diff --git a/doc/source/shell.rst b/doc/source/shell.rst
index 209d681aa..cc0daa65b 100644
--- a/doc/source/shell.rst
+++ b/doc/source/shell.rst
@@ -42,7 +42,7 @@ options, it is easier to just set them as environment variables:
 
     The OpenStack Identity API version.
 
-.. envvar:: OS_CA_CERT
+.. envvar:: OS_CACERT
 
     The location for the CA truststore (PEM formatted) for this client.
 
@@ -65,7 +65,7 @@ For example, in Bash you'd use::
     export OS_TENANT_NAME=myproject
     export OS_AUTH_URL=http(s)://example.com:5000/v2.0/
     export OS_IDENTITY_API_VERSION=2.0
-    export OS_CA_CERT=/etc/keystone/yourca.pem
+    export OS_CACERT=/etc/keystone/yourca.pem
     export OS_CERT=/etc/keystone/yourpublickey.pem
     export OS_KEY=/etc/keystone/yourprivatekey.pem
 
diff --git a/keystoneclient/shell.py b/keystoneclient/shell.py
index 899086322..695fbabca 100644
--- a/keystoneclient/shell.py
+++ b/keystoneclient/shell.py
@@ -128,17 +128,26 @@ class OpenStackIdentityShell(object):
                             default=env('SERVICE_ENDPOINT'),
                             help='Defaults to env[SERVICE_ENDPOINT]')
 
-        parser.add_argument('--os_cacert', metavar='<ca-certificate>',
+        parser.add_argument('--os-cacert',
+                            metavar='<ca-certificate>',
                             default=env('OS_CA_CERT'),
-                            help='Defaults to env[OS_CA_CERT]')
+                            help='Defaults to env[OS_CACERT]')
+        parser.add_argument('--os_cacert',
+                            help=argparse.SUPPRESS)
 
-        parser.add_argument('--os_cert', metavar='<certificate>',
+        parser.add_argument('--os-cert',
+                            metavar='<certificate>',
                             default=env('OS_CERT'),
                             help='Defaults to env[OS_CERT]')
+        parser.add_argument('--os_cert',
+                            help=argparse.SUPPRESS)
 
-        parser.add_argument('--os_key', metavar='<key>',
+        parser.add_argument('--os-key',
+                            metavar='<key>',
                             default=env('OS_KEY'),
                             help='Defaults to env[OS_KEY]')
+        parser.add_argument('--os_key',
+                            help=argparse.SUPPRESS)
 
         parser.add_argument('--insecure',
                             default=False,