ocsp fetch delay required after new cert was issued

If you issue a new cert, then the ocsp information for that certificate is sometimes not yet available at the ocsp servers. In such situations a must-staple certificat will be unusable. A small delay between the certificate issuing and the ocsp fetching would help already but it looks like this is not possible to do just by changing the configuration or hook script. A "oscp-fetch-delay-after-cert-issuing" variable is needed I think, a fixed delay of something like 5s might also be okay, but I can imagine that some CAs might need an even longer sleep here.

Trace the shell client's certificate-issuing flow through its OCSP-fetching step, and inspect how configuration and hook scripts currently participate. Confirm how a delay could be represented and verify that the resulting behavior allows must-staple certificates to work when OCSP data is not immediately available.

Written by the indexing model from the issue text.