From 9780e22792c514cee6f7e92b4ad34d09e233b7ab Mon Sep 17 00:00:00 2001
From: Junker der Provinz <133605895+junkerderprovinz@users.noreply.github.com>
Date: Sat, 24 Oct 2026 19:08:12 +0200
Subject: [PATCH] Skip propagation seconds option for Route 53 DNS challenge

certbot deprecated --dns-route53-propagation-seconds in 2.5.0 and
removed it in 3.0.0, so requesting a Route 53 certificate with a
propagation value fails with "unrecognized arguments". The plugin
waits for the record through the AWS GetChange API instead.

Fixes #4702
Fixes #5414

Co-authored-by: Pascaru <23747773+pascaruchan@users.noreply.github.com>
---
 backend/internal/certificate.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/backend/internal/certificate.js b/backend/internal/certificate.js
index 9f81b764d..77d585f44 100644
--- a/backend/internal/certificate.js
+++ b/backend/internal/certificate.js
@@ -862,7 +862,8 @@ const internalCertificate = {
 		if (hasConfigArg) {
 			args.push(`--${dnsPlugin.full_plugin_name}-credentials`, credentialsLocation);
 		}
-		if (certificate.meta.propagation_seconds !== undefined) {
+		// The route53 plugin waits for the change through the AWS API and has no propagation option
+		if (certificate.meta.propagation_seconds !== undefined && certificate.meta.dns_provider !== "route53") {
 			args.push(
 				`--${dnsPlugin.full_plugin_name}-propagation-seconds`,
 				certificate.meta.propagation_seconds.toString(),