diff --git a/commands.go b/commands.go
index e749923df8..cf4bfa5e21 100644
--- a/commands.go
+++ b/commands.go
@@ -34,6 +34,7 @@ import (
 
 type machineConfig struct {
 	machineName    string
+	machineDir     string
 	caCertPath     string
 	clientCertPath string
 	clientKeyPath  string
@@ -71,9 +72,9 @@ func setupCertificates(caCertPath, caKeyPath, clientCertPath, clientKeyPath stri
 	org := utils.GetUsername()
 	bits := 2048
 
-	if _, err := os.Stat(utils.GetMachineDir()); err != nil {
+	if _, err := os.Stat(utils.GetMachineCertDir()); err != nil {
 		if os.IsNotExist(err) {
-			if err := os.MkdirAll(utils.GetMachineDir(), 0700); err != nil {
+			if err := os.MkdirAll(utils.GetMachineCertDir(), 0700); err != nil {
 				log.Fatalf("Error creating machine config dir: %s", err)
 			}
 		} else {
@@ -97,9 +98,9 @@ func setupCertificates(caCertPath, caKeyPath, clientCertPath, clientKeyPath stri
 	if _, err := os.Stat(clientCertPath); os.IsNotExist(err) {
 		log.Infof("Creating client certificate: %s", clientCertPath)
 
-		if _, err := os.Stat(utils.GetMachineClientCertDir()); err != nil {
+		if _, err := os.Stat(utils.GetMachineCertDir()); err != nil {
 			if os.IsNotExist(err) {
-				if err := os.Mkdir(utils.GetMachineClientCertDir(), 0700); err != nil {
+				if err := os.Mkdir(utils.GetMachineCertDir(), 0700); err != nil {
 					log.Fatalf("Error creating machine client cert dir: %s", err)
 				}
 			} else {
@@ -115,11 +116,6 @@ func setupCertificates(caCertPath, caKeyPath, clientCertPath, clientKeyPath stri
 		if err := utils.GenerateCert([]string{""}, clientCertPath, clientKeyPath, caCertPath, caKeyPath, org, bits); err != nil {
 			log.Fatalf("Error generating client certificate: %s", err)
 		}
-
-		// copy ca.pem to client cert dir for docker client
-		if err := utils.CopyFile(caCertPath, filepath.Join(utils.GetMachineClientCertDir(), "ca.pem")); err != nil {
-			log.Fatalf("Error copying ca.pem to client cert dir: %s", err)
-		}
 	}
 
 	return nil
@@ -279,7 +275,7 @@ var Commands = []cli.Command{
 
 func cmdActive(c *cli.Context) {
 	name := c.Args().First()
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	if name == "" {
 		host, err := store.GetActive()
@@ -317,7 +313,7 @@ func cmdCreate(c *cli.Context) {
 		log.Fatalf("Error generating certificates: %s", err)
 	}
 
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	host, err := store.Create(name, driver, c)
 	if err != nil {
@@ -384,7 +380,7 @@ func cmdIp(c *cli.Context) {
 
 func cmdLs(c *cli.Context) {
 	quiet := c.Bool("quiet")
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	hostList, err := store.List()
 	if err != nil {
@@ -460,7 +456,7 @@ func cmdRm(c *cli.Context) {
 
 	isError := false
 
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 	for _, host := range c.Args() {
 		if err := store.Remove(host, force); err != nil {
 			log.Errorf("Error removing machine %s: %s", host, err)
@@ -515,10 +511,10 @@ func cmdEnv(c *cli.Context) {
 	switch userShell {
 	case "fish":
 		fmt.Printf("set -x DOCKER_TLS_VERIFY yes\nset -x DOCKER_CERT_PATH %s\nset -x DOCKER_HOST %s\n",
-			utils.GetMachineClientCertDir(), dockerHost)
+			cfg.machineDir, dockerHost)
 	default:
 		fmt.Printf("export DOCKER_TLS_VERIFY=yes\nexport DOCKER_CERT_PATH=%s\nexport DOCKER_HOST=%s\n",
-			utils.GetMachineClientCertDir(), dockerHost)
+			cfg.machineDir, dockerHost)
 	}
 }
 
@@ -528,7 +524,7 @@ func cmdSsh(c *cli.Context) {
 		sshCmd *exec.Cmd
 	)
 	name := c.Args().First()
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	if name == "" {
 		host, err := store.GetActive()
@@ -703,7 +699,7 @@ func getHosts(c *cli.Context) ([]*Host, error) {
 }
 
 func loadMachine(name string, c *cli.Context) (*Host, error) {
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	machine, err := store.Load(name)
 	if err != nil {
@@ -715,7 +711,7 @@ func loadMachine(name string, c *cli.Context) (*Host, error) {
 
 func getHost(c *cli.Context) *Host {
 	name := c.Args().First()
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 
 	if name == "" {
 		host, err := store.GetActive()
@@ -770,7 +766,7 @@ func getHostState(host Host, store Store, hostListItems chan<- hostListItem) {
 
 func getMachineConfig(c *cli.Context) (*machineConfig, error) {
 	name := c.Args().First()
-	store := NewStore(c.GlobalString("storage-path"), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
+	store := NewStore(utils.GetMachineDir(), c.GlobalString("tls-ca-cert"), c.GlobalString("tls-ca-key"))
 	var machine *Host
 
 	if name == "" {
@@ -790,9 +786,10 @@ func getMachineConfig(c *cli.Context) (*machineConfig, error) {
 		machine = m
 	}
 
-	caCert := filepath.Join(utils.GetMachineClientCertDir(), "ca.pem")
-	clientCert := filepath.Join(utils.GetMachineClientCertDir(), "cert.pem")
-	clientKey := filepath.Join(utils.GetMachineClientCertDir(), "key.pem")
+	machineDir := filepath.Join(utils.GetMachineDir(), machine.Name)
+	caCert := filepath.Join(machineDir, "ca.pem")
+	clientCert := filepath.Join(machineDir, "cert.pem")
+	clientKey := filepath.Join(machineDir, "key.pem")
 	machineUrl, err := machine.GetURL()
 	if err != nil {
 		if err == drivers.ErrHostIsNotRunning {
@@ -803,6 +800,7 @@ func getMachineConfig(c *cli.Context) (*machineConfig, error) {
 	}
 	return &machineConfig{
 		machineName:    name,
+		machineDir:     machineDir,
 		caCertPath:     caCert,
 		clientCertPath: clientCert,
 		clientKeyPath:  clientKey,
diff --git a/commands_test.go b/commands_test.go
index cf934fa463..2ede92b151 100644
--- a/commands_test.go
+++ b/commands_test.go
@@ -3,6 +3,7 @@ package main
 import (
 	"flag"
 	"io/ioutil"
+	"os"
 	"os/exec"
 	"testing"
 
@@ -89,19 +90,27 @@ func TestGetHosts(t *testing.T) {
 	if err := clearHosts(); err != nil {
 		t.Fatal(err)
 	}
+	os.Setenv("MACHINE_STORAGE_PATH", TestStoreDir)
 
 	flags := getDefaultTestDriverFlags()
 
-	store := NewStore(TestStoreDir, "", "")
+	store := NewStore(TestMachineDir, "", "")
+	var err error
 
-	_, hostAerr := store.Create("test-a", "none", flags)
-	if hostAerr != nil {
-		t.Fatal(hostAerr)
+	_, err = store.Create("test-a", "none", flags)
+	if err != nil {
+		t.Fatal(err)
 	}
 
-	_, hostBerr := store.Create("test-b", "none", flags)
-	if hostBerr != nil {
-		t.Fatal(hostBerr)
+	_, err = store.Create("test-b", "none", flags)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	storeHosts, err := store.List()
+
+	if len(storeHosts) != 2 {
+		t.Fatalf("List returned %d items", len(storeHosts))
 	}
 
 	set := flag.NewFlagSet("start", 0)
@@ -109,7 +118,7 @@ func TestGetHosts(t *testing.T) {
 
 	globalSet := flag.NewFlagSet("-d", 0)
 	globalSet.String("-d", "none", "driver")
-	globalSet.String("storage-path", TestStoreDir, "storage path")
+	globalSet.String("storage-path", store.Path, "storage path")
 	globalSet.String("tls-ca-cert", "", "")
 	globalSet.String("tls-ca-key", "", "")
 
@@ -123,6 +132,8 @@ func TestGetHosts(t *testing.T) {
 	if len(hosts) != 2 {
 		t.Fatal("Expected %d hosts, got %d hosts", 2, len(hosts))
 	}
+
+	os.Setenv("MACHINE_STORAGE_PATH", "")
 }
 
 func TestGetHostState(t *testing.T) {
@@ -131,7 +142,12 @@ func TestGetHostState(t *testing.T) {
 		t.Fatal("Error creating tmp dir:", err)
 	}
 	hostListItems := make(chan hostListItem)
-	store := NewStore(storePath, "", "")
+
+	store, err := getTestStore()
+	if err != nil {
+		t.Fatal(err)
+	}
+
 	hosts := []Host{
 		{
 			Name:       "foo",
diff --git a/drivers/virtualbox/virtualbox.go b/drivers/virtualbox/virtualbox.go
index 5534f1d6c1..a59c3e0e57 100644
--- a/drivers/virtualbox/virtualbox.go
+++ b/drivers/virtualbox/virtualbox.go
@@ -26,6 +26,7 @@ import (
 
 const (
 	dockerConfigDir = "/var/lib/boot2docker"
+	isoFilename     = "boot2docker.iso"
 )
 
 type Driver struct {
@@ -129,11 +130,21 @@ func (d *Driver) Create() error {
 	}
 
 	b2dutils := utils.NewB2dUtils("", "")
+	imgPath := utils.GetMachineCacheDir()
+	isoFilename := "boot2docker.iso"
+	commonIsoPath := filepath.Join(imgPath, "boot2docker.iso")
+	// just in case boot2docker.iso has been manually deleted
+	if _, err := os.Stat(imgPath); os.IsNotExist(err) {
+		if err := os.Mkdir(imgPath, 0700); err != nil {
+			return err
+		}
+
+	}
 
 	if d.Boot2DockerURL != "" {
 		isoURL = d.Boot2DockerURL
-		log.Infof("Downloading boot2docker.iso from %s...", isoURL)
-		if err := b2dutils.DownloadISO(d.storePath, "boot2docker.iso", isoURL); err != nil {
+		log.Infof("Downloading %s from %s...", isoFilename, isoURL)
+		if err := b2dutils.DownloadISO(commonIsoPath, isoFilename, isoURL); err != nil {
 			return err
 
 		}
@@ -146,25 +157,14 @@ func (d *Driver) Create() error {
 			log.Warnf("Unable to check for the latest release: %s", err)
 		}
 
-		// todo: use real constant for .docker
-		rootPath := filepath.Join(utils.GetMachineDir())
-		imgPath := filepath.Join(rootPath, ".images")
-		commonIsoPath := filepath.Join(imgPath, "boot2docker.iso")
 		if _, err := os.Stat(commonIsoPath); os.IsNotExist(err) {
-			log.Infof("Downloading boot2docker.iso to %s...", commonIsoPath)
-			// just in case boot2docker.iso has been manually deleted
-			if _, err := os.Stat(imgPath); os.IsNotExist(err) {
-				if err := os.Mkdir(imgPath, 0700); err != nil {
-					return err
-				}
-
-			}
-			if err := b2dutils.DownloadISO(imgPath, "boot2docker.iso", isoURL); err != nil {
+			log.Infof("Downloading %s to %s...", isoFilename, commonIsoPath)
+			if err := b2dutils.DownloadISO(imgPath, isoFilename, isoURL); err != nil {
 				return err
 			}
 		}
 
-		isoDest := filepath.Join(d.storePath, "boot2docker.iso")
+		isoDest := filepath.Join(d.storePath, isoFilename)
 		if err := utils.CopyFile(commonIsoPath, isoDest); err != nil {
 			return err
 		}
diff --git a/drivers/vmwarefusion/fusion_darwin.go b/drivers/vmwarefusion/fusion_darwin.go
index 909a3d2a65..38f5e9824a 100644
--- a/drivers/vmwarefusion/fusion_darwin.go
+++ b/drivers/vmwarefusion/fusion_darwin.go
@@ -149,10 +149,20 @@ func (d *Driver) Create() error {
 
 	b2dutils := utils.NewB2dUtils("", "")
 
+	imgPath := utils.GetMachineCacheDir()
+	commonIsoPath := filepath.Join(imgPath, isoFilename)
+	// just in case boot2docker.iso has been manually deleted
+	if _, err := os.Stat(imgPath); os.IsNotExist(err) {
+		if err := os.Mkdir(imgPath, 0700); err != nil {
+			return err
+		}
+
+	}
+
 	if d.Boot2DockerURL != "" {
 		isoURL = d.Boot2DockerURL
 		log.Infof("Downloading boot2docker.iso from %s...", isoURL)
-		if err := b2dutils.DownloadISO(d.storePath, isoFilename, isoURL); err != nil {
+		if err := b2dutils.DownloadISO(commonIsoPath, isoFilename, isoURL); err != nil {
 			return err
 		}
 
@@ -168,9 +178,6 @@ func (d *Driver) Create() error {
 
 		isoURL := "https://github.com/cloudnativeapps/boot2docker/releases/download/v1.5.0-vmw/boot2docker-1.5.0-vmw.iso"
 
-		rootPath := filepath.Join(utils.GetMachineDir())
-		imgPath := filepath.Join(rootPath, ".images")
-		commonIsoPath := filepath.Join(imgPath, isoFilename)
 		if _, err := os.Stat(commonIsoPath); os.IsNotExist(err) {
 			log.Infof("Downloading boot2docker.iso to %s...", commonIsoPath)
 			// just in case boot2docker.iso has been manually deleted
diff --git a/drivers/vmwarevsphere/vsphere.go b/drivers/vmwarevsphere/vsphere.go
index 5dd20edecd..5bd27f6822 100644
--- a/drivers/vmwarevsphere/vsphere.go
+++ b/drivers/vmwarevsphere/vsphere.go
@@ -28,7 +28,8 @@ import (
 
 const (
 	DATASTORE_DIR      = "boot2docker-iso"
-	B2D_ISO_NAME       = "boot2docker-vmw.iso"
+	isoFilename        = "boot2docker-vmw.iso"
+	B2D_ISO_NAME       = isoFilename
 	DEFAULT_CPU_NUMBER = 2
 	dockerConfigDir    = "/var/lib/boot2docker"
 	B2D_USER           = "docker"
@@ -179,7 +180,10 @@ func (d *Driver) SetConfigFromFlags(flags drivers.DriverOptions) error {
 	d.SwarmHost = flags.String("swarm-host")
 	d.SwarmDiscovery = flags.String("swarm-discovery")
 
-	d.ISO = path.Join(d.storePath, "boot2docker.iso")
+	imgPath := utils.GetMachineCacheDir()
+	commonIsoPath := filepath.Join(imgPath, isoFilename)
+
+	d.ISO = path.Join(commonIsoPath)
 
 	return nil
 }
@@ -242,10 +246,20 @@ func (d *Driver) Create() error {
 
 	b2dutils := utils.NewB2dUtils("", "")
 
+	imgPath := utils.GetMachineCacheDir()
+	commonIsoPath := filepath.Join(imgPath, isoFilename)
+	// just in case boot2docker.iso has been manually deleted
+	if _, err := os.Stat(imgPath); os.IsNotExist(err) {
+		if err := os.Mkdir(imgPath, 0700); err != nil {
+			return err
+		}
+
+	}
+
 	if d.Boot2DockerURL != "" {
 		isoURL = d.Boot2DockerURL
 		log.Infof("Downloading boot2docker.iso from %s...", isoURL)
-		if err := b2dutils.DownloadISO(d.storePath, "boot2docker.iso", isoURL); err != nil {
+		if err := b2dutils.DownloadISO(commonIsoPath, isoFilename, isoURL); err != nil {
 			return err
 
 		}
@@ -263,9 +277,6 @@ func (d *Driver) Create() error {
 
 		isoURL := "https://github.com/cloudnativeapps/boot2docker/releases/download/v1.5.0-vmw/boot2docker-1.5.0-vmw.iso"
 
-		rootPath := filepath.Join(utils.GetMachineDir())
-		imgPath := filepath.Join(rootPath, ".images")
-		commonIsoPath := filepath.Join(imgPath, B2D_ISO_NAME)
 		if _, err := os.Stat(commonIsoPath); os.IsNotExist(err) {
 			log.Infof("Downloading boot2docker.iso to %s...", commonIsoPath)
 			// just in case boot2docker.iso has been manually deleted
@@ -276,13 +287,13 @@ func (d *Driver) Create() error {
 				}
 
 			}
-			if err := b2dutils.DownloadISO(imgPath, B2D_ISO_NAME, isoURL); err != nil {
+			if err := b2dutils.DownloadISO(imgPath, isoFilename, isoURL); err != nil {
 				return err
 
 			}
 
 		}
-		isoDest := filepath.Join(d.storePath, B2D_ISO_NAME)
+		isoDest := filepath.Join(d.storePath, isoFilename)
 		if err := utils.CopyFile(commonIsoPath, isoDest); err != nil {
 			return err
 
@@ -310,7 +321,7 @@ func (d *Driver) Create() error {
 		return err
 	}
 
-	isoPath := fmt.Sprintf("%s/%s", DATASTORE_DIR, B2D_ISO_NAME)
+	isoPath := fmt.Sprintf("%s/%s", DATASTORE_DIR, isoFilename)
 	if err := vcConn.VmCreate(isoPath); err != nil {
 		return err
 	}
diff --git a/host.go b/host.go
index d9a5c2207b..f9321d585f 100644
--- a/host.go
+++ b/host.go
@@ -106,27 +106,6 @@ func ValidateHostName(name string) (string, error) {
 	return name, nil
 }
 
-func GenerateClientCertificate(caCertPath, privateKeyPath string) error {
-	var (
-		org  = "docker-machine"
-		bits = 2048
-	)
-
-	clientCertPath := filepath.Join(utils.GetMachineDir(), "cert.pem")
-	clientKeyPath := filepath.Join(utils.GetMachineDir(), "key.pem")
-
-	if err := os.MkdirAll(utils.GetMachineDir(), 0700); err != nil {
-		return err
-	}
-
-	log.Debugf("generating client cert: %s", clientCertPath)
-	if err := utils.GenerateCert([]string{""}, clientCertPath, clientKeyPath, caCertPath, privateKeyPath, org, bits); err != nil {
-		return fmt.Errorf("error generating client cert: %s", err)
-	}
-
-	return nil
-}
-
 func (h *Host) ConfigureSwarm(discovery string, master bool, host string, addr string) error {
 	d := h.Driver
 
@@ -207,6 +186,22 @@ func (h *Host) ConfigureAuth() error {
 		return nil
 	}
 
+	// copy certs to client dir for docker client
+	machineDir := filepath.Join(utils.GetMachineDir(), h.Name)
+	if err := utils.CopyFile(h.CaCertPath, filepath.Join(machineDir, "ca.pem")); err != nil {
+		log.Fatalf("Error copying ca.pem to machine dir: %s", err)
+	}
+
+	clientCertPath := filepath.Join(utils.GetMachineCertDir(), "cert.pem")
+	if err := utils.CopyFile(clientCertPath, filepath.Join(machineDir, "cert.pem")); err != nil {
+		log.Fatalf("Error copying cert.pem to machine dir: %s", err)
+	}
+
+	clientKeyPath := filepath.Join(utils.GetMachineCertDir(), "key.pem")
+	if err := utils.CopyFile(clientKeyPath, filepath.Join(machineDir, "key.pem")); err != nil {
+		log.Fatalf("Error copying key.pem to machine dir: %s", err)
+	}
+
 	var (
 		ip         = ""
 		ipErr      error
@@ -236,7 +231,12 @@ func (h *Host) ConfigureAuth() error {
 	org := h.Name
 	bits := 2048
 
-	log.Debugf("generating server cert: %s", serverCertPath)
+	log.Debugf("generating server cert: %s ca-key=%s private-key=%s org=%s",
+		serverCertPath,
+		h.CaCertPath,
+		h.PrivateKeyPath,
+		org,
+	)
 
 	if err := utils.GenerateCert([]string{ip}, serverCertPath, serverKeyPath, h.CaCertPath, h.PrivateKeyPath, org, bits); err != nil {
 		return fmt.Errorf("error generating server cert: %s", err)
diff --git a/host_test.go b/host_test.go
index f1a7816646..a84564bcd2 100644
--- a/host_test.go
+++ b/host_test.go
@@ -4,13 +4,11 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
-	"path/filepath"
 	"regexp"
 	"strings"
 	"testing"
 
 	_ "github.com/docker/machine/drivers/none"
-	"github.com/docker/machine/utils"
 )
 
 const (
@@ -27,6 +25,7 @@ func getTestStore() (*Store, error) {
 		fmt.Println(err)
 		os.Exit(1)
 	}
+	os.Setenv("MACHINE_STORAGE_PATH", tmpDir)
 
 	return NewStore(tmpDir, hostTestCaCert, hostTestPrivateKey), nil
 }
@@ -118,37 +117,6 @@ func TestValidateHostnameInvalid(t *testing.T) {
 	}
 }
 
-func TestGenerateClientCertificate(t *testing.T) {
-	tmpDir, err := ioutil.TempDir("", "machine-test-")
-	if err != nil {
-		fmt.Println(err)
-		os.Exit(1)
-	}
-
-	os.Setenv("MACHINE_DIR", tmpDir)
-
-	caCertPath := filepath.Join(tmpDir, "ca.pem")
-	caKeyPath := filepath.Join(tmpDir, "key.pem")
-	testOrg := "test-org"
-	bits := 2048
-	if err := utils.GenerateCACertificate(caCertPath, caKeyPath, testOrg, bits); err != nil {
-		t.Fatal(err)
-	}
-
-	if err := GenerateClientCertificate(caCertPath, caKeyPath); err != nil {
-		t.Fatal(err)
-	}
-
-	clientCertPath := filepath.Join(utils.GetMachineDir(), "cert.pem")
-	clientKeyPath := filepath.Join(utils.GetMachineDir(), "key.pem")
-	if _, err := os.Stat(clientCertPath); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(clientKeyPath); err != nil {
-		t.Fatal(err)
-	}
-}
-
 func TestGenerateDockerConfigNonLocal(t *testing.T) {
 	host, err := getDefaultTestHost()
 	if err != nil {
diff --git a/main.go b/main.go
index 3d26007e58..229b938ba4 100644
--- a/main.go
+++ b/main.go
@@ -35,31 +35,32 @@ func main() {
 		cli.StringFlag{
 			EnvVar: "MACHINE_STORAGE_PATH",
 			Name:   "storage-path",
+			Value:  utils.GetMachineRoot(),
 			Usage:  "Configures storage path",
 		},
 		cli.StringFlag{
 			EnvVar: "MACHINE_TLS_CA_CERT",
 			Name:   "tls-ca-cert",
 			Usage:  "CA to verify remotes against",
-			Value:  filepath.Join(utils.GetMachineDir(), "ca.pem"),
+			Value:  filepath.Join(utils.GetMachineCertDir(), "ca.pem"),
 		},
 		cli.StringFlag{
 			EnvVar: "MACHINE_TLS_CA_KEY",
 			Name:   "tls-ca-key",
 			Usage:  "Private key to generate certificates",
-			Value:  filepath.Join(utils.GetMachineDir(), "key.pem"),
+			Value:  filepath.Join(utils.GetMachineCertDir(), "ca-key.pem"),
 		},
 		cli.StringFlag{
 			EnvVar: "MACHINE_TLS_CLIENT_CERT",
 			Name:   "tls-client-cert",
 			Usage:  "Client cert to use for TLS",
-			Value:  filepath.Join(utils.GetMachineClientCertDir(), "cert.pem"),
+			Value:  filepath.Join(utils.GetMachineCertDir(), "cert.pem"),
 		},
 		cli.StringFlag{
 			EnvVar: "MACHINE_TLS_CLIENT_KEY",
 			Name:   "tls-client-key",
 			Usage:  "Private key used in client TLS auth",
-			Value:  filepath.Join(utils.GetMachineClientCertDir(), "key.pem"),
+			Value:  filepath.Join(utils.GetMachineCertDir(), "key.pem"),
 		},
 	}
 
diff --git a/store_test.go b/store_test.go
index 524c0afa17..8490dd7055 100644
--- a/store_test.go
+++ b/store_test.go
@@ -12,6 +12,10 @@ const (
 	TestStoreDir = ".store-test"
 )
 
+var (
+	TestMachineDir = filepath.Join(TestStoreDir, "machine", "machines")
+)
+
 type DriverOptionsMock struct {
 	Data map[string]interface{}
 }
@@ -174,7 +178,11 @@ func TestStoreGetSetActive(t *testing.T) {
 
 	flags := getDefaultTestDriverFlags()
 
-	store := NewStore(TestStoreDir, "", "")
+	//store := NewStore(TestStoreDir, "", "")
+	store, err := getTestStore()
+	if err != nil {
+		t.Fatal(err)
+	}
 
 	// No hosts set
 	host, err := store.GetActive()
diff --git a/utils/utils.go b/utils/utils.go
index fb4bd17126..4708eec7bd 100644
--- a/utils/utils.go
+++ b/utils/utils.go
@@ -15,23 +15,31 @@ func GetHomeDir() string {
 }
 
 func GetBaseDir() string {
-	baseDir := os.Getenv("MACHINE_DIR")
+	baseDir := os.Getenv("MACHINE_STORAGE_PATH")
 	if baseDir == "" {
-		baseDir = GetHomeDir()
+		baseDir = filepath.Join(GetHomeDir(), ".docker")
 	}
 	return baseDir
 }
 
 func GetDockerDir() string {
-	return filepath.Join(GetBaseDir(), ".docker")
+	return filepath.Join(GetHomeDir(), ".docker")
+}
+
+func GetMachineRoot() string {
+	return filepath.Join(GetBaseDir(), "machine")
 }
 
 func GetMachineDir() string {
-	return filepath.Join(GetDockerDir(), "machines")
+	return filepath.Join(GetMachineRoot(), "machines")
 }
 
-func GetMachineClientCertDir() string {
-	return filepath.Join(GetMachineDir(), ".client")
+func GetMachineCertDir() string {
+	return filepath.Join(GetMachineRoot(), "certs")
+}
+
+func GetMachineCacheDir() string {
+	return filepath.Join(GetMachineRoot(), "cache")
 }
 
 func GetUsername() string {
diff --git a/utils/utils_test.go b/utils/utils_test.go
index 450c8c0735..1b9f4c6cdb 100644
--- a/utils/utils_test.go
+++ b/utils/utils_test.go
@@ -15,44 +15,34 @@ func TestGetBaseDir(t *testing.T) {
 	homeDir := GetHomeDir()
 	baseDir := GetBaseDir()
 
-	if strings.Index(homeDir, baseDir) != 0 {
+	if strings.Index(baseDir, homeDir) != 0 {
 		t.Fatalf("expected base dir with prefix %s; received %s", homeDir, baseDir)
 	}
 }
 
 func TestGetCustomBaseDir(t *testing.T) {
 	root := "/tmp"
-	os.Setenv("MACHINE_DIR", root)
+	os.Setenv("MACHINE_STORAGE_PATH", root)
 	baseDir := GetBaseDir()
 
-	if strings.Index(root, baseDir) != 0 {
+	if strings.Index(baseDir, root) != 0 {
 		t.Fatalf("expected base dir with prefix %s; received %s", root, baseDir)
 	}
-	os.Setenv("MACHINE_DIR", "")
+	os.Setenv("MACHINE_STORAGE_PATH", "")
 }
 
 func TestGetDockerDir(t *testing.T) {
-	root := "/tmp"
-	os.Setenv("MACHINE_DIR", root)
-	dockerDir := GetDockerDir()
+	homeDir := GetHomeDir()
+	baseDir := GetBaseDir()
 
-	if strings.Index(dockerDir, root) != 0 {
-		t.Fatalf("expected docker dir with prefix %s; received %s", root, dockerDir)
+	if strings.Index(baseDir, homeDir) != 0 {
+		t.Fatalf("expected base dir with prefix %s; received %s", homeDir, baseDir)
 	}
-
-	path, filename := path.Split(dockerDir)
-	if strings.Index(path, root) != 0 {
-		t.Fatalf("expected base path of %s; received %s", root, path)
-	}
-	if filename != ".docker" {
-		t.Fatalf("expected docker dir \".docker\"; received %s", filename)
-	}
-	os.Setenv("MACHINE_DIR", "")
 }
 
 func TestGetMachineDir(t *testing.T) {
 	root := "/tmp"
-	os.Setenv("MACHINE_DIR", root)
+	os.Setenv("MACHINE_STORAGE_PATH", root)
 	machineDir := GetMachineDir()
 
 	if strings.Index(machineDir, root) != 0 {
@@ -66,13 +56,13 @@ func TestGetMachineDir(t *testing.T) {
 	if filename != "machines" {
 		t.Fatalf("expected machine dir \"machines\"; received %s", filename)
 	}
-	os.Setenv("MACHINE_DIR", "")
+	os.Setenv("MACHINE_STORAGE_PATH", "")
 }
 
-func TestGetMachineClientCertDir(t *testing.T) {
+func TestGetMachineCertDir(t *testing.T) {
 	root := "/tmp"
-	os.Setenv("MACHINE_DIR", root)
-	clientDir := GetMachineClientCertDir()
+	os.Setenv("MACHINE_STORAGE_PATH", root)
+	clientDir := GetMachineCertDir()
 
 	if strings.Index(clientDir, root) != 0 {
 		t.Fatalf("expected machine client cert dir with prefix %s; received %s", root, clientDir)
@@ -82,10 +72,10 @@ func TestGetMachineClientCertDir(t *testing.T) {
 	if strings.Index(path, root) != 0 {
 		t.Fatalf("expected base path of %s; received %s", root, path)
 	}
-	if filename != ".client" {
-		t.Fatalf("expected machine client dir \".client\"; received %s", filename)
+	if filename != "certs" {
+		t.Fatalf("expected machine client dir \"certs\"; received %s", filename)
 	}
-	os.Setenv("MACHINE_DIR", "")
+	os.Setenv("MACHINE_STORAGE_PATH", "")
 }
 
 func TestCopyFile(t *testing.T) {