How to avoid challenge failures due to slow propagation of Route53?

Yes. I know some people here recommend having multiple CAs at the ready in general, just in case one has an outage or some other sort of problem. (Wikipedia even goes so far as to have multiple certificates active in all their datacenters so they can easily switch if one CA has an OCSP outage, but most systems don't work on Wikipedia's scale.)

I don't think certbot makes CA fallback simple, but it's not something I've tried. Other software like Caddy will automatically switch as needed, but I don't know how easy it would be to integrate into the AWS ecosystem.

5 Likes

Very useful tech sharing, thanks for your advice, Peter!

3 Likes

Yes, even Google CA.

I am not sure it is clear but Certbot is not doing the DNS query that is failing. Certbot is the ACME Client. The Let's Encrypt ACME Server is the one timing out its own query to validate the TXT record.

No ACME Client can control the timeout durations or retries chosen by the LE Server.

Other Certificate Authorities may work for you not because Certbot behaves different but because they may have a different strategy in their DNS queries that might work for your situation.

I apologize if this just re-states something you already understood. Just reading some of the comments I wasn't sure.

For some other CA's see this comparison

4 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.