diff --git a/letsencrypt/cli.py b/letsencrypt/cli.py
index 7b8231bde..4d32f9ca0 100644
--- a/letsencrypt/cli.py
+++ b/letsencrypt/cli.py
@@ -98,9 +98,11 @@ def run(args, config, plugins):
         return "Configurator could not be determined"
 
     acme, doms = _common_run(args, config, acc, authenticator, installer)
+    # TODO: Handle errors from _common_run?
     lineage = acme.obtain_and_enroll_certificate(doms, authenticator,
                                                  installer)
-    # TODO: Decide whether to enroll or not from config/policy
+    if not lineage:
+        return "Certificate could not be obtained"
     acme.deploy_certificate(doms, lineage)
     acme.enhance_config(doms, args.redirect)
 
@@ -122,9 +124,11 @@ def auth(args, config, plugins):
     else:
         installer = None
 
+    # TODO: Handle errors from _common_run?
     acme, doms = _common_run(
         args, config, acc, authenticator=authenticator, installer=installer)
-    acme.obtain_certificate(doms)
+    if not acme.obtain_and_enroll_certificate(doms, authenticator, installer):
+        return "Certificate could not be obtained"
 
 
 def install(args, config, plugins):
diff --git a/letsencrypt/client.py b/letsencrypt/client.py
index e7c6310eb..0a16dbff0 100644
--- a/letsencrypt/client.py
+++ b/letsencrypt/client.py
@@ -163,7 +163,8 @@ class Client(object):
         # TODO: Add IPlugin.name or use PluginsFactory.find_init instead
         #       of assuming that each plugin has a .name attribute
         self.config.namespace.authenticator = authenticator.name
-        self.config.namespace.installer = installer.name
+        if installer is not None:
+            self.config.namespace.installer = installer.name
         return storage.RenewableCert.new_lineage(domains[0], cert_pem,
                                                  privkey, chain_pem,
                                                  vars(self.config.namespace))