diff --git a/acme/setup.py b/acme/setup.py
index 1dbdc1291..4ff19fc86 100644
--- a/acme/setup.py
+++ b/acme/setup.py
@@ -3,7 +3,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'cryptography>=2.5.0',
diff --git a/certbot-apache/setup.py b/certbot-apache/setup.py
index ab545be03..0fa966c15 100644
--- a/certbot-apache/setup.py
+++ b/certbot-apache/setup.py
@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     # We specify the minimum acme and certbot version as the current plugin
diff --git a/certbot-compatibility-test/setup.py b/certbot-compatibility-test/setup.py
index 2b8226d6e..5548cd72f 100644
--- a/certbot-compatibility-test/setup.py
+++ b/certbot-compatibility-test/setup.py
@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'certbot',
diff --git a/certbot-dns-cloudflare/setup.py b/certbot-dns-cloudflare/setup.py
index 3ac78a942..e251e52d8 100644
--- a/certbot-dns-cloudflare/setup.py
+++ b/certbot-dns-cloudflare/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'cloudflare>=1.5.1',
diff --git a/certbot-dns-digitalocean/setup.py b/certbot-dns-digitalocean/setup.py
index ca1b1612e..718115892 100644
--- a/certbot-dns-digitalocean/setup.py
+++ b/certbot-dns-digitalocean/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'python-digitalocean>=1.11', # 1.15.0 or newer is recommended for TTL support
diff --git a/certbot-dns-dnsimple/setup.py b/certbot-dns-dnsimple/setup.py
index 5760b6381..2b7ebb799 100644
--- a/certbot-dns-dnsimple/setup.py
+++ b/certbot-dns-dnsimple/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     # This version of lexicon is required to address the problem described in
diff --git a/certbot-dns-dnsmadeeasy/setup.py b/certbot-dns-dnsmadeeasy/setup.py
index 103b8c3e9..663f1b182 100644
--- a/certbot-dns-dnsmadeeasy/setup.py
+++ b/certbot-dns-dnsmadeeasy/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-gehirn/setup.py b/certbot-dns-gehirn/setup.py
index 77cd937b3..4bbe47ed2 100644
--- a/certbot-dns-gehirn/setup.py
+++ b/certbot-dns-gehirn/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-google/setup.py b/certbot-dns-google/setup.py
index eb4152456..b16a16ebd 100644
--- a/certbot-dns-google/setup.py
+++ b/certbot-dns-google/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'google-api-python-client>=1.5.5',
diff --git a/certbot-dns-linode/setup.py b/certbot-dns-linode/setup.py
index 3ff9ad5a0..0bbd897dc 100644
--- a/certbot-dns-linode/setup.py
+++ b/certbot-dns-linode/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-luadns/setup.py b/certbot-dns-luadns/setup.py
index 729e9950c..e4197fa37 100644
--- a/certbot-dns-luadns/setup.py
+++ b/certbot-dns-luadns/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-nsone/setup.py b/certbot-dns-nsone/setup.py
index 039cbb180..b91e0207a 100644
--- a/certbot-dns-nsone/setup.py
+++ b/certbot-dns-nsone/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-ovh/setup.py b/certbot-dns-ovh/setup.py
index 8748f6293..612e549ca 100644
--- a/certbot-dns-ovh/setup.py
+++ b/certbot-dns-ovh/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-dns-rfc2136/setup.py b/certbot-dns-rfc2136/setup.py
index 476c8a4ab..8282ca4fb 100644
--- a/certbot-dns-rfc2136/setup.py
+++ b/certbot-dns-rfc2136/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dnspython>=1.15.0',
diff --git a/certbot-dns-route53/setup.py b/certbot-dns-route53/setup.py
index 596146d05..40bd21545 100644
--- a/certbot-dns-route53/setup.py
+++ b/certbot-dns-route53/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'boto3>=1.15.15',
diff --git a/certbot-dns-sakuracloud/setup.py b/certbot-dns-sakuracloud/setup.py
index 464380ccc..6064ce852 100644
--- a/certbot-dns-sakuracloud/setup.py
+++ b/certbot-dns-sakuracloud/setup.py
@@ -4,7 +4,7 @@ import sys
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     'dns-lexicon>=3.2.1',
diff --git a/certbot-nginx/setup.py b/certbot-nginx/setup.py
index a2beec1d6..9963a75e2 100644
--- a/certbot-nginx/setup.py
+++ b/certbot-nginx/setup.py
@@ -1,7 +1,7 @@
 from setuptools import find_packages
 from setuptools import setup
 
-version = '2.3.0.dev0'
+version = '2.3.0'
 
 install_requires = [
     # We specify the minimum acme and certbot version as the current plugin
diff --git a/certbot/certbot/__init__.py b/certbot/certbot/__init__.py
index 331332bb7..7da96a76d 100644
--- a/certbot/certbot/__init__.py
+++ b/certbot/certbot/__init__.py
@@ -1,3 +1,3 @@
 """Certbot client."""
 # version number like 1.2.3a0, must have at least 2 parts, like 1.2
-__version__ = '2.3.0.dev0'
+__version__ = '2.3.0'
diff --git a/certbot/docs/cli-help.txt b/certbot/docs/cli-help.txt
index dd270e6eb..d2eb17da2 100644
--- a/certbot/docs/cli-help.txt
+++ b/certbot/docs/cli-help.txt
@@ -26,6 +26,7 @@ manage certificates:
     certificates    Display information about certificates you have from Certbot
     revoke          Revoke a certificate (supply --cert-name or --cert-path)
     delete          Delete a certificate (supply --cert-name)
+    reconfigure     Update a certificate's configuration (supply --cert-name)
 
 manage your account:
     register        Create an ACME account
@@ -35,7 +36,7 @@ manage your account:
   --agree-tos       Agree to the ACME server's Subscriber Agreement
    -m EMAIL         Email address for important account notifications
 
-optional arguments:
+options:
   -h, --help            show this help message and exit
   -c CONFIG_FILE, --config CONFIG_FILE
                         path to config file (default: /etc/letsencrypt/cli.ini
@@ -58,18 +59,15 @@ optional arguments:
                         it's not being run in a terminal. This flag cannot be
                         used with the renew subcommand. (default: False)
   -d DOMAIN, --domains DOMAIN, --domain DOMAIN
-                        Domain names to apply. For multiple domains you can
+                        Domain names to include. For multiple domains you can
                         use multiple -d flags or enter a comma separated list
-                        of domains as a parameter. The first domain provided
-                        will be the subject CN of the certificate, and all
-                        domains will be Subject Alternative Names on the
-                        certificate. The first domain will also be used in
-                        some software user interfaces and as the file paths
-                        for the certificate and related material unless
-                        otherwise specified or you already have a certificate
-                        with the same name. In the case of a name collision it
-                        will append a number like 0001 to the file path name.
-                        (default: Ask)
+                        of domains as a parameter. All domains will be
+                        included as Subject Alternative Names on the
+                        certificate. The first domain will be used as the
+                        certificate name, unless otherwise specified or if you
+                        already have a certificate with the same name. In the
+                        case of a name conflict, a number like -0001 will be
+                        appended to the certificate name. (default: Ask)
   --eab-kid EAB_KID     Key Identifier for External Account Binding (default:
                         None)
   --eab-hmac-key EAB_HMAC_KEY
@@ -126,7 +124,7 @@ optional arguments:
                         case, and to know when to deprecate support for past
                         Python versions and flags. If you wish to hide this
                         information from the Let's Encrypt server, set this to
-                        "". (default: CertbotACMEClient/2.2.0 (certbot;
+                        "". (default: CertbotACMEClient/2.3.0 (certbot;
                         OS_NAME OS_VERSION) Authenticator/XXX Installer/YYY
                         (SUBCOMMAND; flags: FLAGS) Py/major.minor.patchlevel).
                         The flags encoded in the user agent are: --duplicate,
@@ -229,6 +227,17 @@ security:
 testing:
   The following flags are meant for testing and integration purposes only.
 
+  --run-deploy-hooks    When performing a test run using `--dry-run` or
+                        `reconfigure`, run any applicable deploy hooks. This
+                        includes hooks set on the command line, saved in the
+                        certificate's renewal configuration file, or present
+                        in the renewal-hooks directory. To exclude directory
+                        hooks, use --no-directory-hooks. The hook(s) will only
+                        be run if the dry run succeeds, and will use the
+                        current active certificate, not the temporary test
+                        certificate acquired during the dry run. This flag is
+                        recommended when modifying the deploy hook using
+                        `reconfigure`. (default: False)
   --test-cert, --staging
                         Use the staging server to obtain or revoke test
                         (invalid) certificates; equivalent to --server
@@ -288,6 +297,8 @@ manage:
                         --cert-name
   update_symlinks       Recreate symlinks in your /etc/letsencrypt/live/
                         directory
+  reconfigure           Update renewal configuration for a certificate
+                        specified by --cert-name
 
 run:
   Options for obtaining & installing certificates
@@ -432,6 +443,9 @@ enhance:
 show_account:
   Options useful for the "show_account" subcommand:
 
+reconfigure:
+  Common options that may be updated with the "reconfigure" subcommand:
+
 plugins:
   Plugin Selection: Certbot client supports an extensible plugins
   architecture. See 'certbot plugins' for a list of all installed plugins
@@ -707,10 +721,16 @@ null:
   Null Installer
 
 standalone:
-  Spin up a temporary webserver
+  Runs an HTTP server locally which serves the necessary validation files
+  under the /.well-known/acme-challenge/ request path. Suitable if there is
+  no HTTP server already running. HTTP challenge only (wildcards not
+  supported).
 
 webroot:
-  Place files in webroot directory
+  Saves the necessary validation files to a .well-known/acme-challenge/
+  directory within the nominated webroot path. A seperate HTTP server must
+  be running and serving files from the webroot path. HTTP challenge only
+  (wildcards not supported).
 
   --webroot-path WEBROOT_PATH, -w WEBROOT_PATH
                         public_html / webroot path. This can be specified