Yeah HSTS is a bit of a pain here for visitors, as yes browsers will insist on having https - and as you say, Voice can't really try to get a certificate until it knows that the DNS is correct. Well I suppose in theory it could, but if we did lots of letsencrypt requests that failed we would probably get blocked once the DNS started working!

The Voice servers are using the standard DNS resolver provided by our hosting company (UpCloud), I'm not aware that it has longer timeouts than any other!

Note also that Voice doesn't constantly check - so you would find you get a faster switch if you click the Recheck button periodically. So, update DNS, wait 10 minutes, Recheck, repeat until it says OK!

There would still be a short delay before the SSL cert is created, but it should be a lot les than 15-20 hours!

Another option for a seamless switch would be to use a service like CloudFlare for the SSL provision on the old site, then switch this over to the Voice site once it's ready. Configure the custom domain in the normal way the point CloudFlare to the Voice IP address. This is a bit less tested, but it does work, and in theory would have zero downtime, as you aren't waiting for Voice to create the certificate.

Thanks

Joe