Repository: certbot/certbot

Issue:
--dns-route53-propagation-seconds not respected?
We got a report that `--dns-route53-propagation-seconds` is not respected. Quickly looking at the code, this seems like a real problem because that flag is added by the common DNS authenticator class in Certbot and used in the `perform` method which the route53 plugin overrides without calling the parent class.

It looks like the route53 plugin has some additional logic to wait for DNS changes to propagate, but I think we should either respect that flag or deprecate it and remove it from the plugin in the future.


Discussion:
We've made a lot of changes to Certbot since this issue was opened. If you still have this issue with an up-to-date version of Certbot, can you please add a comment letting us know? This helps us to better see what issues are still affecting our users. If there is no activity in the next 30 days, this issue will be automatically closed.
This is still valid.
I can confirm this is still valid and the default timeout of 10 seconds can cause verification failure in large hosted zones. Is it possible to increase the default timeout from 10 seconds until this issue is resolved? Taking a look at Cloudtrail events it appears this process can take over 30 seconds. 

![Screenshot 2023-02-17 at 2 25 50 PM](https://user-images.githubusercontent.com/72095847/219805572-adf4d508-2043-4cec-9a57-324b46a1a16b.png)

>I can confirm this is still valid and the default timeout of 10 seconds can cause verification failure in large hosted zones

As bmw mentioned, the plugin does not use the 10 second sleep, but instead uses the Route53 GetChange API to confirm that each change request has transitioned into the `INSYNC` state (propagated to all Route53 nameservers).

This should be in theory sufficient to guarantee that the ACME server can see the DNS records.

I'm not super keen on reviewing https://github.com/certbot/certbot/pull/9591 unless we have a working theory about why (or if) failures are happening. If we want to do this off a single report, I'd like at least to see the Certbot logs showing the plugin doing its job and failing. Thanks!

Otherwise, I'm in favor of deprecating the flag.
I can say that for @jgoldfarb1123 's issue (coworker) it was unrelated, we had a CAA failure that wasn't showing up in certbot logs. I'm going to close my draft PR as the feature isn't really necessary, but some indication should maybe be given by the route53 provider that it isn't going to respect that setting, in case someone passes it in.

Resolving patch:
diff --git a/certbot-dns-route53/certbot_dns_route53/__init__.py b/certbot-dns-route53/certbot_dns_route53/__init__.py
--- a/certbot-dns-route53/certbot_dns_route53/__init__.py
+++ b/certbot-dns-route53/certbot_dns_route53/__init__.py
@@ -8,17 +8,6 @@
    `certbot.eff.org <https://certbot.eff.org/instructions#wildcard>`_, choosing your system and
    selecting the Wildcard tab.
 
-Named Arguments
----------------
-
-========================================  =====================================
-``--dns-route53-propagation-seconds``     The number of seconds to wait for DNS
-                                          to propagate before asking the ACME
-                                          server to verify the DNS record.
-                                          (Default: 10)
-========================================  =====================================
-
-
 Credentials
 -----------
 Use of this plugin requires a configuration file containing Amazon Web Sevices
diff --git a/certbot-dns-route53/certbot_dns_route53/_internal/dns_route53.py b/certbot-dns-route53/certbot_dns_route53/_internal/dns_route53.py
--- a/certbot-dns-route53/certbot_dns_route53/_internal/dns_route53.py
+++ b/certbot-dns-route53/certbot_dns_route53/_internal/dns_route53.py
@@ -3,6 +3,7 @@
 import logging
 import time
 from typing import Any
+from typing import Callable
 from typing import DefaultDict
 from typing import Dict
 from typing import List
@@ -12,9 +13,11 @@
 from botocore.exceptions import NoCredentialsError
 
 from acme.challenges import ChallengeResponse
+from certbot import achallenges
 from certbot import errors
 from certbot.achallenges import AnnotatedChallenge
 from certbot.plugins import dns_common
+from certbot.util import add_deprecated_argument
 
 logger = logging.getLogger(__name__)
 
@@ -44,6 +47,17 @@ def __init__(self, *args: Any, **kwargs: Any) -> None:
     def more_info(self) -> str:
         return "Solve a DNS01 challenge using AWS Route53"
 
+    @classmethod
+    def add_parser_arguments(cls, add: Callable[..., None],  # pylint: disable=arguments-differ
+                             default_propagation_seconds: int = 10) -> None:
+        add_deprecated_argument(add, 'propagation-seconds', 1)
+
+    def auth_hint(self, failed_achalls: List[achallenges.AnnotatedChallenge]) -> str:
+        return (
+            'The Certificate Authority failed to verify the DNS TXT records created by '
+            '--dns-route53. Ensure the above domains have their DNS hosted by AWS Route53.'
+        )
+
     def _setup_credentials(self) -> None:
         pass
 


Test patch:
diff --git a/certbot-dns-route53/tests/dns_route53_test.py b/certbot-dns-route53/tests/dns_route53_test.py
--- a/certbot-dns-route53/tests/dns_route53_test.py
+++ b/certbot-dns-route53/tests/dns_route53_test.py
@@ -85,6 +85,13 @@ def test_cleanup_client_error(self):
 
         self.auth.cleanup([self.achall])
 
+    def test_parser_arguments(self) -> None:
+        from certbot.util import DeprecatedArgumentAction
+        m = mock.MagicMock()
+        self.auth.add_parser_arguments(m)  # pylint: disable=no-member
+        m.assert_any_call('propagation-seconds', action=DeprecatedArgumentAction,
+                          help=mock.ANY, nargs=1)
+
 
 class ClientTest(unittest.TestCase):
     # pylint: disable=protected-access