some weird situation i ended up with last week

howto/tls.md

@@ -80,9 +80,43 @@ Then remove the file.
 
 ## Pager playbook
 
- * if you get email from Digicert, ask the Tor Browser team, they use
-   it to sign code (see "Design" below for more information about
-   which CAs are in use)
+### Digicert validation emails
+
+If you get email from DigiCert Validation, ask the Tor Browser team,
+they use it to sign code (see "Design" below for more information
+about which CAs are in use)
+
+### Waiting for master to update...
+
+If a push to the Let's encrypt repository loops on a warning like:
+
+    remote: Waiting for master to update torproject.net (for _acme-challenge.pages.torproject.net) from 2021012804.  Currently at 2021012804..
+
+It might be because the Let's Encrypt hook is not *really* changing
+the zonefile, and *not* incrementing the serial number (as hinted
+above). This can happen if you force-push an empty change to the
+repository and/or a previous hook failed to get a cert or was
+interrupted.
+
+The trick then is to abort the above push, then *manually edit* (yes)
+the zonefile in (for the `torproject.net` domain, in the above
+example):
+
+    $EDITOR /srv/dns.torproject.org/var/generated/torproject.net
+
+... and remove the ` _acme-challenge` line. Then you should somehow
+update the zone with another, unrelated change, to trigger a serial
+number change. For example, you could add a random A record:
+
+    ynayMF5xckel8uGpo0GdVEQjM7X9    IN TXT "random record to trigger a zone rebuild, should be removed"
+
+And push *that* change (in `dns/domains.git`). Then the serial number
+will change, and the infrastructure will notice the `_acme-challenge`
+record is gone. Then you can re-do the certification process and it
+should go through.
+
+Don't forget to remove the random `TXT` record created above once
+everything is done.
 
 ## Disaster recovery