diff --git a/cmd/kubeadm/app/cmd/alpha/certs.go b/cmd/kubeadm/app/cmd/alpha/certs.go
index 7ce70c6e4ab..e1fdf80c702 100644
--- a/cmd/kubeadm/app/cmd/alpha/certs.go
+++ b/cmd/kubeadm/app/cmd/alpha/certs.go
@@ -101,7 +101,7 @@ func NewCmdCertsUtility(out io.Writer) *cobra.Command {
 	cmd.AddCommand(newCmdCertsRenewal(out))
 	cmd.AddCommand(newCmdCertsExpiration(out, constants.KubernetesDir))
 	cmd.AddCommand(newCmdCertificateKey())
-	cmd.AddCommand(newCmdGenCSR())
+	cmd.AddCommand(newCmdGenCSR(out))
 	return cmd
 }
 
@@ -147,7 +147,7 @@ func (o *genCSRConfig) load() (err error) {
 }
 
 // newCmdGenCSR returns cobra.Command for generating keys and CSRs
-func newCmdGenCSR() *cobra.Command {
+func newCmdGenCSR(out io.Writer) *cobra.Command {
 	config := newGenCSRConfig()
 
 	cmd := &cobra.Command{
@@ -160,7 +160,7 @@ func newCmdGenCSR() *cobra.Command {
 			if err := config.load(); err != nil {
 				return err
 			}
-			return runGenCSR(config)
+			return runGenCSR(out, config)
 		},
 	}
 	config.addFlagSet(cmd.Flags())
@@ -168,11 +168,11 @@ func newCmdGenCSR() *cobra.Command {
 }
 
 // runGenCSR contains the logic of the generate-csr sub-command.
-func runGenCSR(config *genCSRConfig) error {
-	if err := certsphase.CreateDefaultKeysAndCSRFiles(config.kubeadmConfig); err != nil {
+func runGenCSR(out io.Writer, config *genCSRConfig) error {
+	if err := certsphase.CreateDefaultKeysAndCSRFiles(out, config.kubeadmConfig); err != nil {
 		return err
 	}
-	if err := kubeconfigphase.CreateDefaultKubeConfigsAndCSRFiles(config.kubeConfigDir, config.kubeadmConfig); err != nil {
+	if err := kubeconfigphase.CreateDefaultKubeConfigsAndCSRFiles(out, config.kubeConfigDir, config.kubeadmConfig); err != nil {
 		return err
 	}
 	return nil
diff --git a/cmd/kubeadm/app/cmd/alpha/certs_test.go b/cmd/kubeadm/app/cmd/alpha/certs_test.go
index 826cf9988b2..59e8f0f47b2 100644
--- a/cmd/kubeadm/app/cmd/alpha/certs_test.go
+++ b/cmd/kubeadm/app/cmd/alpha/certs_test.go
@@ -334,7 +334,7 @@ func TestRunGenCSR(t *testing.T) {
 		},
 	}
 
-	err := runGenCSR(&config)
+	err := runGenCSR(nil, &config)
 	require.NoError(t, err, "expected runGenCSR to not fail")
 
 	t.Log("The command generates key and CSR files in the configured --cert-dir")
diff --git a/cmd/kubeadm/app/phases/certs/certlist.go b/cmd/kubeadm/app/phases/certs/certlist.go
index b787b77aad3..18b05672cab 100644
--- a/cmd/kubeadm/app/phases/certs/certlist.go
+++ b/cmd/kubeadm/app/phases/certs/certlist.go
@@ -19,6 +19,8 @@ package certs
 import (
 	"crypto"
 	"crypto/x509"
+	"fmt"
+	"io"
 
 	"github.com/pkg/errors"
 
@@ -477,15 +479,21 @@ func createKeyAndCSR(kubeadmConfig *kubeadmapi.InitConfiguration, cert *KubeadmC
 
 // CreateDefaultKeysAndCSRFiles is used in ExternalCA mode to create key files
 // and adjacent CSR files.
-func CreateDefaultKeysAndCSRFiles(config *kubeadmapi.InitConfiguration) error {
+func CreateDefaultKeysAndCSRFiles(out io.Writer, config *kubeadmapi.InitConfiguration) error {
 	certificates, err := leafCertificates(GetDefaultCertList())
 	if err != nil {
 		return err
 	}
+	if out != nil {
+		fmt.Fprintf(out, "generating keys and CSRs in %s\n", config.CertificatesDir)
+	}
 	for _, cert := range certificates {
 		if err := createKeyAndCSR(config, cert); err != nil {
 			return err
 		}
+		if out != nil {
+			fmt.Fprintf(out, "  %s\n", cert.BaseName)
+		}
 	}
 	return nil
 }
diff --git a/cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go b/cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
index 6431dd8f3f5..e0ca88bed6a 100644
--- a/cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
+++ b/cmd/kubeadm/app/phases/kubeconfig/kubeconfig.go
@@ -508,15 +508,21 @@ func createKubeConfigAndCSR(kubeConfigDir string, kubeadmConfig *kubeadmapi.Init
 
 // CreateDefaultKubeConfigsAndCSRFiles is used in ExternalCA mode to create
 // kubeconfig files and adjacent CSR files.
-func CreateDefaultKubeConfigsAndCSRFiles(kubeConfigDir string, kubeadmConfig *kubeadmapi.InitConfiguration) error {
+func CreateDefaultKubeConfigsAndCSRFiles(out io.Writer, kubeConfigDir string, kubeadmConfig *kubeadmapi.InitConfiguration) error {
 	kubeConfigs, err := getKubeConfigSpecsBase(kubeadmConfig)
 	if err != nil {
 		return err
 	}
+	if out != nil {
+		fmt.Fprintf(out, "generating keys and CSRs in %s\n", kubeConfigDir)
+	}
 	for name, spec := range kubeConfigs {
 		if err := createKubeConfigAndCSR(kubeConfigDir, kubeadmConfig, name, spec); err != nil {
 			return err
 		}
+		if out != nil {
+			fmt.Fprintf(out, "  %s\n", name)
+		}
 	}
 	return nil
 }