diff --git a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/KeyPairGenerationToolTests.java b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/KeyPairGenerationToolTests.java
index a70e646e292..885a3b9b8e0 100644
--- a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/KeyPairGenerationToolTests.java
+++ b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/KeyPairGenerationToolTests.java
@@ -5,17 +5,17 @@
  */
 package org.elasticsearch.license.licensor.tools;
 
-import org.apache.commons.cli.MissingOptionException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
 import org.elasticsearch.common.cli.CliTool.Command;
 import org.elasticsearch.common.cli.CliTool.ExitStatus;
 import org.elasticsearch.common.cli.CliToolTestCase;
+import org.elasticsearch.common.cli.UserError;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.env.Environment;
 import org.elasticsearch.license.licensor.tools.KeyPairGeneratorTool.KeyGenerator;
 
-import java.nio.file.Files;
-import java.nio.file.Path;
-
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.instanceOf;
 import static org.hamcrest.core.IsEqual.equalTo;
@@ -24,20 +24,16 @@ public class KeyPairGenerationToolTests extends CliToolTestCase {
     public void testParsingMissingPath() throws Exception {
         KeyPairGeneratorTool keyPairGeneratorTool = new KeyPairGeneratorTool();
         Path tempFile = createTempFile();
-        try {
+        UserError e = expectThrows(UserError.class, () -> {
             keyPairGeneratorTool.parse(KeyPairGeneratorTool.NAME,
-                    new String[] { "--privateKeyPath", tempFile.toAbsolutePath().toString() });
-            fail("no public key path provided");
-        } catch (MissingOptionException e) {
-            assertThat(e.getMessage(), containsString("pub"));
-        }
-        try {
+                new String[]{"--privateKeyPath", tempFile.toAbsolutePath().toString()});
+        });
+        assertThat(e.getMessage(), containsString("pub"));
+        e = expectThrows(UserError.class, () -> {
             keyPairGeneratorTool.parse(KeyPairGeneratorTool.NAME,
                     new String[] { "--publicKeyPath", tempFile.toAbsolutePath().toString() });
-            fail("no private key path provided");
-        } catch (MissingOptionException e) {
-            assertThat(e.getMessage(), containsString("pri"));
-        }
+        });
+        assertThat(e.getMessage(), containsString("pri"));
     }
 
     public void testParsingNeverOverrideKey() throws Exception {
diff --git a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseGenerationToolTests.java b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseGenerationToolTests.java
index 578b6b42a71..c4568af3138 100644
--- a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseGenerationToolTests.java
+++ b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseGenerationToolTests.java
@@ -5,10 +5,14 @@
  */
 package org.elasticsearch.license.licensor.tools;
 
-import org.apache.commons.cli.MissingOptionException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
 import org.elasticsearch.common.cli.CliTool.Command;
 import org.elasticsearch.common.cli.CliTool.ExitStatus;
 import org.elasticsearch.common.cli.CliToolTestCase;
+import org.elasticsearch.common.cli.UserError;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.env.Environment;
 import org.elasticsearch.license.core.License;
@@ -16,10 +20,6 @@ import org.elasticsearch.license.licensor.TestUtils;
 import org.elasticsearch.license.licensor.tools.LicenseGeneratorTool.LicenseGenerator;
 import org.junit.Before;
 
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
 import static org.hamcrest.CoreMatchers.containsString;
 import static org.hamcrest.CoreMatchers.instanceOf;
 import static org.hamcrest.core.IsEqual.equalTo;
@@ -72,15 +72,13 @@ public class LicenseGenerationToolTests extends CliToolTestCase {
         TestUtils.LicenseSpec inputLicenseSpec = TestUtils.generateRandomLicenseSpec(License.VERSION_CURRENT);
         LicenseGeneratorTool licenseGeneratorTool = new LicenseGeneratorTool();
         boolean pubKeyMissing = randomBoolean();
-        try {
+        UserError e = expectThrows(UserError.class, () -> {
             licenseGeneratorTool.parse(LicenseGeneratorTool.NAME,
-                    new String[] { "--license", TestUtils.generateLicenseSpecString(inputLicenseSpec),
-                            ((pubKeyMissing) ? "--privateKeyPath" : "--publicKeyPath"),
-                            ((pubKeyMissing) ? priKeyPath.toString() : pubKeyPath.toString()) });
-            fail("missing argument: " + ((pubKeyMissing) ? "publicKeyPath" : "privateKeyPath") + " should throw an exception");
-        } catch (MissingOptionException e) {
-            assertThat(e.getMessage(), containsString((pubKeyMissing) ? "pub" : "pri"));
-        }
+                new String[]{"--license", TestUtils.generateLicenseSpecString(inputLicenseSpec),
+                    ((pubKeyMissing) ? "--privateKeyPath" : "--publicKeyPath"),
+                    ((pubKeyMissing) ? priKeyPath.toString() : pubKeyPath.toString())});
+        });
+        assertThat(e.getMessage(), containsString((pubKeyMissing) ? "pub" : "pri"));
     }
 
     public void testParsingSimple() throws Exception {
diff --git a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseVerificationToolTests.java b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseVerificationToolTests.java
index 16a5bb70b00..5c2e519bdf1 100644
--- a/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseVerificationToolTests.java
+++ b/elasticsearch/license/licensor/src/test/java/org/elasticsearch/license/licensor/tools/LicenseVerificationToolTests.java
@@ -5,10 +5,16 @@
  */
 package org.elasticsearch.license.licensor.tools;
 
-import org.apache.commons.cli.MissingOptionException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
 import org.elasticsearch.common.cli.CliTool.Command;
 import org.elasticsearch.common.cli.CliTool.ExitStatus;
 import org.elasticsearch.common.cli.CliToolTestCase;
+import org.elasticsearch.common.cli.UserError;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.common.unit.TimeValue;
 import org.elasticsearch.env.Environment;
@@ -18,12 +24,6 @@ import org.elasticsearch.license.licensor.tools.LicenseVerificationTool.LicenseV
 import org.hamcrest.CoreMatchers;
 import org.junit.Before;
 
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.List;
-
 import static org.hamcrest.CoreMatchers.instanceOf;
 import static org.hamcrest.Matchers.containsString;
 import static org.hamcrest.core.IsEqual.equalTo;
@@ -52,12 +52,11 @@ public class LicenseVerificationToolTests extends CliToolTestCase {
     public void testParsingMissingPublicKeyPath() throws Exception {
         License inputLicense = TestUtils.generateSignedLicense(TimeValue.timeValueHours(1), pubKeyPath, priKeyPath);
         LicenseVerificationTool licenseVerificationTool = new LicenseVerificationTool();
-        try {
+        UserError e = expectThrows(UserError.class, () -> {
             licenseVerificationTool.parse(LicenseVerificationTool.NAME,
                     new String[] { "--license", TestUtils.dumpLicense(inputLicense) });
-        } catch (MissingOptionException e) {
-            assertThat(e.getMessage(), containsString("pub"));
-        }
+        });
+        assertThat(e.getMessage(), containsString("pub"));
     }
 
     public void testParsingNonExistentPublicKeyPath() throws Exception {
diff --git a/elasticsearch/x-pack/shield/src/main/java/org/elasticsearch/shield/authc/esusers/tool/ESUsersTool.java b/elasticsearch/x-pack/shield/src/main/java/org/elasticsearch/shield/authc/esusers/tool/ESUsersTool.java
index 219ff041ac2..e77e54d477b 100644
--- a/elasticsearch/x-pack/shield/src/main/java/org/elasticsearch/shield/authc/esusers/tool/ESUsersTool.java
+++ b/elasticsearch/x-pack/shield/src/main/java/org/elasticsearch/shield/authc/esusers/tool/ESUsersTool.java
@@ -50,7 +50,7 @@ public class ESUsersTool extends CliTool {
             .cmds(Useradd.CMD, Userdel.CMD, Passwd.CMD, Roles.CMD, ListUsersAndRoles.CMD)
             .build();
 
-    public static void main(String[] args) {
+    public static void main(String[] args) throws Exception {
         ExitStatus exitStatus = new ESUsersTool().execute(args);
         exit(exitStatus.status());
     }
@@ -537,8 +537,8 @@ public class ESUsersTool extends CliTool {
         if (!unknownRoles.isEmpty()) {
             Path rolesFile = FileRolesStore.resolveFile(settings, env);
             terminal.println("Warning: The following roles [%s] are unknown. Make sure to add them to the [%s] file. " +
-                            "Nonetheless the user will still be associated with all specified roles",
-                    Strings.collectionToCommaDelimitedString(unknownRoles), rolesFile.toAbsolutePath());
+                    "Nonetheless the user will still be associated with all specified roles",
+                Strings.collectionToCommaDelimitedString(unknownRoles), rolesFile.toAbsolutePath());
         }
     }
 }