id          = "step"
name        = "step"
homepage    = "https://github.com/smallstep/cli"
description = "step is an easy-to-use CLI tool for building, operating, and automating Public Key Infrastructure (PKI) systems and workflows."
executables      = ["step"]

[dotfiles]

# Smallstep documents STEPPATH (default $HOME/.step), the defaults.json
# configuration file, and the contexts/profiles/authorities layouts here:
# https://smallstep.com/docs/step-cli/the-step-command/
paths = [
  "~/.step/config/defaults.json",
  "~/.step/contexts.json",
  "~/.step/current-context.json",
  "~/.step/certs/",
  "~/.step/profiles/*/config/defaults.json",
  "~/.step/authorities/*/config/defaults.json",
  "~/.step/authorities/*/certs/",
]

# The same documentation identifies secrets directories in STEPPATH and in
# each authority tree; private keys must never travel as ordinary content.
secret = [
  "~/.step/secrets/",
  "~/.step/authorities/*/secrets/",
]

[commands]
format = 1
label = "Smallstep certificates"
description = "Inspect certificates and create certificates or CSRs with step certificate. Other step commands (ca, crypto, oauth, ssh) and KMS/template options are not covered."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["certificate", "inspect"]
label = "Inspect a certificate"
description = "Print the details of a certificate or CSR, from a file or a remote host. Local certificates are not verified."

[[commands.subcommand.source]]
id = "docs"
kind = "manual"
url = "https://smallstep.com/docs/step-cli/reference/certificate/inspect/"
revision = "2026-10-27"
evidence = """
step certificate inspect <crt-file>
[--bundle] [--short] [--format=<format>] [--roots=<root-bundle>]
[--servername=<servername>]
--format=format
text: Print output in unstructured text suitable for a human to read.
json: Print output in JSON format.
pem: Print output in PEM format.
--roots=roots
--bundle
Print all certificates in the order in which they appear in the bundle.
--short
Print the certificate or CSR details in shorter and more friendly format.
--insecure
Use an insecure client to retrieve a remote peer certificate.
$ step certificate inspect ./certificate.crt
"""

[[commands.subcommand.field]]
id = "crt"
label = "Certificate, CSR or URL"
description = "A file path, a remote host or URL such as https://example.com, or - for stdin."
type = "string"
position = 0
min = 1
sources = ["docs"]

[[commands.subcommand.field]]
id = "format"
label = "Output format"
type = "enum"
option = ["--format"]
choices = [
  { value = "text", label = "Text" },
  { value = "json", label = "JSON" },
  { value = "pem", label = "PEM" },
]
sources = ["docs"]

[[commands.subcommand.field]]
id = "short"
label = "Short output"
type = "boolean"
option = ["--short"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "bundle"
label = "Print whole bundle"
type = "boolean"
option = ["--bundle"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "roots"
label = "Root certificates"
description = "File, comma-separated files or directory used to verify a remote server."
type = "path"
option = ["--roots"]
path = { kind = "any", role = "input" }
sources = ["docs"]

[[commands.subcommand.field]]
id = "insecure"
label = "Skip server verification"
type = "boolean"
option = ["--insecure"]
sources = ["docs"]

[[commands.subcommand.task]]
id = "local"
label = "Inspect a local certificate"
fields = ["crt", "short", "bundle", "format"]
required = ["crt"]

[[commands.subcommand.task]]
id = "remote"
label = "Inspect a remote certificate"
fields = ["crt", "bundle", "roots"]
required = ["crt"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["crt", "format", "short", "bundle"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["roots", "insecure"]

[[commands.subcommand]]
path = ["certificate", "create"]
label = "Create a certificate"
description = "Generate a key pair and a certificate or CSR (PEM). Passwords are prompted unless no-password is set."

[[commands.subcommand.source]]
id = "docs"
kind = "manual"
url = "https://smallstep.com/docs/step-cli/reference/certificate/create/"
revision = "2026-10-27"
evidence = """
step certificate create <subject> <crt-file> <key-file>
[--kty=<type>] [--curve=<curve>] [--size=<size>]
[--csr] [--profile=<profile>] [--template=<file>]
[--not-before=<duration>] [--not-after=<duration>] [--san=<SAN>]
[--ca=<issuer-cert>] [--ca-key=<issuer-key>]
[--no-password] [--subtle] [--insecure]
--kty=kty
EC: Create an elliptic curve key pair
OKP: Create an octet key pair (for "Ed25519" curve)
RSA: Create an RSA key pair
--size=size
--crv=curve, --curve=curve
P-256: NIST P-256 Curve
P-384: NIST P-384 Curve
P-521: NIST P-521 Curve
Ed25519: Ed25519 Curve
--csr
Generate a certificate signing request (CSR) instead of a certificate.
--profile=profile
leaf: Generate a leaf x.509 certificate suitable for use with TLS.
intermediate-ca: Generate a certificate that can be used to sign additional leaf certificates.
root-ca: Generate a new self-signed root certificate suitable for use as a root CA.
self-signed: Generate a new self-signed leaf certificate suitable for use with TLS.
--not-after=time|duration
"""

[[commands.subcommand.field]]
id = "subject"
label = "Subject"
description = "Hostname for services or email address for people."
type = "string"
position = 0
min = 1
sources = ["docs"]

[[commands.subcommand.field]]
id = "crt_file"
label = "Certificate file to write"
type = "path"
position = 1
min = 1
path = { kind = "file", role = "output" }
sources = ["docs"]

[[commands.subcommand.field]]
id = "key_file"
label = "Private key file to write"
type = "path"
position = 2
min = 1
path = { kind = "file", role = "output" }
sources = ["docs"]

[[commands.subcommand.field]]
id = "profile"
label = "Profile"
type = "enum"
option = ["--profile"]
choices = [
  { value = "leaf", label = "Leaf (TLS client or server)" },
  { value = "intermediate-ca", label = "Intermediate CA" },
  { value = "root-ca", label = "Root CA" },
]
sources = ["docs"]

[[commands.subcommand.field]]
id = "csr"
label = "Create a CSR instead"
type = "boolean"
option = ["--csr"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "kty"
label = "Key type"
type = "enum"
option = ["--kty"]
choices = [
  { value = "EC", label = "EC" },
  { value = "OKP", label = "OKP (Ed25519)" },
  { value = "RSA", label = "RSA" },
]
sources = ["docs"]

[[commands.subcommand.field]]
id = "curve"
label = "Curve"
type = "enum"
option = ["--curve"]
choices = [
  { value = "P-256", label = "P-256" },
  { value = "P-384", label = "P-384" },
  { value = "P-521", label = "P-521" },
  { value = "Ed25519", label = "Ed25519" },
]
sources = ["docs"]

[[commands.subcommand.field]]
id = "size"
label = "RSA key size (bits)"
type = "integer"
option = ["--size"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "san"
label = "Subject alternative names"
type = "string"
option = ["--san"]
multiple = true
sources = ["docs"]

[[commands.subcommand.field]]
id = "not_after"
label = "Not after"
description = "RFC 3339 time or a duration such as 8760h."
type = "string"
option = ["--not-after"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "ca"
label = "Issuer certificate"
type = "path"
option = ["--ca"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["docs"]

[[commands.subcommand.field]]
id = "ca_key"
label = "Issuer key"
type = "path"
option = ["--ca-key"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["docs"]

[[commands.subcommand.field]]
id = "no_password"
label = "No key password"
description = "Writes the private key unencrypted. Requires --insecure."
type = "boolean"
option = ["--no-password"]
sources = ["docs"]

[[commands.subcommand.field]]
id = "insecure"
label = "Allow insecure options"
type = "boolean"
option = ["--insecure"]
sources = ["docs"]

[[commands.subcommand.task]]
id = "root-ca"
label = "Root CA"
fields = ["subject", "crt_file", "key_file", "profile", "kty", "curve", "not_after"]
required = ["subject", "crt_file", "key_file", "profile"]
set = { profile = ["root-ca"] }

[[commands.subcommand.task]]
id = "leaf"
label = "Leaf signed by a CA"
fields = ["subject", "crt_file", "key_file", "profile", "san", "ca", "ca_key", "not_after"]
required = ["subject", "crt_file", "key_file", "ca", "ca_key"]
set = { profile = ["leaf"] }

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["subject", "crt_file", "key_file", "profile", "san", "ca", "ca_key"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["csr", "kty", "curve", "size", "not_after", "no_password", "insecure"]