diff --git a/certbot/tests/account_test.py b/certbot/tests/account_test.py
index 5950dcda9..575a40286 100644
--- a/certbot/tests/account_test.py
+++ b/certbot/tests/account_test.py
@@ -14,12 +14,10 @@ from acme import messages
 
 from certbot import errors
 
-from certbot.tests import util
-
-from certbot.tests.util import TempDirTestCase
+import certbot.tests.util as test_util
 
 
-KEY = jose.JWKRSA.load(util.load_vector("rsa512_key_2.pem"))
+KEY = jose.JWKRSA.load(test_util.load_vector("rsa512_key_2.pem"))
 
 
 class AccountTest(unittest.TestCase):
@@ -58,12 +56,9 @@ class AccountTest(unittest.TestCase):
         self.assertTrue(repr(self.acc).startswith(
           "<Account(i_am_a_regr, bca5889f66457d5b62fbba7b25f9ab6f, Meta("))
 
-class ReportNewAccountTest(unittest.TestCase):
+class ReportNewAccountTest(test_util.ConfigTestCase):
     """Tests for certbot.account.report_new_account."""
 
-    def setUp(self):
-        self.config = mock.MagicMock(config_dir="/etc/letsencrypt")
-
     def _call(self):
         from certbot.account import report_new_account
         report_new_account(self.config)
@@ -98,14 +93,12 @@ class AccountMemoryStorageTest(unittest.TestCase):
         self.assertEqual([account], self.storage.find_all())
 
 
-class AccountFileStorageTest(TempDirTestCase):
+class AccountFileStorageTest(test_util.ConfigTestCase):
     """Tests for certbot.account.AccountFileStorage."""
 
     def setUp(self):
         super(AccountFileStorageTest, self).setUp()
 
-        self.config = mock.MagicMock(
-            accounts_dir=os.path.join(self.tempdir, "accounts"))
         from certbot.account import AccountFileStorage
         self.storage = AccountFileStorage(self.config)
 
diff --git a/certbot/tests/cert_manager_test.py b/certbot/tests/cert_manager_test.py
index f4a108019..401abcfbe 100644
--- a/certbot/tests/cert_manager_test.py
+++ b/certbot/tests/cert_manager_test.py
@@ -18,58 +18,50 @@ from certbot.storage import ALL_FOUR
 from certbot.tests import storage_test
 from certbot.tests import util as test_util
 
-from certbot.tests.util import TempDirTestCase
 
-
-class BaseCertManagerTest(TempDirTestCase):
+class BaseCertManagerTest(test_util.ConfigTestCase):
     """Base class for setting up Cert Manager tests.
     """
     def setUp(self):
         super(BaseCertManagerTest, self).setUp()
 
-        os.makedirs(os.path.join(self.tempdir, "renewal"))
-
-        self.cli_config = configuration.NamespaceConfig(mock.MagicMock(
-            config_dir=self.tempdir,
-            work_dir=self.tempdir,
-            logs_dir=self.tempdir,
-            quiet=False,
-        ))
+        self.config.quiet = False
+        os.makedirs(self.config.renewal_configs_dir)
 
         self.domains = {
             "example.org": None,
-            "other.com": os.path.join(self.tempdir, "specialarchive")
+            "other.com": os.path.join(self.config.config_dir, "specialarchive")
         }
-        self.configs = dict((domain, self._set_up_config(domain, self.domains[domain]))
+        self.config_files = dict((domain, self._set_up_config(domain, self.domains[domain]))
             for domain in self.domains)
 
         # We also create a file that isn't a renewal config in the same
         # location to test that logic that reads in all-and-only renewal
         # configs will ignore it and NOT attempt to parse it.
-        junk = open(os.path.join(self.tempdir, "renewal", "IGNORE.THIS"), "w")
+        junk = open(os.path.join(self.config.renewal_configs_dir, "IGNORE.THIS"), "w")
         junk.write("This file should be ignored!")
         junk.close()
 
     def _set_up_config(self, domain, custom_archive):
         # TODO: maybe provide NamespaceConfig.make_dirs?
         # TODO: main() should create those dirs, c.f. #902
-        os.makedirs(os.path.join(self.tempdir, "live", domain))
-        config = configobj.ConfigObj()
+        os.makedirs(os.path.join(self.config.live_dir, domain))
+        config_file = configobj.ConfigObj()
 
         if custom_archive is not None:
             os.makedirs(custom_archive)
-            config["archive_dir"] = custom_archive
+            config_file["archive_dir"] = custom_archive
         else:
-            os.makedirs(os.path.join(self.tempdir, "archive", domain))
+            os.makedirs(os.path.join(self.config.default_archive_dir, domain))
 
         for kind in ALL_FOUR:
-            config[kind] = os.path.join(self.tempdir, "live", domain,
+            config_file[kind] = os.path.join(self.config.live_dir, domain,
                                         kind + ".pem")
 
-        config.filename = os.path.join(self.tempdir, "renewal",
+        config_file.filename = os.path.join(self.config.renewal_configs_dir,
                                        domain + ".conf")
-        config.write()
-        return config
+        config_file.write()
+        return config_file
 
 
 class UpdateLiveSymlinksTest(BaseCertManagerTest):
@@ -86,27 +78,27 @@ class UpdateLiveSymlinksTest(BaseCertManagerTest):
             if custom_archive is not None:
                 archive_dir_path = custom_archive
             else:
-                archive_dir_path = os.path.join(self.tempdir, "archive", domain)
+                archive_dir_path = os.path.join(self.config.default_archive_dir, domain)
             archive_paths[domain] = dict((kind,
                 os.path.join(archive_dir_path, kind + "1.pem")) for kind in ALL_FOUR)
             for kind in ALL_FOUR:
-                live_path = self.configs[domain][kind]
+                live_path = self.config_files[domain][kind]
                 archive_path = archive_paths[domain][kind]
                 open(archive_path, 'a').close()
                 # path is incorrect but base must be correct
-                os.symlink(os.path.join(self.tempdir, kind + "1.pem"), live_path)
+                os.symlink(os.path.join(self.config.config_dir, kind + "1.pem"), live_path)
 
         # run update symlinks
-        cert_manager.update_live_symlinks(self.cli_config)
+        cert_manager.update_live_symlinks(self.config)
 
         # check that symlinks go where they should
         prev_dir = os.getcwd()
         try:
             for domain in self.domains:
                 for kind in ALL_FOUR:
-                    os.chdir(os.path.dirname(self.configs[domain][kind]))
+                    os.chdir(os.path.dirname(self.config_files[domain][kind]))
                     self.assertEqual(
-                        os.path.realpath(os.readlink(self.configs[domain][kind])),
+                        os.path.realpath(os.readlink(self.config_files[domain][kind])),
                         os.path.realpath(archive_paths[domain][kind]))
         finally:
             os.chdir(prev_dir)
@@ -121,9 +113,9 @@ class DeleteTest(storage_test.BaseRenewableCertTest):
     def test_delete(self, mock_delete_files, mock_lineage_for_certname, unused_get_utility):
         """Test delete"""
         mock_lineage_for_certname.return_value = self.test_rc
-        self.cli_config.certname = "example.org"
+        self.config.certname = "example.org"
         from certbot import cert_manager
-        cert_manager.delete(self.cli_config)
+        cert_manager.delete(self.config)
         self.assertTrue(mock_delete_files.called)
 
 
@@ -137,15 +129,15 @@ class CertificatesTest(BaseCertManagerTest):
     @mock.patch('certbot.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_parse_fail(self, mock_utility, mock_logger):
-        self._certificates(self.cli_config)
+        self._certificates(self.config)
         self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member
         self.assertTrue(mock_utility.called)
 
     @mock.patch('certbot.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_quiet(self, mock_utility, mock_logger):
-        self.cli_config.quiet = True
-        self._certificates(self.cli_config)
+        self.config.quiet = True
+        self._certificates(self.config)
         self.assertFalse(mock_utility.notification.called)
         self.assertTrue(mock_logger.warning.called) #pylint: disable=no-member
 
@@ -158,7 +150,7 @@ class CertificatesTest(BaseCertManagerTest):
         mock_utility, mock_logger, mock_verifier):
         mock_verifier.return_value = None
         mock_report.return_value = ""
-        self._certificates(self.cli_config)
+        self._certificates(self.config)
         self.assertFalse(mock_logger.warning.called) #pylint: disable=no-member
         self.assertTrue(mock_report.called)
         self.assertTrue(mock_utility.called)
@@ -167,20 +159,19 @@ class CertificatesTest(BaseCertManagerTest):
     @mock.patch('certbot.cert_manager.logger')
     @test_util.patch_get_utility()
     def test_certificates_no_files(self, mock_utility, mock_logger):
-        tempdir = tempfile.mkdtemp()
-
-        cli_config = configuration.NamespaceConfig(mock.MagicMock(
-                config_dir=tempdir,
-                work_dir=tempdir,
-                logs_dir=tempdir,
-                quiet=False,
+        empty_tempdir = tempfile.mkdtemp()
+        empty_config = configuration.NamespaceConfig(mock.MagicMock(
+            config_dir=os.path.join(empty_tempdir, "config"),
+            work_dir=os.path.join(empty_tempdir, "work"),
+            logs_dir=os.path.join(empty_tempdir, "logs"),
+            quiet=False
         ))
 
-        os.makedirs(os.path.join(tempdir, "renewal"))
-        self._certificates(cli_config)
+        os.makedirs(empty_config.renewal_configs_dir)
+        self._certificates(empty_config)
         self.assertFalse(mock_logger.warning.called) #pylint: disable=no-member
         self.assertTrue(mock_utility.called)
-        shutil.rmtree(tempdir)
+        shutil.rmtree(empty_tempdir)
 
     @mock.patch('certbot.cert_manager.ocsp.RevocationChecker.ocsp_revoked')
     def test_report_human_readable(self, mock_revoked):
@@ -261,7 +252,7 @@ class SearchLineagesTest(BaseCertManagerTest):
         mock_renewable_cert.side_effect = errors.CertStorageError
         from certbot import cert_manager
         # pylint: disable=protected-access
-        self.assertEqual(cert_manager._search_lineages(self.cli_config, lambda x: x, "check"),
+        self.assertEqual(cert_manager._search_lineages(self.config, lambda x: x, "check"),
             "check")
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -278,7 +269,7 @@ class LineageForCertnameTest(BaseCertManagerTest):
         mock_match = mock.Mock(lineagename="example.com")
         mock_renewable_cert.return_value = mock_match
         from certbot import cert_manager
-        self.assertEqual(cert_manager.lineage_for_certname(self.cli_config, "example.com"),
+        self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"),
             mock_match)
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -288,7 +279,7 @@ class LineageForCertnameTest(BaseCertManagerTest):
         mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "other.com.conf"
         from certbot import cert_manager
-        self.assertEqual(cert_manager.lineage_for_certname(self.cli_config, "example.com"),
+        self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"),
             None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -298,7 +289,7 @@ class LineageForCertnameTest(BaseCertManagerTest):
         mock_make_or_verify_dir):
         mock_renewal_conf_file.side_effect = errors.CertStorageError()
         from certbot import cert_manager
-        self.assertEqual(cert_manager.lineage_for_certname(self.cli_config, "example.com"),
+        self.assertEqual(cert_manager.lineage_for_certname(self.config, "example.com"),
             None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -317,7 +308,7 @@ class DomainsForCertnameTest(BaseCertManagerTest):
         mock_match.names.return_value = domains
         mock_renewable_cert.return_value = mock_match
         from certbot import cert_manager
-        self.assertEqual(cert_manager.domains_for_certname(self.cli_config, "example.com"),
+        self.assertEqual(cert_manager.domains_for_certname(self.config, "example.com"),
             domains)
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -327,7 +318,7 @@ class DomainsForCertnameTest(BaseCertManagerTest):
         mock_make_or_verify_dir):
         mock_renewal_conf_file.return_value = "somefile.conf"
         from certbot import cert_manager
-        self.assertEqual(cert_manager.domains_for_certname(self.cli_config, "other.com"),
+        self.assertEqual(cert_manager.domains_for_certname(self.config, "other.com"),
             None)
         self.assertTrue(mock_make_or_verify_dir.called)
 
@@ -337,15 +328,8 @@ class RenameLineageTest(BaseCertManagerTest):
 
     def setUp(self):
         super(RenameLineageTest, self).setUp()
-        self.mock_config = configuration.NamespaceConfig(
-            namespace=mock.MagicMock(
-                config_dir=self.tempdir,
-                work_dir=self.tempdir,
-                logs_dir=self.tempdir,
-                certname="example.org",
-                new_certname="after",
-            )
-        )
+        self.config.certname = "example.org"
+        self.config.new_certname = "after"
 
     def _call(self, *args, **kwargs):
         from certbot import cert_manager
@@ -354,81 +338,81 @@ class RenameLineageTest(BaseCertManagerTest):
     @mock.patch('certbot.storage.renewal_conf_files')
     @test_util.patch_get_utility()
     def test_no_certname(self, mock_get_utility, mock_renewal_conf_files):
-        mock_config = mock.Mock(certname=None, new_certname="two")
+        self.config.certname = None
+        self.config.new_certname = "two"
 
         # if not choices
         mock_renewal_conf_files.return_value = []
-        self.assertRaises(errors.Error, self._call, mock_config)
+        self.assertRaises(errors.Error, self._call, self.config)
 
         mock_renewal_conf_files.return_value = ["one.conf"]
         util_mock = mock.Mock()
         util_mock.menu.return_value = (display_util.CANCEL, 0)
         mock_get_utility.return_value = util_mock
-        self.assertRaises(errors.Error, self._call, mock_config)
+        self.assertRaises(errors.Error, self._call, self.config)
 
         util_mock.menu.return_value = (display_util.OK, -1)
-        self.assertRaises(errors.Error, self._call, mock_config)
+        self.assertRaises(errors.Error, self._call, self.config)
 
     @test_util.patch_get_utility()
     def test_no_new_certname(self, mock_get_utility):
-        mock_config = mock.Mock(certname="one", new_certname=None)
+        self.config.certname = "one"
+        self.config.new_certname = None
 
         util_mock = mock.Mock()
         util_mock.input.return_value = (display_util.CANCEL, "name")
         mock_get_utility.return_value = util_mock
-        self.assertRaises(errors.Error, self._call, mock_config)
+        self.assertRaises(errors.Error, self._call, self.config)
 
         util_mock = mock.Mock()
         util_mock.input.return_value = (display_util.OK, None)
         mock_get_utility.return_value = util_mock
-        self.assertRaises(errors.Error, self._call, mock_config)
+        self.assertRaises(errors.Error, self._call, self.config)
 
     @test_util.patch_get_utility()
     @mock.patch('certbot.cert_manager.lineage_for_certname')
     def test_no_existing_certname(self, mock_lineage_for_certname, unused_get_utility):
-        mock_config = mock.Mock(certname="one", new_certname="two")
+        self.config.certname = "one"
+        self.config.new_certname = "two"
         mock_lineage_for_certname.return_value = None
         self.assertRaises(errors.ConfigurationError,
-            self._call, mock_config)
+            self._call, self.config)
 
     @test_util.patch_get_utility()
     @mock.patch("certbot.storage.RenewableCert._check_symlinks")
     def test_rename_cert(self, mock_check, unused_get_utility):
         mock_check.return_value = True
-        mock_config = self.mock_config
-        self._call(mock_config)
+        self._call(self.config)
         from certbot import cert_manager
-        updated_lineage = cert_manager.lineage_for_certname(mock_config, mock_config.new_certname)
+        updated_lineage = cert_manager.lineage_for_certname(self.config, self.config.new_certname)
         self.assertTrue(updated_lineage is not None)
-        self.assertEqual(updated_lineage.lineagename, mock_config.new_certname)
+        self.assertEqual(updated_lineage.lineagename, self.config.new_certname)
 
     @test_util.patch_get_utility()
     @mock.patch("certbot.storage.RenewableCert._check_symlinks")
     def test_rename_cert_interactive_certname(self, mock_check, mock_get_utility):
         mock_check.return_value = True
-        mock_config = self.mock_config
-        mock_config.certname = None
+        self.config.certname = None
         util_mock = mock.Mock()
         util_mock.menu.return_value = (display_util.OK, 0)
         mock_get_utility.return_value = util_mock
-        self._call(mock_config)
+        self._call(self.config)
         from certbot import cert_manager
-        updated_lineage = cert_manager.lineage_for_certname(mock_config, mock_config.new_certname)
+        updated_lineage = cert_manager.lineage_for_certname(self.config, self.config.new_certname)
         self.assertTrue(updated_lineage is not None)
-        self.assertEqual(updated_lineage.lineagename, mock_config.new_certname)
+        self.assertEqual(updated_lineage.lineagename, self.config.new_certname)
 
     @test_util.patch_get_utility()
     @mock.patch("certbot.storage.RenewableCert._check_symlinks")
     def test_rename_cert_bad_new_certname(self, mock_check, unused_get_utility):
         mock_check.return_value = True
-        mock_config = self.mock_config
 
         # for example, don't rename to existing certname
-        mock_config.new_certname = "example.org"
-        self.assertRaises(errors.ConfigurationError, self._call, mock_config)
+        self.config.new_certname = "example.org"
+        self.assertRaises(errors.ConfigurationError, self._call, self.config)
 
-        mock_config.new_certname = "one{0}two".format(os.path.sep)
-        self.assertRaises(errors.ConfigurationError, self._call, mock_config)
+        self.config.new_certname = "one{0}two".format(os.path.sep)
+        self.assertRaises(errors.ConfigurationError, self._call, self.config)
 
 
 class DuplicativeCertsTest(storage_test.BaseRenewableCertTest):
@@ -436,7 +420,7 @@ class DuplicativeCertsTest(storage_test.BaseRenewableCertTest):
 
     def setUp(self):
         super(DuplicativeCertsTest, self).setUp()
-        self.config.write()
+        self.config_file.write()
         self._write_out_ex_kinds()
 
     @mock.patch('certbot.util.make_or_verify_dir')
@@ -448,24 +432,24 @@ class DuplicativeCertsTest(storage_test.BaseRenewableCertTest):
 
         # No overlap at all
         result = find_duplicative_certs(
-            self.cli_config, ['wow.net', 'hooray.org'])
+            self.config, ['wow.net', 'hooray.org'])
         self.assertEqual(result, (None, None))
 
         # Totally identical
         result = find_duplicative_certs(
-            self.cli_config, ['example.com', 'www.example.com'])
+            self.config, ['example.com', 'www.example.com'])
         self.assertTrue(result[0].configfile.filename.endswith('example.org.conf'))
         self.assertEqual(result[1], None)
 
         # Superset
         result = find_duplicative_certs(
-            self.cli_config, ['example.com', 'www.example.com', 'something.new'])
+            self.config, ['example.com', 'www.example.com', 'something.new'])
         self.assertEqual(result[0], None)
         self.assertTrue(result[1].configfile.filename.endswith('example.org.conf'))
 
         # Partial overlap doesn't count
         result = find_duplicative_certs(
-            self.cli_config, ['example.com', 'something.new'])
+            self.config, ['example.com', 'something.new'])
         self.assertEqual(result, (None, None))
 
 
diff --git a/certbot/tests/client_test.py b/certbot/tests/client_test.py
index 97fd6241d..a547f6a9a 100644
--- a/certbot/tests/client_test.py
+++ b/certbot/tests/client_test.py
@@ -21,20 +21,13 @@ KEY = test_util.load_vector("rsa512_key.pem")
 CSR_SAN = test_util.load_vector("csr-san.pem")
 
 
-class ConfigHelper(object):
-    """Creates a dummy object to imitate a namespace object
-
-        Example: cfg = ConfigHelper(redirect=True, hsts=False, uir=False)
-        will result in: cfg.redirect=True, cfg.hsts=False, etc.
-    """
-    def __init__(self, **kwds):
-        self.__dict__.update(kwds)
-
-class RegisterTest(unittest.TestCase):
+class RegisterTest(test_util.ConfigTestCase):
     """Tests for certbot.client.register."""
 
     def setUp(self):
-        self.config = mock.MagicMock(rsa_key_size=1024, register_unsafely_without_email=False)
+        super(RegisterTest, self).setUp()
+        self.config.rsa_key_size = 1024
+        self.config.register_unsafely_without_email = False
         self.account_storage = account.AccountMemoryStorage()
         self.tos_cb = mock.MagicMock()
 
@@ -116,14 +109,12 @@ class RegisterTest(unittest.TestCase):
         self.assertFalse(mock_handle.called)
 
 
-class ClientTestCommon(unittest.TestCase):
+class ClientTestCommon(test_util.ConfigTestCase):
     """Common base class for certbot.client.Client tests."""
     def setUp(self):
-        self.config = mock.MagicMock(
-            no_verify_ssl=False,
-            config_dir="/etc/letsencrypt",
-            work_dir="/var/lib/letsencrypt",
-            allow_subset_of_names=False)
+        super(ClientTestCommon, self).setUp()
+        self.config.no_verify_ssl = False
+        self.config.allow_subset_of_names = False
 
         # pylint: disable=star-args
         self.account = mock.MagicMock(**{"key.pem": KEY})
@@ -143,7 +134,6 @@ class ClientTest(ClientTestCommon):
         super(ClientTest, self).setUp()
 
         self.config.allow_subset_of_names = False
-        self.config.config_dir = "/etc/letsencrypt"
         self.config.dry_run = False
         self.eg_domains = ["example.com", "www.example.com"]
 
@@ -262,8 +252,8 @@ class ClientTest(ClientTestCommon):
         mock_crypto.make_key.return_value = mock.sentinel.key_pem
         key = util.Key(file=None, pem=mock.sentinel.key_pem)
 
-        with mock.patch.object(self.client.config, 'dry_run', new=True):
-            self._test_obtain_certificate_common(key, csr)
+        self.client.config.dry_run = True
+        self._test_obtain_certificate_common(key, csr)
 
         mock_crypto.make_key.assert_called_once_with(self.config.rsa_key_size)
         mock_acme_crypto.make_csr.assert_called_once_with(
diff --git a/certbot/tests/configuration_test.py b/certbot/tests/configuration_test.py
index 66a07dddd..eafee6339 100644
--- a/certbot/tests/configuration_test.py
+++ b/certbot/tests/configuration_test.py
@@ -6,33 +6,32 @@ import mock
 
 from certbot import errors
 
+from certbot.tests import util as test_util
 
-class NamespaceConfigTest(unittest.TestCase):
+class NamespaceConfigTest(test_util.ConfigTestCase):
     """Tests for certbot.configuration.NamespaceConfig."""
 
     def setUp(self):
-        self.namespace = mock.MagicMock(
-            config_dir='/tmp/config', work_dir='/tmp/foo',
-            logs_dir="/tmp/bar", foo='bar',
-            server='https://acme-server.org:443/new',
-            tls_sni_01_port=1234, http01_port=4321)
-        from certbot.configuration import NamespaceConfig
-        self.config = NamespaceConfig(self.namespace)
+        super(NamespaceConfigTest, self).setUp()
+        self.config.foo = 'bar'
+        self.config.server = 'https://acme-server.org:443/new'
+        self.config.tls_sni_01_port = 1234
+        self.config.http01_port = 4321
 
     def test_init_same_ports(self):
-        self.namespace.tls_sni_01_port = 4321
+        self.config.namespace.tls_sni_01_port = 4321
         from certbot.configuration import NamespaceConfig
-        self.assertRaises(errors.Error, NamespaceConfig, self.namespace)
+        self.assertRaises(errors.Error, NamespaceConfig, self.config.namespace)
 
     def test_proxy_getattr(self):
         self.assertEqual(self.config.foo, 'bar')
-        self.assertEqual(self.config.work_dir, '/tmp/foo')
+        self.assertEqual(self.config.work_dir, os.path.join(self.tempdir, 'work'))
 
     def test_server_path(self):
         self.assertEqual(['acme-server.org:443', 'new'],
                          self.config.server_path.split(os.path.sep))
 
-        self.namespace.server = ('http://user:pass@acme.server:443'
+        self.config.namespace.server = ('http://user:pass@acme.server:443'
                                  '/p/a/t/h;parameters?query#fragment')
         self.assertEqual(['user:pass@acme.server:443', 'p', 'a', 't', 'h'],
                          self.config.server_path.split(os.path.sep))
@@ -48,12 +47,18 @@ class NamespaceConfigTest(unittest.TestCase):
         constants.TEMP_CHECKPOINT_DIR = 't'
 
         self.assertEqual(
-            self.config.accounts_dir, '/tmp/config/acc/acme-server.org:443/new')
-        self.assertEqual(self.config.backup_dir, '/tmp/foo/backups')
-        self.assertEqual(self.config.csr_dir, '/tmp/config/csr')
-        self.assertEqual(self.config.in_progress_dir, '/tmp/foo/../p')
-        self.assertEqual(self.config.key_dir, '/tmp/config/keys')
-        self.assertEqual(self.config.temp_checkpoint_dir, '/tmp/foo/t')
+            self.config.accounts_dir, os.path.join(
+                self.config.config_dir, 'acc/acme-server.org:443/new'))
+        self.assertEqual(
+                self.config.backup_dir, os.path.join(self.config.work_dir, 'backups'))
+        self.assertEqual(
+                self.config.csr_dir, os.path.join(self.config.config_dir, 'csr'))
+        self.assertEqual(
+                self.config.in_progress_dir, os.path.join(self.config.work_dir, '../p'))
+        self.assertEqual(
+                self.config.key_dir, os.path.join(self.config.config_dir, 'keys'))
+        self.assertEqual(
+                self.config.temp_checkpoint_dir, os.path.join(self.config.work_dir, 't'))
 
     def test_absolute_paths(self):
         from certbot.configuration import NamespaceConfig
@@ -95,10 +100,13 @@ class NamespaceConfigTest(unittest.TestCase):
         constants.LIVE_DIR = 'l'
         constants.RENEWAL_CONFIGS_DIR = 'renewal_configs'
 
-        self.assertEqual(self.config.default_archive_dir, '/tmp/config/a')
-        self.assertEqual(self.config.live_dir, '/tmp/config/l')
         self.assertEqual(
-            self.config.renewal_configs_dir, '/tmp/config/renewal_configs')
+                self.config.default_archive_dir, os.path.join(self.config.config_dir, 'a'))
+        self.assertEqual(
+                self.config.live_dir, os.path.join(self.config.config_dir, 'l'))
+        self.assertEqual(
+                self.config.renewal_configs_dir, os.path.join(
+                    self.config.config_dir, 'renewal_configs'))
 
     def test_renewal_absolute_paths(self):
         from certbot.configuration import NamespaceConfig
diff --git a/certbot/tests/eff_test.py b/certbot/tests/eff_test.py
index fd9a61181..160af1993 100644
--- a/certbot/tests/eff_test.py
+++ b/certbot/tests/eff_test.py
@@ -4,20 +4,22 @@ import unittest
 import mock
 
 from certbot import constants
-from certbot.tests import util
+import certbot.tests.util as test_util
 
 
-class HandleSubscriptionTest(unittest.TestCase):
+class HandleSubscriptionTest(test_util.ConfigTestCase):
     """Tests for certbot.eff.handle_subscription."""
     def setUp(self):
+        super(HandleSubscriptionTest, self).setUp()
         self.email = 'certbot@example.org'
-        self.config = mock.Mock(email=self.email, eff_email=None)
+        self.config.email = self.email
+        self.config.eff_email = None
 
     def _call(self):
         from certbot.eff import handle_subscription
         return handle_subscription(self.config)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     @mock.patch('certbot.eff.subscribe')
     def test_failure(self, mock_subscribe, mock_get_utility):
         self.config.email = None
@@ -32,12 +34,12 @@ class HandleSubscriptionTest(unittest.TestCase):
     @mock.patch('certbot.eff.subscribe')
     def test_no_subscribe_with_no_prompt(self, mock_subscribe):
         self.config.eff_email = False
-        with util.patch_get_utility() as mock_get_utility:
+        with test_util.patch_get_utility() as mock_get_utility:
             self._call()
         self.assertFalse(mock_subscribe.called)
         self._assert_no_get_utility_calls(mock_get_utility)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     @mock.patch('certbot.eff.subscribe')
     def test_subscribe_with_no_prompt(self, mock_subscribe, mock_get_utility):
         self.config.eff_email = True
@@ -49,7 +51,7 @@ class HandleSubscriptionTest(unittest.TestCase):
         self.assertFalse(mock_get_utility().yesno.called)
         self.assertFalse(mock_get_utility().add_message.called)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     @mock.patch('certbot.eff.subscribe')
     def test_subscribe_with_prompt(self, mock_subscribe, mock_get_utility):
         mock_get_utility().yesno.return_value = True
@@ -62,7 +64,7 @@ class HandleSubscriptionTest(unittest.TestCase):
         self.assertTrue(mock_subscribe.called)
         self.assertEqual(mock_subscribe.call_args[0][0], self.email)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     @mock.patch('certbot.eff.subscribe')
     def test_no_subscribe_with_prompt(self, mock_subscribe, mock_get_utility):
         mock_get_utility().yesno.return_value = False
@@ -105,7 +107,7 @@ class SubscribeTest(unittest.TestCase):
         self.assertFalse(data is None)
         self.assertEqual(data.get('email'), self.email)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     def test_bad_status(self, mock_get_utility):
         self.json['status'] = False
         self._call()  # pylint: disable=no-value-for-parameter
@@ -113,7 +115,7 @@ class SubscribeTest(unittest.TestCase):
         expected_part = 'because your e-mail address appears to be invalid.'
         self.assertTrue(expected_part in actual)
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     def test_not_ok(self, mock_get_utility):
         self.response.ok = False
         self._call()  # pylint: disable=no-value-for-parameter
@@ -125,7 +127,7 @@ class SubscribeTest(unittest.TestCase):
         self.assertTrue(mock_get_utility().add_message.called)
         return mock_get_utility().add_message.call_args[0][0]
 
-    @util.patch_get_utility()
+    @test_util.patch_get_utility()
     def test_subscribe(self, mock_get_utility):
         self._call()  # pylint: disable=no-value-for-parameter
         self.assertFalse(mock_get_utility.called)
diff --git a/certbot/tests/log_test.py b/certbot/tests/log_test.py
index 5ee9ad812..1f2dc3be0 100644
--- a/certbot/tests/log_test.py
+++ b/certbot/tests/log_test.py
@@ -55,7 +55,7 @@ class PreArgParseSetupTest(unittest.TestCase):
             memory_handler, 1, 2, 3, debug=True, log_path=mock.ANY)
 
 
-class PostArgParseSetupTest(test_util.TempDirTestCase):
+class PostArgParseSetupTest(test_util.ConfigTestCase):
     """Tests for certbot.log.post_arg_parse_setup."""
 
     @classmethod
@@ -65,9 +65,10 @@ class PostArgParseSetupTest(test_util.TempDirTestCase):
 
     def setUp(self):
         super(PostArgParseSetupTest, self).setUp()
-        self.config = mock.MagicMock(
-            debug=False, logs_dir=self.tempdir, max_log_backups=1000,
-            quiet=False, verbose_count=constants.CLI_DEFAULTS['verbose_count'])
+        self.config.debug = False
+        self.config.max_log_backups = 1000
+        self.config.quiet = False
+        self.config.verbose_count = constants.CLI_DEFAULTS['verbose_count']
         self.devnull = open(os.devnull, 'w')
 
         from certbot.log import ColoredStreamHandler
@@ -102,7 +103,7 @@ class PostArgParseSetupTest(test_util.TempDirTestCase):
         self.assertFalse(os.path.exists(self.temp_path))
         mock_sys.excepthook(1, 2, 3)
         mock_except_hook.assert_called_once_with(
-            1, 2, 3, debug=self.config.debug, log_path=self.tempdir)
+            1, 2, 3, debug=self.config.debug, log_path=self.config.logs_dir)
 
         level = self.stream_handler.level
         if self.config.quiet:
@@ -119,7 +120,7 @@ class PostArgParseSetupTest(test_util.TempDirTestCase):
         self.test_common()
 
 
-class SetupLogFileHandlerTest(test_util.TempDirTestCase):
+class SetupLogFileHandlerTest(test_util.ConfigTestCase):
     """Tests for certbot.log.setup_log_file_handler."""
 
     @classmethod
@@ -129,7 +130,7 @@ class SetupLogFileHandlerTest(test_util.TempDirTestCase):
 
     def setUp(self):
         super(SetupLogFileHandlerTest, self).setUp()
-        self.config = mock.MagicMock(logs_dir=self.tempdir, max_log_backups=42)
+        self.config.max_log_backups = 42
 
     @mock.patch('certbot.main.logging.handlers.RotatingFileHandler')
     def test_failure(self, mock_handler):
diff --git a/certbot/tests/main_test.py b/certbot/tests/main_test.py
index 48e19b7b3..ae34ebfd7 100644
--- a/certbot/tests/main_test.py
+++ b/certbot/tests/main_test.py
@@ -23,8 +23,6 @@ from certbot import configuration
 from certbot import crypto_util
 from certbot import errors
 from certbot import main
-from certbot import renewal
-from certbot import storage
 from certbot import util
 
 from certbot.plugins import disco
@@ -289,16 +287,14 @@ class RevokeTest(test_util.TempDirTestCase):
         self.mock_success_revoke.assert_not_called()
 
 
-class DetermineAccountTest(unittest.TestCase):
+class DetermineAccountTest(test_util.ConfigTestCase):
     """Tests for certbot.main._determine_account."""
 
     def setUp(self):
-        self.args = mock.MagicMock(account=None, email=None,
-                                   config_dir="unused_config",
-                                   logs_dir="unused_logs",
-                                   work_dir="unused_work",
-                                   register_unsafely_without_email=False)
-        self.config = configuration.NamespaceConfig(self.args)
+        super(DetermineAccountTest, self).setUp()
+        self.config.account = None
+        self.config.email = None
+        self.config.register_unsafely_without_email = False
         self.accs = [mock.MagicMock(id='x'), mock.MagicMock(id='y')]
         self.account_storage = account.AccountMemoryStorage()
         # For use in saving accounts: fake out the new_authz URL.
@@ -359,19 +355,16 @@ class DetermineAccountTest(unittest.TestCase):
         self.assertEqual('other email', self.config.email)
 
 
-class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-methods
+class MainTest(test_util.ConfigTestCase):  # pylint: disable=too-many-public-methods
     """Tests for different commands."""
 
     def setUp(self):
         super(MainTest, self).setUp()
 
-        self.config_dir = os.path.join(self.tempdir, 'config')
-        self.work_dir = os.path.join(self.tempdir, 'work')
-        self.logs_dir = os.path.join(self.tempdir, 'logs')
-        os.mkdir(self.logs_dir)
-        self.standard_args = ['--config-dir', self.config_dir,
-                              '--work-dir', self.work_dir,
-                              '--logs-dir', self.logs_dir, '--text']
+        os.mkdir(self.config.logs_dir)
+        self.standard_args = ['--config-dir', self.config.config_dir,
+                              '--work-dir', self.config.work_dir,
+                              '--logs-dir', self.config.logs_dir, '--text']
 
     def tearDown(self):
         # Reset globals in cli
@@ -756,7 +749,7 @@ class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-me
             raise
         finally:
             if log_out:
-                with open(os.path.join(self.logs_dir, "letsencrypt.log")) as lf:
+                with open(os.path.join(self.config.logs_dir, "letsencrypt.log")) as lf:
                     self.assertTrue(log_out in lf.read())
 
         return mock_lineage, mock_get_utility, stdout
@@ -788,18 +781,18 @@ class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-me
 
     def _dump_log(self):
         print("Logs:")
-        log_path = os.path.join(self.logs_dir, "letsencrypt.log")
+        log_path = os.path.join(self.config.logs_dir, "letsencrypt.log")
         if os.path.exists(log_path):
             with open(log_path) as lf:
                 print(lf.read())
 
     def test_renew_verb(self):
-        test_util.make_lineage(self.config_dir, 'sample-renewal.conf')
+        test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--dry-run", "-tvv"]
         self._test_renewal_common(True, [], args=args, should_renew=True)
 
     def test_quiet_renew(self):
-        test_util.make_lineage(self.config_dir, 'sample-renewal.conf')
+        test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--dry-run"]
         _, _, stdout = self._test_renewal_common(True, [], args=args, should_renew=True)
         out = stdout.getvalue()
@@ -811,36 +804,21 @@ class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-me
         self.assertEqual("", out)
 
     def test_renew_hook_validation(self):
-        test_util.make_lineage(self.config_dir, 'sample-renewal.conf')
+        test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--dry-run", "--post-hook=no-such-command"]
         self._test_renewal_common(True, [], args=args, should_renew=False,
                                   error_expected=True)
 
     def test_renew_no_hook_validation(self):
-        test_util.make_lineage(self.config_dir, 'sample-renewal.conf')
+        test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         args = ["renew", "--dry-run", "--post-hook=no-such-command",
                 "--disable-hook-validation"]
         with mock.patch("certbot.hooks.post_hook"):
             self._test_renewal_common(True, [], args=args, should_renew=True,
                                       error_expected=False)
 
-    @mock.patch("certbot.cli.set_by_cli")
-    def test_ancient_webroot_renewal_conf(self, mock_set_by_cli):
-        mock_set_by_cli.return_value = False
-        rc_path = test_util.make_lineage(
-            self.config_dir, 'sample-renewal-ancient.conf')
-        args = mock.MagicMock(account=None, config_dir=self.config_dir,
-                              logs_dir=self.logs_dir, work_dir=self.work_dir,
-                              email=None, webroot_path=None)
-        config = configuration.NamespaceConfig(args)
-        lineage = storage.RenewableCert(rc_path, config)
-        renewalparams = lineage.configuration["renewalparams"]
-        # pylint: disable=protected-access
-        renewal._restore_webroot_config(config, renewalparams)
-        self.assertEqual(config.webroot_path, ["/var/www/"])
-
     def test_renew_verb_empty_config(self):
-        rd = os.path.join(self.config_dir, 'renewal')
+        rd = os.path.join(self.config.config_dir, 'renewal')
         if not os.path.exists(rd):
             os.makedirs(rd)
         with open(os.path.join(rd, 'empty.conf'), 'w'):
@@ -849,7 +827,7 @@ class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-me
         self._test_renewal_common(False, [], args=args, should_renew=False, error_expected=True)
 
     def test_renew_with_certname(self):
-        test_util.make_lineage(self.config_dir, 'sample-renewal.conf')
+        test_util.make_lineage(self.config.config_dir, 'sample-renewal.conf')
         self._test_renewal_common(True, [], should_renew=True,
             args=['renew', '--dry-run', '--cert-name', 'sample-renewal'])
 
@@ -859,7 +837,7 @@ class MainTest(test_util.TempDirTestCase):  # pylint: disable=too-many-public-me
             error_expected=True)
 
     def _make_dummy_renewal_config(self):
-        renewer_configs_dir = os.path.join(self.config_dir, 'renewal')
+        renewer_configs_dir = os.path.join(self.config.config_dir, 'renewal')
         os.makedirs(renewer_configs_dir)
         with open(os.path.join(renewer_configs_dir, 'test.conf'), 'w') as f:
             f.write("My contents don't matter")
diff --git a/certbot/tests/renewal_test.py b/certbot/tests/renewal_test.py
index 869e6b104..d292d909a 100644
--- a/certbot/tests/renewal_test.py
+++ b/certbot/tests/renewal_test.py
@@ -1,5 +1,4 @@
 """Tests for certbot.renewal"""
-import os
 import mock
 import unittest
 
@@ -9,24 +8,22 @@ from certbot import configuration
 from certbot import errors
 from certbot import storage
 
-from certbot.tests import util
+import certbot.tests.util as test_util
 
 
-class RenewalTest(util.TempDirTestCase):
+class RenewalTest(test_util.ConfigTestCase):
     def setUp(self):
         super(RenewalTest, self).setUp()
 
-        self.config_dir = os.path.join(self.tempdir, 'config')
-
     @mock.patch('certbot.cli.set_by_cli')
     def test_ancient_webroot_renewal_conf(self, mock_set_by_cli):
         mock_set_by_cli.return_value = False
-        rc_path = util.make_lineage(
-            self.config_dir, 'sample-renewal-ancient.conf')
-        args = mock.MagicMock(account=None, config_dir=self.config_dir,
-                              logs_dir="logs", work_dir="work",
-                              email=None, webroot_path=None)
-        config = configuration.NamespaceConfig(args)
+        rc_path = test_util.make_lineage(
+            self.config.config_dir, 'sample-renewal-ancient.conf')
+        self.config.account = None
+        self.config.email = None
+        self.config.webroot_path = None
+        config = configuration.NamespaceConfig(self.config)
         lineage = storage.RenewableCert(rc_path, config)
         renewalparams = lineage.configuration['renewalparams']
         # pylint: disable=protected-access
@@ -35,10 +32,10 @@ class RenewalTest(util.TempDirTestCase):
         self.assertEqual(config.webroot_path, ['/var/www/'])
 
 
-class RestoreRequiredConfigElementsTest(unittest.TestCase):
+class RestoreRequiredConfigElementsTest(test_util.ConfigTestCase):
     """Tests for certbot.renewal.restore_required_config_elements."""
     def setUp(self):
-        self.config = mock.MagicMock()
+        super(RestoreRequiredConfigElementsTest, self).setUp()
 
     @classmethod
     def _call(cls, *args, **kwargs):
diff --git a/certbot/tests/reverter_test.py b/certbot/tests/reverter_test.py
index d430f8292..b048737c2 100644
--- a/certbot/tests/reverter_test.py
+++ b/certbot/tests/reverter_test.py
@@ -14,16 +14,16 @@ from certbot import errors
 from certbot.tests import util as test_util
 
 
-class ReverterCheckpointLocalTest(unittest.TestCase):
+class ReverterCheckpointLocalTest(test_util.ConfigTestCase):
     # pylint: disable=too-many-instance-attributes, too-many-public-methods
     """Test the Reverter Class."""
     def setUp(self):
+        super(ReverterCheckpointLocalTest, self).setUp()
         from certbot.reverter import Reverter
 
         # Disable spurious errors... we are trying to test for them
         logging.disable(logging.CRITICAL)
 
-        self.config = setup_work_direc()
         self.reverter = Reverter(self.config)
 
         tup = setup_test_files()
@@ -277,15 +277,15 @@ class ReverterCheckpointLocalTest(unittest.TestCase):
         self.assertEqual(read_in(self.config2), "directive-dir2")
 
 
-class TestFullCheckpointsReverter(unittest.TestCase):
+class TestFullCheckpointsReverter(test_util.ConfigTestCase):
     # pylint: disable=too-many-instance-attributes
     """Tests functions having to deal with full checkpoints."""
     def setUp(self):
+        super(TestFullCheckpointsReverter, self).setUp()
         from certbot.reverter import Reverter
         # Disable spurious errors...
         logging.disable(logging.CRITICAL)
 
-        self.config = setup_work_direc()
         self.reverter = Reverter(self.config)
 
         tup = setup_test_files()
@@ -439,21 +439,6 @@ class TestFullCheckpointsReverter(unittest.TestCase):
         return config3
 
 
-def setup_work_direc():
-    """Setup directories.
-
-    :returns: Mocked :class:`certbot.interfaces.IConfig`
-
-    """
-    work_dir = tempfile.mkdtemp("work")
-    backup_dir = os.path.join(work_dir, "backup")
-
-    return mock.MagicMock(
-        work_dir=work_dir, backup_dir=backup_dir,
-        temp_checkpoint_dir=os.path.join(work_dir, "temp"),
-        in_progress_dir=os.path.join(backup_dir, "in_progress_dir"))
-
-
 def setup_test_files():
     """Setup sample configuration files."""
     dir1 = tempfile.mkdtemp("dir1")
diff --git a/certbot/tests/storage_test.py b/certbot/tests/storage_test.py
index e6e2b25ff..5e8acc832 100644
--- a/certbot/tests/storage_test.py
+++ b/certbot/tests/storage_test.py
@@ -13,14 +13,13 @@ import six
 
 import certbot
 from certbot import cli
-from certbot import configuration
 from certbot import errors
 from certbot.storage import ALL_FOUR
 
-from certbot.tests import util
+import certbot.tests.util as test_util
 
 
-CERT = util.load_cert('cert.pem')
+CERT = test_util.load_cert('cert.pem')
 
 
 def unlink_all(rc_object):
@@ -36,7 +35,7 @@ def fill_with_sample_data(rc_object):
             f.write(kind)
 
 
-class BaseRenewableCertTest(util.TempDirTestCase):
+class BaseRenewableCertTest(test_util.ConfigTestCase):
     """Base class for setting up Renewable Cert tests.
 
     .. note:: It may be required to write out self.config for
@@ -50,39 +49,31 @@ class BaseRenewableCertTest(util.TempDirTestCase):
 
         super(BaseRenewableCertTest, self).setUp()
 
-        self.cli_config = configuration.NamespaceConfig(
-            namespace=mock.MagicMock(
-                config_dir=self.tempdir,
-                work_dir=self.tempdir,
-                logs_dir=self.tempdir,
-            )
-        )
-
         # TODO: maybe provide NamespaceConfig.make_dirs?
         # TODO: main() should create those dirs, c.f. #902
-        os.makedirs(os.path.join(self.tempdir, "live", "example.org"))
-        archive_path = os.path.join(self.tempdir, "archive", "example.org")
+        os.makedirs(os.path.join(self.config.config_dir, "live", "example.org"))
+        archive_path = os.path.join(self.config.config_dir, "archive", "example.org")
         os.makedirs(archive_path)
-        os.makedirs(os.path.join(self.tempdir, "renewal"))
+        os.makedirs(os.path.join(self.config.config_dir, "renewal"))
 
-        config = configobj.ConfigObj()
+        config_file = configobj.ConfigObj()
         for kind in ALL_FOUR:
-            kind_path = os.path.join(self.tempdir, "live", "example.org",
+            kind_path = os.path.join(self.config.config_dir, "live", "example.org",
                                         kind + ".pem")
-            config[kind] = kind_path
-        with open(os.path.join(self.tempdir, "live", "example.org",
+            config_file[kind] = kind_path
+        with open(os.path.join(self.config.config_dir, "live", "example.org",
                                         "README"), 'a'):
             pass
-        config["archive"] = archive_path
-        config.filename = os.path.join(self.tempdir, "renewal",
+        config_file["archive"] = archive_path
+        config_file.filename = os.path.join(self.config.config_dir, "renewal",
                                        "example.org.conf")
-        config.write()
-        self.config = config
+        config_file.write()
+        self.config_file = config_file
 
         # We also create a file that isn't a renewal config in the same
         # location to test that logic that reads in all-and-only renewal
         # configs will ignore it and NOT attempt to parse it.
-        junk = open(os.path.join(self.tempdir, "renewal", "IGNORE.THIS"), "w")
+        junk = open(os.path.join(self.config.config_dir, "renewal", "IGNORE.THIS"), "w")
         junk.write("This file should be ignored!")
         junk.close()
 
@@ -90,7 +81,7 @@ class BaseRenewableCertTest(util.TempDirTestCase):
 
         with mock.patch("certbot.storage.RenewableCert._check_symlinks") as check:
             check.return_value = True
-            self.test_rc = storage.RenewableCert(config.filename, self.cli_config)
+            self.test_rc = storage.RenewableCert(config_file.filename, self.config)
 
     def _write_out_kind(self, kind, ver, value=None):
         link = getattr(self.test_rc, kind)
@@ -117,7 +108,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         for kind in ALL_FOUR:
             self.assertEqual(
                 getattr(self.test_rc, kind), os.path.join(
-                    self.tempdir, "live", "example.org", kind + ".pem"))
+                    self.config.config_dir, "live", "example.org", kind + ".pem"))
 
     def test_renewal_bad_config(self):
         """Test that the RenewableCert constructor will complain if
@@ -125,14 +116,14 @@ class RenewableCertTests(BaseRenewableCertTest):
 
         """
         from certbot import storage
-        broken = os.path.join(self.tempdir, "broken.conf")
+        broken = os.path.join(self.config.config_dir, "broken.conf")
         with open(broken, "w") as f:
             f.write("[No closing bracket for you!")
         self.assertRaises(errors.CertStorageError, storage.RenewableCert,
-                          broken, self.cli_config)
+                          broken, self.config)
         os.unlink(broken)
         self.assertRaises(errors.CertStorageError, storage.RenewableCert,
-                          "fun", self.cli_config)
+                          "fun", self.config)
 
     def test_renewal_incomplete_config(self):
         """Test that the RenewableCert constructor will complain if
@@ -143,30 +134,30 @@ class RenewableCertTests(BaseRenewableCertTest):
         # Here the required privkey is missing.
         config["chain"] = "imaginary_chain.pem"
         config["fullchain"] = "imaginary_fullchain.pem"
-        config.filename = os.path.join(self.tempdir, "imaginary_config.conf")
+        config.filename = os.path.join(self.config.config_dir, "imaginary_config.conf")
         config.write()
         self.assertRaises(errors.CertStorageError, storage.RenewableCert,
-                          config.filename, self.cli_config)
+                          config.filename, self.config)
 
     def test_no_renewal_version(self):
         from certbot import storage
 
         self._write_out_ex_kinds()
-        self.assertTrue("version" not in self.config)
+        self.assertTrue("version" not in self.config_file)
 
         with mock.patch("certbot.storage.logger") as mock_logger:
-            storage.RenewableCert(self.config.filename, self.cli_config)
+            storage.RenewableCert(self.config_file.filename, self.config)
         self.assertFalse(mock_logger.warning.called)
 
     def test_renewal_newer_version(self):
         from certbot import storage
 
         self._write_out_ex_kinds()
-        self.config["version"] = "99.99.99"
-        self.config.write()
+        self.config_file["version"] = "99.99.99"
+        self.config_file.write()
 
         with mock.patch("certbot.storage.logger") as mock_logger:
-            storage.RenewableCert(self.config.filename, self.cli_config)
+            storage.RenewableCert(self.config_file.filename, self.config)
         self.assertTrue(mock_logger.warning.called)
         self.assertTrue("version" in mock_logger.warning.call_args[0][0])
 
@@ -191,7 +182,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         unlink_all(self.test_rc)
         # Items must point to desired place if they are absolute
         for kind in ALL_FOUR:
-            os.symlink(os.path.join(self.tempdir, kind + "17.pem"),
+            os.symlink(os.path.join(self.config.config_dir, kind + "17.pem"),
                        getattr(self.test_rc, kind))
         self.assertFalse(self.test_rc._consistent())
         unlink_all(self.test_rc)
@@ -216,17 +207,17 @@ class RenewableCertTests(BaseRenewableCertTest):
         # Relative path logic
         self._write_out_kind("cert", 17)
         self.assertTrue(os.path.samefile(self.test_rc.current_target("cert"),
-                                         os.path.join(self.tempdir, "archive",
+                                         os.path.join(self.config.config_dir, "archive",
                                                       "example.org",
                                                       "cert17.pem")))
         # Absolute path logic
         os.unlink(self.test_rc.cert)
-        os.symlink(os.path.join(self.tempdir, "archive", "example.org",
+        os.symlink(os.path.join(self.config.config_dir, "archive", "example.org",
                                 "cert17.pem"), self.test_rc.cert)
         with open(self.test_rc.cert, "w") as f:
             f.write("cert")
         self.assertTrue(os.path.samefile(self.test_rc.current_target("cert"),
-                                         os.path.join(self.tempdir, "archive",
+                                         os.path.join(self.config.config_dir, "archive",
                                                       "example.org",
                                                       "cert17.pem")))
 
@@ -369,18 +360,18 @@ class RenewableCertTests(BaseRenewableCertTest):
 
     def test_names(self):
         # Trying the current version
-        self._write_out_kind("cert", 12, util.load_vector("cert-san.pem"))
+        self._write_out_kind("cert", 12, test_util.load_vector("cert-san.pem"))
         self.assertEqual(self.test_rc.names(),
                          ["example.com", "www.example.com"])
 
         # Trying a non-current version
-        self._write_out_kind("cert", 15, util.load_vector("cert.pem"))
+        self._write_out_kind("cert", 15, test_util.load_vector("cert.pem"))
         self.assertEqual(self.test_rc.names(12),
                          ["example.com", "www.example.com"])
 
         # Testing common name is listed first
         self._write_out_kind(
-            "cert", 12, util.load_vector("cert-5sans.pem"))
+            "cert", 12, test_util.load_vector("cert-5sans.pem"))
         self.assertEqual(
             self.test_rc.names(12),
             ["example.com"] + ["{0}.example.com".format(c) for c in "abcd"])
@@ -393,7 +384,7 @@ class RenewableCertTests(BaseRenewableCertTest):
     def test_time_interval_judgments(self, mock_datetime):
         """Test should_autodeploy() and should_autorenew() on the basis
         of expiry time windows."""
-        test_cert = util.load_vector("cert.pem")
+        test_cert = test_util.load_vector("cert.pem")
         self._write_out_ex_kinds()
 
         self.test_rc.update_all_links_to(12)
@@ -491,7 +482,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.update_all_links_to(3)
         self.assertEqual(
             6, self.test_rc.save_successor(3, b'new cert', None,
-                                           b'new chain', self.cli_config))
+                                           b'new chain', self.config))
         with open(self.test_rc.version("cert", 6)) as f:
             self.assertEqual(f.read(), "new cert")
         with open(self.test_rc.version("chain", 6)) as f:
@@ -504,10 +495,10 @@ class RenewableCertTests(BaseRenewableCertTest):
         # Let's try two more updates
         self.assertEqual(
             7, self.test_rc.save_successor(6, b'again', None,
-                                           b'newer chain', self.cli_config))
+                                           b'newer chain', self.config))
         self.assertEqual(
             8, self.test_rc.save_successor(7, b'hello', None,
-                                           b'other chain', self.cli_config))
+                                           b'other chain', self.config))
         # All of the subsequent versions should link directly to the original
         # privkey.
         for i in (6, 7, 8):
@@ -522,14 +513,14 @@ class RenewableCertTests(BaseRenewableCertTest):
         self.test_rc.update_all_links_to(8)
         self.assertEqual(
             9, self.test_rc.save_successor(8, b'last', None,
-                                           b'attempt', self.cli_config))
+                                           b'attempt', self.config))
         for kind in ALL_FOUR:
             self.assertEqual(self.test_rc.available_versions(kind),
                              list(six.moves.range(1, 10)))
             self.assertEqual(self.test_rc.current_version(kind), 8)
         with open(self.test_rc.version("fullchain", 9)) as f:
             self.assertEqual(f.read(), "last" + "attempt")
-        temp_config_file = os.path.join(self.cli_config.renewal_configs_dir,
+        temp_config_file = os.path.join(self.config.renewal_configs_dir,
                                         self.test_rc.lineagename) + ".conf.new"
         with open(temp_config_file, "w") as f:
             f.write("We previously crashed while writing me :(")
@@ -537,7 +528,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         # be saved in a new file rather than creating a new symlink.
         self.assertEqual(
             10, self.test_rc.save_successor(9, b'with', b'a',
-                                            b'key', self.cli_config))
+                                            b'key', self.config))
         self.assertTrue(os.path.exists(self.test_rc.version("privkey", 10)))
         self.assertFalse(os.path.islink(self.test_rc.version("privkey", 10)))
         self.assertFalse(os.path.exists(temp_config_file))
@@ -597,38 +588,38 @@ class RenewableCertTests(BaseRenewableCertTest):
 
         from certbot import storage
         result = storage.RenewableCert.new_lineage(
-            "the-lineage.com", b"cert", b"privkey", b"chain", self.cli_config)
+            "the-lineage.com", b"cert", b"privkey", b"chain", self.config)
         # This consistency check tests most relevant properties about the
         # newly created cert lineage.
         # pylint: disable=protected-access
         self.assertTrue(result._consistent())
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.renewal_configs_dir, "the-lineage.com.conf")))
+            self.config.renewal_configs_dir, "the-lineage.com.conf")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "the-lineage.com", "README")))
+            self.config.live_dir, "the-lineage.com", "README")))
         with open(result.fullchain, "rb") as f:
             self.assertEqual(f.read(), b"cert" + b"chain")
         # Let's do it again and make sure it makes a different lineage
         result = storage.RenewableCert.new_lineage(
-            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config)
+            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.config)
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.renewal_configs_dir, "the-lineage.com-0001.conf")))
+            self.config.renewal_configs_dir, "the-lineage.com-0001.conf")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "the-lineage.com-0001", "README")))
+            self.config.live_dir, "the-lineage.com-0001", "README")))
         # Now trigger the detection of already existing files
         os.mkdir(os.path.join(
-            self.cli_config.live_dir, "the-lineage.com-0002"))
+            self.config.live_dir, "the-lineage.com-0002"))
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert.new_lineage, "the-lineage.com",
-                          b"cert3", b"privkey3", b"chain3", self.cli_config)
-        os.mkdir(os.path.join(self.cli_config.default_archive_dir, "other-example.com"))
+                          b"cert3", b"privkey3", b"chain3", self.config)
+        os.mkdir(os.path.join(self.config.default_archive_dir, "other-example.com"))
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert.new_lineage,
                           "other-example.com", b"cert4",
-                          b"privkey4", b"chain4", self.cli_config)
+                          b"privkey4", b"chain4", self.config)
         # Make sure it can accept renewal parameters
         result = storage.RenewableCert.new_lineage(
-            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config)
+            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.config)
         # TODO: Conceivably we could test that the renewal parameters actually
         #       got saved
 
@@ -640,19 +631,19 @@ class RenewableCertTests(BaseRenewableCertTest):
         mock_rv.side_effect = lambda x: x
 
         from certbot import storage
-        shutil.rmtree(self.cli_config.renewal_configs_dir)
-        shutil.rmtree(self.cli_config.default_archive_dir)
-        shutil.rmtree(self.cli_config.live_dir)
+        shutil.rmtree(self.config.renewal_configs_dir)
+        shutil.rmtree(self.config.default_archive_dir)
+        shutil.rmtree(self.config.live_dir)
 
         storage.RenewableCert.new_lineage(
-            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.cli_config)
+            "the-lineage.com", b"cert2", b"privkey2", b"chain2", self.config)
         self.assertTrue(os.path.exists(
             os.path.join(
-                self.cli_config.renewal_configs_dir, "the-lineage.com.conf")))
+                self.config.renewal_configs_dir, "the-lineage.com.conf")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "the-lineage.com", "privkey.pem")))
+            self.config.live_dir, "the-lineage.com", "privkey.pem")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.default_archive_dir, "the-lineage.com", "privkey1.pem")))
+            self.config.default_archive_dir, "the-lineage.com", "privkey1.pem")))
 
     @mock.patch("certbot.storage.util.unique_lineage_name")
     def test_invalid_config_filename(self, mock_uln):
@@ -660,7 +651,7 @@ class RenewableCertTests(BaseRenewableCertTest):
         mock_uln.return_value = "this_does_not_end_with_dot_conf", "yikes"
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert.new_lineage, "example.com",
-                          "cert", "privkey", "chain", self.cli_config)
+                          "cert", "privkey", "chain", self.config)
 
     def test_bad_kind(self):
         self.assertRaises(
@@ -744,18 +735,18 @@ class RenewableCertTests(BaseRenewableCertTest):
         from certbot import storage
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert,
-                          self.config.filename, self.cli_config)
-        os.symlink("missing", self.config[ALL_FOUR[0]])
+                          self.config_file.filename, self.config)
+        os.symlink("missing", self.config_file[ALL_FOUR[0]])
         self.assertRaises(errors.CertStorageError,
                           storage.RenewableCert,
-                          self.config.filename, self.cli_config)
+                          self.config_file.filename, self.config)
 
     def test_write_renewal_config(self):
         # Mostly tested by the process of creating and updating lineages,
         # but we can test that this successfully creates files, removes
         # unneeded items, and preserves comments.
-        temp = os.path.join(self.tempdir, "sample-file")
-        temp2 = os.path.join(self.tempdir, "sample-file.new")
+        temp = os.path.join(self.config.config_dir, "sample-file")
+        temp2 = os.path.join(self.config.config_dir, "sample-file.new")
         with open(temp, "w") as f:
             f.write("[renewalparams]\nuseful = value # A useful value\n"
                     "useless = value # Not needed\n")
@@ -785,17 +776,17 @@ class RenewableCertTests(BaseRenewableCertTest):
 
     def test_update_symlinks(self):
         from certbot import storage
-        archive_dir_path = os.path.join(self.tempdir, "archive", "example.org")
+        archive_dir_path = os.path.join(self.config.config_dir, "archive", "example.org")
         for kind in ALL_FOUR:
-            live_path = self.config[kind]
+            live_path = self.config_file[kind]
             basename = kind + "1.pem"
             archive_path = os.path.join(archive_dir_path, basename)
             open(archive_path, 'a').close()
-            os.symlink(os.path.join(self.tempdir, basename), live_path)
+            os.symlink(os.path.join(self.config.config_dir, basename), live_path)
         self.assertRaises(errors.CertStorageError,
-                          storage.RenewableCert, self.config.filename,
-                          self.cli_config)
-        storage.RenewableCert(self.config.filename, self.cli_config,
+                          storage.RenewableCert, self.config_file.filename,
+                          self.config)
+        storage.RenewableCert(self.config_file.filename, self.config,
             update_symlinks=True)
 
 class DeleteFilesTest(BaseRenewableCertTest):
@@ -804,88 +795,88 @@ class DeleteFilesTest(BaseRenewableCertTest):
         super(DeleteFilesTest, self).setUp()
 
         for kind in ALL_FOUR:
-            kind_path = os.path.join(self.tempdir, "live", "example.org",
+            kind_path = os.path.join(self.config.config_dir, "live", "example.org",
                                         kind + ".pem")
             with open(kind_path, 'a'):
                 pass
-        self.config.write()
+        self.config_file.write()
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.renewal_configs_dir, "example.org.conf")))
+            self.config.renewal_configs_dir, "example.org.conf")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertTrue(os.path.exists(os.path.join(
-            self.tempdir, "archive", "example.org")))
+            self.config.config_dir, "archive", "example.org")))
 
     def _call(self):
         from certbot import storage
         with mock.patch("certbot.storage.logger"):
-            storage.delete_files(self.cli_config, "example.org")
+            storage.delete_files(self.config, "example.org")
 
     def test_delete_all_files(self):
         self._call()
 
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.renewal_configs_dir, "example.org.conf")))
+            self.config.renewal_configs_dir, "example.org.conf")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.tempdir, "archive", "example.org")))
+            self.config.config_dir, "archive", "example.org")))
 
     def test_bad_renewal_config(self):
-        with open(self.config.filename, 'a') as config_file:
+        with open(self.config_file.filename, 'a') as config_file:
             config_file.write("asdfasfasdfasdf")
 
         self.assertRaises(errors.CertStorageError, self._call)
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.renewal_configs_dir, "example.org.conf")))
+            self.config.renewal_configs_dir, "example.org.conf")))
 
     def test_no_renewal_config(self):
-        os.remove(self.config.filename)
+        os.remove(self.config_file.filename)
         self.assertRaises(errors.CertStorageError, self._call)
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
-        self.assertFalse(os.path.exists(self.config.filename))
+            self.config.live_dir, "example.org")))
+        self.assertFalse(os.path.exists(self.config_file.filename))
 
     def test_no_cert_file(self):
         os.remove(os.path.join(
-            self.cli_config.live_dir, "example.org", "cert.pem"))
+            self.config.live_dir, "example.org", "cert.pem"))
         self._call()
-        self.assertFalse(os.path.exists(self.config.filename))
+        self.assertFalse(os.path.exists(self.config_file.filename))
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.tempdir, "archive", "example.org")))
+            self.config.config_dir, "archive", "example.org")))
 
     def test_no_readme_file(self):
         os.remove(os.path.join(
-            self.cli_config.live_dir, "example.org", "README"))
+            self.config.live_dir, "example.org", "README"))
         self._call()
-        self.assertFalse(os.path.exists(self.config.filename))
+        self.assertFalse(os.path.exists(self.config_file.filename))
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.tempdir, "archive", "example.org")))
+            self.config.config_dir, "archive", "example.org")))
 
     def test_livedir_not_empty(self):
         with open(os.path.join(
-            self.cli_config.live_dir, "example.org", "other_file"), 'a'):
+            self.config.live_dir, "example.org", "other_file"), 'a'):
             pass
         self._call()
-        self.assertFalse(os.path.exists(self.config.filename))
+        self.assertFalse(os.path.exists(self.config_file.filename))
         self.assertTrue(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(os.path.join(
-            self.tempdir, "archive", "example.org")))
+            self.config.config_dir, "archive", "example.org")))
 
     def test_no_archive(self):
-        archive_dir = os.path.join(self.tempdir, "archive", "example.org")
+        archive_dir = os.path.join(self.config.config_dir, "archive", "example.org")
         os.rmdir(archive_dir)
         self._call()
-        self.assertFalse(os.path.exists(self.config.filename))
+        self.assertFalse(os.path.exists(self.config_file.filename))
         self.assertFalse(os.path.exists(os.path.join(
-            self.cli_config.live_dir, "example.org")))
+            self.config.live_dir, "example.org")))
         self.assertFalse(os.path.exists(archive_dir))
 
 
diff --git a/certbot/tests/util.py b/certbot/tests/util.py
index a36f0f6ac..4ecddc34f 100644
--- a/certbot/tests/util.py
+++ b/certbot/tests/util.py
@@ -22,6 +22,7 @@ from certbot import constants
 from certbot import interfaces
 from certbot import storage
 from certbot import util
+from certbot import configuration
 
 from certbot.display import util as display_util
 
@@ -246,6 +247,20 @@ class TempDirTestCase(unittest.TestCase):
     def tearDown(self):
         shutil.rmtree(self.tempdir)
 
+class ConfigTestCase(TempDirTestCase):
+    """Test class which sets up a NamespaceConfig object.
+
+    """
+    def setUp(self):
+        super(ConfigTestCase, self).setUp()
+        self.config = configuration.NamespaceConfig(
+            mock.MagicMock(
+                config_dir=os.path.join(self.tempdir, 'config'),
+                work_dir=os.path.join(self.tempdir, 'work'),
+                logs_dir=os.path.join(self.tempdir, 'logs'),
+                server="example.com",
+            )
+        )
 
 def lock_and_call(func, lock_path):
     """Grab a lock for lock_path and call func.