CLI Reference

Commands read ~/.certone/config.yaml for the runtime user by default. Use --config to select another path; omit it when using the default. Docker environment-variable mode uses --env, which cannot be combined with --config.

Command	Purpose	Performs deployment?
`certone help`	Show entry-point help	No
`certone version`	Show version, OS, and architecture	No
`certone init`	Interactively create default configuration and credentials	No
`certone init --template --config /absolute/path/config.yaml`	Create a template without overwriting an existing file	No, but writes configuration
`certone check --config …`	Check configuration and basic local prerequisites	No
`certone doctor --config …`	Run local diagnostics	No
`certone doctor --network --config …`	Run local diagnostics and check platform authentication and metadata	No
`certone sync --once --prepare --config …`	Prepare file outputs before an application's first start; skip check/reload/verify	Writes files, but does not report completed deployment
`certone sync --once --config …`	Perform one synchronization cycle	Yes; writes depend on differences and tasks
`certone run --config …`	Maintain certificates continuously	Yes
`certone exec --config … -- application-command`	Prepare certificates, start the application, and maintain certificates	Yes; also starts the application
`certone status --config …`	Read the saved status in plain language	No
`certone status --json --config …`	Read the saved snapshot as JSON	No
`certone diagnose --config … --output file`	Export diagnostic information	No, but writes a diagnostic file
`certone service install/start/stop/restart/status/uninstall --config …`	Manage the system service	Starting or restarting triggers synchronization

check and doctor probe write access by briefly creating and removing a temporary file in the nearest existing output/state directory; they do not create certificate outputs. They may also write logs depending on logging configuration. status and diagnose do not open the log file, so they remain usable when that log destination is unwritable. “No deployment” means they do not write certificate outputs or invoke application deployment operations.

Run certone <command> --help for the options accepted by that command. Unsupported options and extra positional arguments are rejected.

Put options after the relevant subcommand: use certone run --config …, not certone --config … run. Put the service operation after service and the application command after exec's -- separator.

Use check for configuration problems, doctor --network for connectivity, status for deployment records, and logs for the actual failure reason.