diff --git a/letsencrypt/auth_handler.py b/letsencrypt/auth_handler.py
index 9afd4f324..63426f7bd 100644
--- a/letsencrypt/auth_handler.py
+++ b/letsencrypt/auth_handler.py
@@ -88,21 +88,14 @@ class AuthHandler(object):
             if response:
                 failed_domains = failed_domains.union(response)
 
-        my_authzr = self.authzr
-
-        logger.debug("authzr: %s", my_authzr)
-
-        returnDomains = []
-        #Remove failing domains if best_effort is true
-        for domain in domains:
-            if not domain in failed_domains:
-                returnDomains.append(domain)
+        returnDomains = [domain for domain in domains
+                        if domain not in failed_domains]
 
         # Just make sure all decisions are complete.
         self.verify_authzr_complete()
         # Only return valid authorizations
-        return ([authzr for authzr in my_authzr.values()
-                if authzr.body.status == messages.STATUS_VALID], returnDomains)
+        return [authzr for authzr in self.authzr.values()
+                if authzr.body.status == messages.STATUS_VALID], returnDomains
 
     def _choose_challenges(self, domains):
         """Retrieve necessary challenges to satisfy server."""
@@ -154,12 +147,12 @@ class AuthHandler(object):
 
         # Check for updated status...
         try:
-            result = self._poll_challenges(chall_update, best_effort)
+            failed_domains = self._poll_challenges(chall_update, best_effort)
         finally:
             # This removes challenges from self.dv_c and self.cont_c
             self._cleanup_challenges(active_achalls)
 
-        return result
+        return failed_domains
 
     def _send_responses(self, achalls, resps, chall_update):
         """Send responses and make sure errors are handled.
diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index 49b0e53ff..eba05055d 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -694,7 +694,7 @@ def obtain_cert(config, plugins, lineage=None):
     if config.csr is not None:
         assert lineage is None, "Did not expect a CSR with a RenewableCert"
         csr, typ = config.actual_csr
-        certr, chain = le_client.obtain_certificate_from_csr(config.domains, csr, False, typ)
+        certr, chain = le_client.obtain_certificate_from_csr(config.domains, csr, typ, authzr=False)
         if config.dry_run:
             logger.info(
                 "Dry run: skipping saving certificate to %s", config.cert_path)
@@ -1606,7 +1606,8 @@ def prepare_and_parse_args(plugins, args, detect_defaults=False):
     helpful.add(
         "automation", "--allow-subset-of-names", dest="allow_subset_of_names",
         action="store_true", default=False,
-        help="Allow subsets of domain names to fail validation without exiting.")
+        help="Allow subsets of domain names in a single lineage to fail "
+             "validation without exiting.")
 
     helpful.add_group(
         "renew", description="The 'renew' subcommand will attempt to renew all"
diff --git a/letsencrypt/client.py b/letsencrypt/client.py
index c9b094910..d825f6da7 100644
--- a/letsencrypt/client.py
+++ b/letsencrypt/client.py
@@ -195,8 +195,8 @@ class Client(object):
         else:
             self.auth_handler = None
 
-    def obtain_certificate_from_csr(self, domains, csr, authzr=False,
-        typ=OpenSSL.crypto.FILETYPE_ASN1):
+    def obtain_certificate_from_csr(self, domains, csr,
+        typ=OpenSSL.crypto.FILETYPE_ASN1, authzr=False):
         """Obtain certificate.
 
         Internal function with precondition that `domains` are
@@ -255,7 +255,7 @@ class Client(object):
             self.config.rsa_key_size, self.config.key_dir)
         csr = crypto_util.init_save_csr(key, domains, self.config.csr_dir)
 
-        return self.obtain_certificate_from_csr(domains, csr, authzr) + (key, csr)
+        return self.obtain_certificate_from_csr(domains, csr, authzr=authzr) + (key, csr)
 
     def obtain_and_enroll_certificate(self, domains):
         """Obtain and enroll certificate.
diff --git a/letsencrypt/tests/client_test.py b/letsencrypt/tests/client_test.py
index 220f60a38..07f76b64a 100644
--- a/letsencrypt/tests/client_test.py
+++ b/letsencrypt/tests/client_test.py
@@ -144,7 +144,7 @@ class ClientTest(unittest.TestCase):
                 self.client.obtain_certificate_from_csr(
                     self.eg_domains,
                     test_csr,
-                    authzr))
+                    authzr=authzr))
             # and that the cert was obtained correctly
             self._check_obtain_certificate()