Certbot: deactivate authorization(s) (rfc8555#section-7.5.2)

Yeah, I concur. I reviewed the logs from my earlier tests using --dry-run with --server and Certbot is ignoring the --server value when --dry-run is set. I am testing against the latest v5.1. I mistakenly concluded --dry-run with --server for prod deactivated prod. But, what actually happened was Certbot ignored --server. I should have checked its logs :slight_smile:

This is pretty clear from the Certbot logs. At the top it shows options used. You can see a setting for --server (prod) is set but all the ACME API requests to go LE staging.

Certbot v4 was the first to support ARI and there were some initial issues / fixes related to sending the ARI request to the wrong server with --dry-run. This is likely when this regressed. As you note, the Certbot docs are clear that --server should be allowed but it is not. From the --dry-run docs:

The test server may be overridden with --server.

And in another section it provides a caution that only makes sense if --server works with --dry-run

--dry-run uses the Let’s Encrypt staging server, unless --server is specified on the CLI or in the cli.ini configuration file. Take caution when using --dry-run with a custom server, as it may cause real certificates to be issued and discarded.

Supporting this is pretty important as Let's Encrypt is not the only CA that Certbot supports. Ignoring --server means people using other CA can't test the same way.

Not sure I'll have time today to make a report to EFF. If they've dropped support for this feature the docs need updating.