Automate New Cert Request w/Crypt::LE on IIS DNS challenge

[stevenzhu]

Hi,

Generally speaking, it's fine to wait a few days for the customer to setup his DNS records.

However, the issue is not "record does not exist"...
The last line of the error you supplied clearly states the issue: anti-replay token expired.

Since I have little knowledge on this.... Quoting from an older post (responsed by other user)

@nickmcdonnough

The response in the thread you linked to that is likely related to what your experiencing is this one . Essentially, Boulder only allows X amount of nonces to be active at any time. Once X is reached then Boulder begins invalidating nonces starting with the oldest ones. This means that if you make a request a request to Boulder and then wait a bit it is possible the nonce you received previously will be invalid when you make the next request. I am unfamiliar with the service you’re using so I’m not sure how they handle this.

In conclusion, (technically) you should be able to wait a few hours / days before proceed on validation, but due to Boulder's settings, it's better to proceed validation as soon as the records are ready.

Thank you