Hi black,
The proper way is to wait a bit longer, or retry automatically until it works.
Normally, it is just a few seconds. However, due to this issue, ad-hoc notifications to our global secondaries currently are ineffective, and our fall-back mechanism triggers all updates instead. The fall-back mechanism checks freshness once a minute, and depending on when exactly your update happened, it may be discovered right away, or after approximately one minute. There should be only very few cases which take longer.
This is currently not possible, but it seems like a reasonable feature! We’d appreciate a feature request on our GitHub.
Here’s another (not very elegant) workaround: You could delegate your _acme-challenge
subdomain to another DNS provider which doesn’t have an anycast deployment. In such a setup, you will see the same state as Let’s Encrypt, so you can proceed with validation immediately once you observe that the challenge has been published.
Stay secure,
Peter