Feature: lock timeout with dynamo.

[yonderblue]

When multiple servers both try to get a cert and none is there yet, the last one will win on the Put and either is valid, so perhaps that is ok but since they will both be requesting a new one it will consume letsencrypt rate limit.

[adrianosela]

This is a good point @Gaillard. I am unsure of what the best way to handle this issue is. Perhaps giving the very first ever "Get()" a random sleep so as to minimize the chance of simultaneous cert creation requests to LE.

However, it may not be that serious, here is why I don't think its too big of a deal:

Even if your first deployment of n replicas, where (n > LE rate limit = 5) fails one of the replicas/containers, at that point you will already have the last of the certs in store, and all successive deployments will succeed to pick up a cert from storage. This includes the replicas that died and restarted when they failed to get a cert directly from acme/autocert; as well as all new deployments.

In terms of security, it may not be great to generate multiple redundant certs and throw all but one away without revoking them.

I will try to think of a good way to handle this situation soon in the future. Thank you for bringing up the issue.

Since the issue does not break the current implementation for DynamoDB, I am tagging this issue as an enhancement.

If you would like to work on this, PRs are welcome.