the 1s default was not always long enough.

roles/nginx/tasks/main.yml

@@ -47,7 +47,7 @@
   when: certbot_authenticator == 'gandi'
 
 - name: Generate TLS certificates via nginx
-  command: /root/certbot-venv/bin/certbot certonly --nginx --cert-name {{ nginx_domain | quote }} -n --agree-tos -d {{ nginx_certificates | join(",") | quote }} -m {{ admin_email | quote }}
+  command: /root/certbot-venv/bin/certbot certonly --nginx --nginx-sleep-seconds 10 --cert-name {{ nginx_domain | quote }} -n --agree-tos -d {{ nginx_certificates | join(",") | quote }} -m {{ admin_email | quote }}
   register: certbot
   changed_when: '"no action taken." not in certbot.stdout'
   when: certbot_authenticator == 'nginx'