{
  "id": "step",
  "name": "step",
  "homepage": "https://github.com/smallstep/cli",
  "description": "step is an easy-to-use CLI tool for building, operating, and automating Public Key Infrastructure (PKI) systems and workflows.",
  "executables": [
    "step"
  ],
  "dotfiles": {
    "paths": [
      "~/.step/config/defaults.json",
      "~/.step/contexts.json",
      "~/.step/current-context.json",
      "~/.step/certs/",
      "~/.step/profiles/*/config/defaults.json",
      "~/.step/authorities/*/config/defaults.json",
      "~/.step/authorities/*/certs/"
    ],
    "secret": [
      "~/.step/secrets/",
      "~/.step/authorities/*/secrets/"
    ]
  },
  "commands": {
    "format": 1,
    "label": "Smallstep certificates",
    "description": "Inspect certificates and create certificates or CSRs with step certificate. Other step commands (ca, crypto, oauth, ssh) and KMS/template options are not covered.",
    "quality": "ai-draft",
    "parser": {
      "end_of_options": "--",
      "interleave": "permute",
      "long_equals": true,
      "short_attached": true,
      "short_bundles": false
    },
    "subcommand": [
      {
        "path": [
          "certificate",
          "inspect"
        ],
        "label": "Inspect a certificate",
        "description": "Print the details of a certificate or CSR, from a file or a remote host. Local certificates are not verified.",
        "source": [
          {
            "id": "docs",
            "kind": "manual",
            "url": "https://smallstep.com/docs/step-cli/reference/certificate/inspect/",
            "revision": "2026-10-27",
            "evidence": "step certificate inspect <crt-file>\n[--bundle] [--short] [--format=<format>] [--roots=<root-bundle>]\n[--servername=<servername>]\n--format=format\ntext: Print output in unstructured text suitable for a human to read.\njson: Print output in JSON format.\npem: Print output in PEM format.\n--roots=roots\n--bundle\nPrint all certificates in the order in which they appear in the bundle.\n--short\nPrint the certificate or CSR details in shorter and more friendly format.\n--insecure\nUse an insecure client to retrieve a remote peer certificate.\n$ step certificate inspect ./certificate.crt\n"
          }
        ],
        "field": [
          {
            "id": "crt",
            "label": "Certificate, CSR or URL",
            "description": "A file path, a remote host or URL such as https://example.com, or - for stdin.",
            "type": "string",
            "position": 0,
            "min": 1,
            "sources": [
              "docs"
            ]
          },
          {
            "id": "format",
            "label": "Output format",
            "type": "enum",
            "option": [
              "--format"
            ],
            "choices": [
              {
                "value": "text",
                "label": "Text"
              },
              {
                "value": "json",
                "label": "JSON"
              },
              {
                "value": "pem",
                "label": "PEM"
              }
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "short",
            "label": "Short output",
            "type": "boolean",
            "option": [
              "--short"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "bundle",
            "label": "Print whole bundle",
            "type": "boolean",
            "option": [
              "--bundle"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "roots",
            "label": "Root certificates",
            "description": "File, comma-separated files or directory used to verify a remote server.",
            "type": "path",
            "option": [
              "--roots"
            ],
            "path": {
              "kind": "any",
              "role": "input"
            },
            "sources": [
              "docs"
            ]
          },
          {
            "id": "insecure",
            "label": "Skip server verification",
            "type": "boolean",
            "option": [
              "--insecure"
            ],
            "sources": [
              "docs"
            ]
          }
        ],
        "task": [
          {
            "id": "local",
            "label": "Inspect a local certificate",
            "fields": [
              "crt",
              "short",
              "bundle",
              "format"
            ],
            "required": [
              "crt"
            ]
          },
          {
            "id": "remote",
            "label": "Inspect a remote certificate",
            "fields": [
              "crt",
              "bundle",
              "roots"
            ],
            "required": [
              "crt"
            ]
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "crt",
              "format",
              "short",
              "bundle"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "roots",
              "insecure"
            ]
          }
        ]
      },
      {
        "path": [
          "certificate",
          "create"
        ],
        "label": "Create a certificate",
        "description": "Generate a key pair and a certificate or CSR (PEM). Passwords are prompted unless no-password is set.",
        "source": [
          {
            "id": "docs",
            "kind": "manual",
            "url": "https://smallstep.com/docs/step-cli/reference/certificate/create/",
            "revision": "2026-10-27",
            "evidence": "step certificate create <subject> <crt-file> <key-file>\n[--kty=<type>] [--curve=<curve>] [--size=<size>]\n[--csr] [--profile=<profile>] [--template=<file>]\n[--not-before=<duration>] [--not-after=<duration>] [--san=<SAN>]\n[--ca=<issuer-cert>] [--ca-key=<issuer-key>]\n[--no-password] [--subtle] [--insecure]\n--kty=kty\nEC: Create an elliptic curve key pair\nOKP: Create an octet key pair (for \"Ed25519\" curve)\nRSA: Create an RSA key pair\n--size=size\n--crv=curve, --curve=curve\nP-256: NIST P-256 Curve\nP-384: NIST P-384 Curve\nP-521: NIST P-521 Curve\nEd25519: Ed25519 Curve\n--csr\nGenerate a certificate signing request (CSR) instead of a certificate.\n--profile=profile\nleaf: Generate a leaf x.509 certificate suitable for use with TLS.\nintermediate-ca: Generate a certificate that can be used to sign additional leaf certificates.\nroot-ca: Generate a new self-signed root certificate suitable for use as a root CA.\nself-signed: Generate a new self-signed leaf certificate suitable for use with TLS.\n--not-after=time|duration\n"
          }
        ],
        "field": [
          {
            "id": "subject",
            "label": "Subject",
            "description": "Hostname for services or email address for people.",
            "type": "string",
            "position": 0,
            "min": 1,
            "sources": [
              "docs"
            ]
          },
          {
            "id": "crt_file",
            "label": "Certificate file to write",
            "type": "path",
            "position": 1,
            "min": 1,
            "path": {
              "kind": "file",
              "role": "output"
            },
            "sources": [
              "docs"
            ]
          },
          {
            "id": "key_file",
            "label": "Private key file to write",
            "type": "path",
            "position": 2,
            "min": 1,
            "path": {
              "kind": "file",
              "role": "output"
            },
            "sources": [
              "docs"
            ]
          },
          {
            "id": "profile",
            "label": "Profile",
            "type": "enum",
            "option": [
              "--profile"
            ],
            "choices": [
              {
                "value": "leaf",
                "label": "Leaf (TLS client or server)"
              },
              {
                "value": "intermediate-ca",
                "label": "Intermediate CA"
              },
              {
                "value": "root-ca",
                "label": "Root CA"
              }
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "csr",
            "label": "Create a CSR instead",
            "type": "boolean",
            "option": [
              "--csr"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "kty",
            "label": "Key type",
            "type": "enum",
            "option": [
              "--kty"
            ],
            "choices": [
              {
                "value": "EC",
                "label": "EC"
              },
              {
                "value": "OKP",
                "label": "OKP (Ed25519)"
              },
              {
                "value": "RSA",
                "label": "RSA"
              }
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "curve",
            "label": "Curve",
            "type": "enum",
            "option": [
              "--curve"
            ],
            "choices": [
              {
                "value": "P-256",
                "label": "P-256"
              },
              {
                "value": "P-384",
                "label": "P-384"
              },
              {
                "value": "P-521",
                "label": "P-521"
              },
              {
                "value": "Ed25519",
                "label": "Ed25519"
              }
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "size",
            "label": "RSA key size (bits)",
            "type": "integer",
            "option": [
              "--size"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "san",
            "label": "Subject alternative names",
            "type": "string",
            "option": [
              "--san"
            ],
            "multiple": true,
            "sources": [
              "docs"
            ]
          },
          {
            "id": "not_after",
            "label": "Not after",
            "description": "RFC 3339 time or a duration such as 8760h.",
            "type": "string",
            "option": [
              "--not-after"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "ca",
            "label": "Issuer certificate",
            "type": "path",
            "option": [
              "--ca"
            ],
            "path": {
              "kind": "file",
              "role": "input",
              "must_exist": true
            },
            "sources": [
              "docs"
            ]
          },
          {
            "id": "ca_key",
            "label": "Issuer key",
            "type": "path",
            "option": [
              "--ca-key"
            ],
            "path": {
              "kind": "file",
              "role": "input",
              "must_exist": true
            },
            "sources": [
              "docs"
            ]
          },
          {
            "id": "no_password",
            "label": "No key password",
            "description": "Writes the private key unencrypted. Requires --insecure.",
            "type": "boolean",
            "option": [
              "--no-password"
            ],
            "sources": [
              "docs"
            ]
          },
          {
            "id": "insecure",
            "label": "Allow insecure options",
            "type": "boolean",
            "option": [
              "--insecure"
            ],
            "sources": [
              "docs"
            ]
          }
        ],
        "task": [
          {
            "id": "root-ca",
            "label": "Root CA",
            "fields": [
              "subject",
              "crt_file",
              "key_file",
              "profile",
              "kty",
              "curve",
              "not_after"
            ],
            "required": [
              "subject",
              "crt_file",
              "key_file",
              "profile"
            ],
            "set": {
              "profile": [
                "root-ca"
              ]
            }
          },
          {
            "id": "leaf",
            "label": "Leaf signed by a CA",
            "fields": [
              "subject",
              "crt_file",
              "key_file",
              "profile",
              "san",
              "ca",
              "ca_key",
              "not_after"
            ],
            "required": [
              "subject",
              "crt_file",
              "key_file",
              "ca",
              "ca_key"
            ],
            "set": {
              "profile": [
                "leaf"
              ]
            }
          }
        ],
        "group": [
          {
            "id": "basic",
            "label": "Basic",
            "fields": [
              "subject",
              "crt_file",
              "key_file",
              "profile",
              "san",
              "ca",
              "ca_key"
            ]
          },
          {
            "id": "advanced",
            "label": "Advanced",
            "fields": [
              "csr",
              "kty",
              "curve",
              "size",
              "not_after",
              "no_password",
              "insecure"
            ]
          }
        ]
      }
    ]
  }
}