Feature: lock timeout with dynamo. about certcache HOT 1 OPEN

This is a good point @Gaillard. I am unsure of what the best way to handle this issue is. Perhaps giving the very first ever "Get()" a random sleep so as to minimize the chance of simultaneous cert creation requests to LE.

However, it may not be that serious, here is why I don't think its too big of a deal:

Even if your first deployment of n replicas, where (n > LE rate limit = 5) fails one of the replicas/containers, at that point you will already have the last of the certs in store, and all successive deployments will succeed to pick up a cert from storage. This includes the replicas that died and restarted when they failed to get a cert directly from acme/autocert; as well as all new deployments.

In terms of security, it may not be great to generate multiple redundant certs and throw all but one away without revoking them.

I will try to think of a good way to handle this situation soon in the future. Thank you for bringing up the issue.

Since the issue does not break the current implementation for DynamoDB, I am tagging this issue as an enhancement.

If you would like to work on this, PRs are welcome.

from certcache.