step

step is an easy-to-use CLI tool for building, operating, and automating Public Key Infrastructure (PKI) systems and workflows.

Runs as step|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Command form

ai-draft · 4 tasks · 20 fields

Inspect certificates and create certificates or CSRs with step certificate. Other step commands (ca, crypto, oauth, ssh) and KMS/template options are not covered.

Opens the form; the finished command lands at your prompt, unrun

Run in Otty

otty gui step

`step certificate inspect`

Inspect a certificate

Print the details of a certificate or CSR, from a file or a remote host. Local certificates are not verified.

Inspect a certificateExample values, fixed in this page — nothing here reaches a terminal

Basic

Certificate, CSR or URL*

string

Output format

3 choicesenum

Short output

--short

Print whole bundle

--bundle

TasksEach one presets the form for one job

Inspect a local certificate

crtshortbundleformat

Inspect a remote certificate

crtbundleroots

ParametersOnly these flags are editable in the form

Certificate, CSR or URL

A file path, a remote host or URL such as https://example.com, or - for stdin.
string · positional 0

Output format

enum

--formattextjsonpem

Short output

boolean

--short

Print whole bundle

boolean

--bundle

Root certificates

File, comma-separated files or directory used to verify a remote server.
path

--roots

Skip server verification

boolean

--insecure

`step certificate create`

Create a certificate

Generate a key pair and a certificate or CSR (PEM). Passwords are prompted unless no-password is set.

Create a certificateExample values, fixed in this page — nothing here reaches a terminal

Basic

Subject*

string

Certificate file to write*

file

Private key file to write*

file

Profile*

Root CAenum

Advanced

Key type

3 choicesenum

Curve

4 choicesenum

Not after

string

TasksEach one presets the form for one job

Root CA

subjectcrt_filekey_fileprofilektycurvenot_after

Leaf signed by a CA

subjectcrt_filekey_fileprofilesancaca_keynot_after

ParametersOnly these flags are editable in the form

Subject

Hostname for services or email address for people.
string · positional 0

Certificate file to write

path · positional 1

Private key file to write

path · positional 2

Profile

enum

--profileleafintermediate-caroot-ca

Create a CSR instead

boolean

--csr

Key type

enum

--ktyECOKPRSA

Curve

enum

--curveP-256P-384P-521Ed25519

RSA key size (bits)

integer

--size

Subject alternative names

string · repeatable

--san

Not after

RFC 3339 time or a duration such as 8760h.
string

--not-after

Issuer certificate

path

--ca

Issuer key

path

--ca-key

No key password

Writes the private key unencrypted. Requires --insecure.
boolean

--no-password

Allow insecure options

boolean

--insecure

SourcesEvery flag above is checked against these

docs

step certificate inspect <crt-file> [--bundle] [--short] [--format=<format>] [--roots=<root-bundle>] [--servername=<servername>] --format=format text: Print output in unstructured text suitable for a human to read. json: Print output in JSON format. pem: Print output in PEM format. --roots=roots --bundle Print all certificates in the order in which they appe…

manual2026-10-27

smallstep.com

docs

step certificate create <subject> <crt-file> <key-file> [--kty=<type>] [--curve=<curve>] [--size=<size>] [--csr] [--profile=<profile>] [--template=<file>] [--not-before=<duration>] [--not-after=<duration>] [--san=<SAN>] [--ca=<issuer-cert>] [--ca-key=<issuer-key>] [--no-password] [--subtle] [--insecure] --kty=kty EC: Create an elliptic curve key pair OKP: Cr…

manual2026-10-27

smallstep.com

Before it fills your prompt, Otty checks the installed step against its version. A form that does not match your version is not offered.