Difference between certbot's dry run and staging options

Question

Whenever I'm testing with certbot, I'm afraid of exceeding rate limits and thus getting my account throttled. So I use both the --dry-run and --staging options simultaneously.

This is shown in many other SO questions and tutorials - and since it works, I never worried about it.

But I'm sure there's a difference between them... what is it?

Answer 1

From the CLI docs, the --staging option:

--test-cert, --staging
Use the staging server to obtain or revoke test (invalid) certificates; equivalent to --server https:// acme-staging-v02.api.letsencrypt.org/directory (default: False)

And the --dry-run option:

--dry-run
Perform a test run of the client, obtaining test (invalid) certificates but not saving them to disk. This can currently only be used with the 'certonly' and 'renew' subcommands. Note: Although --dry-run tries to avoid making any persistent changes on a system, it is not completely side-effect free: if used with webserver authenticator plugins like apache and nginx, it makes and then reverts temporary config changes in order to obtain test certificates, and reloads webservers to deploy and then roll back those changes. It also calls --pre-hook and --post-hook commands if they are defined because they may be necessary to accurately simulate renewal. --deploy- hook commands are not called. (default: False)

So according to the docs, using the staging server avoids the rate limiter. The dry run option can be used to verify one's config is working, without saving the result of issue/renew requests.

The docs do not mention whether a dry run can exceed use limits, but from the above descriptions I'd assume it can.