diff --git a/lib/cli/commands/vm.js b/lib/cli/commands/vm.js
index e6c08611c..fc0656e79 100644
--- a/lib/cli/commands/vm.js
+++ b/lib/cli/commands/vm.js
@@ -113,7 +113,7 @@ exports.init = function(cli) {
     .option('-c, --connect', 'connect to existing VMs')
     .option('-l, --location <name>', 'location of the data center')
     .option('-a, --affinity-group <name>', 'affinity group')
-    .option('-t, --ssh [cert]', 'upload SSH and upload ssh cert to VM') // $TODO: make ssh work with create-from
+    .option('-t, --ssh-cert <pem-file>', 'Upload SSH certificate')
     .option('-s, --subscription <id>', 'use the subscription id')
     .execute(function(dnsName, roleFile, options, callback) {
 
@@ -137,7 +137,8 @@ exports.init = function(cli) {
         location: options.location,
         dnsPrefix: dnsPrefix,
         connect: options.connect,
-        role: role
+        role: role,
+        sshCert: options.sshCert
       }, callback);
     });
 
@@ -495,7 +496,18 @@ exports.init = function(cli) {
     if (options.role) {
       role = options.role;
       logger.silly('role', role);
-      doSvcMgmtRoleCreate();
+
+      if (options.sshCert) {
+        loadSshCert();
+
+        progress = cli.progress('Configuring certificate');
+        configureCert(dnsPrefix, function() {
+          progress.end();
+          doSvcMgmtRoleCreate();
+        });
+      } else {
+        doSvcMgmtRoleCreate();
+      }
     } else {
       // find the provided image
       logger.verbose('looking for image ' + options.imageName);
@@ -526,6 +538,17 @@ exports.init = function(cli) {
         }
       });
     }
+
+    function loadSshCert() {
+      logger.silly('trying to open SSH cert: ' + options.sshCert);
+      pemSshCert = fs.readFileSync(options.sshCert);
+      var pemSshCertStr = pemSshCert.toString();
+      if (!utils.isPemCert(pemSshCertStr)) {
+        cmdCallback('Specified SSH certificate is not in PEM format');
+      }
+                
+      sshFingerprint = utils.getCertFingerprint(pemSshCertStr);
+    }
     
     function createDefaultRole(name, callback) {
       var inputEndPoints = [];
@@ -565,14 +588,7 @@ exports.init = function(cli) {
               if (utils.isSha1Hash(options.sshCert)) {
                 sshFingerprint = options.sshCert;
               } else {
-                logger.silly('trying to open SSH cert: ' + options.sshCert);
-                pemSshCert = fs.readFileSync(options.sshCert);
-                var pemSshCertStr = pemSshCert.toString();
-                if (!utils.isPemCert(pemSshCertStr)) {
-                  cmdCallback('Specified SSH certificate is not in PEM format');
-                }
-                
-                sshFingerprint = utils.getCertFingerprint(pemSshCertStr);
+                loadSshCert();
               }
               
               sshFingerprint = sshFingerprint.toUpperCase();
@@ -615,7 +631,7 @@ exports.init = function(cli) {
 
         if(configureSshCert) {
           progress = cli.progress('Configuring certificate');
-          configureCert(dnsPrefix, function(error, response) {
+          configureCert(dnsPrefix, function() {
             progress.end();
             logger.verbose('role:');
             logger.json('verbose', role);
@@ -662,16 +678,18 @@ exports.init = function(cli) {
     }
 
     function configureCert(service, callback) {
-      provisioningConfig.SSH = {
-        PublicKeys: [ {
-            Fingerprint: sshFingerprint,
-            Path: '/home/' + options.userName + '/.ssh/authorized_keys'
-          }
-        ]
-      };
+      if (provisioningConfig) {
+        provisioningConfig.SSH = {
+          PublicKeys: [ {
+              Fingerprint: sshFingerprint,
+              Path: '/home/' + options.userName + '/.ssh/authorized_keys'
+            }
+          ]
+        };
 
-      logger.silly('provisioningConfig with SSH:');
-      logger.silly(JSON.stringify(provisioningConfig));
+        logger.silly('provisioningConfig with SSH:');
+        logger.silly(JSON.stringify(provisioningConfig));
+      }
 
       if (pemSshCert) {
         logger.verbose('uploading cert');