Yep, I agree this is a big* problem, and I've written a patch to fix it in certbot-route53
, so all records are put in place at once, and waited on together: Restore parallel waiting to Route53 plugin by jsha · Pull Request #5712 · certbot/certbot · GitHub. I think our goal here should be to get more Certbot plugins, and more ACME clients in general, to implement parallel waiting. That's already the norm for HTTP validation. My understanding is that a popular DNS updating library, lexicon
, might be one of the reasons serial updating is so common, but AFAIK the Certbot team is working with the maintainers to improve the state of things.
*At least, for initial issuance, and for debugging problems. For background renewal, it's not important.