[Puppet Users] puppet ca generate --dns-alt-names

I'm trying to generate a CA certificate that will be used on multiple
puppet masters, accessed by round robin DNS.

The individual nodes have their own hostnames and the round robin name
is puppet.resnet.bris.ac.uk or puppet.resnet.bristol.ac.uk (the twin
domain name for Bristol university is historical, and a total pain).

However I'm having trouble with puppet ca as follows:

[jg4461@puppet1 ~]$ sudo puppet ca generate --dns_alt_names
puppet.resnet.bris.ac.uk
Error: puppet ca generate takes 1 argument, but you gave 0
Error: Try 'puppet help ca generate' for usage

[jg4461@puppet-1 ~]$ sudo puppet ca generate
--dns_alt_names=puppet.resnet.bris.ac.uk, puppet.resnet.bristol.ac.uk
Error: The certificate retrieved from the master does not match the
agent's private key.
To fix this, remove the certificate from both the master and the agent
and then start a puppet run, which will automatically regenerate a
certficate.
On the master:
puppet cert clean puppet1.resnet.bris.ac.uk
On the agent:
rm -f /var/lib/puppet/ssl/certs/puppet1.resnet.bris.ac.uk.pem
puppet agent -t

[jg4461@puppet1 ~]$ puppet --version
3.0.1


Am I doing something wrong, or is something broken?

Thanks,
Jonathan