diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go
index 9f18878a6ba..afdd53fe1cf 100644
--- a/cmd/kube-apiserver/app/server.go
+++ b/cmd/kube-apiserver/app/server.go
@@ -24,6 +24,7 @@ import (
 	"net"
 	"net/http"
 	"os"
+	"path"
 	"regexp"
 	"strconv"
 	"strings"
@@ -56,6 +57,7 @@ type APIServer struct {
 	APIBurst                   int
 	TLSCertFile                string
 	TLSPrivateKeyFile          string
+	CertDirectory              string
 	APIPrefix                  string
 	StorageVersion             string
 	CloudProvider              string
@@ -99,6 +101,7 @@ func NewAPIServer() *APIServer {
 		EnableLogsSupport:      true,
 		MasterServiceNamespace: api.NamespaceDefault,
 		ClusterName:            "kubernetes",
+		CertDirectory:          "/var/run/kubernetes",
 
 		RuntimeConfig: make(util.ConfigurationMap),
 		KubeletConfig: client.KubeletConfig{
@@ -143,6 +146,8 @@ func (s *APIServer) AddFlags(fs *pflag.FlagSet) {
 		"If HTTPS serving is enabled, and --tls_cert_file and --tls_private_key_file are not provided, "+
 		"a self-signed certificate and key are generated for the public address and saved to /var/run/kubernetes.")
 	fs.StringVar(&s.TLSPrivateKeyFile, "tls_private_key_file", s.TLSPrivateKeyFile, "File containing x509 private key matching --tls_cert_file.")
+	fs.StringVar(&s.CertDirectory, "cert_dir", s.CertDirectory, "The directory where the TLS certs are located (by default /var/run/kubernetes). "+
+		"If --tls_cert_file and --tls_private_key_file are provided, this flag will be ignored.")
 	fs.StringVar(&s.APIPrefix, "api_prefix", s.APIPrefix, "The prefix for API requests on the server. Default '/api'.")
 	fs.StringVar(&s.StorageVersion, "storage_version", s.StorageVersion, "The version to store resources with. Defaults to server preferred")
 	fs.StringVar(&s.CloudProvider, "cloud_provider", s.CloudProvider, "The provider for cloud services.  Empty string for no provider.")
@@ -368,8 +373,8 @@ func (s *APIServer) Run(_ []string) error {
 			defer util.HandleCrash()
 			for {
 				if s.TLSCertFile == "" && s.TLSPrivateKeyFile == "" {
-					s.TLSCertFile = "/var/run/kubernetes/apiserver.crt"
-					s.TLSPrivateKeyFile = "/var/run/kubernetes/apiserver.key"
+					s.TLSCertFile = path.Join(s.CertDirectory, "apiserver.crt")
+					s.TLSPrivateKeyFile = path.Join(s.CertDirectory, "apiserver.key")
 					if err := util.GenerateSelfSignedCert(config.PublicAddress.String(), s.TLSCertFile, s.TLSPrivateKeyFile); err != nil {
 						glog.Errorf("Unable to generate self signed cert: %v", err)
 					} else {
diff --git a/cmd/kubelet/app/server.go b/cmd/kubelet/app/server.go
index 2a288dd9970..a9c8d15bfbe 100644
--- a/cmd/kubelet/app/server.go
+++ b/cmd/kubelet/app/server.go
@@ -169,7 +169,8 @@ func (s *KubeletServer) AddFlags(fs *pflag.FlagSet) {
 		"If --tls_cert_file and --tls_private_key_file are not provided, a self-signed certificate and key "+
 		"are generated for the public address and saved to the directory passed to --cert_dir.")
 	fs.StringVar(&s.TLSPrivateKeyFile, "tls_private_key_file", s.TLSPrivateKeyFile, "File containing x509 private key matching --tls_cert_file.")
-	fs.StringVar(&s.CertDirectory, "cert_dir", s.CertDirectory, "The directory where the TLS certs are located (by default /var/run/kubernetes)")
+	fs.StringVar(&s.CertDirectory, "cert_dir", s.CertDirectory, "The directory where the TLS certs are located (by default /var/run/kubernetes). "+
+		"If --tls_cert_file and --tls_private_key_file are provided, this flag will be ignored.")
 	fs.StringVar(&s.HostnameOverride, "hostname_override", s.HostnameOverride, "If non-empty, will use this string as identification instead of the actual hostname.")
 	fs.StringVar(&s.PodInfraContainerImage, "pod_infra_container_image", s.PodInfraContainerImage, "The image whose network/ipc namespaces containers in each pod will use.")
 	fs.StringVar(&s.DockerEndpoint, "docker_endpoint", s.DockerEndpoint, "If non-empty, use this for the docker endpoint to communicate with")
diff --git a/hack/test-cmd.sh b/hack/test-cmd.sh
index e8736b6ef02..b86756a9a02 100755
--- a/hack/test-cmd.sh
+++ b/hack/test-cmd.sh
@@ -95,6 +95,7 @@ kube::log::status "Starting kube-apiserver"
   --public_address_override="127.0.0.1" \
   --kubelet_port=${KUBELET_PORT} \
   --runtime_config=api/v1beta3 \
+  --cert_dir="${TMPDIR:-/tmp/}" \
   --portal_net="10.0.0.0/24" 1>&2 &
 APISERVER_PID=$!
 
@@ -621,11 +622,11 @@ __EOF__
   ##################### 
 
   kube::log::status "Testing resource aliasing"
-  kubectl create -f examples/cassandra/cassandra.yaml
-  kubectl create -f examples/cassandra/cassandra-controller.yaml
-  kubectl create -f examples/cassandra/cassandra-service.yaml
+  kubectl create -f examples/cassandra/cassandra.yaml "${kube_flags[@]}"
+  kubectl create -f examples/cassandra/cassandra-controller.yaml "${kube_flags[@]}"
+  kubectl create -f examples/cassandra/cassandra-service.yaml "${kube_flags[@]}"
   kube::test::get_object_assert "all -l'name=cassandra'" "{{range.items}}{{$id_field}}:{{end}}" 'cassandra:cassandra:cassandra:'
-  kubectl delete all -l name=cassandra
+  kubectl delete all -l name=cassandra "${kube_flags[@]}"
 
 
   ###########