Thanks to @rahnas we identified a second issue, where Certbot sending the wrong Content-Type when it downloads the certificate during a --dry-run. This was fixed in Certbot v0.32.0.
In Ubuntu, make sure you upgrade Certbot to 0.31.0-2 from the PPA, which has the fix backported.
This should not affect any live renewals or real certificates. It only affects --dry-run.
(@cpu did EnforceV2ContentType get enabled today as well?)