OS_CACERT env var not respected

Ran across an issue recently trying to use Ironic behind SSL with a self-signed cert where it doesn't seem to respect the OS_CACERT env var:

[centos@instack-undercloud ~]$ env | grep OS_CACERT
OS_CACERT=/home/centos/test.pem
[centos@instack-undercloud ~]$ ironic node-list
SSL exception connecting to https://192.0.2.2:13000/v2.0/tokens: [Errno 1] _ssl.c:504: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
[centos@instack-undercloud ~]$ ironic --os-cacert ./test.pem node-list
+------+------+---------------+-------------+-----------------+-------------+
| UUID | Name | Instance UUID | Power State | Provision State | Maintenance |
+------+------+---------------+-------------+-----------------+-------------+
+------+------+---------------+-------------+-----------------+-------------+

I think I've tracked this down to an issue with how argparse handles dest overrides for the deprecated name of --os-cacert. In ironicclient, the deprecated form of the opt is registered with a dest of os_cacert, then later the current name is registered using a keystoneclient function. Unfortunately this seems to cause the deprecated opt's default to override the current opt's default. A minimal example can be seen here:

parser = argparse.ArgumentParser()
# Hypothetical deprecated param being redirected to new name
parser.add_argument('--foo', dest='bar')
# New name that should take precedence over the deprecated one
parser.add_argument('--bar', default='baz')
args = parser.parse_args()
print args

Results in the output:
[bnemec@RedHat scripts]$ ./test.py
Namespace(bar=None)

Inverting the registration order makes it work as expected:
[bnemec@RedHat scripts]$ ./test.py
Namespace(bar='baz')