diff --git a/lib/puppet/application/cert.rb b/lib/puppet/application/cert.rb
index 467b0c859..c8aad1833 100644
--- a/lib/puppet/application/cert.rb
+++ b/lib/puppet/application/cert.rb
@@ -1,85 +1,95 @@
 require 'puppet/application'
 
 class Puppet::Application::Cert < Puppet::Application
 
   should_parse_config
   run_mode :master
 
-  attr_accessor :cert_mode, :all, :ca, :digest, :signed
+  attr_accessor :all, :ca, :digest, :signed
 
-  def find_mode(opt)
-    require 'puppet/ssl/certificate_authority'
-    modes = Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS
-    tmp = opt.sub("--", '').to_sym
-    @cert_mode = modes.include?(tmp) ? tmp : nil
+  def subcommand
+    @subcommand
+  end
+  def subcommand=(name)
+    # Handle the nasty, legacy mapping of "clean" to "destroy".
+    sub = name.to_sym
+    @subcommand = (sub == :clean ? :destroy : sub)
   end
 
   option("--clean", "-c") do
-    @cert_mode = :destroy
+    self.subcommand = "destroy"
   end
 
   option("--all", "-a") do
     @all = true
   end
 
   option("--digest DIGEST") do |arg|
     @digest = arg
   end
 
   option("--signed", "-s") do
     @signed = true
   end
 
   option("--debug", "-d") do |arg|
     Puppet::Util::Log.level = :debug
   end
 
   require 'puppet/ssl/certificate_authority/interface'
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject {|m| m == :destroy }.each do |method|
     option("--#{method}", "-#{method.to_s[0,1]}") do
-      find_mode("--#{method}")
+      self.subcommand = method
     end
   end
 
   option("--verbose", "-v") do
     Puppet::Util::Log.level = :info
   end
 
   def main
     if @all
       hosts = :all
     elsif @signed
       hosts = :signed
     else
       hosts = command_line.args.collect { |h| h.downcase }
     end
     begin
-      @ca.apply(:revoke, :to => hosts) if @cert_mode == :destroy
-      @ca.apply(@cert_mode, :to => hosts, :digest => @digest)
+      @ca.apply(:revoke, :to => hosts) if subcommand == :destroy
+      @ca.apply(subcommand, :to => hosts, :digest => @digest)
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(24)
     end
   end
 
   def setup
+    require 'puppet/ssl/certificate_authority'
     exit(Puppet.settings.print_configs ? 0 : 1) if Puppet.settings.print_configs?
 
     Puppet::Util::Log.newdestination :console
 
-    if [:generate, :destroy].include? @cert_mode
+    if [:generate, :destroy].include? subcommand
       Puppet::SSL::Host.ca_location = :local
     else
       Puppet::SSL::Host.ca_location = :only
     end
 
     begin
       @ca = Puppet::SSL::CertificateAuthority.new
     rescue => detail
       puts detail.backtrace if Puppet[:trace]
       puts detail.to_s
       exit(23)
     end
   end
+
+  def parse_options
+    # handle the bareword subcommand pattern.
+    result = super
+    self.subcommand ||= self.command_line.args.shift
+    result
+  end
 end
diff --git a/spec/unit/application/cert_spec.rb b/spec/unit/application/cert_spec.rb
index 4663fc938..2f57d07a9 100755
--- a/spec/unit/application/cert_spec.rb
+++ b/spec/unit/application/cert_spec.rb
@@ -1,194 +1,224 @@
 #!/usr/bin/env ruby
 
 require File.dirname(__FILE__) + '/../../spec_helper'
 
 require 'puppet/application/cert'
 
 describe Puppet::Application::Cert do
   before :each do
     @cert_app = Puppet::Application[:cert]
     Puppet::Util::Log.stubs(:newdestination)
     Puppet::Util::Log.stubs(:level=)
   end
 
   it "should operate in master run_mode" do
     @cert_app.class.run_mode.name.should equal(:master)
   end
 
   it "should ask Puppet::Application to parse Puppet configuration file" do
     @cert_app.should_parse_config?.should be_true
   end
 
   it "should declare a main command" do
     @cert_app.should respond_to(:main)
   end
 
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject{ |m| m == :destroy }.each do |method|
     it "should declare option --#{method}" do
       @cert_app.should respond_to("handle_#{method}".to_sym)
     end
   end
 
   it "should set log level to info with the --verbose option" do
 
     Puppet::Log.expects(:level=).with(:info)
 
     @cert_app.handle_verbose(0)
   end
 
   it "should set log level to debug with the --debug option" do
 
     Puppet::Log.expects(:level=).with(:debug)
 
     @cert_app.handle_debug(0)
   end
 
   it "should set the fingerprint digest with the --digest option" do
     @cert_app.handle_digest(:digest)
 
     @cert_app.digest.should == :digest
   end
 
   it "should set cert_mode to :destroy for --clean" do
     @cert_app.handle_clean(0)
-    @cert_app.cert_mode.should == :destroy
+    @cert_app.subcommand.should == :destroy
   end
 
   it "should set all to true for --all" do
     @cert_app.handle_all(0)
     @cert_app.all.should be_true
   end
 
   it "should set signed to true for --signed" do
     @cert_app.handle_signed(0)
     @cert_app.signed.should be_true
   end
 
   Puppet::SSL::CertificateAuthority::Interface::INTERFACE_METHODS.reject { |m| m == :destroy }.each do |method|
     it "should set cert_mode to #{method} with option --#{method}" do
       @cert_app.send("handle_#{method}".to_sym, nil)
 
-      @cert_app.cert_mode.should == method
+      @cert_app.subcommand.should == method
     end
   end
 
   describe "during setup" do
 
     before :each do
       Puppet::Log.stubs(:newdestination)
       Puppet::SSL::Host.stubs(:ca_location=)
       Puppet::SSL::CertificateAuthority.stubs(:new)
     end
 
     it "should set console as the log destination" do
       Puppet::Log.expects(:newdestination).with(:console)
 
       @cert_app.setup
     end
 
     it "should print puppet config if asked to in Puppet config" do
       @cert_app.stubs(:exit)
       Puppet.settings.stubs(:print_configs?).returns(true)
 
       Puppet.settings.expects(:print_configs)
 
       @cert_app.setup
     end
 
     it "should exit after printing puppet config if asked to in Puppet config" do
       Puppet.settings.stubs(:print_configs?).returns(true)
 
       lambda { @cert_app.setup }.should raise_error(SystemExit)
     end
 
     it "should set the CA location to 'only'" do
       Puppet::SSL::Host.expects(:ca_location=).with(:only)
 
       @cert_app.setup
     end
 
     it "should create a new certificate authority" do
       Puppet::SSL::CertificateAuthority.expects(:new)
 
       @cert_app.setup
     end
 
     it "should set the ca_location to :local if the cert_mode is generate" do
-      @cert_app.find_mode('--generate')
+      @cert_app.subcommand = 'generate'
       Puppet::SSL::Host.expects(:ca_location=).with(:local)
       @cert_app.setup
     end
 
     it "should set the ca_location to :local if the cert_mode is destroy" do
-      @cert_app.find_mode('--destroy')
+      @cert_app.subcommand = 'destroy'
       Puppet::SSL::Host.expects(:ca_location=).with(:local)
       @cert_app.setup
     end
 
     it "should set the ca_location to :only if the cert_mode is print" do
-      @cert_app.find_mode('--print')
+      @cert_app.subcommand = 'print'
       Puppet::SSL::Host.expects(:ca_location=).with(:only)
       @cert_app.setup
     end
   end
 
   describe "when running" do
     before :each do
       @cert_app.all = false
       @ca = stub_everything 'ca'
       @cert_app.ca = @ca
       @cert_app.command_line.stubs(:args).returns([])
     end
 
     it "should delegate to the CertificateAuthority" do
       @ca.expects(:apply)
 
       @cert_app.main
     end
 
     it "should delegate with :all if option --all was given" do
       @cert_app.handle_all(0)
 
       @ca.expects(:apply).with { |cert_mode,to| to[:to] == :all }
 
       @cert_app.main
     end
 
     it "should delegate to ca.apply with the hosts given on command line" do
       @cert_app.command_line.stubs(:args).returns(["host"])
 
       @ca.expects(:apply).with { |cert_mode,to| to[:to] == ["host"]}
 
       @cert_app.main
     end
 
     it "should send the currently set digest" do
       @cert_app.command_line.stubs(:args).returns(["host"])
       @cert_app.handle_digest(:digest)
 
       @ca.expects(:apply).with { |cert_mode,to| to[:digest] == :digest}
 
       @cert_app.main
     end
 
-    it "should delegate to ca.apply with current set cert_mode" do
-      @cert_app.cert_mode = "currentmode"
+    it "should revoke cert if cert_mode is clean" do
+      @cert_app.subcommand = :destroy
       @cert_app.command_line.stubs(:args).returns(["host"])
 
-      @ca.expects(:apply).with { |cert_mode,to| cert_mode == "currentmode" }
+      @ca.expects(:apply).with { |cert_mode,to| cert_mode == :revoke }
+      @ca.expects(:apply).with { |cert_mode,to| cert_mode == :destroy }
 
       @cert_app.main
     end
+  end
 
-    it "should revoke cert if cert_mode is clean" do
-      @cert_app.cert_mode = :destroy
-      @cert_app.command_line.stubs(:args).returns(["host"])
+  describe "when identifying subcommands" do
+    before :each do
+      @cert_app.all = false
+      @ca = stub_everything 'ca'
+      @cert_app.ca = @ca
+    end
 
-      @ca.expects(:apply).with { |cert_mode,to| cert_mode == :revoke }
-      @ca.expects(:apply).with { |cert_mode,to| cert_mode == :destroy }
+    %w{list revoke generate sign print verify fingerprint}.each do |cmd|
+      short = cmd[0,1]
+      [cmd, "--#{cmd}", "-#{short}"].each do |option|
+        # In our command line '-v' was eaten by 'verbose', so we can't consume
+        # it here; this is a special case from our otherwise standard
+        # processing. --daniel 2011-02-22
+        next if option == "-v"
 
-      @cert_app.main
+        it "should recognise '#{option}'" do
+          args = [option, "fun.example.com"]
+
+          @cert_app.command_line.stubs(:args).returns(args)
+          @cert_app.parse_options
+          @cert_app.subcommand.should == cmd.to_sym
+
+          args.should == ["fun.example.com"]
+        end
+      end
     end
 
+    %w{clean --clean -c}.each do |ugly|
+      it "should recognise the '#{ugly}' option as destroy" do
+        args = [ugly, "fun.example.com"]
+
+        @cert_app.command_line.stubs(:args).returns(args)
+        @cert_app.parse_options
+        @cert_app.subcommand.should == :destroy
+
+        args.should == ["fun.example.com"]
+      end
+    end
   end
 end