diff --git a/lib/puppet/application/cert.rb b/lib/puppet/application/cert.rb
index a4ee5fef3..80ccc46f9 100644
--- a/lib/puppet/application/cert.rb
+++ b/lib/puppet/application/cert.rb
@@ -1,76 +1,82 @@
 require 'puppet'
 require 'puppet/application'
 require 'puppet/ssl/certificate_authority'
 
 class Puppet::Application::Cert < Puppet::Application
 
     should_parse_config
 
-    attr_accessor :mode, :all, :ca, :digest
+    attr_accessor :mode, :all, :ca, :digest, :signed
 
     def find_mode(opt)
         modes = Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS
         tmp = opt.sub("--", '').to_sym
         @mode = modes.include?(tmp) ? tmp : nil
     end
 
     option("--clean", "-c") do
         @mode = :destroy
     end
 
     option("--all", "-a") do
         @all = true
     end
 
     option("--digest DIGEST") do |arg|
         @digest = arg
     end
 
+    option("--signed", "-s") do
+        @signed = true
+    end
+
     option("--debug", "-d") do |arg|
         Puppet::Util::Log.level = :debug
     end
 
     Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject {|m| m == :destroy }.each do |method|
         option("--#{method}", "-%s" % method.to_s[0,1] ) do
             find_mode("--#{method}")
         end
     end
 
     option("--verbose", "-v") do
         Puppet::Util::Log.level = :info
     end
 
     def main
         if @all
             hosts = :all
+        elsif @signed
+            hosts = :signed
         else
             hosts = command_line.args.collect { |h| puts h; h.downcase }
         end
         begin
             @ca.apply(:revoke, :to => hosts) if @mode == :destroy
             @ca.apply(@mode, :to => hosts, :digest => @digest)
         rescue => detail
             puts detail.backtrace if Puppet[:trace]
             puts detail.to_s
             exit(24)
         end
     end
 
     def setup
         if Puppet.settings.print_configs?
             exit(Puppet.settings.print_configs ? 0 : 1)
         end
 
         Puppet::Util::Log.newdestination :console
 
         Puppet::SSL::Host.ca_location = :only
 
         begin
             @ca = Puppet::SSL::CertificateAuthority.new
         rescue => detail
             puts detail.backtrace if Puppet[:trace]
             puts detail.to_s
             exit(23)
         end
     end
 end
diff --git a/lib/puppet/ssl/certificate_authority/interface.rb b/lib/puppet/ssl/certificate_authority/interface.rb
index d2dc7b9b5..b60834a2c 100644
--- a/lib/puppet/ssl/certificate_authority/interface.rb
+++ b/lib/puppet/ssl/certificate_authority/interface.rb
@@ -1,130 +1,132 @@
 # This class is basically a hidden class that knows how to act
 # on the CA.  It's only used by the 'puppetca' executable, and its
 # job is to provide a CLI-like interface to the CA class.
 class Puppet::SSL::CertificateAuthority::Interface
     INTERFACE_METHODS = [:destroy, :list, :revoke, :generate, :sign, :print, :verify, :fingerprint]
 
     class InterfaceError < ArgumentError; end
 
     attr_reader :method, :subjects, :digest
 
     # Actually perform the work.
     def apply(ca)
         unless subjects or method == :list
             raise ArgumentError, "You must provide hosts or :all when using %s" % method
         end
 
         begin
             if respond_to?(method)
                 return send(method, ca)
             end
 
             (subjects == :all ? ca.list : subjects).each do |host|
                 ca.send(method, host)
             end
         rescue InterfaceError
             raise
         rescue => detail
             puts detail.backtrace if Puppet[:trace]
             Puppet.err "Could not call %s: %s" % [method, detail]
         end
     end
 
     def generate(ca)
         raise InterfaceError, "It makes no sense to generate all hosts; you must specify a list" if subjects == :all
 
         subjects.each do |host|
             ca.generate(host)
         end
     end
 
     def initialize(method, options)
         self.method = method
         self.subjects = options[:to]
         @digest = options[:digest] || :MD5
     end
 
     # List the hosts.
     def list(ca)
         unless subjects
             puts ca.waiting?.join("\n")
             return nil
         end
 
         signed = ca.list
         requests = ca.waiting?
 
         if subjects == :all
             hosts = [signed, requests].flatten
+        elsif subjects == :signed
+            hosts = signed.flatten
         else
             hosts = subjects
         end
 
         hosts.uniq.sort.each do |host|
             invalid = false
             begin
                 ca.verify(host) unless requests.include?(host)
             rescue Puppet::SSL::CertificateAuthority::CertificateVerificationError => details
                 invalid = details.to_s
             end
             if not invalid and signed.include?(host)
                 puts "+ #{host} (#{ca.fingerprint(host, @digest)})"
             elsif invalid
                 puts "- #{host} (#{ca.fingerprint(host, @digest)}) (#{invalid})"
             else
                 puts "#{host} (#{ca.fingerprint(host, @digest)})"
             end
         end
     end
 
     # Set the method to apply.
     def method=(method)
         raise ArgumentError, "Invalid method %s to apply" % method unless INTERFACE_METHODS.include?(method)
         @method = method
     end
 
     # Print certificate information.
     def print(ca)
         (subjects == :all ? ca.list  : subjects).each do |host|
             if value = ca.print(host)
                 puts value
             else
                 Puppet.err "Could not find certificate for %s" % host
             end
         end
     end
 
     # Print certificate information.
     def fingerprint(ca)
         (subjects == :all ? ca.list + ca.waiting?: subjects).each do |host|
             if value = ca.fingerprint(host, @digest)
                 puts "#{host} #{value}"
             else
                 Puppet.err "Could not find certificate for %s" % host
             end
         end
     end
 
     # Sign a given certificate.
     def sign(ca)
         list = subjects == :all ? ca.waiting? : subjects
         raise InterfaceError, "No waiting certificate requests to sign" if list.empty?
         list.each do |host|
             ca.sign(host)
         end
     end
 
     # Set the list of hosts we're operating on.  Also supports keywords.
     def subjects=(value)
-        unless value == :all or value.is_a?(Array)
+        unless value == :all or value == :signed or value.is_a?(Array)
             raise ArgumentError, "Subjects must be an array or :all; not %s" % value
         end
 
         if value.is_a?(Array) and value.empty?
             value = nil
         end
 
         @subjects = value
     end
 end
 
diff --git a/spec/unit/application/cert.rb b/spec/unit/application/cert.rb
index 5970355e8..66c6aeac8 100644
--- a/spec/unit/application/cert.rb
+++ b/spec/unit/application/cert.rb
@@ -1,167 +1,172 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/application/cert'
 
 describe Puppet::Application::Cert do
     before :each do
         @cert_app = Puppet::Application[:cert]
         Puppet::Util::Log.stubs(:newdestination)
         Puppet::Util::Log.stubs(:level=)
     end
 
     it "should ask Puppet::Application to parse Puppet configuration file" do
         @cert_app.should_parse_config?.should be_true
     end
 
     it "should declare a main command" do
         @cert_app.should respond_to(:main)
     end
 
     Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject{ |m| m == :destroy }.each do |method|
         it "should declare option --#{method}" do
             @cert_app.should respond_to("handle_#{method}".to_sym)
         end
     end
 
     it "should set log level to info with the --verbose option" do
 
         Puppet::Log.expects(:level=).with(:info)
 
         @cert_app.handle_verbose(0)
     end
 
     it "should set log level to debug with the --debug option" do
 
         Puppet::Log.expects(:level=).with(:debug)
 
         @cert_app.handle_debug(0)
     end
 
     it "should set the fingerprint digest with the --digest option" do
         @cert_app.handle_digest(:digest)
 
         @cert_app.digest.should == :digest
     end
 
     it "should set mode to :destroy for --clean" do
         @cert_app.handle_clean(0)
         @cert_app.mode.should == :destroy
     end
 
     it "should set all to true for --all" do
         @cert_app.handle_all(0)
         @cert_app.all.should be_true
     end
 
+    it "should set signed to true for --signed" do
+        @puppetca.handle_signed(0)
+        @puppetca.signed.should be_true
+    end
+    
     Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject { |m| m == :destroy }.each do |method|
         it "should set mode to #{method} with option --#{method}" do
             @cert_app.send("handle_#{method}".to_sym, nil)
 
             @cert_app.mode.should == method
         end
     end
 
     describe "during setup" do
 
         before :each do
             Puppet::Log.stubs(:newdestination)
             Puppet::SSL::Host.stubs(:ca_location=)
             Puppet::SSL::CertificateAuthority.stubs(:new)
         end
 
         it "should set console as the log destination" do
             Puppet::Log.expects(:newdestination).with(:console)
 
             @cert_app.setup
         end
 
         it "should print puppet config if asked to in Puppet config" do
             @cert_app.stubs(:exit)
             Puppet.settings.stubs(:print_configs?).returns(true)
 
             Puppet.settings.expects(:print_configs)
 
             @cert_app.setup
         end
 
         it "should exit after printing puppet config if asked to in Puppet config" do
             Puppet.settings.stubs(:print_configs?).returns(true)
 
             lambda { @cert_app.setup }.should raise_error(SystemExit)
         end
 
         it "should set the CA location to 'only'" do
             Puppet::SSL::Host.expects(:ca_location=).with(:only)
 
             @cert_app.setup
         end
 
         it "should create a new certificate authority" do
             Puppet::SSL::CertificateAuthority.expects(:new)
 
             @cert_app.setup
         end
     end
 
     describe "when running" do
         before :each do
             @cert_app.all = false
             @ca = stub_everything 'ca'
             @cert_app.ca = @ca
             @cert_app.command_line.stubs(:args).returns([])
         end
 
         it "should delegate to the CertificateAuthority" do
             @ca.expects(:apply)
 
             @cert_app.main
         end
 
         it "should delegate with :all if option --all was given" do
             @cert_app.handle_all(0)
 
             @ca.expects(:apply).with { |mode,to| to[:to] == :all }
 
             @cert_app.main
         end
 
         it "should delegate to ca.apply with the hosts given on command line" do
             @cert_app.command_line.stubs(:args).returns(["host"])
 
             @ca.expects(:apply).with { |mode,to| to[:to] == ["host"]}
 
             @cert_app.main
         end
 
         it "should send the currently set digest" do
             @cert_app.command_line.stubs(:args).returns(["host"])
             @cert_app.handle_digest(:digest)
 
             @ca.expects(:apply).with { |mode,to| to[:digest] == :digest}
 
             @cert_app.main
         end
 
         it "should delegate to ca.apply with current set mode" do
             @cert_app.mode = "currentmode"
             @cert_app.command_line.stubs(:args).returns(["host"])
 
             @ca.expects(:apply).with { |mode,to| mode == "currentmode" }
 
             @cert_app.main
         end
 
         it "should revoke cert if mode is clean" do
             @cert_app.mode = :destroy
             @cert_app.command_line.stubs(:args).returns(["host"])
 
             @ca.expects(:apply).with { |mode,to| mode == :revoke }
             @ca.expects(:apply).with { |mode,to| mode == :destroy }
 
             @cert_app.main
         end
 
     end
 end
diff --git a/spec/unit/ssl/certificate_authority/interface.rb b/spec/unit/ssl/certificate_authority/interface.rb
index bcba298b2..d38e31b1b 100755
--- a/spec/unit/ssl/certificate_authority/interface.rb
+++ b/spec/unit/ssl/certificate_authority/interface.rb
@@ -1,323 +1,333 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../../spec_helper'
 
 require 'puppet/ssl/certificate_authority'
 
 describe "a normal interface method", :shared => true do
     it "should call the method on the CA for each host specified if an array was provided" do
         @ca.expects(@method).with("host1")
         @ca.expects(@method).with("host2")
 
         @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => %w{host1 host2})
 
         @applier.apply(@ca)
     end
 
     it "should call the method on the CA for all existing certificates if :all was provided" do
         @ca.expects(:list).returns %w{host1 host2}
 
         @ca.expects(@method).with("host1")
         @ca.expects(@method).with("host2")
 
         @applier = Puppet::SSL::CertificateAuthority::Interface.new(@method, :to => :all)
 
         @applier.apply(@ca)
     end
 end
 
 describe Puppet::SSL::CertificateAuthority::Interface do
     before do
         @class = Puppet::SSL::CertificateAuthority::Interface
     end
     describe "when initializing" do
         it "should set its method using its settor" do
             @class.any_instance.expects(:method=).with(:generate)
             @class.new(:generate, :to => :all)
         end
 
         it "should set its subjects using the settor" do
             @class.any_instance.expects(:subjects=).with(:all)
             @class.new(:generate, :to => :all)
         end
 
         it "should set the digest if given" do
             interface = @class.new(:generate, :to => :all, :digest => :digest)
             interface.digest.should == :digest
         end
 
         it "should set the digest to md5 if none given" do
             interface = @class.new(:generate, :to => :all)
             interface.digest.should == :MD5
         end
     end
 
     describe "when setting the method" do
         it "should set the method" do
             @class.new(:generate, :to => :all).method.should == :generate
         end
 
         it "should fail if the method isn't a member of the INTERFACE_METHODS array" do
             Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.expects(:include?).with(:thing).returns false
 
             lambda { @class.new(:thing, :to => :all) }.should raise_error(ArgumentError)
         end
     end
 
     describe "when setting the subjects" do
         it "should set the subjects" do
             @class.new(:generate, :to => :all).subjects.should == :all
         end
 
         it "should fail if the subjects setting isn't :all or an array" do
             lambda { @class.new(:generate, "other") }.should raise_error(ArgumentError)
         end
     end
 
     it "should have a method for triggering the application" do
         @class.new(:generate, :to => :all).should respond_to(:apply)
     end
 
     describe "when applying" do
         before do
             # We use a real object here, because :verify can't be stubbed, apparently.
             @ca = Object.new
         end
 
         it "should raise InterfaceErrors" do
             @applier = @class.new(:revoke, :to => :all)
 
             @ca.expects(:list).raises Puppet::SSL::CertificateAuthority::Interface::InterfaceError
 
             lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
         end
 
         it "should log non-Interface failures rather than failing" do
             @applier = @class.new(:revoke, :to => :all)
 
             @ca.expects(:list).raises ArgumentError
 
             Puppet.expects(:err)
 
             lambda { @applier.apply(@ca) }.should_not raise_error
         end
 
         describe "with an empty array specified and the method is not list" do
             it "should fail" do
                 @applier = @class.new(:sign, :to => [])
                 lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
             end
         end
 
         describe ":generate" do
             it "should fail if :all was specified" do
                 @applier = @class.new(:generate, :to => :all)
                 lambda { @applier.apply(@ca) }.should raise_error(ArgumentError)
             end
 
             it "should call :generate on the CA for each host specified" do
                 @applier = @class.new(:generate, :to => %w{host1 host2})
 
                 @ca.expects(:generate).with("host1")
                 @ca.expects(:generate).with("host2")
 
                 @applier.apply(@ca)
             end
         end
 
         describe ":verify" do
             before { @method = :verify }
             #it_should_behave_like "a normal interface method"
 
             it "should call the method on the CA for each host specified if an array was provided" do
                 # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
             end
 
             it "should call the method on the CA for all existing certificates if :all was provided" do
                 # LAK:NOTE Mocha apparently doesn't allow you to mock :verify, but I'm confident this works in real life.
             end
         end
 
         describe ":destroy" do
             before { @method = :destroy }
             it_should_behave_like "a normal interface method"
         end
 
         describe ":revoke" do
             before { @method = :revoke }
             it_should_behave_like "a normal interface method"
         end
 
         describe ":sign" do
             describe "and an array of names was provided" do
                 before do
                     @applier = @class.new(:sign, :to => %w{host1 host2})
                 end
 
                 it "should sign the specified waiting certificate requests" do
                     @ca.expects(:sign).with("host1")
                     @ca.expects(:sign).with("host2")
 
                     @applier.apply(@ca)
                 end
             end
 
             describe "and :all was provided" do
                 it "should sign all waiting certificate requests" do
                     @ca.stubs(:waiting?).returns(%w{cert1 cert2})
 
                     @ca.expects(:sign).with("cert1")
                     @ca.expects(:sign).with("cert2")
 
                     @applier = @class.new(:sign, :to => :all)
                     @applier.apply(@ca)
                 end
 
                 it "should fail if there are no waiting certificate requests" do
                     @ca.stubs(:waiting?).returns([])
 
                     @applier = @class.new(:sign, :to => :all)
                     lambda { @applier.apply(@ca) }.should raise_error(Puppet::SSL::CertificateAuthority::Interface::InterfaceError)
                 end
             end
         end
 
         describe ":list" do
             describe "and an empty array was provided" do
                 it "should print a string containing all certificate requests" do
                     @ca.expects(:waiting?).returns %w{host1 host2}
                     @ca.stubs(:verify)
 
                     @applier = @class.new(:list, :to => [])
 
                     @applier.expects(:puts).with "host1\nhost2"
 
                     @applier.apply(@ca)
                 end
             end
 
             describe "and :all was provided" do
                 it "should print a string containing all certificate requests and certificates" do
                     @ca.expects(:waiting?).returns %w{host1 host2}
                     @ca.expects(:list).returns %w{host3 host4}
                     @ca.stubs(:verify)
                     @ca.stubs(:fingerprint).returns "fingerprint"
                     @ca.expects(:verify).with("host3").raises(Puppet::SSL::CertificateAuthority::CertificateVerificationError.new(23), "certificate revoked")
 
                     @applier = @class.new(:list, :to => :all)
 
                     @applier.expects(:puts).with "host1 (fingerprint)"
                     @applier.expects(:puts).with "host2 (fingerprint)"
                     @applier.expects(:puts).with "- host3 (fingerprint) (certificate revoked)"
                     @applier.expects(:puts).with "+ host4 (fingerprint)"
 
                     @applier.apply(@ca)
                 end
             end
 
+           describe "and :signed was provided" do
+                it "should print a string containing all signed certificate requests and certificates" do
+                    @ca.expects(:list).returns %w{host1 host2}
+
+                    @applier = @class.new(:list, :signed)
+
+                    @applier.apply(@ca)
+                end
+            end
+
             describe "and an array of names was provided" do
                 it "should print a string of all named hosts that have a waiting request" do
                     @ca.expects(:waiting?).returns %w{host1 host2}
                     @ca.expects(:list).returns %w{host3 host4}
                     @ca.stubs(:fingerprint).returns "fingerprint"
                     @ca.stubs(:verify)
 
                     @applier = @class.new(:list, :to => %w{host1 host2 host3 host4})
 
                     @applier.expects(:puts).with "host1 (fingerprint)"
                     @applier.expects(:puts).with "host2 (fingerprint)"
                     @applier.expects(:puts).with "+ host3 (fingerprint)"
                     @applier.expects(:puts).with "+ host4 (fingerprint)"
 
                     @applier.apply(@ca)
                 end
             end
         end
 
         describe ":print" do
             describe "and :all was provided" do
                 it "should print all certificates" do
                     @ca.expects(:list).returns %w{host1 host2}
 
                     @applier = @class.new(:print, :to => :all)
 
                     @ca.expects(:print).with("host1").returns "h1"
                     @applier.expects(:puts).with "h1"
 
                     @ca.expects(:print).with("host2").returns "h2"
                     @applier.expects(:puts).with "h2"
 
                     @applier.apply(@ca)
                 end
             end
 
             describe "and an array of names was provided" do
                 it "should print each named certificate if found" do
                     @applier = @class.new(:print, :to => %w{host1 host2})
 
                     @ca.expects(:print).with("host1").returns "h1"
                     @applier.expects(:puts).with "h1"
 
                     @ca.expects(:print).with("host2").returns "h2"
                     @applier.expects(:puts).with "h2"
 
                     @applier.apply(@ca)
                 end
 
                 it "should log any named but not found certificates" do
                     @applier = @class.new(:print, :to => %w{host1 host2})
 
                     @ca.expects(:print).with("host1").returns "h1"
                     @applier.expects(:puts).with "h1"
 
                     @ca.expects(:print).with("host2").returns nil
                     Puppet.expects(:err).with { |msg| msg.include?("host2") }
 
                     @applier.apply(@ca)
                 end
             end
         end
 
         describe ":fingerprint" do
             it "should fingerprint with the set digest algorithm" do
                 @applier = @class.new(:fingerprint, :to => %w{host1}, :digest => :digest)
 
                 @ca.expects(:fingerprint).with("host1", :digest).returns "fingerprint1"
                 @applier.expects(:puts).with "host1 fingerprint1"
 
                 @applier.apply(@ca)
             end
 
             describe "and :all was provided" do
                 it "should fingerprint all certificates (including waiting ones)" do
                     @ca.expects(:list).returns %w{host1}
                     @ca.expects(:waiting?).returns %w{host2}
 
                     @applier = @class.new(:fingerprint, :to => :all)
 
                     @ca.expects(:fingerprint).with("host1", :MD5).returns "fingerprint1"
                     @applier.expects(:puts).with "host1 fingerprint1"
 
                     @ca.expects(:fingerprint).with("host2", :MD5).returns "fingerprint2"
                     @applier.expects(:puts).with "host2 fingerprint2"
 
                     @applier.apply(@ca)
                 end
             end
 
             describe "and an array of names was provided" do
                 it "should print each named certificate if found" do
                     @applier = @class.new(:fingerprint, :to => %w{host1 host2})
 
                     @ca.expects(:fingerprint).with("host1", :MD5).returns "fingerprint1"
                     @applier.expects(:puts).with "host1 fingerprint1"
 
                     @ca.expects(:fingerprint).with("host2", :MD5).returns "fingerprint2"
                     @applier.expects(:puts).with "host2 fingerprint2"
 
                     @applier.apply(@ca)
                 end
             end
         end
     end
 end