Let max retries exit the CA processing step instead of retryAfter

[ignoramous]

For background see:

• [Question]How many domains can a zeroSSL 90 day wildcard certificate support at most #6576

[ignoramous]

Emitting _err from a few relevant places so GitHub's built-in Copliot will help catch the issue (--debug 2 generates a LOT of logs and options like Copilot help reduce time it takes to parse them).

Even after these changes, a few places with return 1 emit logs as _info or _debug or not emitted at all (should be probably changed to _err).

[Neilpang]

if the retryafter is too large, it usually means the ca is refusing your requests. so we should give up.
Maybe 600 is not that large to give up. how about make it 3600?

[ignoramous]

if the retryafter is too large, it usually means the ca is refusing your requests ... Maybe 600 is not that large to give up. how about make it 3600?

What I've found with ZeroSSL is, when there are 8+ domains in a single cert request, it takes a while (I've seen it take 10mins). But their retrtAfter is set to 84600 (1 day), which is over-the-top, as the response is usually available within 10mins.