diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py
index 54244db2a..0e516b5b0 100644
--- a/letsencrypt/plugins/manual.py
+++ b/letsencrypt/plugins/manual.py
@@ -91,7 +91,7 @@ s.serve_forever()" """
             help="Automatically allows public IP logging.")
 
     def prepare(self):  # pylint: disable=missing-docstring,no-self-use
-        if self.config.noninteractive_mode:
+        if self.config.noninteractive_mode and not self.conf("test-mode"):
             raise errors.PluginError("Running manual mode non-interactively is not supported")
 
     def more_info(self):  # pylint: disable=missing-docstring,no-self-use
diff --git a/letsencrypt/plugins/manual_test.py b/letsencrypt/plugins/manual_test.py
index e16fadd13..e749eb1f9 100644
--- a/letsencrypt/plugins/manual_test.py
+++ b/letsencrypt/plugins/manual_test.py
@@ -23,16 +23,21 @@ class AuthenticatorTest(unittest.TestCase):
     def setUp(self):
         from letsencrypt.plugins.manual import Authenticator
         self.config = mock.MagicMock(
-            http01_port=8080, manual_test_mode=False, manual_public_ip_logging_ok=False)
+            http01_port=8080, manual_test_mode=False,
+            manual_public_ip_logging_ok=False, noninteractive_mode=True)
         self.auth = Authenticator(config=self.config, name="manual")
         self.achalls = [achallenges.KeyAuthorizationAnnotatedChallenge(
             challb=acme_util.HTTP01_P, domain="foo.com", account_key=KEY)]
 
         config_test_mode = mock.MagicMock(
-            http01_port=8080, manual_test_mode=True)
+            http01_port=8080, manual_test_mode=True, noninteractive_mode=True)
         self.auth_test_mode = Authenticator(
             config=config_test_mode, name="manual")
 
+    def test_prepare(self):
+        self.assertRaises(errors.PluginError, self.auth.prepare)
+        self.auth_test_mode.prepare()  # error not raised
+
     def test_more_info(self):
         self.assertTrue(isinstance(self.auth.more_info(), str))
 
diff --git a/letsencrypt/plugins/standalone.py b/letsencrypt/plugins/standalone.py
index cde7041d8..71a17a28e 100644
--- a/letsencrypt/plugins/standalone.py
+++ b/letsencrypt/plugins/standalone.py
@@ -90,6 +90,9 @@ class ServerManager(object):
         logger.debug("Stopping server at %s:%d...",
                      *instance.server.socket.getsockname()[:2])
         instance.server.shutdown()
+        # Not calling server_close causes problems when renewing multiple
+        # certs with `letsencrypt renew` using TLSSNI01 and PyOpenSSL 0.13
+        instance.server.server_close()
         instance.thread.join()
         del self._instances[port]
 
diff --git a/tests/boulder-integration.sh b/tests/boulder-integration.sh
index b6c76ee22..29618b97f 100755
--- a/tests/boulder-integration.sh
+++ b/tests/boulder-integration.sh
@@ -20,17 +20,16 @@ else
   readlink="readlink"
 fi
 
-common() {
-    letsencrypt_test \
+common_no_force_renew() {
+    letsencrypt_test_no_force_renew \
         --authenticator standalone \
         --installer null \
         "$@"
 }
 
-common_no_force_renew() {
-    letsencrypt_test_no_force_renew \
-        --authenticator standalone \
-        --installer null \
+common() {
+    common_no_force_renew \
+        --renew-by-default \
         "$@"
 }
 
@@ -51,21 +50,27 @@ common --domains le3.wtf install \
        --cert-path "${root}/csr/cert.pem" \
        --key-path "${root}/csr/key.pem"
 
+CheckCertCount() {
+    CERTCOUNT=`ls "${root}/conf/archive/le.wtf/cert"* | wc -l`
+    if [ "$CERTCOUNT" -ne "$1" ] ; then
+        echo Wrong cert count, not "$1" `ls "${root}/conf/archive/le.wtf/"*`
+        exit 1
+    fi
+}
+
+CheckCertCount 1
 # This won't renew (because it's not time yet)
-letsencrypt_test_no_force_renew --authenticator standalone --installer null renew
+common_no_force_renew renew
+CheckCertCount 1
+
+# --renew-by-default is used, so renewal should occur
+common renew
+CheckCertCount 2
 
 # This will renew because the expiry is less than 10 years from now
-sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le1.wtf.conf"
-letsencrypt_test_no_force_renew --authenticator standalone --installer null renew
-
-ls "$root/conf/archive/le1.wtf"
-# dir="$root/conf/archive/le1.wtf"
-# for x in cert chain fullchain privkey;
-# do
-#     latest="$(ls -1t $dir/ | grep -e "^${x}" | head -n1)"
-#     live="$($readlink -f "$root/conf/live/le1.wtf/${x}.pem")"
-#     [ "${dir}/${latest}" = "$live" ]  # renewer fails this test
-# done
+sed -i "4arenew_before_expiry = 10 years" "$root/conf/renewal/le.wtf.conf"
+common_no_force_renew renew
+CheckCertCount 3
 
 # revoke by account key
 common revoke --cert-path "$root/conf/live/le.wtf/cert.pem"
diff --git a/tests/integration/_common.sh b/tests/integration/_common.sh
index 9230cc682..e86d087cb 100755
--- a/tests/integration/_common.sh
+++ b/tests/integration/_common.sh
@@ -12,20 +12,8 @@ store_flags="$store_flags --logs-dir $root/logs"
 export root store_flags
 
 letsencrypt_test () {
-    letsencrypt \
-        --server "${SERVER:-http://localhost:4000/directory}" \
-        --no-verify-ssl \
-        --tls-sni-01-port 5001 \
-        --http-01-port 5002 \
-        --manual-test-mode \
-        $store_flags \
-        --text \
-        --no-redirect \
-        --agree-tos \
-        --register-unsafely-without-email \
+    letsencrypt_test_no_force_renew \
         --renew-by-default \
-        --debug \
-        -vvvvvvv \
         "$@"
 }
 
@@ -37,7 +25,7 @@ letsencrypt_test_no_force_renew () {
         --http-01-port 5002 \
         --manual-test-mode \
         $store_flags \
-        --text \
+        --non-interactive \
         --no-redirect \
         --agree-tos \
         --register-unsafely-without-email \