No, Peter made good point that --dry-run sets the Let's Encrypt Staging server. You look to be using some other CA since you used --server in your first post. And, LE does not require EAB 
As for --force-renewal, be careful to only use that once and not for your regularly scheduled renew. You'd end up getting a cert each time which might cause problems with your CA.
And, I'd avoid using --deploy-hook for renew command because that should already be in your renewal profile from your first command. See the /etc/letsencrypt/renewal folder for these profiles
I'm not sure my --dry-run suggestion works as-is with alternate CA. I know there was some sort of trick about adding --server URL but not sure if that actually works with --dry-run or was some other context.
Update: I found a previous thread which talks about --dry-run and --server. Should work