.getcode()}]", result)
         if response.getcode() != 200:
-            raise Exception(json.loads(response.read().decode("utf8")))
+            print(f"Delete dns record [{response.getcode()}]", result)
+            raise CertApiException(
+                "Cloudflare API error",
+                detail=json.loads(result),
+                step="Cloudflare.delete_record"
+            )

certapi-0.4.4/src/certapi/challenge_solver/dns/digitalocean/digitalocean_challenge_solver.py

@@ -0,0 +1,88 @@
+import os
+from collections.abc import MutableMapping
+from typing import Literal
+from ...ChallengeSolver import ChallengeSolver
+from .digitalocean_client import DigitalOcean
+from certapi.errors import CertApiException
+
+
+class DigitalOceanChallengeSolver(ChallengeSolver):
+    def __init__(self, api_key: str = None):
+        self.digitalocean = DigitalOcean(api_key)
+        self.challenges_map = {}  # Stores key: record_id (needed for deletion)
+
+    def supported_challenge_type(self) -> Literal["dns-01"]:
+        return "dns-01"
+
+    def supports_domain(self, domain: str) -> bool:
+        """
+        Checks if the DigitalOcean account has access to the given domain (or its base domain)
+        as a registered zone.
+        """
+        try:
+            self.digitalocean.determine_domain(domain)
+            return True
+        except CertApiException as e:
+            # Log the exception or handle it as needed, but return False as it doesn't support the domain
+            print(f"DigitalOceanChallengeSolver.supports_domain: {e.message} - {e.detail}")
+            return False
+        except Exception as e:
+            # Catch any other unexpected exceptions
+            print(f"DigitalOceanChallengeSolver.supports_domain: An unexpected error occurred: {e}")
+            return False
+
+    def save_challenge(self, key: str, value: str, domain=None):
+        # key example: _acme-challenge.sub.example.com
+        # value example: ACME_CHALLENGE_TOKEN
+        base_domain = self.digitalocean.determine_domain(domain)
+
+        record_id = self.digitalocean.create_record(name=key, data=value, domain=base_domain)
+        self.challenges_map[key] = record_id
+        print(f"DigitalOceanChallengeSolver: Saved challenge for {key} with record ID {record_id}")
+
+    def get_challenge(self, key: str, domain: str) -> str:
+        base_domain = self.digitalocean.determine_domain(domain)
+        records = self.digitalocean.list_records(base_domain, name_filter=key)
+        for record in records:
+            if record["name"] == key:
+                return record["data"]  # DigitalOcean API returns 'data' for TXT record content
+        return None  # Return None if not found, as per ChallengeSolver's __getitem__ behavior
+
+    def delete_challenge(self, key: str, domain: str):
+        if key not in self.challenges_map:
+            raise KeyError(f"Challenge {key} not found in store (no record_id stored).")
+
+        record_id = self.challenges_map[key]
+        base_domain = self.digitalocean.determine_domain(domain)
+        self.digitalocean.delete_record(record=record_id, domain=base_domain)
+        del self.challenges_map[key]
+        print(f"DigitalOceanChallengeSolver: Deleted challenge for {key} with record ID {record_id}")
+
+    def cleanup_old_challenges(self):
+        domains = self.digitalocean._get_domains()
+        for domain_obj in domains:
+            domain_name = domain_obj["name"]
+            try:
+                records = self.digitalocean.list_records(domain_name)
+                for record in records:
+                    if record["type"] == "TXT" and record["name"].startswith("_acme-challenge"):
+                        print(f"DigitalOceanChallengeSolver: Deleting old challenge record {record['name']} in domain {domain_name}")
+                        try:
+                            self.digitalocean.delete_record(record["id"], domain_name)
+                        except CertApiException as e:
+                            print(f"DigitalOceanChallengeSolver: Warning - Failed to delete record {record['name']} in domain {domain_name}: {e.message} - {e.detail}")
+                        except Exception as e:
+                            print(f"DigitalOceanChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in domain {domain_name}: {e}")
+            except CertApiException as e:
+                print(f"DigitalOceanChallengeSolver: Error listing challenges in domain {domain_name}: {e.message} - {e.detail}")
+            except Exception as e:
+                print(f"DigitalOceanChallengeSolver: An unexpected error occurred while listing challenges in domain {domain_name}: {e}")
+
+    def __iter__(self):
+        # This is tricky as we can't easily iterate all challenges across all domains
+        # If the user wants a full API-driven iteration, they need to clarify how to get all domains.
+        return iter(self.challenges_map)
+
+    def __len__(self):
+        # Similar to __iter__, this will count challenges managed by this store instance.
+        return len(self.challenges_map)