certapi 0.4.4__tar.gz → 0.4.6__tar.gz

certapi-0.4.6/PKG-INFO

@@ -0,0 +1,63 @@
+Metadata-Version: 2.1
+Name: certapi
+Version: 0.4.6
+Summary: Python Package for managing keys, request SSL certificates from ACME.
+Home-page: https://github.com/mesudip/certapi
+Author: Sudip Bhattarai
+Author-email: sudipbhattarai100@gmail.com
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.6
+Description-Content-Type: text/markdown
+
+# CertApi
+
+CertApi is a Python package for requesting SSL certificates from ACME.
+This is to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
+
+> ⚠️ Warning: This project is in beta. Please stay tuned for the LTS `v1.0.0` release.
+
+## Installation
+
+You can install CertApi using pip
+
+```bash
+pip install certapi
+```
+
+## Use Low level API
+
+```python
+import json
+import os
+from certapi import FileSystemKeyStore, CertApiException, CloudflareChallengeSolver, AcmeCertManager, AcmeCertIssuer
+
+
+# Initialize the key store and create acme account key
+key_store = FileSystemKeyStore("data")
+
+acme_key = key_store._get_or_generate_key("acme_account", "rsa")[0]
+
+# Initialize the Cloudflare challenge solver
+# The API key is read from the CLOUDFLARE_API_KEY environment variable, or you can set it below.
+challenge_solver = CloudflareChallengeSolver(api_key=None)
+
+## initialize cert issuer
+cert_issuer = AcmeCertIssuer(acme_key, challenge_solver)
+
+# Setup ACME account.
+cert_issuer.setup()
+
+try:
+    # Obtain a certificate for your domain
+    (key, cert) = cert_issuer.generate_key_and_cert_for_domain("your-domain.com")
+
+    print("------ Private Key -----")
+    print(key.to_pem())
+    print("------- Certificate ------")
+    print(cert)
+except CertApiException as e:
+    print(f"An error occurred:", json.dumps(e.json_obj(), indent=2))
+
+```

certapi-0.4.6/README.md

@@ -0,0 +1,50 @@
+# CertApi
+
+CertApi is a Python package for requesting SSL certificates from ACME.
+This is to be used as a base library for building other tools, or to integrate Certificate creation feature in you app.
+
+> ⚠️ Warning: This project is in beta. Please stay tuned for the LTS `v1.0.0` release.
+
+## Installation
+
+You can install CertApi using pip
+
+```bash
+pip install certapi
+```
+
+## Use Low level API
+
+```python
+import json
+import os
+from certapi import FileSystemKeyStore, CertApiException, CloudflareChallengeSolver, AcmeCertManager, AcmeCertIssuer
+
+
+# Initialize the key store and create acme account key
+key_store = FileSystemKeyStore("data")
+
+acme_key = key_store._get_or_generate_key("acme_account", "rsa")[0]
+
+# Initialize the Cloudflare challenge solver
+# The API key is read from the CLOUDFLARE_API_KEY environment variable, or you can set it below.
+challenge_solver = CloudflareChallengeSolver(api_key=None)
+
+## initialize cert issuer
+cert_issuer = AcmeCertIssuer(acme_key, challenge_solver)
+
+# Setup ACME account.
+cert_issuer.setup()
+
+try:
+    # Obtain a certificate for your domain
+    (key, cert) = cert_issuer.generate_key_and_cert_for_domain("your-domain.com")
+
+    print("------ Private Key -----")
+    print(key.to_pem())
+    print("------- Certificate ------")
+    print(cert)
+except CertApiException as e:
+    print(f"An error occurred:", json.dumps(e.json_obj(), indent=2))
+
+```

{certapi-0.4.4 → certapi-0.4.6}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="certapi",
-    version="0.4.4",
+    version="0.4.6",
     packages=find_packages(where="src"),
     package_dir={"": "src"},
     install_requires=[

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/__init__.py

@@ -12,7 +12,7 @@ from .crypto import (
     Ed25519PrivateKey,
     EllipticCurvePrivateKey,
 )
-from .keystore import FileSystemKeystore, SqliteKeyStore, PostgresKeyStore, KeyStore
+from .keystore import FileSystemKeyStore, SqliteKeyStore, PostgresKeyStore, KeyStore
 from .challenge_solver import (
     ChallengeSolver,
     InMemoryChallengeSolver,
@@ -20,4 +20,4 @@ from .challenge_solver import (
     CloudflareChallengeSolver,
     DigitalOceanChallengeSolver,
 )
-from .issuers import CertIssuer,SelfCertIssuer,AcmeCertIssuer
+from .issuers import CertIssuer, SelfCertIssuer, AcmeCertIssuer

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/acme/Acme.py

@@ -40,6 +40,32 @@ class Acme:
         if self.directory is None:
             self.directory = get("Fetch Acme Directory", self.acme_url).json()
 
+    def register(self):
+        """
+        Register an ACME Account. Re-registering is idempotent.
+        """
+        response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})
+        if "location" in response.headers:
+            self.key_id = response.headers["location"]
+        return response
+
+    def create_order(self, domains: List[str]) -> "Order":
+        """
+        Makes newOrder request, fetches all challenge details, and returns an Order object.
+        You cann then Use functions in Order and Challenge
+        """
+        payload = {"identifiers": [{"type": "dns", "value": d} for d in domains]}
+        res = self._directory_req("newOrder", payload)
+        res_json = res.json()
+        challenges = []
+        identifiers = res_json["identifiers"]
+
+        # auth_url means the url for challenge. In case of ACME challenge and authorization means same.
+        for auth_url, identifier in zip(res_json["authorizations"], identifiers):
+            auth_res = get(f"Get Challenge [{identifier['value']}]", auth_url)
+            challenges.append(Challenge(auth_url, auth_res.json(), self))
+        return Order(res.headers["location"], res_json, challenges, self)
+
     def _directory(self, key):
         if not self.directory:
             self.directory = get("Fetch Acme Directory", self.acme_url).json()
@@ -100,28 +126,3 @@ class Acme:
                 raise e
 
         return self.record_nonce(response)
-
-    def register(self):
-        response = self._directory_req("newAccount", {"termsOfServiceAgreed": True})
-        if "location" in response.headers:
-            self.key_id = response.headers["location"]
-        return response
-
-    def create_authorized_order(self, domains: List[str]) -> "Order":
-        payload = {"identifiers": [{"type": "dns", "value": d} for d in domains]}
-        res = self._directory_req("newOrder", payload)
-        res_json = res.json()
-        challenges = []
-        for auth_url in res_json["authorizations"]:
-            auth_res = self._signed_req(auth_url, None, step="Authorize Created Order")
-            challenges.append(Challenge(auth_url, auth_res.json(), self))
-        return Order(res.headers["location"], res_json, challenges, self)
-
-    def authorize_order(self, auth_url):
-        return self._signed_req(auth_url, None, step="Authorize Created Order")
-
-    def verify_challenge(self, challenge_url):
-        return self._signed_req(challenge_url, {}, step="Verify Challenge")
-
-    def finalize_order(self):
-        pass

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/acme/Order.py

@@ -31,9 +31,7 @@ class Order:
         elif self.status != "valid":
             raise ValueError("Order not in 'valid' state! Complete challenge and call finalize()")
 
-        certificate_res = self._acme._signed_req(
-            self._data["certificate"], step="Get Certificate from Successful Order"
-        )
+        certificate_res = self._acme._signed_req(self._data["certificate"], step="Download Certificate")
         return certificate_res.text
 
     def finalize(self, csr: CertificateSigningRequest):

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/acme/http.py

@@ -7,15 +7,6 @@ def request(method, step: str, url: str, json=None, headers=None, throw=True) ->
     try:
         res = requests.request(method, url, json=json, headers=headers, timeout=15)
         print("Request [" + str(res.status_code) + "] : " + method + " " + url + " step=" + step)
-    except requests.HTTPError as e:
-        status = res.status_code if res else None
-        status = status if status else (e.response.status_code if e.response else None)
-        if status:
-            print("Request [" + str(status) + "] : " + method + " " + url + " step=" + step)
-        else:
-            print("Request : " + method + " " + url + " step=" + step)
-
-        raise e
     except requests.RequestException as e:
         print("Request : " + str(method) + " " + str(url) + " step=" + str(step))
         raise AcmeNetworkError(
@@ -51,5 +42,5 @@ def post(step: str, url: str, json=None, headers=None, throw=True) -> requests.R
     return request("POST", step, url, json=json, headers=headers, throw=throw)
 
 
-def get(step: str, url) -> requests.Response:
-    return request("GET", step, url)
+def get(step: str, url, headers=None, throw=True) -> requests.Response:
+    return request("GET", step, url, headers=headers, throw=throw)

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/challenge_solver/dns/cloudflare/cloudflare_challenge_solver.py

@@ -1,11 +1,10 @@
 import os
-import time
 from collections.abc import MutableMapping
 from typing import Literal
 from concurrent.futures import ThreadPoolExecutor
 from ...ChallengeSolver import ChallengeSolver
 from .cloudflare_client import Cloudflare
-from certapi.errors import CertApiException
+from certapi.errors import CertApiException, DomainNotOwnedException, NetworkError
 
 
 class CloudflareChallengeSolver(ChallengeSolver):
@@ -24,37 +23,36 @@ class CloudflareChallengeSolver(ChallengeSolver):
         try:
             self.cloudflare.determine_registered_domain(domain)
             return True
-        except CertApiException as e:
-            # Log the exception or handle it as needed, but return False as it doesn't support the domain
-            print(f"CloudflareChallengeSolver.supports_domain: {e.message} - {e.detail}")
-            return False
+        except DomainNotOwnedException as e:
             return False
 
     def save_challenge(self, key: str, value: str, domain=None):
-        # key example: _acme-challenge.sub.example.com
-        # value example: ACME_CHALLENGE_TOKEN
-        base_domain = self.cloudflare.determine_registered_domain(domain)
 
-        record_id = self.cloudflare.create_record(name=key, data=value, domain=base_domain)
+        if domain is None:
+            domain = key.replace("_acme-challenge.", "")
+
+        record_id = self.cloudflare.create_record(name=key, data=value, domain=domain)
         self.challenges_map[key] = record_id
         print(f"CloudflareChallengeSolver[{domain}]: Added Record {key}")
 
     def get_challenge(self, key: str, domain: str) -> str:
-        base_domain = self.cloudflare.determine_registered_domain(domain)
-        records = self.cloudflare.list_txt_records(base_domain, name_filter=key)
+        if domain is None:
+            domain = key.replace("_acme-challenge.", "")
+        records = self.cloudflare.list_txt_records(domain, name_filter=key)
         for record in records:
             if record["name"] == key:
                 return record["content"]
-        return None  # Return None if not found, as per ChallengeSolver's __getitem__ behavior
+        return None
 
     def delete_challenge(self, key: str, domain: str):
         if key not in self.challenges_map:
-            print(f"CloudflareChallengeSolver.delete: Not found Skipping  key={key}  record_id={record_id}")
+            print(f"CloudflareChallengeSolver.delete: Not found Skipping  key={key}  domain={domain}")
             return
+        if domain is None:
+            domain = key.replace("_acme-challenge.", "")
 
         record_id = self.challenges_map[key]
-        base_domain = self.cloudflare.determine_registered_domain(domain)
-        self.cloudflare.delete_record(record=record_id, domain=base_domain)
+        self.cloudflare.delete_record(record=record_id, domain=domain)
         del self.challenges_map[key]
         print(f"CloudflareChallengeSolver: Deleted challenge for {key} with record ID {record_id}")
 
@@ -65,20 +63,27 @@ class CloudflareChallengeSolver(ChallengeSolver):
             records = self.cloudflare.list_txt_records(zone_name)
             for record in records:
                 if record["type"] == "TXT" and record["name"].startswith("_acme-challenge"):
-                    print(f"CloudflareChallengeSolver: Deleting old challenge record {record['name']} in zone {zone_name}")
+                    print(f"Cloudflare [{zone_name}\t\t]: Deleting dangling challenge record {record['name']}")
                     try:
                         self.cloudflare.delete_record(record["id"], zone_name)
                     except CertApiException as e:
-                        print(f"CloudflareChallengeSolver: Warning - Failed to delete record {record['name']} in zone {zone_name}: {e.message} - {e.detail}")
+                        print(
+                            f"CloudflareChallengeSolver: Warning - Failed to delete record {record['name']} in zone {zone_name}: {e.message} - {e.detail}"
+                        )
                     except Exception as e:
-                        print(f"CloudflareChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in zone {zone_name}: {e}")
+                        print(
+                            f"CloudflareChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in zone {zone_name}: {e}"
+                        )
         except CertApiException as e:
             print(f"CloudflareChallengeSolver: Error listing challenges in zone {zone_name}: {e.message} - {e.detail}")
         except Exception as e:
-            print(f"CloudflareChallengeSolver: An unexpected error occurred while listing challenges in zone {zone_name}: {e}")
+            print(
+                f"CloudflareChallengeSolver: An unexpected error occurred while listing challenges in zone {zone_name}: {e}"
+            )
 
     def cleanup_old_challenges(self):
         zones = self.cloudflare._get_zones()
+        print(f"Cloudflare: Scanning dangling acme challenges and deleting them...")
         with ThreadPoolExecutor(max_workers=len(zones)) as executor:
             executor.map(self._cleanup_zone_challenges, zones)
 

certapi-0.4.6/src/certapi/challenge_solver/dns/cloudflare/cloudflare_client.py

@@ -0,0 +1,134 @@
+import json
+import time
+from os import getenv
+from certapi.errors import CertApiException, HttpError, DomainNotOwnedException
+from certapi.http.HttpClientBase import HttpClientBase
+from urllib.parse import urlencode
+from urllib.request import Request
+
+
+class Cloudflare(HttpClientBase):
+    name = "cloudflare"
+
+    def __init__(self, api_key: str = None):
+        if not api_key:
+            api_key = getenv("CLOUDFLARE_API_KEY")
+            if not api_key:
+                raise CertApiException("CLOUDFLARE_API_KEY not found in environment", step="Cloudflare.__init__")
+
+        headers = {"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"}
+        super().__init__("https://api.cloudflare.com/client/v4", headers, auto_retry=True)
+        self._zones_cache = None
+        self._zones_cache_time = 0  # Unix timestamp of last cache update
+
+    def _get_zones(self):
+        """Fetch and cache Cloudflare zones"""
+        # Cache for 1 day (86400 seconds)
+        if self._zones_cache and (time.time() - self._zones_cache_time) < 86400:
+            return self._zones_cache
+
+        api_url = f"{self.api_base_url}/zones?per_page=50"
+        response = self._get(api_url, step="Cloudflare Get Zones")
+
+        zones = response.json()["result"]
+        self._zones_cache = zones
+        self._zones_cache_time = time.time()
+        return zones
+
+    def _get_zone_id_(self, domain):
+        """Determine Cloudflare Zone ID for a given domain"""
+        zones = self._get_zones()
+        for zone in zones:
+            if zone["name"] == domain:
+                return zone["id"]
+
+    def _get_zone_id(self, domain):
+        """Determine Cloudflare Zone ID for a given domain"""
+        zone_id = self._get_zone_id_(domain)
+        if zone_id is None:
+            raise DomainNotOwnedException(
+                "No Cloudflare zone found for domain", detail={"domain": domain}, step="Cloudflare Get Zone ID"
+            )
+
+    def _determine_zone_id(self, domain: str) -> str:
+        """
+        Determine the registered domain in Cloudflare and return its Zone ID.
+        This method encapsulates the logic of finding the correct zone for a given domain.
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        zone_id = self._get_zone_id_(registered_domain)
+        return zone_id
+
+    def determine_registered_domain(self, domain: str) -> str:
+        """
+        Determine the registered domain in Cloudflare for a given (sub)domain.
+        This method iterates through parts of the domain to find a matching Cloudflare zone.
+        """
+        parts = domain.split(".")
+        err = None
+        for i in range(len(parts)):
+            potential_domain = ".".join(parts[i:])
+            if self._get_zone_id_(potential_domain) is not None:
+                return potential_domain
+
+        raise DomainNotOwnedException(
+            "No Cloudflare zone found for " + domain, detail={"domain": domain}, step="Cloudflare Get Zone ID"
+        )
+
+    def list_txt_records(self, domain: str, name_filter: str = None) -> list:
+        """
+        Lists TXT records for a given domain, optionally filtered by name.
+        Returns a list of dictionaries, each representing a TXT record.
+        """
+        zone_id = self._determine_zone_id(domain)
+        params = {"type": "TXT"}
+        if name_filter:
+            params["name"] = name_filter
+
+        api_url = f"{self.api_base_url}/zones/{zone_id}/dns_records?{urlencode(params)}"
+
+        response = self._get(api_url, step="Cloudflare List TXT Records")
+
+        result = response.json()
+        if not result.get("success"):
+            raise CertApiException(
+                "Unknown error listing TXT records",
+                detail=result.get("errors", "Unknown error listing TXT records"),
+                step="Cloudflare List TXT Records",
+            )
+
+        return result["result"]
+
+    def create_record(self, name, data, domain):
+        """
+        Create DNS record
+        Params:
+            name, string, record name (e.g., _acme-challenge.example.com)
+            data, string, record data (e.g., ACME challenge token)
+            domain, string, dns domain (e.g., example.com) - This will be used to determine the registered zone.
+        Return:
+            record_id, string, created record id
+        """
+        zone_id = self._determine_zone_id(domain)
+        api_url = "{0}/zones/{1}/dns_records".format(self.api_base_url, zone_id)
+        request_data = {
+            "type": "TXT",
+            "name": name,
+            "content": data,
+            "ttl": 120,  # Cloudflare minimum TTL for TXT is 120 seconds
+            "proxied": False,
+        }
+        response = self._post(api_url, json_data=request_data, step="Cloudflare Create Record")
+        result = response.json()
+        return result["result"]["id"]
+
+    def delete_record(self, record, domain):
+        """
+        Delete DNS record
+        Params:
+            record, string, record id number
+            domain, string, dns domain - This will be used to determine the registered zone.
+        """
+        zone_id = self._determine_zone_id(domain)
+        api_url = "{0}/zones/{1}/dns_records/{2}".format(self.api_base_url, zone_id, record)
+        self._delete(api_url, step="Cloudflare Delete Record")

{certapi-0.4.4 → certapi-0.4.6}/src/certapi/challenge_solver/dns/digitalocean/digitalocean_challenge_solver.py

@@ -1,9 +1,10 @@
 import os
+import time
 from collections.abc import MutableMapping
-from typing import Literal
+from typing import Literal, Callable, Any
 from ...ChallengeSolver import ChallengeSolver
 from .digitalocean_client import DigitalOcean
-from certapi.errors import CertApiException
+from certapi.errors import CertApiException, NetworkError
 
 
 class DigitalOceanChallengeSolver(ChallengeSolver):
@@ -20,29 +21,25 @@ class DigitalOceanChallengeSolver(ChallengeSolver):
         as a registered zone.
         """
         try:
-            self.digitalocean.determine_domain(domain)
+            self.digitalocean.determine_registered_domain(domain)
             return True
         except CertApiException as e:
             # Log the exception or handle it as needed, but return False as it doesn't support the domain
             print(f"DigitalOceanChallengeSolver.supports_domain: {e.message} - {e.detail}")
             return False
-        except Exception as e:
-            # Catch any other unexpected exceptions
-            print(f"DigitalOceanChallengeSolver.supports_domain: An unexpected error occurred: {e}")
-            return False
 
     def save_challenge(self, key: str, value: str, domain=None):
         # key example: _acme-challenge.sub.example.com
         # value example: ACME_CHALLENGE_TOKEN
-        base_domain = self.digitalocean.determine_domain(domain)
+        base_domain = self.digitalocean.determine_registered_domain(domain)
 
         record_id = self.digitalocean.create_record(name=key, data=value, domain=base_domain)
         self.challenges_map[key] = record_id
         print(f"DigitalOceanChallengeSolver: Saved challenge for {key} with record ID {record_id}")
 
     def get_challenge(self, key: str, domain: str) -> str:
-        base_domain = self.digitalocean.determine_domain(domain)
-        records = self.digitalocean.list_records(base_domain, name_filter=key)
+        base_domain = self.digitalocean.determine_registered_domain(domain)
+        records = self.digitalocean.list_txt_records(base_domain, name_filter=key)
         for record in records:
             if record["name"] == key:
                 return record["data"]  # DigitalOcean API returns 'data' for TXT record content
@@ -53,7 +50,7 @@ class DigitalOceanChallengeSolver(ChallengeSolver):
             raise KeyError(f"Challenge {key} not found in store (no record_id stored).")
 
         record_id = self.challenges_map[key]
-        base_domain = self.digitalocean.determine_domain(domain)
+        base_domain = self.digitalocean.determine_registered_domain(domain)
         self.digitalocean.delete_record(record=record_id, domain=base_domain)
         del self.challenges_map[key]
         print(f"DigitalOceanChallengeSolver: Deleted challenge for {key} with record ID {record_id}")
@@ -63,20 +60,30 @@ class DigitalOceanChallengeSolver(ChallengeSolver):
         for domain_obj in domains:
             domain_name = domain_obj["name"]
             try:
-                records = self.digitalocean.list_records(domain_name)
+                records = self.digitalocean.list_txt_records(domain_name)
                 for record in records:
                     if record["type"] == "TXT" and record["name"].startswith("_acme-challenge"):
-                        print(f"DigitalOceanChallengeSolver: Deleting old challenge record {record['name']} in domain {domain_name}")
+                        print(
+                            f"DigitalOceanChallengeSolver: Deleting old challenge record {record['name']} in domain {domain_name}"
+                        )
                         try:
                             self.digitalocean.delete_record(record["id"], domain_name)
                         except CertApiException as e:
-                            print(f"DigitalOceanChallengeSolver: Warning - Failed to delete record {record['name']} in domain {domain_name}: {e.message} - {e.detail}")
+                            print(
+                                f"DigitalOceanChallengeSolver: Warning - Failed to delete record {record['name']} in domain {domain_name}: {e.message} - {e.detail}"
+                            )
                         except Exception as e:
-                            print(f"DigitalOceanChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in domain {domain_name}: {e}")
+                            print(
+                                f"DigitalOceanChallengeSolver: Warning - An unexpected error occurred while deleting record {record['name']} in domain {domain_name}: {e}"
+                            )
             except CertApiException as e:
-                print(f"DigitalOceanChallengeSolver: Error listing challenges in domain {domain_name}: {e.message} - {e.detail}")
+                print(
+                    f"DigitalOceanChallengeSolver: Error listing challenges in domain {domain_name}: {e.message} - {e.detail}"
+                )
             except Exception as e:
-                print(f"DigitalOceanChallengeSolver: An unexpected error occurred while listing challenges in domain {domain_name}: {e}")
+                print(
+                    f"DigitalOceanChallengeSolver: An unexpected error occurred while listing challenges in domain {domain_name}: {e}"
+                )
 
     def __iter__(self):
         # This is tricky as we can't easily iterate all challenges across all domains

certapi-0.4.6/src/certapi/challenge_solver/dns/digitalocean/digitalocean_client.py

@@ -0,0 +1,91 @@
+import time
+from os import getenv
+from certapi.errors import CertApiException, DomainNotOwnedException
+from certapi.http.HttpClientBase import HttpClientBase
+
+
+class DigitalOcean(HttpClientBase):
+    name = "digitalocean"
+
+    def __init__(self, api_key: str = None):
+        if not api_key:
+            api_key = getenv("DIGITALOCEAN_API_KEY")
+            if not api_key:
+                raise CertApiException("DIGITALOCEAN_API_KEY not found in environment", step="DigitalOcean.__init__")
+
+        headers = {"Content-Type": "application/json", "Authorization": f"Bearer {api_key}"}
+        super().__init__("https://api.digitalocean.com/v2/domains", headers, auto_retry=True)
+        self._domains_cache = None
+        self._domains_cache_time = 0  # Unix timestamp of last cache update
+
+    def _get_domains(self):
+        """Fetch and cache DigitalOcean domains"""
+        # Cache for 1 day (86400 seconds)
+        if self._domains_cache and (time.time() - self._domains_cache_time) < 86400:
+            return self._domains_cache
+
+        response = self._get(self.api_base_url, step="DigitalOcean Get Domains")
+        domains = response.json()["domains"]
+        self._domains_cache = domains
+        self._domains_cache_time = time.time()
+        return domains
+
+    def determine_registered_domain(self, domain: str) -> str:
+        """
+        Determine the registered domain in DigitalOcean for a given (sub)domain.
+        This method iterates through parts of the domain to find a matching DigitalOcean domain.
+        """
+        domains = self._get_domains()
+        domain_parts = domain.split(".")
+        for i in range(len(domain_parts)):
+            sub_domain = ".".join(domain_parts[i:])
+            for d in domains:
+                if d["name"] == sub_domain:
+                    return sub_domain
+        raise DomainNotOwnedException(
+            "No DigitalOcean domain found for " + domain,
+            detail={"domain": domain},
+            step="DigitalOcean Determine Domain",
+        )
+
+    def list_txt_records(self, domain: str, name_filter: str = None) -> list:
+        """
+        Lists TXT records for a given domain, optionally filtered by name.
+        Returns a list of dictionaries, each representing a TXT record.
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        api_url = f"{self.api_base_url}/{registered_domain}/records"
+
+        response = self._get(api_url, step="DigitalOcean List TXT Records")
+
+        all_records = response.json()["domain_records"]
+
+        if name_filter:
+            filtered_records = [r for r in all_records if r["name"] == name_filter and r["type"] == "TXT"]
+        else:
+            filtered_records = [r for r in all_records if r["type"] == "TXT"]
+
+        return filtered_records
+
+    def create_record(self, name, data, domain):
+        """
+        Create DNS record
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        api_url = f"{self.api_base_url}/{registered_domain}/records"
+        request_data = {
+            "type": "TXT",
+            "name": name,
+            "data": data,
+            "ttl": 300,
+        }
+        response = self._post(api_url, json_data=request_data, step="DigitalOcean Create Record")
+        return response.json()["domain_record"]["id"]
+
+    def delete_record(self, record, domain):
+        """
+        Delete DNS record
+        """
+        registered_domain = self.determine_registered_domain(domain)
+        api_url = f"{self.api_base_url}/{registered_domain}/records/{record}"
+        self._delete(api_url, step="DigitalOcean Delete Record")