# Show information about CA hierarchy and issued certificates.

    gimmecert status

"""

def key_specification(specification):

    """

    Verifies and parses the passed-in key specification. This is a

    small utility function for use with the Python argument parser.

    :param specification: Key specification. Currently supported formats are: "rsa:KEY_SIZE" and "ecdsa:CURVE_NAME".

@subcommand_parser

def setup_init_subcommand_parser(parser, subparsers):

    subparser = subparsers.add_parser('init', description='Initialise CA hierarchy.')

    subparser.add_argument('--ca-base-name', '-b', help="Base name to use for CA naming. Default is to use the working directory base name.")

    subparser.add_argument('--ca-hierarchy-depth', '-d', type=int, help="Depth of CA hierarchy to generate. Default is 1", default=1)

    subparser.add_argument('--key-specification', '-k', type=key_specification,

    def init_wrapper(args):

        project_directory = os.getcwd()

        if args.ca_base_name is None:

            args.ca_base_name = os.path.basename(project_directory)

    subparser = subparsers.add_parser('server', description='Issues server certificate.')

    subparser.add_argument('entity_name', help='Name of the server entity.')

    subparser.add_argument('dns_name', nargs='*', help='Additional DNS names to include in subject alternative name.')

    subparser.add_argument('--csr', '-c', type=str, default=None, help='''Do not generate server private key locally, and use the passed-in \

    certificate signing request (CSR) instead. Use dash (-) to read from standard input. Only the public key is taken from the CSR.''')

    subparser.add_argument('--key-specification', '-k', type=key_specification,

    def server_wrapper(args):

        project_directory = os.getcwd()

        return server(sys.stdout, sys.stderr, project_directory, args.entity_name, args.dns_name, args.csr, args.key_specification)

def setup_client_subcommand_parser(parser, subparsers):

    subparser = subparsers.add_parser('client', description='Issue client certificate.')

    subparser.add_argument('entity_name', help='Name of the client entity.')

    subparser.add_argument('--csr', '-c', type=str, default=None, help='''Do not generate client private key locally, and use the passed-in \

    certificate signing request (CSR) instead. Use dash (-) to read from standard input. Only the public key is taken from the CSR.''')

    subparser.add_argument('--key-specification', '-k', type=key_specification,

    def client_wrapper(args):

        project_directory = os.getcwd()

        return client(sys.stdout, sys.stderr, project_directory, args.entity_name, args.csr, args.key_specification)

    Default is to keep the existing key. Mutually exclusive with the --csr option.''')

    new_private_key_or_csr_group.add_argument('--csr', '-c', type=str, default=None, help='''Do not use local private key and public key information from \

    existing certificate, and use the passed-in certificate signing request (CSR) instead. Use dash (-) to read from standard input. \

    If private key exists, it will be removed. Mutually exclusive with the --new-private-key option. Only the public key is taken from the CSR.''')

    subparser.add_argument('--key-specification', '-k', type=key_specification,

    def renew_wrapper(args):

        # This is a workaround for having the key specification option

        # be dependant on new private key option, since argparse

        # cannot provide such verification on its own.

        if args.key_specification and not args.new_private_key: