diff --git a/letsencrypt/client/client.py b/letsencrypt/client/client.py
index 11c8dbcc7..1843a7839 100644
--- a/letsencrypt/client/client.py
+++ b/letsencrypt/client/client.py
@@ -505,8 +505,6 @@ class Client(object):
         logging.info(
             "Configured Apache for challenges; waiting for verification...")
 
-        print responses
-
         return responses, challenge_objs
 
     def _assign_responses(self, resp, index_list, responses):
diff --git a/letsencrypt/client/tests/challenge_util_test.py b/letsencrypt/client/tests/challenge_util_test.py
new file mode 100644
index 000000000..a03bc47b7
--- /dev/null
+++ b/letsencrypt/client/tests/challenge_util_test.py
@@ -0,0 +1,63 @@
+"""Tests for challenge_util."""
+import M2Crypto
+import mock
+import os
+import pkg_resources
+import re
+import unittest
+
+from letsencrypt.client import challenge_util
+from letsencrypt.client import client
+from letsencrypt.client import CONFIG
+from letsencrypt.client import le_util
+
+
+class DvnsiGenCertTest(unittest.TestCase):
+    """Tests for letsencrypt.client.challenge_util.dvsni_gen_cert."""
+
+    def test_standard(self):
+        """Basic test for straightline code."""
+
+        # This is a helper function that can be used for handling
+        # open context managers more elegantly. It avoids dealing with
+        # __enter__ and __exit__ calls.
+        # http://www.voidspace.org.uk/python/mock/helpers.html#mock.mock_open
+        m_open = mock.mock_open()
+        with mock.patch("letsencrypt.client.challenge_util.open",
+                        m_open, create=True):
+
+            domain = "example.com"
+            dvsni_r = "r_value"
+            r_b64 = le_util.jose_b64encode(dvsni_r)
+            pem = pkg_resources.resource_string(
+                __name__, os.path.join("testdata", "rsa256_key.pem"))
+            key = client.Client.Key("path", pem)
+            nonce = "12345ABCDE"
+            s_b64 = self._call("tmp.crt", domain, r_b64, nonce, key)
+
+            self.assertTrue(m_open.called)
+            self.assertEqual(m_open.call_args[0], ("tmp.crt", 'w'))
+            self.assertEqual(m_open().write.call_count, 1)
+
+            # pylint: disable=protected-access
+            ext = challenge_util._dvsni_gen_ext(
+                dvsni_r, le_util.jose_b64decode(s_b64))
+            self._standard_check_cert(
+                m_open().write.call_args[0][0], domain, nonce, ext)
+
+    def _standard_check_cert(self, pem, domain, nonce, ext):
+        dns_regex = r"DNS:([^, $]*)"
+        cert = M2Crypto.X509.load_cert_string(pem)
+        self.assertEqual(
+            cert.get_subject().CN, nonce + CONFIG.INVALID_EXT)
+
+        sans = cert.get_ext("subjectAltName").get_value()
+
+        exp_sans = set([nonce + CONFIG.INVALID_EXT, domain, ext])
+        act_sans = set(re.findall(dns_regex, sans))
+
+        self.assertEqual(exp_sans, act_sans)
+
+    def _call(self, filepath, name, r_b64, nonce, key):
+        from letsencrypt.client.challenge_util import dvsni_gen_cert
+        return dvsni_gen_cert(filepath, name, r_b64, nonce, key)
diff --git a/letsencrypt/client/tests/testdata/rsa256_key.pem b/letsencrypt/client/tests/testdata/rsa256_key.pem
new file mode 100644
index 000000000..610c8d315
--- /dev/null
+++ b/letsencrypt/client/tests/testdata/rsa256_key.pem
@@ -0,0 +1,9 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIBOgIBAAJBAKx1c7RR7R/drnBSQ/zfx1vQLHUbFLh1AQQQ5R8DZUXd36efNK79
+vukFhN9HFoHZiUvOjm0c+pVE6K+EdE/twuUCAwEAAQJAMbrEnJCrQe8YqAbw1/Bn
+elAzIamndfE3U8bTavf9sgFpS4HL83rhd6PDbvx81ucaJAT/5x048fM/nFl4fzAc
+mQIhAOF/a9o3EIsDKEmUl+Z1OaOiUxDF3kqWSmALEsmvDhwXAiEAw8ljV5RO/rUp
+Zu2YMDFq3MKpyyMgBIJ8CxmGRc6gCmMCIGRQzkcmhfqBrhOFwkmozrqIBRIKJIjj
+8TRm2LXWZZ2DAiAqVO7PztdNpynugUy4jtbGKKjBrTSNBRGA7OHlUgm0dQIhALQq
+6oGU29Vxlvt3k0vmiRKU4AVfLyNXIGtcWcNG46h/
+-----END RSA PRIVATE KEY-----