diff --git a/letsencrypt/plugins/manual.py b/letsencrypt/plugins/manual.py
index 99463c362..f7717064b 100644
--- a/letsencrypt/plugins/manual.py
+++ b/letsencrypt/plugins/manual.py
@@ -130,10 +130,7 @@ binary for temporary key/certificate generation.""".replace("\n", "")
         if self.conf("test-mode"):
             logger.debug("Test mode. Executing the manual command: %s", command)
             # sh shipped with OS X does't support echo -n
-            if sys.platform == "darwin":
-                executable = "/bin/bash"
-            else:
-                executable = None
+            executable = "/bin/bash" if sys.platform == "darwin" else None
             try:
                 self._httpd = subprocess.Popen(
                     command,
diff --git a/letsencrypt/plugins/util_test.py b/letsencrypt/plugins/util_test.py
index 14cbcf7a8..1591976b0 100644
--- a/letsencrypt/plugins/util_test.py
+++ b/letsencrypt/plugins/util_test.py
@@ -98,6 +98,10 @@ class AlreadyListeningTest(unittest.TestCase):
         self.assertEqual(mock_get_utility.call_count, 1)
         mock_process.assert_called_once_with(4420)
 
+    @mock.patch("letsencrypt.plugins.util.psutil.net_connections")
+    def test_access_denied_exception(self, mock_net):
+        mock_net.side_effect = psutil.AccessDenied("")
+        self.assertFalse(self._call(12345))
 
 if __name__ == "__main__":
     unittest.main()  # pragma: no cover