diff --git a/command/ssh/needsRenewal.go b/command/ssh/needsRenewal.go
index 54bbec49c..f53b5e41d 100644
--- a/command/ssh/needsRenewal.go
+++ b/command/ssh/needsRenewal.go
@@ -77,25 +77,36 @@ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".`,
 }
 
 func needsRenewalAction(ctx *cli.Context) error {
-	if err := errs.NumberOfArguments(ctx, 1); err != nil {
-		return errs.NewExitError(err, 255)
+	if err := errs.MinMaxNumberOfArguments(ctx, 0, 1); err != nil {
+		return errs.NewExitError(errors.Wrap(err, "too many arguments"), 255)
+	}
+
+	var name string
+	switch ctx.NArg() {
+	case 0:
+		name = "-"
+	case 1:
+		name = ctx.Args().First()
+	default:
+		return errs.NewExitError(errors.Errorf("too many arguments"), 255)
 	}
 
 	var (
-		certFile  = ctx.Args().First()
 		expiresIn = ctx.String("expires-in")
 		isVerbose = ctx.Bool("verbose")
 	)
 
-	_, err := os.Stat(certFile)
-	switch {
-	case os.IsNotExist(err):
-		return errs.NewExitError(err, 2)
-	case err != nil:
-		return errs.NewExitError(err, 255)
+	if name != "-" {
+		_, err := os.Stat(name)
+		switch {
+		case os.IsNotExist(err):
+			return errs.NewExitError(err, 2)
+		case err != nil:
+			return errs.NewExitError(err, 255)
+		}
 	}
 
-	b, err := utils.ReadFile(certFile)
+	b, err := utils.ReadFile(name)
 	if err != nil {
 		return errs.NewExitError(err, 255)
 	}