Renewal aborts on transient 404 when downloading a just-issued certificate

Welcome

• Yes, I'm using a binary release or the library within the two latest releases.
• Yes, I've searched for similar issues on GitHub and didn't find any.

How do you use lego?

Binary

Effective version of lego

v5.4.0

Logs

could not obtain the certificate for "example.com": certificates: one or more domains had a
problem: [example.com: unable to communicate with the API server: error: Post
"https://acme-v02.api.letsencrypt.org/acme/cert/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx":
POST <same URL> giving up after 1 attempt(s): acme: error: 404 ::
urn:ietf:params:acme:error:malformed :: Certificate not found]

What did you expect to see?

lego keeps polling the certificate URL until --cert.timeout expires. The poll loop already fires every 500ms over the default 30s, so one 404 right after finalize shouldn't fail the whole renewal.

What did you see instead?

Validation and finalize both succeed, but the POST-as-GET on the certificate URL sometimes returns 404 :: Certificate not found. That's replica lag on Let's Encrypt's side, a known issue there ("the 404 bug"). lego aborts on the first 404 because checkResponse (certificate/certificates.go) returns the error straight out of the wait.For polling loop. Nothing retries a 404: the library's retrievablePost only retries badNonce, and the CLI's retryablehttp policy excludes 404.

Reproduction steps

This is intermittent on LE production (http-01 renewal) and can't be triggered on demand. We notice it because we renew about 4 certificates every hour, and when this 404 issue happens we restart the whole renewal process, but this counts to the 5 renewal limit per cert per week.

Go environment (if applicable)

No response

In which context are you using lego?

Professional use

Supporting the Maintainers

• Yes, I find this project useful, and I appreciate the work done by the maintainers.
• Yes, I have starred this repository to help others find it.
• Yes, I have sponsored this project to keep the project stable and maintained.

Confirmation

• Yes, I've included all the information above (version, usage, etc.).