OCSP with LetsEncrypt Used to Work But Now Doesn't

[jsha]

@philpennock

Is this anything we've done wrong to trigger it? Would a sleep N between getting the new cert and requesting the first OCSP staple for it help reduce the likelihood of problems?

For now, a sleep 1 after getting the cert and before requesting OCSP for the first time will help avoid caching issues like this. We're planning to fix this soonish by making the OCSP generation a blocking part of certificate generation.