Can I run certbot certonly --test-cert to get a test certificate and save the file then run certbot renew --test-cert --force-renewal to update it and save the new file? Shouldn't manual-auth-hook and manual-cleanup-hook to be called both times to manage DNS records but it doesn't happen. Is there a different way to do it?
Use: certbot renew --dry-run
Optionally add --cert-name X if just testing one certificate (see: certbot certificates)
--force-renewal forces Certbot to perform renewal even if the cert is not due (by age or ARI). But, successful challenges are retained by Let's Encrypt and the manual auth hooks are only used when a fresh challenge is needed. The --dry-run option deactivates prior challenges.
Note --dry-run will not get a fresh cert but will not disturb any prior cert even if using --test-cert for the prior one.
See the profiles page for the "Authorization reuse period" that applies to eachprofile: Profiles - Let's Encrypt. The default profile reuses challenges for 30 days
Update: I think we covered this back in May 
Certonly --force-renewal - #2 by MikeMcQ
But, successful challenges are retained by Let's Encrypt and the manual auth hooks are only used when a fresh challenge is needed. The --dry-run option deactivates prior challenges.
I want to test getting a new test certificate and save the file so I can use renew to test updating it. I want the hooks to run both times.
--test-cert saves the file and --dry-run makes sure the hooks run so I need both?
certbot --test-cert --dry-run certonly -d example.com
certbot --test-cert --dry-run renew
For the real certificate I do this?
certbot certonly -d example.com
certbot renew
What's the difference between not disturbing prior certs and deactivating prior challenges aren't they saying opposite things?
The --dry-run sets the Let's Encrypt Staging server. It also deauthorizes any prior saved authorizations for that domain name (for your account). That means Certbot is performing all the steps very much like the first time it got a cert for that domain and has to satisfy the challenge. However, with --dry-run Certbot won't actually save the cert that LE issues as a result of successful process.
Using --test-cert only change the ACME Server to use the LE Staging server. Otherwise everything is the same as when getting a production cert. If there was a previous successful challenge it may be reused by the LE Staging server (per the duration described in the related profile). Certbot will save the cert that was issued and may even clobber a production cert. It warns if running in interactive mode about this.
You can't actually do exactly what you want by having challenges deauthorized each time and saving a LE staging cert. Certbot does not have such an option. Other ACME Clients may allow this. You need to adapt your testing scheme accordingly and rely more on unit-testing your hooks.
You could use the TLSSERVER or maybe SHORTLIVED profiles to shorten the length of time an authorization (challenge) is reused. Check the profiles doc I previously linked for the durations.
But, why is it important for you to have --dry-run download and save the LE staging cert to your local system? --dry-run is best for testing that changes related to challenges will still work for next production renewal. Not saving the test cert (and clobbering a production cert) is a feature.
Yes, you use certonly once to get the original cert. The renew is run by a cronjob or more likely a systemd timer and usually twice / day. The cronjob or timer is usually setup during install of Certbot but this depends on your system and method of install. See the Certbot docs for commands to check how the renew command runs.
To test your manual hook just use
certbot renew --dry-run
Each --dry-run will invoke your hooks because, as I described in previous post, it deactivates any prior authorizations (challenges) for that domain so it has to be done again.
I can see why you might want to do that but you don't have to test that Certbot will update your certificate after a successful renewal. That is the EFF's Certbot's team job to test that If the --dry-run works that proves your hooks worked properly and so the production renew should be fine. Just monitor the cert at the first expected renewal to ensure it happened.
You haven't shown all the other options but you may need to use a --deploy-hook or just another way to reload the service using the cert. Many services (like Apache or nginx) need to be reloaded to start using a newly saved cert.