After receiving a badNonce error, the call can be safely retried. Nonce errors can happen unexpectedly based on an unknown expiration date or server-side changes. Rather than force the caller handle these errors, retryPostJWS will keep retrying until success or a different error. According to the spec, the error returned should be "urn:ietf:params:acme:error:badNonce", but the error that Let's Encrypt returns is "urn:acme:error:badNonce" so we just check the suffix. Fixes golang/go#19703 Change-Id: Id15012dff91e51d28ed8bc54f13a6212186cb7df Reviewed-on: https://go-review.googlesource.com/40130 Run-TryBot: Alex Vaghin <ddos@google.com> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Alex Vaghin <ddos@google.com>