diff --git a/lib/puppet/application/cert.rb b/lib/puppet/application/cert.rb
index 162672b6a..330fba8bd 100644
--- a/lib/puppet/application/cert.rb
+++ b/lib/puppet/application/cert.rb
@@ -1,226 +1,227 @@
 require 'puppet/application'
 
 class Puppet::Application::Cert < Puppet::Application
 
   should_parse_config
   run_mode :master
 
   attr_accessor :all, :ca, :digest, :signed
 
   def subcommand
     @subcommand
   end
   def subcommand=(name)
     # Handle the nasty, legacy mapping of "clean" to "destroy".
     sub = name.to_sym
     @subcommand = (sub == :clean ? :destroy : sub)
   end
 
   option("--clean", "-c") do
     self.subcommand = "destroy"
   end
 
   option("--all", "-a") do
     @all = true
   end
 
   option("--digest DIGEST") do |arg|
     @digest = arg
   end
 
   option("--signed", "-s") do
     @signed = true
   end
 
   option("--debug", "-d") do |arg|
     Puppet::Util::Log.level = :debug
   end
 
   require 'puppet/ssl/certificate_authority/interface'
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject {|m| m == :destroy }.each do |method|
     option("--#{method}", "-#{method.to_s[0,1]}") do
       self.subcommand = method
     end
   end
 
   option("--verbose", "-v") do
     Puppet::Util::Log.level = :info
   end
 
   def help
     <<-HELP
 
 puppet-cert(8) -- Manage certificates and requests
 ========
 
 SYNOPSIS
 --------
 Standalone certificate authority. Capable of generating certificates,
 but mostly used for signing certificate requests from puppet clients.
 
 
 USAGE
 -----
 puppet cert <action> [-h|--help] [-V|--version] [-d|--debug] [-v|--verbose]
   [--digest <digest>] [<host>]
 
 
 DESCRIPTION
 -----------
 Because the puppet master service defaults to not signing client
 certificate requests, this script is available for signing outstanding
 requests. It can be used to list outstanding requests and then either
 sign them individually or sign all of them.
 
 ACTIONS
 -------
 
 Every action except 'list' and 'generate' requires a hostname to act on,
 unless the '--all' option is set.
 
 * clean:
   Revoke a host's certificate (if applicable) and remove all files
   related to that host from puppet cert's storage. This is useful when
   rebuilding hosts, since new certificate signing requests will only be
   honored if puppet cert does not have a copy of a signed certificate
   for that host. If '--all' is specified then all host certificates,
   both signed and unsigned, will be removed.
 
 * fingerprint:
   Print the DIGEST (defaults to md5) fingerprint of a host's
   certificate.
 
 * generate:
   Generate a certificate for a named client. A certificate/keypair will
   be generated for each client named on the command line.
 
 * list:
   List outstanding certificate requests. If '--all' is specified, signed
   certificates are also listed, prefixed by '+', and revoked or invalid
   certificates are prefixed by '-' (the verification outcome is printed
   in parenthesis).
 
 * print:
   Print the full-text version of a host's certificate.
 
 * revoke:
   Revoke the certificate of a client. The certificate can be specified
   either by its serial number (given as a decimal number or a
   hexadecimal number prefixed by '0x') or by its hostname. The
   certificate is revoked by adding it to the Certificate Revocation List
   given by the 'cacrl' configuration option. Note that the puppet master
   needs to be restarted after revoking certificates.
 
 * sign:
   Sign an outstanding certificate request.
 
 * verify:
   Verify the named certificate against the local CA certificate.
 
 
 OPTIONS
 -------
 Note that any configuration parameter that's valid in the configuration
 file is also a valid long argument. For example, 'ssldir' is a valid
 configuration parameter, so you can specify '--ssldir <directory>' as an
 argument.
 
 See the configuration file documentation at
 http://docs.puppetlabs.com/references/stable/configuration.html for the
 full list of acceptable parameters. A commented list of all
 configuration options can also be generated by running puppet cert with
 '--genconfig'.
 
 * --all:
   Operate on all items. Currently only makes sense with the 'sign',
   'clean', 'list', and 'fingerprint' actions.
 
 * --digest:
   Set the digest for fingerprinting (defaults to md5). Valid values
   depends on your openssl and openssl ruby extension version, but should
   contain at least md5, sha1, md2, sha256.
 
 * --debug:
   Enable full debugging.
 
 * --help:
   Print this help message
 
 * --verbose:
   Enable verbosity.
 
 * --version:
   Print the puppet version number and exit.
 
 
 EXAMPLE
 -------
     $ puppet cert list
     culain.madstop.com
     $ puppet cert sign culain.madstop.com
 
 
 AUTHOR
 ------
 Luke Kanies
 
 
 COPYRIGHT
 ---------
 Copyright (c) 2011 Puppet Labs, LLC Licensed under the Apache 2.0 License
 
     HELP
   end
 
   def main
     if @all
       hosts = :all
     elsif @signed
       hosts = :signed
     else
       hosts = command_line.args.collect { |h| h.downcase }
     end
     begin
       @ca.apply(:revoke, :to => hosts) if subcommand == :destroy
       @ca.apply(subcommand, :to => hosts, :digest => @digest)
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(24)
     end
   end
 
   def setup
     require 'puppet/ssl/certificate_authority'
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::Util::Log.newdestination :console
 
     if [:generate, :destroy].include? subcommand
       Puppet::SSL::Host.ca_location = :local
     else
       Puppet::SSL::Host.ca_location = :only
     end
 
     begin
       @ca = Puppet::SSL::CertificateAuthority.new
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(23)
     end
   end
 
   def parse_options
     # handle the bareword subcommand pattern.
     result = super
     unless self.subcommand then
       if sub = self.command_line.args.shift then
         self.subcommand = sub
       else
-        help
+        puts help
+        exit
       end
     end
     result
   end
 end
diff --git a/spec/unit/application/cert_spec.rb b/spec/unit/application/cert_spec.rb
index 7510f0783..300234c2b 100755
--- a/spec/unit/application/cert_spec.rb
+++ b/spec/unit/application/cert_spec.rb
@@ -1,212 +1,222 @@
 #!/usr/bin/env rspec
 require 'spec_helper'
 require 'puppet/application/cert'
 
 describe Puppet::Application::Cert, :'fails_on_ruby_1.9.2' => true do
   before :each do
     @cert_app = Puppet::Application[:cert]
     Puppet::Util::Log.stubs(:newdestination)
   end
 
   it "should operate in master run_mode" do
     @cert_app.class.run_mode.name.should equal(:master)
   end
 
   it "should ask Puppet::Application to parse Puppet configuration file" do
     @cert_app.should_parse_config?.should be_true
   end
 
   it "should declare a main command" do
     @cert_app.should respond_to(:main)
   end
 
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject{ |m| m == :destroy }.each do |method|
     it "should declare option --#{method}" do
       @cert_app.should respond_to("handle_#{method}".to_sym)
     end
   end
 
   it "should set log level to info with the --verbose option" do
     @cert_app.handle_verbose(0)
     Puppet::Log.level.should == :info
   end
 
   it "should set log level to debug with the --debug option" do
     @cert_app.handle_debug(0)
     Puppet::Log.level.should == :debug
   end
 
   it "should set the fingerprint digest with the --digest option" do
     @cert_app.handle_digest(:digest)
     @cert_app.digest.should == :digest
   end
 
   it "should set cert_mode to :destroy for --clean" do
     @cert_app.handle_clean(0)
     @cert_app.subcommand.should == :destroy
   end
 
   it "should set all to true for --all" do
     @cert_app.handle_all(0)
     @cert_app.all.should be_true
   end
 
   it "should set signed to true for --signed" do
     @cert_app.handle_signed(0)
     @cert_app.signed.should be_true
   end
 
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject { |m| m == :destroy }.each do |method|
     it "should set cert_mode to #{method} with option --#{method}" do
       @cert_app.send("handle_#{method}".to_sym, nil)
 
       @cert_app.subcommand.should == method
     end
   end
 
   describe "during setup" do
 
     before :each do
       Puppet::Log.stubs(:newdestination)
       Puppet::SSL::Host.stubs(:ca_location=)
       Puppet::SSL::CertificateAuthority.stubs(:new)
     end
 
     it "should set console as the log destination" do
       Puppet::Log.expects(:newdestination).with(:console)
 
       @cert_app.setup
     end
 
     it "should print puppet config if asked to in Puppet config" do
       Puppet.settings.stubs(:print_configs?).returns(true)
       Puppet.settings.expects(:print_configs).returns true
       expect { @cert_app.setup }.to exit_with 0
     end
 
     it "should exit after printing puppet config if asked to in Puppet config" do
       Puppet.settings.stubs(:print_configs?).returns(true)
       expect { @cert_app.setup }.to exit_with 1
     end
 
     it "should set the CA location to 'only'" do
       Puppet::SSL::Host.expects(:ca_location=).with(:only)
 
       @cert_app.setup
     end
 
     it "should create a new certificate authority" do
       Puppet::SSL::CertificateAuthority.expects(:new)
 
       @cert_app.setup
     end
 
     it "should set the ca_location to :local if the cert_mode is generate" do
       @cert_app.subcommand = 'generate'
       Puppet::SSL::Host.expects(:ca_location=).with(:local)
       @cert_app.setup
     end
 
     it "should set the ca_location to :local if the cert_mode is destroy" do
       @cert_app.subcommand = 'destroy'
       Puppet::SSL::Host.expects(:ca_location=).with(:local)
       @cert_app.setup
     end
 
     it "should set the ca_location to :only if the cert_mode is print" do
       @cert_app.subcommand = 'print'
       Puppet::SSL::Host.expects(:ca_location=).with(:only)
       @cert_app.setup
     end
   end
 
   describe "when running" do
     before :each do
       @cert_app.all = false
       @ca = stub_everything 'ca'
       @cert_app.ca = @ca
       @cert_app.command_line.stubs(:args).returns([])
     end
 
     it "should delegate to the CertificateAuthority" do
       @ca.expects(:apply)
 
       @cert_app.main
     end
 
     it "should delegate with :all if option --all was given" do
       @cert_app.handle_all(0)
 
       @ca.expects(:apply).with { |cert_mode,to| to[:to] == :all }
 
       @cert_app.main
     end
 
     it "should delegate to ca.apply with the hosts given on command line" do
       @cert_app.command_line.stubs(:args).returns(["host"])
 
       @ca.expects(:apply).with { |cert_mode,to| to[:to] == ["host"]}
 
       @cert_app.main
     end
 
     it "should send the currently set digest" do
       @cert_app.command_line.stubs(:args).returns(["host"])
       @cert_app.handle_digest(:digest)
 
       @ca.expects(:apply).with { |cert_mode,to| to[:digest] == :digest}
 
       @cert_app.main
     end
 
     it "should revoke cert if cert_mode is clean" do
       @cert_app.subcommand = :destroy
       @cert_app.command_line.stubs(:args).returns(["host"])
 
       @ca.expects(:apply).with { |cert_mode,to| cert_mode == :revoke }
       @ca.expects(:apply).with { |cert_mode,to| cert_mode == :destroy }
 
       @cert_app.main
     end
   end
 
   describe "when identifying subcommands" do
     before :each do
       @cert_app.all = false
       @ca = stub_everything 'ca'
       @cert_app.ca = @ca
     end
 
     %w{list revoke generate sign print verify fingerprint}.each do |cmd|
       short = cmd[0,1]
       [cmd, "--#{cmd}", "-#{short}"].each do |option|
         # In our command line '-v' was eaten by 'verbose', so we can't consume
         # it here; this is a special case from our otherwise standard
         # processing. --daniel 2011-02-22
         next if option == "-v"
 
         it "should recognise '#{option}'" do
           args = [option, "fun.example.com"]
 
           @cert_app.command_line.stubs(:args).returns(args)
           @cert_app.parse_options
           @cert_app.subcommand.should == cmd.to_sym
 
           args.should == ["fun.example.com"]
         end
       end
     end
 
     %w{clean --clean -c}.each do |ugly|
       it "should recognise the '#{ugly}' option as destroy" do
         args = [ugly, "fun.example.com"]
 
         @cert_app.command_line.stubs(:args).returns(args)
         @cert_app.parse_options
         @cert_app.subcommand.should == :destroy
 
         args.should == ["fun.example.com"]
       end
     end
+
+    it "should print help and exit if there is no subcommand" do
+      args = []
+      @cert_app.command_line.stubs(:args).returns(args)
+      @cert_app.stubs(:help).returns("I called for help!")
+      @cert_app.expects(:puts).with("I called for help!")
+
+      expect { @cert_app.parse_options }.to exit_with 0
+      @cert_app.subcommand.should be_nil
+    end
   end
 end