It waits for DNS to be set up correctly before trying in the first place, then retries fairly aggressively (with exponential backoff) if needed. Much moreso than tls-setup.sh did.

However, we are also still working through the weird edge cases you get when reality doesn’t match the OT&E, and that occasionally leads to delays until we figure it out. That’s likely what you experienced. -jdw

Automatic TLS didn’t set up correctly because DNS was wrong. Now that it’s correct, I see no way to retry. Guess I just wait.

Doesn’t this present a problem for anyone attempting a fast cutover between hosting providers?

That’s correct. That requirement was why we didn’t think we could do this, but it turns out that they’re happy to allow us to do that as long as we’re the ones holding the private keys. -jdw

I imagine that the service provider integration also involves Let’s Encrypt waiving their individual Terms & Conditions signoff that they would normally require each user to do (besides any technical integration.)