{
  "description": "Inspect certificates and create certificates or CSRs with step certificate. Other step commands (ca, crypto, oauth, ssh) and KMS/template options are not covered.",
  "name": "step",
  "subcommands": [
    {
      "name": "certificate",
      "subcommands": [
        {
          "name": "inspect",
          "description": "Print the details of a certificate or CSR, from a file or a remote host. Local certificates are not verified.",
          "options": [
            {
              "names": [
                "--format"
              ],
              "description": "Output format",
              "args": {
                "name": "format",
                "isOptional": false,
                "suggestions": [
                  {
                    "name": "text",
                    "description": "Text"
                  },
                  {
                    "name": "json",
                    "description": "JSON"
                  },
                  {
                    "name": "pem",
                    "description": "PEM"
                  }
                ]
              }
            },
            {
              "names": [
                "--short"
              ],
              "description": "Short output"
            },
            {
              "names": [
                "--bundle"
              ],
              "description": "Print whole bundle"
            },
            {
              "names": [
                "--roots"
              ],
              "description": "File, comma-separated files or directory used to verify a remote server.",
              "args": {
                "name": "roots",
                "description": "File, comma-separated files or directory used to verify a remote server.",
                "isOptional": false,
                "template": "filepaths"
              }
            },
            {
              "names": [
                "--insecure"
              ],
              "description": "Skip server verification"
            }
          ],
          "args": [
            {
              "name": "crt",
              "description": "A file path, a remote host or URL such as https://example.com, or - for stdin.",
              "isOptional": false
            }
          ]
        },
        {
          "name": "create",
          "description": "Generate a key pair and a certificate or CSR (PEM). Passwords are prompted unless no-password is set.",
          "options": [
            {
              "names": [
                "--profile"
              ],
              "description": "Profile",
              "args": {
                "name": "profile",
                "isOptional": false,
                "suggestions": [
                  {
                    "name": "leaf",
                    "description": "Leaf (TLS client or server)"
                  },
                  {
                    "name": "intermediate-ca",
                    "description": "Intermediate CA"
                  },
                  {
                    "name": "root-ca",
                    "description": "Root CA"
                  }
                ]
              }
            },
            {
              "names": [
                "--csr"
              ],
              "description": "Create a CSR instead"
            },
            {
              "names": [
                "--kty"
              ],
              "description": "Key type",
              "args": {
                "name": "kty",
                "isOptional": false,
                "suggestions": [
                  {
                    "name": "EC",
                    "description": "EC"
                  },
                  {
                    "name": "OKP",
                    "description": "OKP (Ed25519)"
                  },
                  {
                    "name": "RSA",
                    "description": "RSA"
                  }
                ]
              }
            },
            {
              "names": [
                "--curve"
              ],
              "description": "Curve",
              "args": {
                "name": "curve",
                "isOptional": false,
                "suggestions": [
                  {
                    "name": "P-256",
                    "description": "P-256"
                  },
                  {
                    "name": "P-384",
                    "description": "P-384"
                  },
                  {
                    "name": "P-521",
                    "description": "P-521"
                  },
                  {
                    "name": "Ed25519",
                    "description": "Ed25519"
                  }
                ]
              }
            },
            {
              "names": [
                "--size"
              ],
              "description": "RSA key size (bits)",
              "args": {
                "name": "size",
                "isOptional": false
              }
            },
            {
              "names": [
                "--san"
              ],
              "description": "Subject alternative names",
              "args": {
                "name": "san",
                "isOptional": false,
                "isVariadic": true
              },
              "isRepeatable": true
            },
            {
              "names": [
                "--not-after"
              ],
              "description": "RFC 3339 time or a duration such as 8760h.",
              "args": {
                "name": "not_after",
                "description": "RFC 3339 time or a duration such as 8760h.",
                "isOptional": false
              }
            },
            {
              "names": [
                "--ca"
              ],
              "description": "Issuer certificate",
              "args": {
                "name": "ca",
                "isOptional": false,
                "template": "filepaths"
              }
            },
            {
              "names": [
                "--ca-key"
              ],
              "description": "Issuer key",
              "args": {
                "name": "ca_key",
                "isOptional": false,
                "template": "filepaths"
              }
            },
            {
              "names": [
                "--no-password"
              ],
              "description": "Writes the private key unencrypted. Requires --insecure."
            },
            {
              "names": [
                "--insecure"
              ],
              "description": "Allow insecure options"
            }
          ],
          "args": [
            {
              "name": "subject",
              "description": "Hostname for services or email address for people.",
              "isOptional": false
            },
            {
              "name": "crt_file",
              "isOptional": false,
              "template": "filepaths"
            },
            {
              "name": "key_file",
              "isOptional": false,
              "template": "filepaths"
            }
          ]
        }
      ]
    }
  ]
}