diff --git a/magnumclient/tests/v1/test_certificates_shell.py b/magnumclient/tests/v1/test_certificates_shell.py
index f7760cd3..2599f4ca 100644
--- a/magnumclient/tests/v1/test_certificates_shell.py
+++ b/magnumclient/tests/v1/test_certificates_shell.py
@@ -156,3 +156,15 @@ class ShellTest(shell_test_base.TestCommandLineArgument):
         expected_args = {}
         expected_args['cluster_uuid'] = mockcluster.uuid
         mock_rotate_ca.assert_called_once_with(**expected_args)
+
+    @mock.patch('magnumclient.v1.clusters.ClusterManager.get')
+    @mock.patch('magnumclient.v1.certificates.CertificateManager.rotate_ca')
+    def test_ca_rotate_no_cluster_arg(self, mock_rotate_ca, mock_cluster_get):
+        _error_msg = [
+            (".*(error: argument --cluster is required|"  # py27 compatibility
+             "error: the following arguments are required: --cluster).*"),
+            ".*Try 'magnum help ca-rotate' for more information.*"
+        ]
+        self._test_arg_failure('ca-rotate', _error_msg)
+        mock_rotate_ca.assert_not_called()
+        mock_cluster_get.assert_not_called()
diff --git a/magnumclient/v1/certificates_shell.py b/magnumclient/v1/certificates_shell.py
index 56c75777..078a3a87 100644
--- a/magnumclient/v1/certificates_shell.py
+++ b/magnumclient/v1/certificates_shell.py
@@ -87,13 +87,14 @@ def do_ca_sign(cs, args):
 
 
 @utils.arg('--cluster',
-           required=False,
+           required=True,
            metavar='<cluster>',
            help=_('ID or name of the cluster.'))
 def do_ca_rotate(cs, args):
     """Rotate the CA certificate for a bay or cluster to revoke access."""
+    cluster = cs.clusters.get(args.cluster)
     opts = {
-        'cluster_uuid': _get_target_uuid(cs, args)
+        'cluster_uuid': cluster.uuid
     }
 
     cs.certificates.rotate_ca(**opts)