Yeah, I concur. I reviewed the logs from my earlier tests using --dry-run with --server and Certbot is ignoring the --server value when --dry-run is set. I am testing against the latest v5.1. I mistakenly concluded --dry-run with --server for prod deactivated prod. But, what actually happened was Certbot ignored --server. I should have checked its logs ![]()
This is pretty clear from the Certbot logs. At the top it shows options used. You can see a setting for --server (prod) is set but all the ACME API requests to go LE staging.
Certbot v4 was the first to support ARI and there were some initial issues / fixes related to sending the ARI request to the wrong server with --dry-run. This is likely when this regressed. As you note, the Certbot docs are clear that --server should be allowed but it is not. From the --dry-run docs:
The test server may be overridden with --server.
And in another section it provides a caution that only makes sense if --server works with --dry-run
--dry-runuses the Letβs Encrypt staging server, unless--serveris specified on the CLI or in the cli.ini configuration file. Take caution when using--dry-runwith a custom server, as it may cause real certificates to be issued and discarded.
Supporting this is pretty important as Let's Encrypt is not the only CA that Certbot supports. Ignoring --server means people using other CA can't test the same way.
Not sure I'll have time today to make a report to EFF. If they've dropped support for this feature the docs need updating.