#compdef openssl
# ------------------------------------------------------------------------------
# Copyright (c) 2011 Github zsh-users - https://github.com/zsh-users
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without
# modification, are permitted provided that the following conditions are met:
#     * Redistributions of source code must retain the above copyright
#       notice, this list of conditions and the following disclaimer.
#     * Redistributions in binary form must reproduce the above copyright
#       notice, this list of conditions and the following disclaimer in the
#       documentation and/or other materials provided with the distribution.
#     * Neither the name of the zsh-users nor the
#       names of its contributors may be used to endorse or promote products
#       derived from this software without specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
# DISCLAIMED. IN NO EVENT SHALL ZSH-USERS BE LIABLE FOR ANY
# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
# ------------------------------------------------------------------------------
# Description
# -----------
#
#  Completion script for OpenSSL 3.5.3 (https://www.openssl-library.org/)
#
# ------------------------------------------------------------------------------
# Authors
# -------
#
#  * Aaron Schrab <aaron@schrab.com>
#  * Dimitris Apostolou <dimitris.apostolou@icloud.com>
#  * Shohei Yoshida <https://github.com/syohex/>
#
# ------------------------------------------------------------------------------

_openssl() {
  typeset -A opt_args
  local context state line
  local curcontext="$curcontext"
  local ret=1

  local -a openssl_tls_flags=(
    '-ssl3[enable SSL3 protocol]'
    '-no_ssl3[disable SSL3 protocol]'
    '-tls1[enable TLS1 protocol]'
    '-no_tls1[disable TLS1 protocol]'
    '-tls1_1[enable TLS1.1 protocol]'
    '-no_tls1_1[disable TLS1.1 protocol]'
    '-tls1_2[enable TLS1.2 protocol]'
    '-no_tls1_2[disable TLS1.2 protocol]'
    '-tls1_3[enable TLS1.3 protocol]'
    '-no_tls1_3[disable TLS1.3 protocol]'
  )

  local -a openssl_dtls_flags=(
    '-dtls[use DTLS instead of TLS]'
    '-dtls1[use DTLS1 instead of TLS]'
    '-dtls2[use DTLS2 instead of TLS]'
  )

  local -a openssl_extended_verification_flags=(
    '-xkey[extra private key file]:file:_files'
    '-xcert[extra certificate file]:file:_files'
    '-xchain[extra certificate chain file]:file:_files'
    '-xchain_build[build the certificate chain for the extra certificates]'
    '-xcertform[extra certificate format]:format[DER PEM P12]'
  )

  local -a openssl_supported_commands_flags=(
    '-bugs[set various bug workarounds]'
    '(-comp -no_comp)-no_comp[disable support for SSL/TLS compression]'
    '(-comp -no_comp)-comp[enable support for SSL/TLS compression]'
    '-no_ticket[disable support for session tickets]'
    '-serverpref[use server and not client preference order when determining cipher suite]'
    '-client_renegotiation[allow servers to accept client-initiated renegotiation]'
    '-legacy_renegotiation[permit the use of unsafe legacy renegotiation]'
    '-no_renegotiation[disable all attempts at renegotiation in (D)TLSv1.2 and earlier]'
    '-no_resumption_on_reneg[set SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION]'
    '(-legacy_server_connect -no_legacy_server_connect)-legacy_server_connect[permit unsafe legacy renegotiation]'
    '(-legacy_server_connect -no_legacy_server_connect)-no_legacy_server_connect[prohibit unsafe legacy renegotiation]'
    '-prioritize_chacha[prioritize ChaCha ciphers when the client has a ChaCha20 cipher]'
    '-allow_no_dhe_kex[allow a non-(ec)dhe based key exchange mode on resumption]'
    '-strict[enable strict mode protocol handling]'
    '-sigalgs[set signature algorithms for TLSv1.2 and TLSv1.3]:alg:_openssl_signature_algorithms'
    '-client_sigalgs[set signature algorithms for client authentication for TLSv1.2 and TLSv1.3]:alg:_openssl_signature_algorithms'
    '-groups[set the supported groups(colon separated NIST name or OpenSSL OID name)]:groups:_openssl_groups'
    '-curves[set the curves groups]:groups:_openssl_groups'
    '-named_curve[set the temporary curve for ephemeral ECDH modes]:curve'
    '-cipher[set the TLSv1.2 and below ciphersuite list to ciphers]:ciphers'
    '-ciphersuites[set the available ciphersuites for TLSv1.3]:ciphers'
    '-min_protocol[minimum supported protocol]:protocol:_openssl_tls_protocols'
    '-max_protocol[maximum supported protocol]:protocol:_openssl_tls_protocols'
    '-record_padding[padding length for TLSv1.3 records]:padding'
    '-no_middlebox[turn of middlebox compatibility]'
  )

  local -a openssl_provider_options=(
    '-provider[provider ID to be loaded and initialized]:provider'
    '-provider-path[search path that is to be used for looking for providers]:path:_files -/'
    '*-provparam[configuration parameter key to value val in provider name]:key_value'
    '-propquery[property query clause to be used when fetching algorithms from the loaded providers]:query'
  )

  local -a openssl_trusted_certificate_options=(
    '-CAfile[load the specified file which contains a certificate or several of them]:file:_files'
    '-no-CAfile[do not load the default file of trusted certificates]'
    '-CApath[directory as a collection of trusted certificates]:dir:_files -/'
    '-no-CApath[do not use the default directory of trusted certificates]'
    '-CAstore[URI as a store of CA certificates]:uri'
    '-no-CAstore[do not use the default store of trusted CA certificates]'
  )

  local -a openssl_random_state_options=(
    '-rand[file containing random data used to seed the random number generator]:file:_files'
    '-writerand[file to be written the seed data]:file:_files'
  )

  local -a openssl_verification_options=(
    '-allow_proxy_certs[allow the verification of proxy certificates]'
    '-attime[perform validation checks using time specified by timestamp and not current system time]:time'
    '-no_check_time[suppresses checking the validity period of certificates and CRLs against the current time]'
    '-check_ss_sig[verify the signature of the last certificate in a chain if the certificate is supposedly self-signed]'
    '-crl_check[checks end entity certificate validity by attempting to look up a valid CRL]'
    '-crl_check_all[checks the validity of all certificates in the chain by attempting to look up valid CRL]'
    '-explicit_policy[set policy variable require-explicit-policy]'
    '-extended_crl[enable extended CRL features]'
    '-ignore_critical[ignore critical extensions]'
    '-inhibit_any[set policy variable inhibit-any-policy]'
    '-inhibit_map[set policy variable inhibit-policy-mapping]'
    '-partial_chain[allow verification to succeed if an incomplete chain can be built]'
    '-policy[enable policy processing and add arg to the user-initial-policy-set]:policy'
    '-policy_check[enables certificate policy processing]'
    '-policy_print[print out diagnostics related to policy processing]'
    '-purpose[a high-level specification of the intended use of the target certificate]:purpose'
    '-suiteB_128[enable the Suite B mode operation at 128 bit Level of Security]'
    '-suiteB_128_only[enable only the Suite B mode operation at 128 bit Level of Security]'
    '-suiteB_192[enable the Suite B mode operation at 192 bit Level of Security]'
    '-use_deltas[enable support for delta CRLs]'
    '-auth_level[set the certificate chain authentication security level]:level'
    '-verify_depth[limit the certificate chain to num intermediate CA certificates]:depth'
    '-verify_email[verify the email address in Subject Alternative Name or the email]:email'
    '-verify_hostname[verify hostname in Subject Alternative Name or Common Name]:hostname'
    '-verify_ip[verify IP addresses in Subject Alternative Name of the subject certificate]:ip'
    '-x509_strict[disables non-compliant workarounds for broken certificates]'
  )

  _arguments -C -A "-*" \
    '(- *)-help[show help]' \
    '(- *)-version[show version]' \
    '1: :_openssl_subcommands' \
    '*::arg:->args' \
    && ret=0

  case "$state" in
    (args)
      local subcmd=${words[1]}
      if (( $+functions[_openssl_${subcmd}] )); then
        _openssl_${subcmd} && ret=0
      else
        local -a cipher_flags=($(openssl enc -list | tail -n +2 ))
        local -a ciphers=()
        for flag in $cipher_flags[@]
        do
          ciphers+=(${flag:1})
        done

        if (( $ciphers[(I)$subcmd] )); then
          _openssl_enc 1 && ret=0
        else
          local -a digest_flags=($(openssl dgst -list | tail -n +2 ))
          local -a digests=()
          for flag in $digest_flags[@]
          do
            digests+=(${flag:1})
          done

          if (( $digests[(I)$subcmd] )); then
            _openssl_dgst 1 && ret=0
          fi
        fi
      fi

      ;;
  esac

  return ret
}

_openssl_subcommands() {
  local -a commands=(
    'asn1parse:Parse an ASN.1 sequence'
    'ca:Certificate Authority Management'
    'ciphers:Cipher Suite Description Determination'
    'cmp:Certificate Management Protocol(CMP) application'
    'cms:Cryptographic Message Syntax command'
    'crl:Certificate Revocation List Management'
    'crl2pkcs7:CRL to PKCS#7 Conversion'
    'dgst:Message Digest calculation'
    'dhparam: Generation and Management of Diffie-Hellman Parameters'
    'dsa: DSA Data Management'
    'dsaparam:DSA Parameter Generation and Management'
    'ec:Elliptic curve key processing'
    'ecparam:EC parameter manipulation and generation'
    'enc:Encryption, decryption, and encoding'
    'engine:Engine (loadable module) information and manipulation'
    'errstr:Error Number to Error String Conversion'
    'fipsinstall:FIPS configuration installation'
    'gendsa:Generation of DSA Private Key from Parameters'
    'genpkey:Generation of Private Key or Parameters'
    'genrsa:Generation of RSA Private Key'
    "help:Display information about a command's options"
    'info:Display diverse information built into the OpenSSL libraries'
    'list:List algorithms and features'
    'mac:Message Authentication Code Calculation'
    'nseq:Create or examine a Netscape certificate sequence'
    'ocsp:Online Certificate Status Protocol command'
    'passwd:Generation of hashed passwords'
    'pkcs12:PKCS#12 Data Management'
    'pkcs7:PKCS#7 Data Management'
    'pkcs8:PKCS#8 format private key conversion command'
    'pkey:Public and private key management'
    'pkeyparam:Public key algorithm parameter management'
    'pkeyutl:Public key algorithm cryptographic operation command'
    'prime:Compute prime numbers'
    'rand:Generate pseudo-random bytes'
    'rehash:Create symbolic links to certificate and CRL files named by the hash values'
    'req:PKCS#10 X.509 Certificate Signing Request Management'
    'rsautl:RSA command for signing, verification, encryption, and decryption'
    's_client:SSL/TLS client program'
    's_server:SSL/TLS server program'
    's_time:SSL Connection Timer'
    'sess_id:SSL Session Data Management'
    'smime:S/MIME mail processing'
    'speed:Algorithm Speed Measurement'
    'spkac:SPKAC printing and generating command'
    'srp:Maintain SRP password file(deprecated)'
    'storeutl:Command to list and display certificates, keys, CRLs, etc'
    'ts:Time Stamping Authority command'
    'verify:X.509 Certificate Verification'
    'version:OpenSSL Version Information'
    'x509:X.509 Certificate Data Management'

    # Message Digest Commands
    'blake2b512:BLAKE2b-512 Digest'
    'blake2s256:BLAKE2s-256 Digest'
    'md2:MD2 Digest'
    'md4:MD4 Digest'
    'md5:MD5 Digest'
    'mdc2:MDC2 Digest'
    'rmd160:RMD-160 Digest'
    'sha1:SHA-1 Digest'
    'sha224:SHA-2 224 Digest'
    'sha256:SHA-2 256 Digest'
    'sha384:SHA-2 384 Digest'
    'sha512:SHA-2 512 Digest'
    'sha3-224:SHA-3 224 Digest'
    'sha3-256:SHA-3 256 Digest'
    'sha3-384:SHA-3 384 Digest'
    'sha3-512:SHA-3 512 Digest'
    'keccak-224:KECCAK 224 Digest'
    'keccak-256:KECCAK 256 Digest'
    'keccak-384:KECCAK 384 Digest'
    'keccak-512:KECCAK 512 Digest'
    'shake128:SHA-3 SHAKE128 Digest'
    'shake256:SHA-3 SHAKE256 Digest'
    'sm3:SM3 Digest'

    # Encryption, Decryption, and Encoding Commands
    'aes128:AES-128 Cipher'
    'aes-128-cbc:AES-128 CBC Cipher'
    'aes-128-cfb:AES-128 CFB Cipher'
    'aes-128-ctr:AES-128 CTR Cipher'
    'aes-128-ecb:AES-128 ECB Cipher'
    'aes-128-ofb:AES-128 OFB Cipher'
    'aes192:AES-192 Cipher'
    'aes-192-cbc:AES-192 CBC Cipher'
    'aes-192-cfb:AES-192 CFB Cipher'
    'aes-192-ctr:AES-192 CTR Cipher'
    'aes-192-ecb:AES-192 ECB Cipher'
    'aes-192-ofb:AES-192 OFB Cipher'
    'aes256:AES-256 Cipher'
    'aes-256-cbc:AES-256 CBC Cipher'
    'aes-256-cfb:AES-256 CFB Cipher'
    'aes-256-ctr:AES-256 CTR Cipher'
    'aes-256-ecb:AES-256 ECB Cipher'
    'aes-256-ofb:AES-256 OFB Cipher'

    'aria128:Aria-128 Cipher'
    'aria-128-cbc:Aria-128 CBC Cipher'
    'aria-128-cfb:Aria-128 CFB Cipher'
    'aria-128-ctr:Aria-128 CTR Cipher'
    'aria-128-ecb:Aria-128 ECB Cipher'
    'aria-128-ofb:Aria-128 OFB Cipher'
    'aria192:Aria-192 Cipher'
    'aria-192-cbc:Aria-192 CBC Cipher'
    'aria-192-cfb:Aria-192 CFB Cipher'
    'aria-192-ctr:Aria-192 CTR Cipher'
    'aria-192-ecb:Aria-192 ECB Cipher'
    'aria-192-ofb:Aria-192 OFB Cipher'
    'aria256:Aria-256 Cipher'
    'aria-256-cbc:Aria-256 CBC Cipher'
    'aria-256-cfb:Aria-256 CFB Cipher'
    'aria-256-ctr:Aria-256 CTR Cipher'
    'aria-256-ecb:Aria-256 ECB Cipher'
    'aria-256-ofb:Aria-256 OFB Cipher'

    'base64:Base64 Encoding'

    'bf:Blowfish Cipher'
    'bf-cbc:Blowfish CBC Cipher'
    'bf-cfb:Blowfish CFB Cipher'
    'bf-ecb:Blowfish ECB Cipher'
    'bf-ofb:Blowfish OFB Cipher'

    'camellia128:Camellia-128 Cipher'
    'camellia-128-cbc:Camellia-128 CBC Cipher'
    'camellia-128-cfb:Camellia-128 CFB Cipher'
    'camellia-128-ctr:Camellia-128 CTR Cipher'
    'camellia-128-ecb:Camellia-128 ECB Cipher'
    'camellia-128-ofb:Camellia-128 OFB Cipher'
    'camellia192:Camellia-192 Cipher'
    'camellia-192-cbc:Camellia-192 CBC Cipher'
    'camellia-192-cfb:Camellia-192 CFB Cipher'
    'camellia-192-ctr:Camellia-192 CTR Cipher'
    'camellia-192-ecb:Camellia-192 ECB Cipher'
    'camellia-192-ofb:Camellia-192 OFB Cipher'
    'camellia256:Camellia-256 Cipher'
    'camellia-256-cbc:Camellia-256 CBC Cipher'
    'camellia-256-cfb:Camellia-256 CFB Cipher'
    'camellia-256-ctr:Camellia-256 CTR Cipher'
    'camellia-256-ecb:Camellia-256 ECB Cipher'
    'camellia-256-ofb:Camellia-256 OFB Cipher'

    'cast:CAST Cipher'
    'cast-cbc:CAST CBC Cipher'

    'cast5-cbc:CAST5 CBC Cipher'
    'cast5-cfb:CAST5 CFB Cipher'
    'cast5-ecb:CAST5 ECB Cipher'
    'cast5-ofb:CAST5 OFB Cipher'

    'chacha20:Chacha20 Cipher'

    'des:DES Ciper'
    'des-cbc:DES CBC Ciper'
    'des-cfb:DES CFB Ciper'
    'des-ecb:DES ECB Ciper'
    'des-ede:DES EDE Ciper'
    'des-ede-cbc:DES EDE CBC Ciper'
    'des-ede-cfb:DES EDE CFB Ciper'
    'des-ede-ofb:DES EDE OFB Ciper'
    'des-ofb:DES OFB Ciper'

    'des3:Triple-DES Ciper'
    'desx:Triple-DES X Ciper'
    'des-ede3:Triple-DES EDE Ciper'
    'des-ede3-cbc:Triple-DES EDE CBC Ciper'
    'des-ede3-cfb:Triple-DES EDE CFB Ciper'
    'des-ede3-ofb:Triple-DES EDE OFB Ciper'

    'idea:IDEA Ciper'
    'idea-cbc:IDEA CBC Ciper'
    'idea-cfb:IDEA CFB Ciper'
    'idea-ecb:IDEA ECB Ciper'
    'idea-ofb:IDEA OFB Ciper'

    'rc2:RC2 Ciper'
    'rc2-cbc:RC2 CBC Ciper'
    'rc2-cfb:RC2 CFB Ciper'
    'rc2-ecb:RC2 ECB Ciper'
    'rc2-ofb:RC2 OFB Ciper'

    'rc4:RC4 Ciper'

    'rc5:RC5 Ciper'
    'rc5-cbc:RC5 CBC Ciper'
    'rc5-cfb:RC5 CFB Ciper'
    'rc5-ecb:RC5 ECB Ciper'
    'rc5-ofb:RC5 OFB Ciper'

    'seed:SEED Ciper'
    'seed-cbc:SEED CBC Ciper'
    'seed-cfb:SEED CFB Ciper'
    'seed-ecb:SEED ECB Ciper'
    'seed-ofb:SEED OFB Ciper'

    'sm4:SM4 Ciper'
    'sm4-cbc:SM4 CBC Ciper'
    'sm4-cfb:SM4 CFB Ciper'
    'sm4-ctr:SM4 CTR Ciper'
    'sm4-ecb:SM4 ECB Ciper'
    'sm4-ofb:SM4 OFB Ciper'
  )

  _describe -t commands 'command' commands "$@"
}

#
# Commands
#

_openssl_asn1parse() {
  _arguments \
    '(- *)-help[display this summary]' \
    '-inform[input format]:format:(DER PEM B64)' \
    '-in[input file]:file:_files' \
    '-out[output file(output format is always DER)]:file:_files' \
    '-noout[do not produce any output]' \
    '-offset[offset into file]:number' \
    '-length[length of section in file]:number' \
    '-i[indents the output]' \
    '-oid[file of extra oid definitions]:file:_files' \
    '-dump[unknown data in hex form]' \
    '-dlimit[dump the first arg bytes of unknown data in hex form]:bytes' \
    '-strparse[a series of these can be used to "dig"]:offset' \
    '-genstr[string to generate ASN1 structure from]:val' \
    '-genconf[file to generate ASN1 structure from]:file:_files' \
    '-strictpem[strict PEM]' \
    '-item[item to parse and print]:val'
}

_openssl_ca() {
  _arguments \
    '(- *)-help[print out a usage message]' \
    '-verbose[prints extra details about the operations being performed]' \
    '-quiet[prints fewer details about the operations being performed]' \
    '-config[specifies the configuration file to use]:file:_files' \
    '(-name -section)'{-name,-section}'[specifies the configuration file section to use]:section' \
    '-in[input filename containing a single certificate request to be signed by the CA]:file:_files' \
    '-inform[format to use when loading certificate request (CSR) input files]:type:(DER PEM)' \
    '-ss_cert[single self-signed certificate to be signed by the CA]:file:_files' \
    '-spkac[file containing a single Netscape signed public key and challenge to be signed by the CA]:file:_files' \
    '-infiles[all subsequent arguments are taken as the names  f files containing certificate requests]' \
    '-out[output file to output certificates to]:file:_files' \
    '-outdir[directory to output certificates to]:dir:_files -/' \
    '-cert[CA certificate]:file:_files' \
    '-certform[format of the data in certificate input files]:format:(DER PEM P12)' \
    '-keyfile[CA private key to sign certificate requests with]:file_or_uri:_files' \
    '-keyform[format of the private key input file]:format:(DER PEM P12 ENGINE)' \
    '-sigopt[pass options to the signature algorithm during sign operations]:option' \
    '-vfyopt[pass options to the signature algorithm during verify operations]:option' \
    '-key[The password used to encrypt the private key]:password' \
    '-passin[key password source for key files and certificate PKCS#12 files]:arg' \
    '-selfsign[certificates are to be signed with the key given with -keyfile]' \
    '-notext[do not output the text form of a certificate to the output file]' \
    '-dateopt[specify the date output format]:format:(rfc_822 iso_8601)' \
    '(-startdate -not_before)'{-startdate,-not_before}'[start date to be explicitly set]:date' \
    '(-enddate -not_after)'{-enddate,-not_after}'[expiry date to be explicitly set]:date' \
    '-days[number of days from today to certify the certificate for]:days' \
    '-md[message digest to use]:algorithm:(sha256 sha1 md5)' \
    '-policy[CA policy to use]:policy' \
    '-preserveDN[preserve DN order of a certificate]' \
    '-noemailDN[remove EMAIL field from the certificate]' \
    '-batch[enable batch mode]' \
    '-extensions[section of the configuration file to be added when certificate is issued]:section' \
    '-extfile[additional configuration file to read certificate extensions from]:file:_files' \
    '-subj[supersedes subject name given in the request]:subject' \
    '-utf8[field values to be interpreted as UTF8 string]' \
    '-create_serial[creates a new random serial to be used as next serial number]' \
    '-rand_serial[generate a large random number to use as the serial number]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-gencrl[generates a CRL based on information in the index file]' \
    "-crl_lastupdate[allows the value of the CRL's lastUpdate field to be explicitly set]:time" \
    "-crl_nextupdate[allows the value of the CRL's nextUpdate field to be explicitly set]:time" \
    '-crldays[number of days  before the next CRL is due]:days' \
    '-crlhours[number of hours before the next CRL is due]:hours' \
    '-crlsec[number of seconds before the next CRL is due]:seconds' \
    '-revoke[filename containing a certificate to revoke]:file:_files' \
    '-valid[filename containing a certificate to add a Valid certificate entry]:file:_files' \
    '-status[displays the revocation status of the certificate with the specified serial number]:serial' \
    '-updatedb[updates the database index to purge expired certificates]' \
    '-crl_reason[revocation reason]:reason:(unspecified keyCompromise CACompromise affiliationChanged superseded cessationOfOperation certificateHold removeFromCRL)' \
    '-crl_hold[sets the CRL revocation reason code to certificateHold and the hold instruction]:insn:(holdInstructionCallIssuer holdInstructionReject)' \
    '-crl_compromise[sets the revocation reason to keyCompromise and the compromise time]:time' \
    '-crl_CA_compromise[same as crl_compromise except the revocation reason is set to CACompromise]:time' \
    '-crlexts[section of the configuration file containing CRL extensions to include]:section' \
    '*:: :_files'
}

_openssl_ciphers() {
  _arguments \
    '(- *)-help[print help message]' \
    $openssl_provider_options[@] \
    '-s[only list supported ciphers]' \
    '-psk[include cipher suites which require PSK]' \
    '-srp[include cipher suites which require SRP]'\
    '-v[verbose output]' \
    '-V[like -v but include the official cipher suites values in hex]' \
    '-ssl3[list ciphers which could be used in SSL3 protocol negotiation]' \
    '-tls1[list ciphers which could be used in TLS1 protocol negotiation]' \
    '-tls1_1[list ciphers which could be used in TLS1.1 protocol negotiation]' \
    '-tls1_2[list ciphers which could be used in TLS1.2 protocol negotiation]' \
    '-tls1_3[list ciphers which could be used in TLS1.3 protocol negotiation]' \
    '-stdname[precede each cipher suite by its standard name]' \
    '-convert[connvert a standard cipher name to its OpenSSL name]:name' \
    '-ciphersuites[sets the list of TLSv1.3 ciphersuites]:suites' \
    '*:cipher_suite:_openssl_list_ciphers'
}

_openssl_cmp() {
  local -a info_types=(signKeyPairTypes caCerts rootCaCert certReqTemplate crlStatusList)
  local -a mac_algorithms=(
    hmacWithMD5 hmacWithRMD160 hmacWithSHA1 hmacWithSHA224 hmacWithSHA256 hmacWithSHA384
    hmacWithSHA512 hmac-sha1
  )

  _arguments \
    '(- *)-help[print help message]' \
    '-config[configuration file]:file:_files' \
    '-section[sections names to use within config file defining CMP options]:names' \
    '-verbosity[level of verbosity]:level:_openssl_cmp_verbosity_level' \
    '-cmd[CMP command to execute]:command:_openssl_cmp_commands' \
    '-infotype[InfoType name to use for requesting specific info in gem]:type:(($info_types))' \
    '-profile[name of a certificate profile in the PKIHeader generalInfo field]:name' \
    '-geninfo[a comma-separated list of InfoTypeAndValue]:values' \
    '-template[file to save any CRMF certTemplate in DER format]:file:_files' \
    '-keyspec[file to save any keySpec]:file:_files' \
    '-newkey[private or public key file or URI to be requested]:file_or_uri:_files' \
    '-newkeypass[pass phrase source for the key given with -newkey option]:source:_openssl_pass_phrase_options' \
    '-centralkeygen[request central key generation for certificate enrollment]' \
    '-newkeyout[file to save centrally generated private key in PEM format]:file:_files' \
    '-subject[X.509 Distinguished Name(DN) to use as subject field in requested certificate]:name' \
    '-days[number of days new certificate is requested to be valid for]:days' \
    '-reqexts[name of section in OpenSSL config file defining certificate request extensions]:name' \
    '-sans[addresses, email addresses, DNS names, URIS to add as SAN certificate request extension]:spec' \
    '-san_nodefault[disable to be copied from the reference certificate]' \
    '-policies[name of section to be set as certificate request extension]:name' \
    '-policy_oids[one or more OIDs to add as certificate policies request extension]:names' \
    '-policy_oids_critical[set policies given with -policy_oids as critical]' \
    '-popo[Proof-of-possession(POPO) method to use for IR/CR/KUR]:number:(0 1 2)' \
    '-csr[PKCS#10 CSR containing a certificate request]:file:_files' \
    '-out_trusted[trusted certificate file or URI to use for validating newly enrolled certificate]:file_or_uri:_files' \
    '-implicit_confirm[request implicit confirmation of newly enrolled certificates]' \
    '-disable_confirm[do not send certificate confirmation message for newly enrolled certificate]' \
    '-certout[file where any newly enrolled certificate should be saved]:file:_files' \
    '-chainout[file where the chain of any newly enrolled certificate should be saved]:file:_files' \
    '-oldcert[certificate file or URI to be updated message or to be revoked in RR messages]:file_or_uri:_files' \
    '-issuer[X.509 Distinguished Name(ND) to place as the issuer field]:name' \
    '-serial[serial number of certificate to be revoked in revocation request]:number' \
    '-revreason[CRLReason number to be included in revocation request]:reason:_openssl_cmp_revocation_reasons' \
    '-server[domain name or IP address and optionally port of CMP server to connect]:domain_or_ip' \
    '-proxy[proxy server to use for reaching CMP server]:domain_or_ip' \
    '-no_proxy[list of IP addresses and/or DNS names not to use proxy for]:addresses' \
    '-recipient[Distinguished Name(DN) to use in recipient field of CMP request message headers]:name' \
    '-path[HTTP path at CMP server to use for POST requests]:path' \
    '-keep_alive[keep alive type]:value:(0 1 2)' \
    '-msg_timeout[seconds a CMP request-response message round trip is allowed to take]:seconds' \
    '-total_timeout[maximum total seconds a transaction may take]:seconds' \
    '-trusted[certificate files or uris to use as trust anchors]:file_or_uri:_files' \
    '-untrusted[non-trusted intermediate CA certificate files or URIs]:file_or_uri:_files' \
    '-srvcert[CMP server certificate file or URI to expect and directly trust]:file_or_uri:_files' \
    '-expect_sender[Distinguished Name(DN) expected in the sender field of incoming CMP messages]:name' \
    '-ignore_keyusage[ignore key usage restrictions in CMP signer certificates]' \
    '-unprotected_errors[accept missing or invalid protection of negative responses from server]' \
    '-no_cache_extracerts[do not cache certificates in extraCerts field of CMP messages received]' \
    '-srvcert[file where to save successfully validated certificate]:file:_files' \
    '-extracertsout[file where to save the list of certificates contained in extraCert field]:file:_files' \
    '-cacertsout[file where to save the list of CA certificates contained in caPubs field]:file:_files' \
    '-oldwithold[root CA certificate to include in a genm request of infoType "rootCaCert"]:file:_files' \
    '-newwithnew[file to save newWithNew certificate received in a genp message]:file:_files' \
    '-newwithold[file to save any newWithOld certificate received in a genp message]:file:_files' \
    '-oldwithold[file to save any oldWithNew certificate received in a genp message]:file:_files' \
    '-crlcert[certificate to derive CRL issuer data for the source field]:file:_files' \
    '-oldcrl[CRL to obtain an update for in a genm request with infoType "crlStatusList"]:file:_files' \
    '-crlout[file to save any CRL received in a genp message of infoType "crls"]:file:_files' \
    '-ref[reference number/string/value to use as fallback senderKID]:value' \
    '-secret[source of a secret value to use with MAC-based message protection]:source:_openssl_pass_phrase_options' \
    "-cert[client's current CMP signer certificate file or URI]:file_or_uri:_files" \
    '-own_trusted[list of certificates to be used as trusted anchors]:file_or_uri:_files' \
    "-key[private key file or URI for the client's current certificate]:file_or_uri:_files" \
    '-keypass[pass pharse source for the private key]:source:_openssl_pass_phrase_options' \
    '-digest[digest to use in MSG_SIG_ALG and as the on-way function(OWF) in MSG_MAC_ALG]:digest:_openssl_digests' \
    '-mac[MAC algorithm in MSG_MAC_ALG]:alg:(($mac_algorithms))' \
    '-extracerts[certificates files or URIs to append in extraCerts field]:file_or_uri:_files' \
    '-unprotected_errors[send request messages without CMP-level protection]' \
    '-certform[file format to use when saving a certificate]:format:(PEM DER)' \
    '-crlform[file format to use when saving a CRL]:format(PEM DER)' \
    '-keyform[format of the key input]:format:(PEM DER P12 ENGINE)' \
    '-otherpass[pass phrase source for certificate]:source:_openssl_pass_phrase_options' \
    $openssl_provider_options[@] \
    $openssl_random_state_options[@] \
    '-tls_used[make the CMP client use TLS for message exchange]' \
    "-tls_cert[client's TLS certificate file or URI for authenticating to TLS server]:file_or_uri:_files" \
    "-tls_key[private key for client's TLS certificate]:file_or_uri:_files" \
    "-tls_keypass[pass phrase source for client's private TLS key]:source:_openssl_pass_phrase_options" \
    '-tls_extra[extra certificates file or URI to provite to TLS server during handshake]:file_or_uri:_files' \
    '-tls_trusted[trusted certificates to use for validating TLS server certificate]:file_or_uri:_files' \
    '-tls_host[address to be checked during hostname validation]:name' \
    '-batch[do not interactively prompt for input]' \
    '-repeat[number of times to invoke the command with the same parameters]:number' \
    '-reqin[files to take the sequence of CMP requests to send to server]:files:_files' \
    '-reqin_new_tid[use a fresh transaction ID for CMP request messages]' \
    '-reqout[file to save the sequence of CMP requests]:file:_files' \
    '-reqout_only[file to save the first CMP requests created by client]:file:_files' \
    '-rspin[files to save sequence of CMP responses]:file:_files' \
    '-rspout[file to save sequence of actually used CMP responses]:files:_files' \
    '-use_mock_srv[test the client using the internal CMP server mock-up at API level]' \
    '-port[port number of CMP mock-up server]:number' \
    '-max_msgs[maximum number of CMP messages that mock-up server should handle]:number' \
    '-srv_ref[reference value to use as snderKID of server]:value' \
    '-srv_secret[password source for server authentication with a pre-shared key]:arg' \
    '-srv_cert[certificate file or URI of the server]:file_or_uri:_files' \
    '-srv_cert[private key file or URI by the server for signing messages]:file_or_uri:_files' \
    '-srv_keypass[server private key file pass phrase source]:arg' \
    '-srv_trusted[trusted certificates for client authentication]:file_or_uri:_files' \
    '-srv_untrusted[untrusted intermediate CA certs files or URIs]:file_or_uri:_files' \
    '-ref_cert[certificate file or URI to be expected for RR messages]:file_or_uri:_files' \
    '-rsp_cert[certificate file or URI to be returned as mock enrollment result]:file_or_uri:_files' \
    '-rsp_key[private key to be returned as central key generation result]:file_or_uri:_files' \
    '-rsp_keypass[pass phrase source for rsp_cert and rsp_key]:arg' \
    '-rsp_crl[CRL file or URI to be returned in genp of type "crls"]:file_or_uri:_files' \
    '-rsp_extracerts[extra certificates to be include in mock certification responses]:file_or_uri:_files' \
    '-rsp_capubs[CA certificates to be included in mock Initialization Response message]:file_or_uri:_files' \
    '-rsp_newwithnew[certificate to be returned in newWithNew field of genp]:file_or_uri:_files' \
    '-rsp_newwithold[certificate to be returned in newWithPld field of genp]:file_or_uri:_files' \
    '-rsp_oldwithnew[certificate to be returned in oldWithNew field of genp]:file_or_uri:_files' \
    '-poll_count[number of times the client must poll before receiving a certificate]:number' \
    '-check_after[checkAfter value to include in poll response]:number' \
    '-grant_implicitconf[grant implicit confirmation of newly enrolled certificate]' \
    '-pkistatus[PKIStatus to be include in server response]:number' \
    '-failure[a single failure info bit number to be include in server response]:number' \
    '-failurebits[number representing failure bits to be include in server response]:number' \
    '-statusstring[text to be include as status string in server response]:str' \
    '-send_error[force server to reply with error message]' \
    '-send_unprotected[send reponse message without CMP-level protection]' \
    '-send_unprot_err[server shall send unprotected error message]' \
    '-accept_unprotected[accept missing or invalid protection of requests]' \
    '-accept_unprot_err[accept unprotected error messages from client]' \
    '-accept_raverified[accept RAVERIFIED as proof of possession(POPO)]' \
    $openssl_verification_options[@]
}

_openssl_cmp_verbosity_level() {
  local -a levels=(
    '0:EMERG'
    '1:ALERT'
    '2:CRIT'
    '3:ERR'
    '4:WARN'
    '5:NOTE'
    '6:INFO(Default)'
    '7:DEBUG'
    '8:TRACE'
  )

  _describe -t levels 'levels' levels "$@"
}

_openssl_cmp_commands() {
  local -a commands=(
    "ir:Initialization Request"
    "cr:Certificate Request"
    "p10cr:PKCS#10 Certification Request (for legacy support)"
    "kur:Key Update Request"
    "rr:Revocation Request"
    "genm:General Message"
  )

  _describe -t commands 'commands' commands "$@"
}

_openssl_cmp_revocation_reasons() {
  local -a reasons=(
    '0:unspecified'
    '1:keyCompromise'
    '2:cACompromise'
    '3:affiliationChanged'
    '4:superseded'
    '5:cessationOfOperation'
    '6:certificateHold'
    '8:removeFromCRL'
    '9:privilegeWithdrawn'
    '10:aACompromise'
  )

  _describe -t reasons 'reasons' reasons "$@"
}

_openssl_cms() {
  local -a ciphers=($(openssl enc -list | tail -n +2 ))
  local -a cipher_flags=()
  for cipher in $ciphers[@]
  do
    cipher_flags+=("($ciphers)${cipher}[use ${cipher:1:u} to encrypt]")
  done

  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-config[config file]:file:_files' \
    '-encrypt[encrypt data for the given recipient certificates]' \
    '-decrypt[decrypt data using the supplied certificate and private key]' \
    '-sign[sign data using the supplied certificate and private key]' \
    '-verify[verify signed data]' \
    '-resign[resign a message]' \
    '-sign_receipt[generate and output a signed receipt for the supplied message]' \
    '-verify_receipt[verify a signed receipt in file receipt]:receipt:_files' \
    '-digest[digest in hexadecimal form instead of computing it]:digest' \
    '-digest_create[create a CMS DigestedData type]' \
    '-digest_verify[verify a CMS DigestedData type and output the content]' \
    '-compress[create a CMS CompressedData type]' \
    '-uncompress[uncompress a CMS CompressedData type and output the content]' \
    '-EncryptedData_encrypt[encrypt content using supplied symmetric key and algorithm]' \
    '-EncryptedData_decrypt[decrypt content using supplied symmetric key and algorithm]' \
    '-data_create[create a CMS Data type]' \
    '-data_out[Data type and output the content]' \
    '-cmsout[take an input message and write out a PEM encoded CMS structure]' \
    '-inform[input format of the CMS structure]:format:(DER PEM SMIME)' \
    '-outform[output format of the CMS structure]:format(DER PEM SMIME)' \
    '-rctform[signed receipt format for use with the -receipt_verify]:format:(DER PEM SMIME)' \
    '(-stream -indef -noindef)'{-stream,-indef}'[enable streaming I/O for encoding operations]' \
    '(-stream -indef -noindef)-noindef[disable streaming I/O for encoding operations]' \
    '-binary[do not convert to canonical format]' \
    '-crlfeol[use CRLF instead of LF as end of line]' \
    '-asciicrlf[strip trailing whitespace from all lines, delete trailing blank lines at EOF]' \
    '-pwri_password[password for recipient]' \
    '-secretkey[symmetric key to use]:key' \
    '-secretkeyid[key identifier for the supplied symmetric key for KEKRecipientInfo type]:id' \
    '-inkey[private key file or URI to use when signing or decrypting]:file_or_uri:_files' \
    '-passin[private key password source]:option:_openssl_pass_phrase_options' \
    '*-keyopt[options for signing and encryption]:option' \
    '-keyform[format of the private key file]:format:(DER PEM P12 ENGINE)' \
    $openssl_provider_options[@] \
    $openssl_random_state_options[@] \
    '-originator[originator of the encrypted message]:file:_files' \
    '-recip[recipient of the certificate when decrypting a message]:file:_files' \
    $cipher_flags[@] \
    '-wrap[cipher algorithm to use for key wrap]:cipher:_openssl_cipher_algorithms' \
    '-debug_decrypt[set the CMS_DEBUG_DECRYPT flag]' \
    '-md[digest algorithm to use when signing or resigning]:digest:_openssl_digests' \
    '-signer[a signing certificate]:file:_files' \
    '-certfile[additional certificates]:file:_files' \
    '-cades[add an ESS signingCertificate or ESS signingCertificateV2 attributes to the SignerInfo]' \
    '-nodetach[use opaque signing]' \
    '-nocerts[do not include signers certificate when signing]' \
    '-noattr[do not include any signed attributes]' \
    '-nosmimecap[exclude list of supported algorithms from signed attributes]' \
    '-no_signing_time[exclude the signing time from signed attributes]' \
    '-receipt_request_all[requests should be provided by all recipient]' \
    '-receipt_request_first[requests should be provided by first tier recipients]' \
    '-receipt_request_from[add an explicit email address where receipts should be supplied]:email_address' \
    '-receipt_request_to[add an explicit email address where signed receipts should be sent to]:email_address' \
    '-signer[signer certificate file]:file:_files' \
    '-content[supply or override content for detached signature]:file:_files' \
    '-no_content_verify[do not verify signed content signatures]' \
    '-no_attr_verify[do not verify signed attribute signatures]' \
    '-nosigs[do not verify message signature]' \
    '-noverify[do not verify the signers certificate of a signed message]' \
    '-nointern[do not search certificates in message for signer]' \
    '-cades[require and check signer certificate digest]' \
    '-verify_retcode[exit non-zero on verification failure]' \
    $openssl_trusted_certificate_options[@] \
    '-keyid[subject key identifier to identify certificates instead of issuer name and serial number]' \
    '-econtent_type[encapsulated content type]:type' \
    '-text[add plain text MIME headers to the supplied message]' \
    '-certsout[output file name to any certificates contained in the input message]:file:_files' \
    '-to[TO email header]:to' \
    '-from[FROM email header]:from' \
    '-subject[SUBJECT email header]:subject' \
    '-noout[do not output the parsed CMS structure]' \
    '-print[print out all fields of the CMS structure]' \
    '-nameopt[printing options for string fields]:nameopt:_openssl_name_display_options' \
    '-receipt_request_print[print out the contents of any signed receipt requests]' \
    $openssl_verification_options[@] \
    '*::recipient_cert:_files'
}

_openssl_crl() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[CRL input format]:format:(DER PEM)' \
    '-outform[CRL output format]:format:(DER PEM)' \
    '-key[private key to be used to sign the CRL]:key:_files' \
    '-keyform[format of private key file]:format:(DER PEM P12)' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-gendelta[output a comparison of the main CRL and this file]:file:_files' \
    '-badsig[corrupt the signature before writing it]'\
    '-dateopt[date output format]:format:(rfc_822 iso_8601)' \
    '-text[print out the CRL in text form]' \
    '-verify[verify the signature in the CRL]' \
    '-noout[do not output the encoded version of the CRL]' \
    '-fingerprint[output the fingerprint of the CRL]' \
    '-crlnumber[output the number of the CRL]' \
    '-hash[output a hash of the issuer name]' \
    '-hash_old[output the hash of the CRL issuer name using the older algorithm]' \
    '-issuer[output the issuer name]' \
    '-lastupdate[output the lastUpdate field]' \
    '-nextupdate[output the nextUpdate field]' \
    '-nameopt[specify how the subject or issuer names are displayed]:option:_openssl_name_display_options' \
    $openssl_trusted_certificate_options[@] \
    $openssl_provider_options[@]
}

_openssl_crl2pkcs7() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[input format of the CRL]:format:(DER PEM)' \
    '-outform[output format of the PKCS#7 object]:format:(DER PEM)' \
    '-in[input file name to read a CRL from]:file:_files' \
    '-out[output file name to write the PKCS#7 structure]:file:_files' \
    '-certfile[file containing one or more certificates in PEM format]:file:_files' \
    '-nocrl[no CRL is included in the output file]' \
    $openssl_provider_options[@]
}

_openssl_dgst() {
  local not_need_digest_flags=$1
  local -a digest_flags=()

  if (( not_need_digest_flags != 1 )); then
    local -a digests=($(openssl dgst -list | tail -n +2))
    for digest in $digests[@]
    do
      digest_flags+=("${digest}[use ${digest:1} message digest algorithm]")
    done
  fi

  _arguments \
    '(- *)-help[print help message]' \
    $digest_flags[@] \
    '(- *)-list[print out a list of supported message digests]' \
    '-c[print out the digest in two digit groups separated by colons]' \
    '(-d --debug)'{-d,--debug}'[print out BIO debugging information]' \
    '-hex[digest is to be output as a hex dump]' \
    '-binary[output the digest or signature in binary form]' \
    '-xoflen[output length for XOF algorithms]:length' \
    '-r[output the digest in the "coreutils" format]' \
    '-out[output file name]:file:_files' \
    '-sign[private key file or URI to sign the digest]:file_or_uri:_files' \
    '-keyform[format of the key to sign with]:format:(DER PEM P12 ENGINE)' \
    '-sigopt[options of signature algorithms during sign or verify operations]:options' \
    '-passin[private key password source]:source:_openssl_pass_phrase_options' \
    '-verify[public key file to verify the signature]:file:_files' \
    '-prverify[private key file to verify the signature]:file:_files' \
    '-signature[actual signature file to verify]:file:_files' \
    '-hmac[key to create a hashed MAC]:key' \
    '-mac[MAC algorithm]:alg:_openssl_mac_algorithms' \
    '-macopt[options of MAC algorithm]:options' \
    '-fips-fingerprint[compute HMAC using a specific key for certain OpenSSL-FIPS operations]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '*::file:_files'
}

_openssl_dhparam() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[input format(default is PEM)]:format:(DER PEM)' \
    '-outform[output format(default is PEM)]:format:(DER PEM)' \
    '-in[input file name to read a CRL from]:file:_files' \
    '-out[output file name to write the PKCS#7 structure]:file:_files' \
    '-dsaparam[read or create DSA parameters]' \
    '-check[perform numerous checks to see]' \
    '(-2 -3 -5)-2[generator use 2]' \
    '(-2 -3 -5)-3[generator use 3]' \
    '(-2 -3 -5)-5[generator use 5]' \
    '-noout[inhibit the output of the encoded version of the parameters]' \
    '-text[print out the DH parameters in human readable form]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-quiet[suppress the output of progress messages]' \
    '*::numbits'
}

_openssl_dsa() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[key input format]:format:(DER PEM)' \
    '-outform[key output format(default: PEM)]:format:(DER PEM)' \
    '-in[input file name]:file:_files' \
    '-out[output file name to write a key]:file:_files' \
    '-passin[password source for input file]:source:_openssl_pass_phrase_options' \
    '-passout[password source for output file]:source:_openssl_pass_phrase_options' \
    '-aes128[encrypt the private key with aes128 before outputting it]' \
    '-aes192[encrypt the private key with aes192 before outputting it]' \
    '-aes256[encrypt the private key with aes256 before outputting it]' \
    '-aria128[encrypt the private key with aria128 before outputting it]' \
    '-aria192[encrypt the private key with aria192 before outputting it]' \
    '-aria256[encrypt the private key with aria256 before outputting it]' \
    '-camellia128[encrypt the private key with camellia128 before outputting it]' \
    '-camellia192[encrypt the private key with camellia192 before outputting it]' \
    '-camellia256[encrypt the private key with camellia256 before outputting it]' \
    '-des[encrypt the private key with des before outputting it]' \
    '-des3[encrypt the private key with des3 before outputting it]' \
    '-idea[encrypt the private key with idea before outputting it]' \
    '-text[print out the public, private key components and parameters]' \
    '-noout[prevent output of the encoded version of the key]' \
    '-modulus[print out the value of the public key component of the key]' \
    '-pubin[read public key instead of private key]' \
    '-pubout[output public key instead of private key]' \
    '-pvk-strong[enable "Strong" PVK encoding level]' \
    '-pvk-weak[enable "Weak" PVK encoding level]' \
    '-pvk-none[do not enforce PVK encoding]' \
    $openssl_provider_options[@]
}

_openssl_dsaparam() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[DSA parameters input format]:format:(DER PEM)' \
    '-outform[DSA parameters output format]:format:(DER PEM)' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-noout[inhibit the output of the encoded version of the parameters]' \
    '-text[print out the DSA parameters in human readable form]' \
    '-genkey[generate a DSA either using the specified or generated parameters]' \
    '-verbose[print extra details about the operations being performed]' \
    '-quiet[print fewer details about the operations being performed]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '1:numbits' \
    '2:numqbits'
}

_openssl_ec() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[key input format]:format:(DER PEM P12 ENGINE)' \
    '-outform[key output format]:format:(DER PEM)' \
    '-in[input file name or input URI]:file_or_uri:_files' \
    '-out[output file name]:file:_files' \
    '-passin[passowrd source for input file]:source:_openssl_pass_phrase_options' \
    '-passout[passowrd source for output file]:source:_openssl_pass_phrase_options' \
    '-des[encrypt the private key with DES]' \
    '-des3[encrypt the private key with DES3]' \
    '-idea[encrypt the private key with IDEA]' \
    '-text[print out the public, private key components and parameters]' \
    '-noout[prevents output of the encoded version of the key]' \
    '-param_out[print the elliptic curve parameters]' \
    '-pubin[read public key from the input instead of private key]' \
    '-pubout[output public key instead of private key]' \
    '-conv_form[how to convert points on the elliptic curve]:how:(compressed uncompressed hybrid)' \
    '-param_enc[how to encode the elliptic curve parameters]:how:(named_curve explicit)' \
    '-no_public[omit the public key components from the private key output]' \
    '-check[check the consistency of an EC private or public key]' \
    $openssl_provider_options[@]
}

_openssl_ecparam() {
  local -a short_names=($(openssl ecparam -list_curves | awk -F: '/^\s+\S+\s*:/{ print $1 }'))

  _arguments \
    '(- *)-help[print help message]' \
    '-inform[EC parameters input format]:format:(DER PEM)' \
    '-outform[EC parameters output format]:format:(DER PEM)' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-noout[inhibit the output of the encoded version of the parameters]' \
    '-text[print out the EC parameters in human readable form]' \
    '-check[validate the elliptic curve parameters]' \
    '-check_named[validate the elliptic name curve parameters]' \
    '-name[use the EC parameters with the specified short name]:name:(($short_names))' \
    '-list_curves[print out a list of all currently implemented EC parameters name]' \
    '-conv_form[specify how the points on the elliptic curve are converted into octet strings]:type:(compressed uncompressed hybrid)' \
    '-param_enc[specify the how the elliptic curve parameters are encoded]:type:(named_curve explicit)' \
    '-no_seed[inhibit that the seed for the parameter generation]' \
    '-genkey[generate an EC private key]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@]
}

_openssl_enc() {
  local not_need_cipher_flags=$1
  local -a cipher_flags=()

  if (( not_need_cipher_flags != 1 )); then
    local -a ciphers=($(openssl enc -list | tail -n +2 ))

    for cipher in $ciphers[@]
    do
      cipher_flags+=("($ciphers)${cipher}[use ${cipher:1}]")
    done
  fi

  _arguments  \
    '(- *)-help[print help message]' \
    '(- *)'{-list,-ciphers}'[list all supported ciphers]' \
    $cipher_flags[@] \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-pass[password source]:source:_openssl_pass_phrase_options' \
    '-e[encrypt the input data(default behavior)]' \
    '-e[decrypt the input data]' \
    '(-a -base64)'{-a,-base64}'[Base64 proess the data]' \
    '-A[base64 encoding produces output without any newline character]' \
    '-k[password to derive the key from]:password' \
    '-kfile[file to read the password from the first line]:file:_files' \
    '-md[digest to create the key from the passphrase]:digest:(md2 md5 sha1 shar256)' \
    '-iter[interation count on the password in deriving the encryption key]:count' \
    '-pbkdf2[use PBKDF2 algorithm with a default iteration count of 10000]' \
    '-saltlen[salt length to use when using th -pbkdf2 option]:length' \
    '-nosalt[do not use a salt in the key derivation routines]' \
    '-salt[use salt when encrypting]' \
    '-S[actual salt to use]:salt' \
    '-K[actual key to use]:key' \
    '-iv[actual IV to use]:iv' \
    '-p[print out the key and IV used]' \
    '-P[print out the key and IV used then immediately exit]' \
    '-bufsize[buffer size of I/O]:size' \
    '-nopad[disable standard block padding]' \
    '-v[verbose print]' \
    '-debug[debug the BIOs used for I/O]' \
    '-z[compress or decompress encrypted data using zlib after encrypting or before decryption]' \
    '-none[use NULL cipher]' \
    '-skeymgmt[name of the EVP_SKEYMGMT to be used]:name' \
    '-skeyopt[opaque symmetric key options]:options' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@]
}

_openssl_errstr() {
  _arguments \
    '(- *)-help[print help message]' \
    '*:error_code'
}

_openssl_fipsinstall() {
  _arguments \
    '(- *)-help[print help message]' \
    '-module[file name of the FIPS module]:file:_files' \
    '-out[file name to output configuration data to]:file:_files' \
    '-in[input file name to load configuration data from]:_files' \
    '-verify[verify the input configuration file]' \
    '-provider_name[name of the provider inside the configuration file(default: "fips")]:name' \
    '-section_name[name of the section inside the configuration file(default: "fips_sect")]:name' \
    '-mac_name[name of a supported MAC algorithm]:name:_openssl_mac_algorithms' \
    '-macopt[options of the MAC algorithm]:option' \
    '-noout[disable logging of the self tests]' \
    '-pedantic[strictly FIPS compliant]' \
    '-no_conditional_errors[not enter an error state]' \
    '-no_security_checks[not perform run-time security checks]' \
    '-ems_check[enable a run-time Extended Master Secret]' \
    '-no_short_mac[not allow short MAC outputs]' \
    '-hmac_key_check[not allow small keys sizes when using HMAC]' \
    '-kmac_key_check[not allow small keys sizes when using KMAC]' \
    '-no_drbg_truncated_digests[not allow truncated digests with Hash and HMAC DRBGs]' \
    '-signature_digest_check[enforce signature algorithms to use digests]' \
    '-tls13_kdf_digest_check[enable a run-time digest check when deriving a key by TLS13 KDF]' \
    '-tls1_prf_digest_check[enable a run-time digest check when deriving a key by TLS_PRF]' \
    '-sshkdf_digest_check[enable a run-time digest check when deriving a key by SSHKDF]' \
    '-x963kdf_digest_check[enable a run-time digest check when deriving a key by X963KDF]' \
    '-dsa_sign_disabled[not allow DSA signing]' \
    '-tdes_encrypt_disabled[not allow Triple-DES encryption]' \
    '-rsa_pkcs15_padding_disabled[not allow PKCS#1 version 1.5 padding]' \
    '-rsa_pss_saltlen_check[enable a run-time salt length check]' \
    '-rsa_sign_x931_disabled[not allow X9.31 padding]' \
    '-hkdf_key_check[enable a run-time short key-derivation key check when deriving a key by HKDF]'\
    '-kbkdf_key_check[enable a run-time short key-derivation key check when deriving a key by KBKDF]'\
    '-tls13_kdf_key_check[enable a run-time short key-derivation key check when deriving a key by TLS13 KFD]'\
    '-tls1_prf_key_check[enable a run-time short key-derivation key check when deriving a key by TLS_PRF]'\
    '-sshkdf_key_check[enable a run-time short key-derivation key check when deriving a key by SSHKDF]'\
    '-sskdf_key_check[enable a run-time short key-derivation key check when deriving a key by SSKDF]'\
    '-x963kdf_key_check[enable a run-time short key-derivation key check when deriving a key by X963KDF]'\
    '-x942kdf_key_check[enable a run-time short key-derivation key check when deriving a key by X942KDF]'\
    '-no_pbkdf2_lower_bound_check[not perform run-time lower bound check for PBKDF2]' \
    '-ecdh_cofactor_check[enable a run-time check that ECDH uses the EC curves cofactor value]' \
    '-self_test_onload[do not write two fields related to "test status indicator" and "MAC status indicator"]' \
    '-self_test_oninstall[ write two fields related to "test status indicator" and "MAC status indicator]' \
    '-quiet[do not output pass/fail messages]' \
    '-corrupt_desc[currupt description to be used to test failure]:description' \
    '-corrupt_type[currupt type to be used to test failure]:type' \
    '-config[configuration file]:file:_files'
}

_openssl_gendsa() {
  _arguments \
    '(- *)-help[print help message]' \
    '-out[output file name]' \
    '-passout[passphrase used for the output file]:option:_openssl_pass_phrase_options'\
    '-aes128[encrypt the private key with aes128 before outputting it]' \
    '-aes192[encrypt the private key with aes192 before outputting it]' \
    '-aes256[encrypt the private key with aes256 before outputting it]' \
    '-aria128[encrypt the private key with aria128 before outputting it]' \
    '-aria192[encrypt the private key with aria192 before outputting it]' \
    '-aria256[encrypt the private key with aria256 before outputting it]' \
    '-camellia128[encrypt the private key with camellia128 before outputting it]' \
    '-camellia192[encrypt the private key with camellia192 before outputting it]' \
    '-camellia256[encrypt the private key with camellia256 before outputting it]' \
    '-des[encrypt the private key with des before outputting it]' \
    '-des3[encrypt the private key with des3 before outputting it]' \
    '-idea[encrypt the private key with idea before outputting it]' \
    '-verbose[print extra details about the operations being performed]' \
    '-quiet[print fewer details about the operations being performed]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '*:paramfile:_files'
}

_openssl_genpkey() {
  local -a builtin_algorithms=(
    RSA DSA DH DHX EC
    RSA RSA-PSS EC X25519 X448 ED25519 ED448
    ML-DSA-44 ML-DSA-5 ML-DSA-87
    ML-KEM-512 ML-KEM-768 ML-KEM-1024
  )

  local -a ciphers=($(openssl enc -list | tail -n +2 ))
  local -a cipher_flags=()
  for cipher in $ciphers[@]
  do
    cipher_flags+=("($ciphers)${cipher}[use ${cipher:1}]")
  done

  _arguments \
   '(- *)-help[print help message]' \
   '-out[output private key file]:file:_files' \
   '-outpubkey[output public key file]:file:_files' \
   '-outform[output format]:format:(DER PEM)' \
   '-verbose[output "status dots" while generating keys]' \
   '-quiet[do not output "status dots" while generating keys]' \
   '-pass[output file password source]:source:_openssl_pass_phrase_options' \
   $cipher_flags[@] \
   '-algorithm[public key algorithm]:alg:(($builtin_algorithms))' \
   '-pkeyopt[public key algorithm option]:option' \
   '-genparam[generate a set of parameters instead of a private key]' \
   '-paramfile[file to supply public key parameters]:file:_files' \
   '-text[print an (unencrypted) text representation of private and public keys and parameters]' \
   $openssl_random_state_options[@] \
   $openssl_provider_options[@] \
   '-config[configuration file]:file:_files'
}

_openssl_genrsa() {
  _arguments \
    '(- *)-help[print help message]' \
    '-out[output key file name]:file:_files' \
    '-passout[output file password source]:source:_openssl_pass_phrase_options' \
    '-aes128[encrypt the private key with AES128]' \
    '-aes192[encrypt the private key with AES192]' \
    '-aes256[encrypt the private key with AES256]' \
    '-aria128[encrypt the private key with ARIA128]' \
    '-aria192[encrypt the private key with ARIA192]' \
    '-aria256[encrypt the private key with ARIA256]' \
    '-camellia128[encrypt the private key with CAMELLIA128]' \
    '-camellia192[encrypt the private key with CAMELLIA192]' \
    '-camellia256[encrypt the private key with CAMELLIA256]' \
    '-des[encrypt the private key with DES]' \
    '-des3[encrypt the private key with DES3]' \
    '-idea[encrypt the private key with IDEA]' \
    '(-F4 -f4)'{-F4,-f4}'[use 65537 as public exponent]' \
    '-primes[specify the number of primes to use while generating the RSA key]:num' \
    '-verbose[print extra details about the operations being performed]' \
    '-quiet[print fewer details about the operations being performed]' \
    '-traditional[write the key using the traditional PKCS#1 format]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '::numbits'
}

_openssl_help() {
  local -a commands=(
    # Standard commands
    asn1parse ca ciphers cmp
    cms crl crl2pkcs7 dgst
    dhparam dsa dsaparam ec
    ecparam enc engine errstr
    fipsinstall gendsa genpkey genrsa
    help info kdf list
    mac nseq ocsp passwd
    pkcs12 pkcs7 pkcs8 pkey
    pkeyparam pkeyutl prime rand
    rehash req rsa rsautl
    s_client s_server s_time sess_id
    skeyutl smime speed spkac
    srp storeutl ts verify
    version x509

    # Message Digest commands (see the `dgst' command for more details)
    blake2b512 blake2s256 md4 md5
    rmd160 sha1 sha224 sha256
    sha3-224 sha3-256 sha3-384 sha3-512
    sha384 sha512 sha512-224 sha512-256
    shake128 shake256 sm3

    # Cipher commands (see the `enc' command for more details)
    aes-128-cbc aes-128-ecb aes-192-cbc aes-192-ecb
    aes-256-cbc aes-256-ecb aria-128-cbc aria-128-cfb
    aria-128-cfb1 aria-128-cfb8 aria-128-ctr aria-128-ecb
    aria-128-ofb aria-192-cbc aria-192-cfb aria-192-cfb1
    aria-192-cfb8 aria-192-ctr aria-192-ecb aria-192-ofb
    aria-256-cbc aria-256-cfb aria-256-cfb1 aria-256-cfb8
    aria-256-ctr aria-256-ecb aria-256-ofb base64
    bf bf-cbc bf-cfb bf-ecb
    bf-ofb camellia-128-cbc camellia-128-ecb camellia-192-cbc
    camellia-192-ecb camellia-256-cbc camellia-256-ecb cast
    cast-cbc cast5-cbc cast5-cfb cast5-ecb
    cast5-ofb des des-cbc des-cfb
    des-ecb des-ede des-ede-cbc des-ede-cfb
    des-ede-ofb des-ede3 des-ede3-cbc des-ede3-cfb
    des-ede3-ofb des-ofb des3 desx
    rc2 rc2-40-cbc rc2-64-cbc rc2-cbc
    rc2-cfb rc2-ecb rc2-ofb rc4
    rc4-40 seed seed-cbc seed-cfb
    seed-ecb seed-ofb sm4-cbc sm4-cfb
    sm4-ctr sm4-ecb sm4-ofb zlib
    zstd
  )

  _values commands $commands
}

_openssl_info() {
  _arguments \
    '(- *)-help[print help message]' \
    '-configdir[outputs the default directory for OpenSSL configuration files]' \
    '-enginesdir[outputs the default directory for OpenSSL engine modules]' \
    '-modulesdir[outputs the default directory for OpenSSL dynamically loadable modules]' \
    '-dsoext[outputs the DSO extension OpenSSL uses]' \
    '-dirnamesep[outputs the separator character between a directory specification and a filename]' \
    '-listsep[outputs the OpenSSL list separator character]' \
    '-seeds[outputs the randomness seed sources]' \
    '-cpusettings[outputs the OpenSSL CPU settings info]' \
    '-windowscontext[outputs the Windows install context]'
}

_openssl_list() {
  _arguments \
    '(- *)-help[print help message]' \
    '-verbose[displays extra information]' \
    '-select[only list algorithms that match this name]:name' \
    '-1[list the commands, digest-commands, or cipher-commands in a single column]' \
    '-all-algorithms[display lists of all algorithms]' \
    '-commands[display a list of standard command]' \
    '-standard-commands[display list of standard commands]' \
    '-digest-commands[display a list of message digest commands(deprecated)]' \
    '-cipher-commands[display a list of cipher commands(deprecated)]' \
    '-cipher-algorithms[display a list of symmetric cipher algorithms]' \
    '-digest-algorithms[display a list of digest algorithms]' \
    '-kdf-algorithms[display a list of kdf algorithms]' \
    '-mac-algorithms[display a list of mac algorithms]' \
    '-random-instances[list the primary, public and private random number generator details]' \
    '-random-generators[display a list of random number generators]' \
    '-encoders[display a list of encoders]' \
    '-decoders[display a list of decoders]' \
    '-public-key-algorithms[display a list of public key algorithms]' \
    '-public-key-methods[display a list of public key methods]' \
    '-key-managers[display a list of key managers]' \
    '-skey-managers[display a list of symmetric key managers]' \
    '-key-exchange-algorithms[display a list of key exchange algorithms]' \
    '-kem-algorithms[display a list of key encapsulation algorithms]' \
    '-tls-groups[display a list of the IANA names of all available TLS groups]' \
    '-all-tls-groups[display a list of the names of all available TLS groups]' \
    '-tls1_2[list TLS groups compatible with TLS 1.2]'\
    '-tls1_3[list TLS groups compatible with TLS 1.3]'\
    '-signature-algorithms[display a list of signature algorithms]' \
    '-tls-signature-algorithms[display the list of signature algorithms available for TLS handshakes]' \
    '-asymcipher-algorithms[display a list of asymmetric cipher algorithms]' \
    '-store-loaders[display a list of store loaders]' \
    '-providers[display a list of all loaded providers with their names, version and status]' \
    '-disabled[display a list of disabled features]' \
    '-objects[display a list of built in objects]' \
    '-options[output a two-column list of the options accepted by the specified command]:command:_openssl_help' \
    $openssl_provider_options[@]
}

_openssl_mac() {
  local -a cbc_or_gcm_ciphers=(
    AES-128-CBC AES-192-CBC AES-256-CBC
    AES-128-GCM AES-192-GCM AES-256-GCM
  )

  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name to calculate a MAC]:file:_files' \
    '-out[output file name]:file:_files' \
    '-binary[output the MAC in binary form]' \
    '-cipher[specify the cipher algorithm]:ciper:(($cbc_or_gcm_ciphers))' \
    '-digest[use HMAC as an alphanumeric string]:name:_openssl_digests' \
    '-macopt[options to the MAC algorithm]:options:_openssl_macopts' \
    $openssl_provider_options[@] \
    '*:mac_name:_openssl_mac_algorithms'
}

_openssl_nseq() {
  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name to read]:file:_files' \
    '-out[output file name]:file:_files' \
    '-toseq[output Netscape certificate sequence]' \
    $openssl_provider_options[@]
}

_openssl_ocsp() {
  local -a digests=($(openssl dgst -list | tail -n +2))
  local -a digest_flags=()
  for digest in $digests[@]
  do
    digest_flags+=("${digest}[use ${digest:1} message digest algorithm]")
  done

  _arguments \
    '(- *)-help[print help message]' \
    '-out[output file name]:file:_files' \
    '-issuer[specify the current issuer certificate]:file:_files' \
    '-cert[certificate file name to request]:file:_files' \
    '-no_certs[do not include any certificates in signed request]' \
    '-serial[serial number of certificate]:num' \
    '-signer[signer to sign the OSCP request]:file:_files' \
    '-signkey[private key to sign the OCSP request]:file:_files' \
    '-sign_other[additional certificates to include in the signed request]:file:_files' \
    '(-nonce -no_nonce)-nonce[add an OCSP nonce extension to a request]' \
    '(-nonce -no_nonce)-no-nonce[disable OCSP nonce addition]' \
    '-req_text[print out the text form of the OCSP request]' \
    '-resp_text[print out the text form of the OCSP response]' \
    '-text[print out the text form of the OCSP both request and response]' \
    '-reqout[write out the DER-encoded OCSP request to file]:file:_files' \
    '-respout[write out the DER-encoded OCSP response to file]:file:_files' \
    '-reqin[read OCSP request from file]:file:_files' \
    '-respin[read OCSP response from file]:file:_files' \
    '-url[responder host and optionally port and path via a URL]:url:_urls' \
    '-host[host and port to be sent the OCSP request]:host' \
    '-path[HTTP path to be sent the OCSP request]:path' \
    '-proxy[HTTP(S) proxy server to use for reaching the OCSP server]:address' \
    '-no_proxy[list of IP addresses and DNS names of servers not to use an HTTP(S) proxy for]:addresses' \
    '*-head[add the header name with the specified value to the OCSP request]:key_value' \
    '-timeout[connection timeout to the OCSP responder in seconds]:seconds' \
    '-verify_other[file or URI containing additional certificates to search for signer]:file:_files' \
    '-trust_other[do not verify additional certificates]' \
    '-VAfile[file or URI containing explicitly trusted responder certificates]:file:_files' \
    '-noverify[do not attempt to verify the OCSP response signature or the nonce values]' \
    '-no_intern[ignore certificates contained in the OCSP response]' \
    '-no_signature_verify[do not check the signature on the OCSP response]' \
    '-no_cert_verify[do not verify the OCSP response signers certificate at all]' \
    '-no_chain[do not use certificates in the response as additional untrusted CA certificates]' \
    '-no_explicit[do not explicitly trust the root CA]' \
    '-no_cert_checks[do not perform any additional checks on the OCSP response signers certificate]' \
    '-validity_period[acceptable error range in seconds]:nsec' \
    '-status_age[maximum status age in seconds]:seconds: ' \
    '-rcid[digest algorithm to use for certificate identification in the OCSP response]:digest:_openssl_digests' \
    $digest_flags[@] \
    $openssl_trusted_certificate_options[@] \
    $openssl_verification_options[@] \
    $openssl_provider_options[@] \
    '-index[index file parameter]:file:_files' \
    '-CA[index file of CA certificate corresponding to the revocation information]:file:_files' \
    '-rsigner[certificate to sign OCSP responses with]:file:_files' \
    '-rkey[private key to sign OCSP responses with]:file:_files' \
    '-passin[private key password source]:source:_openssl_pass_phrase_options' \
    '-rother[additional certificates to include in the OCSP response]:file:_files' \
    '-rsigopt[pass options to the signature algorithm when signing OCSP responses]:option' \
    '-rmd[digest to use when signing the reponse]:digest:_openssl_digests' \
    '-badsig[corrupt the response signature before writing it]' \
    '-resp_no_certs[do not include any certificates in the OCSP response]' \
    '-resp_key_id[identify the signer certificate using the key ID]'\
    '-port[port to listen for OCSP requests on]:port' \
    '-ignore_err[ignore malformed requests or responses]' \
    '-nrequest[request number that OCSP server will exit after this number of requests]:number' \
    '-multi[run the specified number of OCSP responder child processes]:process_count' \
    '-nmin[number of minites when fresh revocation information]:minites' \
    '-nmin[number of days when fresh revocation information]:minites'
}

_openssl_passwd() {
  _arguments \
    '(- *)-help[print help message]' \
    '-1[use the MD5 based BSD password algorithms(default)]' \
    '-apr[use the apr1 algorithms(Apache variant of the BSD algorithm)]' \
    '-aixmd5[use the AIX MD5 algorithm]' \
    '-5[use the SHA256 based algorithms defined by Ulrich Drepper]' \
    '-6[use the SHA512 based algorithms defined by Ulrich Drepper]' \
    '-salt[use the specified salt]:salt' \
    '-in[read passwords from file]:file' \
    '-stdin[read passwords from stdin]' \
    '-noverify[do not verify when reading a password from the terminal]' \
    '-quiet[do not output warnings when passwords given at the command line are truncated]' \
    '-table[format output as table]' \
    '-reverse[when the -table -option is used, reverse the order of cleartext and hash]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '*::password'
}

_openssl_pkcs12() {
  _arguments \
    '(- *)-help[print help message]' \
    '-passin[input password source]:source:_openssl_pass_phrase_options' \
    '-passout[output password source]:source:_openssl_pass_phrase_options' \
    '-password[password source]:source:_openssl_pass_phrase_options' \
    '-twopass[prompt for separate integrity and encryption passwords]' \
    '-nokeys[no private keys will be output]' \
    '-nocerts[no certificates will be output]' \
    '-noout[inhibit all credentials output]' \
    '-legacy[use legacy mode of operation and automatically load the legacy provider]' \
    $openssl_provider_options[@] \
    $openssl_random_state_options[@] \
    '-in[input file name or URI]:file_or_uri:_files' \
    '-out[output file name]:file:_files' \
    '-info[output additional information about the PKCS#12]' \
    '-nomacver[do not attempt to verify the integrity MAC]' \
    '-clcerts[only output client certificates]' \
    '-cacerts[only output CA certificates]' \
    '-aes128[encrypt the private key with AES128]' \
    '-aes192[encrypt the private key with AES192]' \
    '-aes256[encrypt the private key with AES256]' \
    '-aria128[encrypt the private key with ARIA128]' \
    '-aria192[encrypt the private key with ARIA192]' \
    '-aria256[encrypt the private key with ARIA256]' \
    '-camellia128[encrypt the private key with CAMELLIA128]' \
    '-camellia192[encrypt the private key with CAMELLIA192]' \
    '-camellia256[encrypt the private key with CAMELLIA256]' \
    '-des[encrypt the private key with DES]' \
    '-des3[encrypt the private key with DES3]' \
    '-idea[encrypt the private key with IDEA]' \
    '-noenc[do not encrypt private keys at all]' \
    '-export[create PKCS#12 file rather than parsed]' \
    '-inkey[private key input file or URI for PKCS12 output]:file_or_uri:_files' \
    '-certfile[extra certificates input file]:file:_files' \
    '-passcerts[password source for certificate input]:source:_openssl_pass_phrase_options' \
    '-chain[certificate chain is built and included in the PKCS#12 output file]' \
    '-untrusted[untrusted certificates input file]:file:_files' \
    $openssl_trusted_certificate_options[@] \
    '-name["friendly name" for the certificates and private key]:name' \
    '-caname["friendly name" for other certificates]:name' \
    '-CSP[name as a Microsoft CSP name]:name' \
    '-LMK[add the "Local Key Set" identifier to the attributes]' \
    '-keyex[private key is to be used for key exchange]' \
    '-keysig[private key is to be used for just signing]' \
    '-keypbe[algorithm used to encrypt the private key]:alg:_openssl_cipher_algorithms' \
    '-certpbe[algorithm used to encrypt certificates]:alg:_openssl_cipher_algorithms' \
    '-descert[encrypt the certificates using triple DES]' \
    '-macalg[MAC digest algorithm]:digest:_openssl_digests' \
    '-pbmac1_pbkdf2[use PBMAC1 with PBKDF2 for MAC protection]' \
    '-pbmac1_pbkdf2_md[PBKDF2 KDF digest algorithm]:alg:_openssl_digests' \
    '-iter[iteration count for the encryption key and MAC]:count' \
    '-noiter[set iteration count to 1 for encryption]' \
    '-nomaciter[set iteration count to 1 for MAC]' \
    '-macsaltlen[salt length in bytes for the MAC]:length' \
    '-nomac[do not attempt to provide the MAC integrity]' \
    '-jdktrust[export pkcs12 file in a foormat compatible with Java keystore usage]:usage:(anyExtendedKeyUsage)'
}

_openssl_pkcs7() {
  _arguments \
   '(- *)-help[print help message]' \
   '-inform[input format]:format:(DER PEM)' \
   '-outform[output format]:format:(DER PEM)' \
   '-in[input file name]:file:_files' \
   '-out[output file name]:file:_files' \
   '-print[print out the full PKCS7 object]' \
   '-print_certs[print out any certificates or CRLs contained in the file]' \
   '-quiet[print out just the PEM-encoded certificates without any other output]' \
   '-text[print out certificate details in full]' \
   '-noout[do not output the encoded version of the PKCS#7 structure]' \
   $openssl_provider_options[@]
}

_openssl_pkcs8() {
  local -a prf_algorithms=(
    hmacWithMD5 hmacWithRMD160 hmacWithSHA1 hmacWithSHA224 hmacWithSHA256 hmacWithSHA384 hmacWithSHA512
  )

  _arguments \
   '(- *)-help[print help message]' \
   '-topk8[read a private key and write a PkCS#8 format key]' \
   '-inform[input format]:format:(DER PEM)' \
   '-outform[output format]:format:(DER PEM)' \
   '-traditional[traditional format]' \
   '-in[input file name]:file:_files' \
   '-passin[input password source]:source:_openssl_pass_phrase_options' \
   '-passout[output password source]:source:_openssl_pass_phrase_options' \
   '-out[output file name]:files:_files' \
   '-iter[number of iterations to create PKCS#8 containers]:count' \
   '-noiter[use 1 as iteration count]' \
   '-nocrypt[output unencrypted PrivateKeyInfo structure]' \
   '-v2[algorithm for PKCS#5 v2.0]:alg:_openssl_cipher_algorithms' \
   '-v2prf[PRF algorithm to use with PKCS#5 v2.0]:alg:(($prf_algorithms))' \
   '-v1[algorithm for PKCS#5 v1.5 or PKCS#12]:alg:_openssl_cipher_algorithms' \
   '-scrypt[use the script algorithm for private key encryption]' \
   '-scrypt_N[scrypt "N" parameter]:n' \
   '-scrypt_r[scrypt "r" parameter]:r' \
   '-scrypt_p[scrypt "p" parameter]:p' \
   '-saltlen[length of the salt to use for the PBE algorithm]:length' \
   $openssl_random_state_options[@] \
   $openssl_provider_options[@]
}

_openssl_pkey() {
  _arguments  \
   '(- *)-help[print help message]' \
   $openssl_provider_options[@] \
   '-check[check the consistency of a key pair for both public and private components]' \
   '-pubcheck[check the correctness of either a public key or the public components of a key pair]' \
   '-in[input file or URI]:file_or_uri:_files' \
   '-inform[key input format]:format:(DER PEM P12 ENGINE)' \
   '-passin[password source for the key input]:source:_openssl_pass_phrase_options' \
   '-pubin[read public key instead of private key]' \
   '-out[output file name]' \
   '-outform[key output format]:format:(DER PEM)' \
   '-cipher[cipher to encrypt the PEM encoded private key]:cipher:_openssl_ciphers' \
   '-passout[password source for the output file]:source:_openssl_pass_phrase_options' \
   '-traditional[use older "traditional" format]' \
   '-pubout[output the public components]' \
   '-noout[do not output the key in encoded form]' \
   '-text[output the various key components in plain text]' \
   '-text_pub[output only the public key components in text form]' \
   '-ec_conv_form[specify how the points on the elliptic-curve curve are converted into octet strings]:type:(compressed uncompressed hybrid)' \
   '-ec_param_enc[specify how the elliptic curve parameters are encoded]:type:(named_curve explicit)'
}

_openssl_pkeyparam() {
  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-text[print out the parameters in plain text]' \
    '-noout[do not output the encoded version of the parameters]' \
    '-check[check the correctness of parameters]' \
    $openssl_provider_options[@]
}

_openssl_pkeyutl() {
  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name]:file:_files' \
    '-rawin[indicate that signature or verification input data is raw data]' \
    '-digest[digest algorithm to be used to hash the input data]:digest:_openssl_digests' \
    '-out[output file name]:file:_files' \
    '-secret[shared-secret output file name]:file:_files' \
    '-sigfile[signature file]:file:_files' \
    '-inkey[input key file name or URI]:file_or_uri:_files' \
    '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
    '-passin[input key password source]:source:_openssl_pass_phrase_options' \
    '-pubin[read public key instead of private key]' \
    '-certin[input is a certificate containing a public key]' \
    '-rev[reverse the order of the input buffer]' \
    '-sign[sign the input data and output the signed result]' \
    '-verify[verify the input data against the signature]'\
    '-verifyrecover[verify the given signature and output the recovered data]' \
    '-encrypt[encrypt the input data using a public key]' \
    '-decrypt[decrypt the input data using a private key]' \
    '-derive[derive a shared secret using own private (EC)DH key and peer key]' \
    '-peerkey[file containing the peer public or private (EC)DH key]:file:_files' \
    '-peerform[peer key format]:format:(DER PEM P12 ENGINE)' \
    '-encap[use a Key Encapsulation Mechanism to encapsulate a shared-secret]' \
    '-decap[decode an encapsulated secret with a private key]' \
    '-kemop[specify KEM mode for key algorithm]:mode' \
    '-kdf[key derivation function algorithm]:algorithm:(TLS1-PRF HKDF)' \
    '-kdflen[output length for KDF]:length' \
    '-pkeyopt[public key options]:options' \
    '-pkeyopt_passin[public key option from stdin or a password source]:option:_openssl_pass_phrase_options' \
    '-hexdump[hex dump the output data]' \
    '-asn1parse[parse the ASN.1 output data to check its DER encoding]'\
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-config[configuration file]:file:_files'
}

_openssl_prime() {
  _arguments \
    '(- *)-help[print help message]' \
    '-hex[generate hex output]' \
    '-generate[generate a prime number]' \
    '-bits[how many bits to generate a prime]:num' \
    '-safe[generates a safe prime]' \
    $openssl_provider_options[@] \
    '*::number:'
}

_openssl_rand() {
  _arguments  \
    '(- *)-help[print help message]' \
    '-out[output file name]:file:_files' \
    '-base64[perform base64 encoding on the output]' \
    '-hex[show the output as a hex string]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '*:num'
}

_openssl_rehash() {
  _arguments \
    '(- *)-help[print help message]' \
    '-old[use old-tyle hashing for generating links]' \
    '-n[do not remove existing links]' \
    '-compat[generate links for both old-style(MD5) and new-style(SHA1) hashing]' \
    '-v[print messages about old links removed and new links created]' \
    $openssl_provider_options[@] \
    '*::dir:_files -/'
}

_openssl_req() {
  local -a digests=($(openssl dgst -list | tail -n +2))
  local -a digest_flags=()
  for digest in $digests[@]
  do
    digest_flags+=("($digests)${digest}[use ${digest:1} message digest algorithm]")
  done

  local -a cipher_flags=($(openssl enc -list | tail -n +2 ))
  local -a ciphers=()
  for flag in $cipher_flags[@]
  do
    ciphers+=("${flag:1}")
  done

  _arguments \
    '(- *)-help[print help message]' \
    '-inform[CSR input file format]:format:(DER PEM)' \
    '-outform[output format]:format:(DER PEM)' \
    '-cipher[cipher to use]:cipher:(($ciphers))' \
    '-in[input file name]:file:_files' \
    '-sigopt[options of the signature algorithm during sign operations]:options' \
    '-vfyopt[options of the signature algorithm during verify operations]:options' \
    '-passin[password source for private key and certificate input]:source:_openssl_pass_phrase_options' \
    '-passout[password source for the output file]:source:_openssl_pass_phrase_options' \
    '-out[output file name]:file:_files' \
    '-text[print out the certificate request in text form]' \
    '-subject[print out the certificate request subject]' \
    '-pubkey[print out the public key]' \
    '-noout[prevent output of the encoded version of the certificate request]' \
    '-modules[print out the value of the modulus of the public key]' \
    '-verify[verify the self-signed on the request]' \
    '-new[generate a new certificate request]' \
    '-newkey[generate a new private key]:arg' \
    '-pkeyopt[option of public key algorithm]:option' \
    '-key[private key file or URI]:file_or_uri:_files' \
    '-keyform[format of the private key]:format:(DER PEM P12 ENGINE)' \
    '-keyout[output private key file name]:file:_files' \
    '-noenc[create private key it will not be encrypted]' \
    $digest_flags[@] \
    '-config[config file name]:file:_files' \
    '-section[section name]:section' \
    '-subj[subject name for new request or superseded the subject name]:subject' \
    '-x509[output certificate instead of a certificate request]' \
    '-x509v1[request generation of certificates with X.509 version 1]' \
    '-CA["CA" certificate file or URI]:file_or_uri:_files' \
    '-CAkey["CA" private key file or URI]:file_or_uri:_files' \
    '-not_before[start date to be explicitly set]:date'\
    '-not_after[expiry date to be explicitly set]:date'\
    '-days[the number of days from today to certify the certificate for]:days' \
    '-set_serial[serial number to use when outputting a self-signed certificate]:serial' \
    '-copy_extensions[how X.509 extensions in certificate requests should be handled]:type:(none copy copyall)' \
    '-extensions[specify certificate extension section (override value in config file)]:section' \
    '-reqexts[specify request extension section (override value in config file)]:section ' \
    '-addext[add a specific extension to the certificate]:ext' \
    '-precert[add poison extension to the certificate]' \
    '-utf8[interpret field values as UTF8 strings]' \
    '-reqopt[options to customize the printing format]:option:_openssl_text_printing_options' \
    '-newhdr[add the word NEW to the PEM file header and footer lines]' \
    '-batch[non-interactive mode]' \
    '-verbose[print extra details about the operations being performed]' \
    '-quiet[print fewer details about the operations being performed]' \
    '-keygen_engine[engine for key generation operations]:id' \
    '-nameopt[how subject or issuer names are displayed]:option:_openssl_name_display_options' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@]
}

_openssl_rsa() {
  _arguments \
    '(- *)-help[print help message]' \
    '-inform[key input format]:format:(DER PEM P12 ENGINE)' \
    '-outform[key output format]:format:(DER PEM)' \
    '-traditional[use the traditional PKCS#1 format instead of PKCS#8 format]' \
    '-in[input file or URI]:file_or_uri:_files' \
    '-passin[input password source]:source:_openssl_pass_phrase_options' \
    '-passout[output password source]:source:_openssl_pass_phrase_options' \
    '-out[output file name]:file:_files' \
    '-aes128[encrypt the private key with AES128]' \
    '-aes192[encrypt the private key with AES192]' \
    '-aes256[encrypt the private key with AES256]' \
    '-aria128[encrypt the private key with ARIA128]' \
    '-aria192[encrypt the private key with ARIA192]' \
    '-aria256[encrypt the private key with ARIA256]' \
    '-camellia128[encrypt the private key with CAMELLIA128]' \
    '-camellia192[encrypt the private key with CAMELLIA192]' \
    '-camellia256[encrypt the private key with CAMELLIA256]' \
    '-des[encrypt the private key with DES]' \
    '-des3[encrypt the private key with DES3]' \
    '-idea[encrypt the private key with IDEA]' \
    '-text[print out the various public or private key components in plain text]' \
    '-noout[prevent output of the encoded version of the key]' \
    '-module[print out the value of the modules of the key]'\
    '-check[check the consistency of an RSA private key]' \
    '-pubin[read public key instead of private key]' \
    '-pubout[output public key instead of private key]' \
    '-RSAPublicKey_in[read RSA public key instead of private key]' \
    '-RSAPublicKey_out[output RSA public key instead of private key]' \
    '-pvk-strong[enable "Strong" PVK encoding level(default)]' \
    '-pvk-weak[enable "Weak" PVK encoding level]' \
    '-pvk-none[do not enforce PVK encoding]' \
    $openssl_provider_options[@]
}

_openssl_rsautl() {
  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name]:file:_files' \
    '-passin[pass phrase option]:option:_openssl_pass_phrase_options' \
    '-rev[reverse the order of the input]' \
    '-out[output file name]:file:_files' \
    '-inkey[input key file or URI]:file_or_uri:_files' \
    '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
    '-pubin[read public key instead of private key]' \
    '-certin[input is a certificate containing an RSA public key]' \
    '-sign[sign the input data and output the signed result]' \
    '-verify[verify the input data and output the recovered data]' \
    '-encrypt[encrypt the input data using an RSA public key]' \
    '-decrypt[decrypt the input data using an RSA private key]' \
    '-pkcs[use PKCS#1 for padding]' \
    '-oaep[use OAEP for padding]' \
    '-x931[use ANSI X9.31 for padding]' \
    '-raw[do not use padding]' \
    '-hexdump[hex dump the output data]' \
    '-asn1parse[parse the ASN.1 output data]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@]
}

_openssl_s_client() {
  local tls_start_protocols=(smtp pop3 imap ftp xmpp xmpp-server irc postgres mysql lmtp nntp sieve ldap)

  _arguments \
   '(- *)-help[print help message]' \
   '-ssl_config[section of the configuration file to configure the SSL_CTX object]:section' \
    '-connect[host and optional port to connect to]:host_port' \
    '-host[host to connect to]:host' \
    '-port[port to connect to]:port' \
    '-bind[host address and port to bind as the source for the connection]:host_port' \
    '-proxy[proxy host and port]:host_port' \
    '-proxy_user[proxy user for basic(base64) authenticate]' \
    '-proxy_pass[proxy password source]:option:_openssl_pass_phrase_options' \
    '-unix[connect over the specified Unix-domain socket]:path:_files' \
    '(-4 -6)-4[use IPv4 only]' \
    '(-4 -6)-6[use IPv6 only]' \
    '-quic[connect using the QUIC protocol]' \
    '-servername[set the TLS SNI extension in the ClientHello to the given value]:name' \
    '-noservername[suppress sending of the SNI extension in the ClientHello message]' \
    '-cert[client certificate path]:file:_files' \
    '-certform[client certificate file format]:format:(DER PEM P12)' \
    '-cert_chain[file or URI of untrusted certificates to build the certificate chain]:file_or_uri:_files' \
    '-build_chain[whether the application build build the client certificate chain]' \
    "-CRL[CRL file to use to check the server's certificate]" \
    '-CRLform[CRL file format]:format:(DER PEM)' \
    '-crl_download[download CRL from distribution points in the certificate]' \
    '-key[client private key to use(file or URI)]:file_or_uri:_files' \
    '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
    '-pass[private key and certificate file password source]:option:_openssl_pass_phrase_options' \
    '-verify[verify depth]:depth' \
    '-verify_return_error[returns verification error instead of continuing]' \
    '-verify_quiet[limit verify output to only errors]' \
    '-verifyCAfile[file in PEM format containing trusted certificates to verify]:file:_files' \
    '-verifyCApath[directory containing trusted certificates to verify]:dir:_files -/' \
    '-verifyCAstore[URI of a tstore containing trusted certificatesto verify]:uri:_urls' \
    '-chainCAfile[file in PEM format containing certificates to build client certificate chain]:file:_files' \
    '-chainCApath[directory containing trusted certificates for building client certificate chain]:dir:_files -/' \
    '-chainCAstore[URI of a store containing trusted certificate to build client certificate chain]:uri:_urls' \
    '-requestCAfile[file containing a list of certificates to be sent to the server]:file:_files' \
    '-dane_tlsa_domain[enable DANE TLSA authentication and specify the TLSA base domain]:domain' \
    '-dane_tlsa_rrdata[use one or more times to specify the RRDATA fields of the DANE TLSA RRset]:rrdata' \
    '-dane_ee_no_namechecks[disable server name checks when authenticating via DANE-EE TLSA records]' \
    '-reconnect[reconnect to the same server 5 time using the same sess_id ID]' \
    '-showcerts[display the server certificate list as sent by the server]' \
    '-prexit[print session information when the program exits]' \
    '-no-interactive[run the client in a non-interactive mode]' \
    '-state[print out the SSL session states]' \
    '-debug[print extensive debugging information including a hex dump of all traffic]' \
    '-nocommands[do not use interactive command letters]' \
    '-adv[use advanced command mode]' \
    '-security_debug[enable security debug messages]' \
    '-security_debug_verbose[output more security debug output]' \
    '-msg[show protocol messages]' \
    '-timeout[enable send/receive timeout on DTLS connections]' \
    '-mtu[set MTU of the link layer]:size' \
    '-no_ems[disable Extended master secret negotiation]' \
    '-keymatexport[export keying materials using the specified label]:label' \
    '-keymatexportlen[export the specified number of bytes of keying material(default 20)]:len' \
    '-trace[show verbose trace output of protocol messages]' \
    '-msgfile[file to send output of -msg or -trace to]:file:_files' \
    '-nbio_test[test nonblocking I/O]' \
    '-nbio[turn on nonblocking I/O]' \
    '-crlf[translate a line feed from the terminal into CF+LF]' \
    '-ign_eof[inhibit shutting down the connection when end of file is reached in the input]' \
    '-quiet[inhibit printing of session and certificate information]' \
    '-no_ign_eof[shut down the connection when end of file is reached in the input]' \
    '-psk_identity[PSK identity when using a PSK cipher suite]:identity' \
    '-psk[PSK key when using a PSK cipher suite]:key' \
    '-psk_session[use the pem encoded SSL_SESSION data stored in file as the basic of a PSK]:file:_files' \
    '-sctp[use SCTP for the transport protocol instead of UDO in DTLS]' \
    '-sctp_label_bug[use the incorrect behaviour of older OpenSSL implementations for DTLS/SCTP]' \
    '-fallback_scsv[send TLS_FALLBACK_SCSV in the ClientHello]' \
    '-async[switch on asynchronous mode]' \
    '-maxfraglen[enable Maximum Fragment Length Negotiation]:len:(512 1024 2048 4096)' \
    '-max_send_frag[maximum size of data fragment to send]:size' \
    '-split_send_frag[size used to split data for encrypt pipelines]:size' \
    '-max_pipelines[maximum number of encrypt/decrypt pipelines]:number' \
    '-read_buf[default read buffer size for connections]:size' \
    '-ignore_unexpected_eof[enable the peer does not need to send the close_notify alert]' \
    '-no_tx_cert_comp[disable support for sending TLSv1.3 compressed certificates]' \
    '-no_rx_cert_comp[disable support for receiving TLSv1.3 compressed certificate]' \
    '-brief[only provide a brief summary of connections parameters]' \
    '-starttls[send the protocol-specific message to switch to TLS for communication]:protocol:(($tls_start_protocols))' \
    '-xmpphost[host for the "to" attribute of the stream element]:host' \
    '-name[hostname information for various protocols]:hostname' \
    '-tlsextdebug[print out a hex dump of any TLS extensions received from the server]' \
    '-sess_out[output SSL session to file]:file:_files' \
    '-sess_in[load SSL session from this file]:file:_files' \
    '-serverinfo[list of comma-separated TLS Extension Types]:types' \
    '-status[send a certificate status request to the server(OCSP stapling)]' \
    '-alpn[enable Application-Layer Protocol Negotiation]:protocols' \
    '-nextprotoneg[enable Next Protocol Negotiation extension]:protocols' \
    '(-ct -noct)-ct[enable Certificate Transparency]' \
    '(-ct -noct)-noct[disable Certificate Transparency]' \
    '-ctlogfile[file containing a list of known Certificate Transparency]' \
    '-keylogfile[keylog file for appending TLS secrets]:file:_files' \
    '-early_data[file to read the content and attempt to send it as early data]:file:_files' \
    '-enable_pha[send the Post-Handshake Authentication extension]' \
    '-use_srtp[offer SRTP key management]:value' \
    '-ktls[enable kernel TLS for sending and receiving]' \
    '-tfo[enable creation of connections via TCP fast open]' \
    $openssl_tls_flags[@] \
    $openssl_dtls_flags[@] \
    '-nameopt[how the subject or issuer names are displayed]:option:_openssl_name_display_options' \
    $openssl_extended_verification_flags[@] \
    $openssl_trusted_certificate_options[@] \
    $openssl_supported_commands_flags[@] \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-ssl_client_engine[specified engine to be used for client certificate operations]:id' \
    $openssl_verification_options[@] \
    '-enable_server_rpk[enable support for receiving raw public keys from the server]' \
    '-enable_client_rpk[enable support for sending raw public keys to the server]' \
    '*::host_port'
}

_openssl_s_server() {
  _arguments  \
   '(- *)-help[print help message]' \
   '-port[TCP port to listen on for connections(default: 4433)]:port' \
   '-accept[optional TCP host and port to listen on for connections(default: *:4433)]:host_port' \
   '-unix[Unix domain socket path]:path:_files' \
   '(-4 -6)-4[use IPv4 only]' \
   '(-4 -6)-6[use IPv6 only]' \
   '-unlink[for -unix, unlink any existing socket first]' \
   '-context[SSL context ID]:id' \
   '(-verify -Verify)'{-verify,-Verify}'[verify depth]:depth' \
   '-cert[certificate file]:file:_files' \
   '-cert2[certificate file to use for servername(default: server2.pem)]:file:_files' \
   '-certform[server certificate file format]:format:(DER PEM P12)' \
   '-cert_chain[file or URI of untrusted certificates to build the certificate chain]:file_or_uri:_files' \
   '-build_chain[application should build the server certificate chain]' \
   '-serverinfo[file containing one or more blocks of PEM data]:file:_files' \
   '-key[private key file or URI]:file_or_uri:_files' \
   '-key2[private key file or URI to use for servername]:file_or_uri:_files' \
   '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
   '-pass[private key and certificate file password source]:source:_openssl_pass_phrase_options' \
   '-dcert[additional certificate file]:file:_files' \
   '-dkey[additional private key file or URI]:file_or_uri:_files' \
   '-dcert_chain[file or URI of untrusted certificates to build the server certificate chain]:file_or_uri:_files' \
   '-dcertform[format of the additional certificate file]:format:(DER PEM P12)' \
   '-dkeyform[format of the additional private key]:format:(DER PEM P12 ENGINE)' \
   '-dpass[passphrase for the additional private key and certificate]:pass:_openssl_pass_phrase_options' \
   '-nbio_test[test non blocking I/O]' \
   '-crlf[translate a line feed from the terminal into CR+LF]' \
   '-debug[print extensive debugging information including a hex dump of all traffic]' \
   '-security_debug[print output from SSL/TLS security framework]' \
   '-security_debug_verbose[print more output from SSL/TLS security framework]' \
   '-msg[show all protocol messages with hex dump]' \
   '-msgfile[file to send output of -msg or -trace to]:file:_files' \
   '-state[print the SSL session states]' \
   '-CRL[CRL file]:file:_files' \
   '-CRLform[CRL file format]:format:(DER PEM)' \
   '-crl_download[download CRLs from distribution points]' \
   '-verifyCAfile[file in PEM format CA containing trusted certificates to verify client certificates]:file:_files' \
   '-verifyCApath[directory containing trusted certificates to verify client certificates]:dir:_files -/' \
   '-verifyCAstore[URI of a store containing trusted certificates to verify client certificates]:uri:_urls' \
   '-chainCAfile[file in PEM format containing trusted certificates to build the server certificate chain]:file:_files' \
   '-chainCApath[directory containing trusted certificates for building server certificate chain]:dir:_files -/' \
   '-chainCAstore[URI of a store containing trusted certificates for building server certificate chain]:uri:_urls' \
   '-nocert[no certificate is used]' \
   '-quiet[inhibit printing of session and certificate information]' \
   '-no_resume_ephemeral[disable caching and tickets if ephemeral (EC)DH is used]' \
   '-tlsextdebug[print a hex dump of any TLS extensions received from the server]' \
   '-www[send a status message back to the client when it connects]' \
   '(-WWW -HTTP)'{-WWW,-HTTP}'[emulate a simple web server]' \
   '-http_server_binmode[acting as web-server open files in binary mode]' \
   '-no_ca_names[disable TLS Extension CA Names]' \
   '-ignore_unexpected_eof[peer does not need to send the close_notify alert]' \
   '-servername[servername for HostName TLS extension]' \
   '-servername_fatal[send fatal alert on servername mismatch]' \
   '-id_prefix[generate SSL/TLS session IDs prefixed by this ID]:id' \
   '-keymatexport[export keying material using label]:label' \
   '-keymatexportlen[export the given number of bytes of keying material(default: 20)]:length' \
   '-no_cache[disable session cache]' \
   '-ext_cache[disable internal cache]' \
   '-verify_return_error[close the connection when verification errors occur]' \
   '-verify_quiet[no verify output except verify errors]' \
   '(-no_ign_eof -ign_eof)-ign_eof[ignore input EOF]' \
   '(-no_ign_eof -ign_eof)-no_ign_eof[do not ignore input EOF]' \
   '-no_ems[disable Extended master secret negotiation]' \
   '-status[enable certificate status request support]' \
   '-status_verbose[enable certificate status request support and verbose output of OCSP response]' \
   '-status_timeout[set the timeout for OCSP reponse to the given seconds]:seconds' \
   '-proxy[HTTP(S) proxy server]:proxy' \
   '-no_proxy[list of IP addresses and/or DNS names not to use an HTTP(S) proxy for]:addresses' \
   '-status_url[set a fallback responder URL]:url:_urls' \
   '-status_file[status file]:file:_files' \
   '-ssl_config[configure SSL_CTX using the given configure value]:config' \
   '-trace[show verbose trace output of protocol messages]' \
   '-brief[provide a brief summary of connection parameters]' \
   '-rev[simple echo server that sends back received text reserved]' \
   '-async[switch on asynchronous mode]' \
   '-max_send_frag[maximum size of data fragment to send]:size' \
   '-split_send_frag[size used to split data for encrypt pipelines]:size' \
   '-max_pipelines[maximum number of encrypt/decrypt pipelines]:number' \
   '-naccept[server will exit after receiving the specified number of connections(default: unlimited)]:number' \
   '-read_buf[default read buffer size for connections]:size' \
   '-no_tx_cert_comp[disable support for sending TLSv1.3 compressed certificates]' \
   '-no_rx_cert_comp[disable support for receiving TLSv1.3 compressed certificates]' \
   '-no_comp[disable negotiation of TLS compression]' \
   '-num_tickets[control the number of tickets that will be sent to the client after a full handshake in TLSv1.3]' \
   '-dhparam[DH parameter file to use]:file:_files' \
   '-nbio[turn on non blocking I/O]' \
   '-timeout[enable timeout]' \
   '-mtu[set link-layer MTU]:size' \
   '-psk_identity[PSK identify when using a PSK cipher suite]:id' \
   '-psk_hint[PSK identity hint when using a PSK cipher suite]:hint' \
   '-psk[PSK key when using a PSK cipher suite]:key' \
   '-psk_session[file contains pem encoded SSL_SESSION data]:file:_files' \
   '-srpvfile[verifier file for SRP]:file:_files' \
   '-listen[listen on a UDP port for incoming connections]' \
   '-sctp[use SCTP for the transport protocol instead of UDP in DTLS]' \
   '-sctp_label_bug[allow communication with older broken implementations]' \
   '-use_srtp[offer SRTP key management with a colon-separated profile list]:list' \
   '-no_dhe[no DH parameters will be loaded]' \
   '-alpn[enable the Application-Layer Protocol Negotiation extension]:protocol' \
   '-nextprotoneg[enable the Next Protocol Negotiation extension]:protocol' \
   '-ktls[enable kernel TLS for sending and receiving]' \
   '-sendfile[SSL_sendfile will be used instead of BIO_write to send response]' \
   '-zerocopy_sendfile[SSL_sendfile will use the zerocopy TX mode]' \
   '-keylogfile[append TLS secrets to the specified keylog file]:file:_files' \
   '-max_early_data[change the default maximum early data bytes for new sessions and incoming early data]:size' \
   '-recv_max_early_data[hard limit on the maximum number of early data bytes that will be accepted]:bytes' \
   '-early_data[accept early data where possible]' \
   '-stateless[require TLSv1.3 cookies]' \
   '(-anti_replay -no_anti_replay)-anti_replay[switch replay protection on]' \
   '(-anti_replay -no_anti_replay)-no_anti_replay[switch replay protection off]' \
   '-tfo[enable acceptance of TCP fast Open connections]' \
   '-cert_comp[pre-compresses certificates that will be sent during the handshake]' \
   '-nameopt[how the subject or issuer names are displayed]:how:_openssl_name_display_options' \
   $openssl_tls_flags[@] \
   $openssl_dtls_flags[@] \
   $openssl_supported_commands_flags[@] \
   $openssl_extended_verification_flags[@] \
   $openssl_trusted_certificate_options[@] \
   $openssl_random_state_options[@] \
   $openssl_provider_options[@] \
   $openssl_verification_options[@] \
   '-enable_server_rpk[enable support for sending raw public keys to the client]' \
   '-enable_client_rpk[enable support for receiving raw public keys from the client]'
}

_openssl_s_time() {
  _arguments \
    '(- *)-help[print help message]' \
    '-connect[host and optional port to connect to]:host_port' \
    '-www[page to GET from the server. "/" gets the index.html page]:page' \
    '-cert[certificate to use]:certificate' \
    '-key[private key to use]:key:_files' \
    '-verify[verify depth to use]:depth' \
    '-new[performs the timing test using a new session ID for each connection]' \
    '-reuse[performs the timing test using the same session ID]' \
    '-bugs[enable various workaround for known SSL and TLS implementations]' \
    '-cipher[allow TLSv1.2 and cipher list sent by the client to be modified]:ciperlist:_openssl_list_ciphers' \
    '-ciphersuites[allow the TLSv1.3 ciphersuites sent by the client to be modified]:val' \
    '-time[specify how long seconds this command should establish connections]:seconds' \
    '-nameopt[specify how the subject or issuer names are displayed]:option:_openssl_nameopts' \
    $openssl_trusted_certificate_options[@] \
    $openssl_provider_options[@] \
    $openssl_tls_flags[@]
}

_openssl_sess_id() {
  _arguments \
    '(- *)-help[print help message]' \
    '-context[set the session ID context]:id' \
    '-in[input file(default stdin)]:file:_files' \
    '-inform[input format(default PEM)]:format:(DER PEM)' \
    '-out[output file(default stdout)]:file:_files' \
    '-outform[output format(default PEM)]:format:(PEM DER NSS)' \
    '-text[print ssl session id details]' \
    '-cert[output certificate]' \
    '-noout[do not output the encoded session info]'
}

_openssl_smime() {
  local -a ciphers=($(openssl enc -list | tail -n +2 ))
  local -a cipher_flags=()
  for cipher in $ciphers[@]
  do
    cipher_flags+=("($ciphers)${cipher}[use ${cipher:1}]")
  done

  _arguments \
    '(- *)-help[print help message]' \
    '-encrypt[encrypt message]' \
    '-decrypt[decrypt message]' \
    '-sign[sign message using the supplied certificate and private key]' \
    '-resign[resign a message]' \
    '-verify[verify signed message]' \
    '-pk7out[write out a PEM encoded PKCS#7 structure]' \
    '-in[input message file]:file:_files' \
    '-out[output file name]:file:_files' \
    '-inform[input format]:format:(DER PEM SMIME)' \
    '-outform[output format]:format(DER PEM SMIME)' \
    '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
    '(-stream -indef)'{-stream,-indef}'[enable streaming I/O for encoding operations]' \
    '-noindef[disable streaming I/O]' \
    '-content[file containing the detached content]:file:_files' \
    '-text[add plain text MIME headers to the supplied message]' \
    '-md[digest algorithm to use when signing or resigning]:digest:(sha256 sha1 md5' \
    $cipher_flags[@] \
    '-nointern[use only the certificate in the -certificate]' \
    '-noverify[do not verify the signers certificate of a signed message]' \
    '-nochain[do not do chain verifier of signers certificates]' \
    '-nosigs[do not try to verify the signatures on the message]' \
    '-nocerts[reduce the size of the signed message]' \
    '-noattr[do not include attributes in the mssage]' \
    '-nodetach[use opaque signing]' \
    '-nosmimecap[do not include the SMIMECapabilities attribute]' \
    '-binary[do not convert message to "canonical" format]' \
    '-crlfeol[use CRLF instead of LF as end of line in output file]' \
    '-certfile[additional certificate file]:file:_files' \
    '*-signer[signing certificate]:file:_files' \
    '-recip[recipients certificate when decrypting a message]:file:_files' \
    '-inkey[private key file or URI for signing or decrypting]:file_or_uri:_files' \
    '-passin[private key password source]:source:_openssl_pass_phrase_options' \
    '-to["To" mail header]:addr' \
    '-from["From" mail header]:addr' \
    '-subject["Subject" mail header]:subject' \
    $openssl_verification_options[@] \
    $openssl_trusted_certificate_options[@]\
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-config[config file]:file:_files' \
    '*::recip_rert:_files'
}

_openssl_speed() {
  # NOTE extract algorithms from speed.c and check if 'openssl speed -seconds 1 $alg' succeed
  local -a speed_algorithms=(
    md2 mdc2 md4 md5 hmac sha1 sha256 sha512 whirlpool ripemd rmd160
    ripemd160 rc4 des-cbc des-ede3 aes-128-cbc aes-192-cbc aes-256-cbc
    camellia-128-cbc camellia-192-cbc camellia-256-cbc rc2-cbc rc2 rc5-cbc
    rc5 idea-cbc idea seed-cbc seed bf-cbc blowfish bf cast-cbc cast cast5
    ghash rand kmac128 kmac256 dsa1024 dsa2048 rsa512 rsa1024 rsa2048
    rsa3072 rsa4096 rsa7680 rsa15360 ffdh2048 ffdh3072 ffdh4096 ffdh6144
    ffdh8192 ecdsap160 ecdsap192 ecdsap224 ecdsap256 ecdsap384 ecdsap521
    ecdsak163 ecdsak233 ecdsak283 ecdsak409 ecdsak571 ecdsab163 ecdsab233
    ecdsab283 ecdsab409 ecdsab571 ecdsabrp256r1 ecdsabrp256t1
    ecdsabrp384r1 ecdsabrp384t1 ecdsabrp512r1 ecdsabrp512t1 ecdhp160
    ecdhp192 ecdhp224 ecdhp256 ecdhp384 ecdhp521 ecdhk163 ecdhk233
    ecdhk283 ecdhk409 ecdhk571 ecdhb163 ecdhb233 ecdhb283 ecdhb409
    ecdhb571 ecdhbrp256r1 ecdhbrp256t1 ecdhbrp384r1 ecdhbrp384t1
    ecdhbrp512r1 ecdhbrp512t1 ecdhx25519 ecdhx448 curveSM2
  )

  _arguments \
    '(- *)-help[print help message]' \
    '-config[configuration file]:file:_files' \
    '-elapsed[use wall-clock time instead of CPU user time as divisor]' \
    '-evp[use specified cipher or message digest algorithm via the EVP interface]:alg: _alternative "ciphers\:cipher\:_openssl_digests" "digests\:digest\:_openssl_cipher_algorithms"' \
    '-multi[run multiple operations in parallel]:number' \
    '-async_jobs[enable async mode and start specified number of jobs]:number' \
    '-misalign[misalign the buffers by the specified number of bytes]:number' \
    '-hmac[time the HMAC algorithm using the given message digest]:digest:_openssl_digests' \
    '-cmac[time the CMAC algorithm using the given cipher]:cipher:_openssl_cipher_algorithms' \
    '-decrypt[time the decryption instead of encryption]' \
    '-mb[enable multi-block mode on EVP-named cipher]' \
    '-aead[benchmark EVP-named AEAD cipher in TLS-like sequence]' \
    '-kem-algorithms[benchmark KEM algorithms]' \
    '-signature-algorithms[benchmark signature algorithms]' \
    '-primes[generate n prime RSA key and use it to run the benchmarks]:number' \
    '-seconds[run benchmarks for the given seconds]:number' \
    '-bytes[run benchmarks on num-byte buffers]:bytes' \
    '-mr[produce the summary in a machine-readable format]' \
    '-mlock[lock memory into RAM for more determining measurements]' \
    '-testmode[run the speed command in testmode]' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '*::alg:(($speed_algorithms))'
}

_openssl_spkac() {
  _arguments \
    '(- *)-help[print help message]' \
    '-in[input file name]:file:_files' \
    '-out[output file name]:file:_files' \
    '-digest[digest to sign a created SPKAC file]:digest:_openssl_digests' \
    '-key[private key file or URI to create an SPKAC file]:file_or_uri:_files' \
    '-keyform[key format]:format:(DER PEM P12 ENGINE)' \
    '-passin[input file password source]:option:_openssl_pass_phrase_options' \
    '-challenge[challenge string]:string' \
    '-spkac[alternative name form the variable containing the SPKAC(default "SPKAC")]:name' \
    '-spksect[allow an alternative name form the section containing the SPKAC]:section' \
    '-noout[do not output the text version of the SPKAC]' \
    '-pubkey[output the public key of an SPKAC]' \
    '-verify[verify the digital signature on the supplied SPKAC]' \
    $openssl_provider_options[@]
}

_openssl_srp() {
  _arguments \
    '(- *)-help[print help message]' \
    '-verbose[generate verbose output while processing]' \
    '(-add -modify -delete -list)-add[add a user and SRP verifier]' \
    '(-add -modify -delete -list)-modify[modify the SRP verifier of an existing user]' \
    '(-add -modify -delete -list)-delete[delete user from verifier file]' \
    '(- *)-list[list users]' \
    '-name[particular SRP definition to use]:name' \
    '-srpvfile[srp verifier file name]:file:_files' \
    '-gn[specify the "g" and "N" value]:g_and_N' \
    '-userinfo[additional information to add when adding or modifying a user]:info' \
    '-passin[password source for input file]:option:_openssl_pass_phrase_options' \
    '-passout[password source for output file]:option:_openssl_pass_phrase_options' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@] \
    '-config[config file]:file:_files' \
    '*::user'
}

_openssl_storeutl() {
  _arguments \
    '(- *)-help[print help message]' \
    '-out[output file name]:file:_files' \
    '-noout[prevent output of the PEM data]' \
    '-passin[key password source]:option:_openssl_pass_phrase_options' \
    '-text[print out the objects in text form]' \
    '-r[fetch objects recursively when possible]'\
    '-certs[only select the certificates from the given URI]' \
    '-keys[only select the keys from the given URI]' \
    '-crls[only select the CRLs from the given URI]' \
    '-subject[search for an object having the subject name arg]:arg' \
    '-issuer[search for an object having the given issuer name]:name' \
    '-serial[search for an object having the given serial number]:serial_number' \
    '-alias[search for an object having the given alias]:alias' \
    '-fingerprint[search for an object having the given fingerprint]:fingerprint' \
    '-digest[digest that was used to compute the fingerprint given with -fingerprint]' \
    $openssl_provider_options[@] \
    '*:uri:_urls'
}

_openssl_ts() {
  if [[ CURRENT -eq 2 ]]; then
    _arguments \
      '(- *)-help[print help message]' \
      '-query[generate a TS query]' \
      '-reply[generate a TS reply]' \
      '-verify[verify a TS response]'
  else
    local -a digests=($(openssl dgst -list | tail -n +2))
    local -a digest_flags=()
    for digest in $digests[@]
    do
      digest_flags+=("${digest}[use ${digest:1} message digest algorithm]")
    done

    case $words[2] in
      (-query)
        _arguments \
          '-config[configuration file]:file:_files' \
          '-data[data file for creating timestamp request]:file:_files' \
          '-digest[message imprint in a hexadecimal format]:digest' \
          $digest_flags[@] \
          '-tspolicy[policy that the client expects the TSA for creating the timestamp token]:oid' \
          '-no_nonce[no nonce instead of 64bit long pseudo-random nonce]' \
          '-cert[TSA is expected to include its signing certificates in the response]' \
          '-in[previously created timestamp request]:file:_files' \
          '-out[output file name]:file:_files' \
          '-text[output human-readable text format instead of DER]' \
          $openssl_random_state_options[@]
        ;;
      (-reply)
        _arguments \
          '-config[configuration file]:file:_files' \
          '-section[name of the config file section for the response generation]:section' \
          '-queryfile[file containing a DER encoded timestamp request]:file:_files' \
          '-passin[password source for the private key of the TSA]:source:_openssl_pass_phrase_options' \
          '-signer[signer certificate of the TSA in PEM format]:file:_files' \
          '-inkey[signer private key file or URI of the TSA in PEM format]:file_or_uri:_files' \
          $digest_flags[@] \
          '-chain[certificate chain]:file:_files' \
          '-tspolicy[policy to use for the response]:oid' \
          '-in[previously created timestamp response or timestamp token]:file:_files' \
          '-token_in[input is a DER encoded timestamp token instead of a timestamp response]' \
          '-out[output file name to write the response]:file:_files' \
          '-token_out[output is a timestamp token instead of timestamp response]' \
          '-text[output human-readable text format instead of DER]' \
          $openssl_provider_options[@]
        ;;
      (-verify)
        _arguments \
          '-data[file to hash to be verified against response or token]:file_to_hash:_files' \
          '-digest[message digest to be verified against reponse or token]:bytes' \
          '-queryfile[original timestamp request file in DER format]:file:_files' \
          '-in[timestamp response file in DER format]:file:_files' \
          '-token_in[input is a DER encoded timestamp token instead of a timestamp response]' \
          '-untrusted[set of additional untrusted certificates files or URIs]:file_or_uri:_files' \
          $openssl_trusted_certificate_options[@] \
          $openssl_verification_options[@]
        ;;
    esac
  fi
}

_openssl_verify() {
  _arguments -S  \
    '(- *)-help[print help message]' \
    '-CRLfile[file or URL should contains one or more CRLs in PEM or DER format]:file_or_uri:_files' \
    '-crl_download[attempt to download CRL information for certificates via their CDP entries]' \
    '-show_chain[display information about the certificate chain that has been built]' \
    '-verbose[print extra information about the operations being performed]' \
    '-trusted[file or URI of trusted certificates]:file_or_uri:_files' \
    '-untrusted[file or URI of untrusted certificates to use for chain building]:file_or_uri:_files' \
    '-vfyopt[pass options to the signature algorithms during verify operations]:options' \
    '-nameopt[specify how the subject or issuer names are displayed]:nameopt:_openssl_nameopts' \
    $openssl_trusted_certificate_options[@] \
    $openssl_verification_options[@] \
    $openssl_provider_options[@] \
    '*::certificate:_files'
}

_openssl_version() {
  _arguments \
    '(- *)-help[print help message]' \
    '-a[all information]' \
    '-v[current OpenSSL version]' \
    '-b[date the current version of OpenSSL was built]' \
    '-o[option information, options set when the library was built]' \
    '-f[compilation flags]' \
    '-p[platform setting]' \
    '-d[OPENSSLDIR setting]' \
    '-e[ENGINESDIR settings]' \
    '-m[MODULESDIR settings]' \
    '-r[random number generator source settings]' \
    '-c[OpenSSL CPU settings info]' \
    '-w[OPENSSL OSSL_WINCTX build time variable]'
}

_openssl_x509() {
  local -a digests=($(openssl dgst -list | tail -n +2))
  local -a digest_flags=()
  for digest in $digests[@]
  do
    digest_flags+=("${digest}[use ${digest:1} message digest algorithm]")
  done

  _arguments \
    '(- *)-help[print help message]' \
    '(-in -new)-in[input file or URI for reading a certificate request]:file_or_uri:_files' \
    '-passin[key and certificate file password source]:source:_openssl_pass_phrase_options' \
    '(-in -new)-new[generate a certificate from scratch]' \
    '-x509toreq[output a PKCS#10 certificate request]' \
    '-req[expect a PKCS#10 certificate request]' \
    '-copy_extensions[how to handle X.509 extensions when converting from a certificate to a request]:how:(none copy copyall)' \
    '-inform[input file format]:format:(DER PEM)' \
    '-vfyopt[options of the signature algorithm during verify operations]:option' \
    '(-key -signkey)'{-key,-signkey}'[private key file or URI for a new certificate or certificate request]:file_or_uri:_files' \
    '-keyform[key input format]:format:(DER PEM P12 ENGINE)' \
    '-out[output file name]:file:_files' \
    '-outform[output format]:format:(DER PEM)' \
    '-nocert[do not output a certificate]' \
    '-noout[prevent output except for printing as requested]' \
    '-dataopt[data output format(default: rfc_822)]:format:(rfc_822 iso_8601)' \
    '-text[print out the certificate in text form]' \
    '-certopt[option to customize the print format used with -text]:option:_openssl_text_printing_options' \
    '-fingerprint[calculate and print the digest of the DER encoded version of the entire certificate]' \
    '-alias[print the certificate "alias"(nickname) if any]' \
    '-serial[print the certificate serial number]' \
    '-startdate[print out the start date of the certificate]' \
    '-enddate[print out the expiry date of the certificate]' \
    '-dates[print out the start and expiry dates of a certificate]' \
    '-subject[print the subject name]' \
    '-issuer[print the issuer name]' \
    '-nameopt[how the subject or issuer names are displayed]:option:_openssl_nameopts' \
    '-email[print the email address(es) if any]' \
    '(-hash -subject_hash)'{-hash,-subject_hash}'[print the "hash" of the certificate subject name]' \
    '-subject_hash_old[print the "hash" of the certificate subject name using the older algorithm]' \
    '-issuer_hash[print the "hash" of the certificate issuer name]' \
    '-issuer_hash_old[print the "hash" of the certificate issuer name using the older algorithm]' \
    '-ext[print out the certificate extensions in text form]:extensions:_openssl_certificate_extensions' \
    '-ocspid[print the OCSP hash values for the subject name and public key]' \
    '-ocsp_uri[print the OCSP responder address(es) if any]' \
    '-purpose[perform tests on the certificate extensions and output the result]' \
    "-pubkey[print the certificate's SubjectPublicKeyInfo block in PEM format]" \
    '-modulus[print out the value of the modulus of the public key contained in the certificate]' \
    '-checkend[check if the certificate expires within the given seconds]:seconds' \
    '-checkhost[check that the certificate matches the specified host]:host' \
    '-checkemail[check that the certificate matches the specified email address]:email' \
    '-checkip[check that the certificate matches the specified IP address]:ip' \
    '-set_serial[serial number to use]:serial_number' \
    '-next_serial[serial to be one more than the number in the certificate]' \
    '-not_before[start date to be explicitly set]:date' \
    '-not_after[expiry date to be explicitly set]:date' \
    '-days[the number of days from today until a newly generated certificate expires]:days' \
    '-preserve_dates[preserve "notBefore" and "notAfter" dates of any input certificate]' \
    '-set_issuer[issuer name for certicate created]:issuer' \
    '(-set_subject -subj)'{-set_subject,-subj}'[subject name for certicate created]:subject' \
    '-force_pubkey[public key file to be set in certicate created]:file:_files' \
    '-clrext[prevents taking over any extensions from the source]' \
    '-extfile[configuration file containing certificate and request X.509 extensions to add]:file:_files' \
    '-extensions[section in the extfile to add X.509 extensions form]:section' \
    '-sigopt[options to the signature algorithm during sign operations]:options' \
    '-badsig[currupt the signature before writing it]' \
    $digest_flags[@] \
    '-CA["CA" certificate file or URI]:file_or_uri:_files' \
    '-CAform[format for the CA certificate]:format:(DER PEM P12)' \
    '-CAkey[CA private key file or URI to sign a certificate with]:file_or_uri:_files' \
    '-CAkeyform[format for the CA key]:format:(DER PEM P12 ENGINE)' \
    '-CAserial[CA serial number file to use]:file:_files' \
    '-CAcreateserial[create CA serial number file if it does not exist]' \
    '-trustout[mark any certificate PEM output as <trusted> certificate rather than ordinary]' \
    '-setalias[set the "alias" of the certificate]:alias' \
    '-clrtrust[clear all the permitted or trusted uses of the certificate]' \
    '-addtrust[add a trusted certificate use]:name:(clientAuth serverAuth emailProtection anyExtendedKeyUsage)' \
    '-clrreject[clear all the prohibited or rejected use of the certificate]' \
    '-addreject[add a prohibited trust anchor purpose]:arg:(clientAuth serverAuth emailProtection anyExtendedKeyUsage)' \
    $openssl_random_state_options[@] \
    $openssl_provider_options[@]
}

#
# Utilities
#

_openssl_certificate_extensions() {
  # See x509v3_config document

  local -a extensions=(
    basicConstraints keyUsage extendedKeyUsage subjectKeyIdentifier authorityKeyIdentifier
    subjectAltName issuerAltName authorityInfoAccess crlDistributionPoints
    issuingDistributionPoint certificatePolicies policyConstraints
    inhibitAnyPolicy nameConstraints noCheck tlsfeature
  )

  _values -s , extensions $extensions
}

_openssl_digests() {
  # openssl list -digest-commands is deprecated, use another command instead
  local -a digest_flags=($(openssl dgst -list | tail -n +2))
  local -a digests=()

  for flag in $digest_flags[@]
  do
    digests+=(${flag:1})
  done

  _values 'digests' ${digests}
}

_openssl_cipher_algorithms() {
  local -a encrypt_flags=($(openssl enc -list | tail -n +2))
  local -a encrypts=()

  for flag in $encrypt_flags[@]
  do
    encrypts+=(${flag:1})
  done

  _values 'encrypts' ${encrypts}
}

_openssl_groups() {
  local -a groups=(P-256 P-384 P-521 X25519 X448 ffdhe2048 ffdhe3072 ffdhe4096 ffdhe6144 ffdhe8192)
  _values -s ':' groups $groups
}

_openssl_list_ciphers() {
  # openssl ciphers
  local ciphers
  # add cipher suites
  ciphers=(${(@s/:/)"$(_call_program ciphers openssl ciphers)"})
  # add static cipher strings
  ciphers=(${ciphers} \
    'DEFAULT[the default cipher list]' \
    'COMPLEMENTOFDEFAULT[the ciphers included in ALL but not enabled by default]' \
    'ALL[all cipher suites except the eNULL ciphers]' \
    'COMPLEMENTOFALL[the cipher suites not enabled by ALL]' \
    'HIGH["high" encryption cipher suites]' \
    'MEDIUM["medium" encryption cipher suites]' \
    'LOW["low" encryption cipher suites]' \
    {EXP,EXPORT}'[export encryption algorithms]' \
    'EXPORT40[40 bit export encryption algorithms]' \
    'EXPORT56[56 bit export encryption algorithms]' \
    {eNULL,NULL}'[ciphers offering no encryption]' \
    'aNULL[ciphers offering no authentication]' \
    {kRSA,RSA}'[cipher suites using RSA key exchange]' \
    'kDHr[cipher suites using DH key agreement signed by CAs with RSA keys]' \
    'kDHd[cipher suites using DH key agreement signed by CAs with DSS keys]' \
    'kDH[cipher suites using DH key agreement]' \
    {kDHE,kEDH}'[cipher suites using ephemeral DH key agreement, including anonymous cipher suites]' \
    {DHE,EDH}'[cipher suites using authenticated ephemeral DH key agreement]' \
    'ADH[anonymous DH cipher suites, not including anonymous ECDH ciphers]' \
    'DH[cipher suites using DH, including anonymous DH, ephemeral DH and fixed DH]' \
    'kECDHr[cipher suites using fixed ECDH key agreement signed by CAs with RSA keys]' \
    'kECDHe[cipher suites using fixed ECDH key agreement signed by CAs with ECDSA keys]' \
    'kECDH[cipher suites using fixed ECDH key agreement]' \
    {kECDHE,kEECDH}'[cipher suites using ephemeral ECDH key agreement, including anonymous cipher suites]' \
    {ECDHE,kEECDH}'[cipher suites using authenticated ephemeral ECDH key agreement]' \
    'AECDH[anonymous Elliptic Curve Diffie Hellman cipher suites]' \
    'ECDH[cipher suites using ECDH key exchange, including anonymous, ephemeral and fixed ECDH]' \
    'aRSA[cipher suites using RSA authentication]' \
    {aDSS,DSS}'[cipher suites using DSS authentication]' \
    'aDH[cipher suites effectively using DH authentication]' \
    'aECDH[cipher suites effectively using ECDH authentication]' \
    {aECDSA,ECDSA}'[cipher suites using ECDSA authentication]' \
    'TLSv1.2[TLSv1.2 cipher suites]' \
    'TLSv1[TLSv1.0 cipher suites]' \
    'SSLv3[SSLv3.0 cipher suites]' \
    'SSLv2[SSLv2.0 cipher suites]' \
    'AES128[cipher suites using 128 bit AES]' \
    'AES256[cipher suites using 256 bit AES]' \
    'AES[cipher suites using AES]' \
    'AESGCM[AES in Galois Counter Mode (GCM)]' \
    'CAMELLIA128[cipher suites using 128 bit CAMELLIA]' \
    'CAMELLIA256[cipher suites using 256 bit CAMELLIA]' \
    'CAMELLIA[cipher suites using CAMELLIA]' \
    '3DES[cipher suites using triple DES]' \
    'DES[cipher suites using DES (not triple DES)]' \
    'RC4[cipher suites using RC4]' \
    'RC2[cipher suites using RC2]' \
    'IDEA[cipher suites using IDEA]' \
    'SEED[cipher suites using SEED]' \
    'MD5[cipher suites using MD5]' \
    {SHA1,SHA}'[cipher suites using SHA1]' \
    'SHA256[cipher suites using SHA256]' \
    'SHA384[cipher suites using SHA284]' \
    'aGOST[cipher suites using GOST R 34.10 for authentication]' \
    'aGOST01[cipher suites using GOST R 34.10-2001 authentication]' \
    'aGOST94[cipher suites using GOST R 34.10-94 authentication]' \
    'kGOST[cipher suites, using VKO 34.10 key exchange]' \
    'GOST94[cipher suites, using HMAC based on GOST R 34.11-94]' \
    'GOST89MAC[cipher suites using GOST 28147-89 MAC instead of HMAC]' \
    'PSK[cipher suites using pre-shared keys (PSK)]' \
    'SUITEB128[suite B mode operation using 128 or 192 bit level of security]' \
    'SUITEB128ONLY[suite B mode operation using 128 bit level of security]' \
    'SUITEB192[suite B mode operation using 192 bit level of security]' \
    )
  # FIXME: support !, + and - before each cipher suite
  _values -s : 'cipher suite' ${ciphers}
}

_openssl_mac_algorithms() {
  # openssl list -mac-algorithms
  local algorithms=(
    BLAKE2BMAC BLAKE2SMAC CMAC HMAC KMAC128 KMAC256 SIPHASH POLY1305
  )

  _values algorithms $algorithms
}

_openssl_macopts() {
  local -a options=(
    'key\:[MAC key as an alphanumeric string]'
    'hexkey\:[MAC key in hexadecimal form]'
    'iv\:[IV as an alphanumeric string to be used by GMAC]'
    'hexiv\:[IV in hexadecimal form to be used by GMAC]'
    'size\:[output length to be used by KMAC128 or KMAC256]'
    'custom\:[customization string to be used by KMAC128 or KMAC256]'
    'digest\:[digest]'
    'cipher\:[cipher]'
  )

  _values 'options' ${options}
}

_openssl_name_display_options() {
  local -a options=(
    'compat:display the name using an old format from previous OpenSSL versions'
    'RFC2253:display the name using the format defined in RFC 2253'
    'oneline:display the name in one line more readable RFC 2253'
    'multiline:display the name using multiple lines'
    'esc_2253:escape the "special" characters in a field, as required by RFC 2253'
    'esc_2254:escape the "special" characters in a field as required by RFC 2254 in a field'
    'esc_ctrl:escape non-printable ASCII characters'
    'esc_msb:escape any characters with the most significant bit set'
    'use_quote:escapes some characters by surrounding the entire string with quotation marks'
    'utf8:convert all strings to UTF-8 format first as required by RFC 2253'
    'ignore_type:not attempt to interpret multibyte characters in any way'
    'show_type:display the type of the ASN1 character string before the value'
    'dump_der:output in hex format are displayed using the DER encoding of the field'
    'dump_nostr:dump non-character strings, such as ASN.1 OCTET STRING'
    'dump_all:dump all fields'
    'dump_unknown:dump any field whose OID is not recognised by OpenSSL'
    'sep_comma_plus:set comma as a separator'
    'sep_comma_plus_space:set comma as a separator and put space after the separator'
    'sep_semi_plus_space:set semi-colon as a separator and put space after the separator'
    'sep_multiline:start each field on its own line'
    'dn_rev:reverse the fields of the DN as required by RFC 2253'
    'nofname:does not display the field at all'
    'sname:use short name form'
    'lname:use long name form'
    'oid:represent the OID in numerical form'
    'align:align field values'
    'space_eq:place spaces round the equal sign'
  )

  _values 'options' ${options}
}

_openssl_pass_phrase_options() {
  local -a options=(
    'pass[actual password]:password'
    'env[obtain password from the environment variable]:var:_parameters -g "*export*"'
    'file[read the password from the file]:file:_files'
    'fd[read the password from the file descriptor number]:number'
    'stdin[read the password from standard input]'
  )

  _values -S : 'options' ${options}
}

_openssl_signature_algorithms() {
  local -a algorithms=(
    RSA DSA ECDSA
    SHA1 SHA224 SHA224 SHA384 SHA512
    ecdsa_secp256r1_sha256 ed25519 rsa_pss_pss_sha256
  )

  _values -s ':' algorithms $algorithms
}

_openssl_text_printing_options() {
  local -a options=(
    'compatible[use the old format]'
    'no_header[do not print header information]'
    'no_version[do not print out the version number]'
    'no_serial[do not print the serial number]'
    'no_signame[do not print out the signature algorithm used]'
    'no_validity[do not print the validity]'
    'no_subject[do not print out the subject name]'
    'no_issuer[do not print out the issuer name]'
    'no_pubkey[do not print out the public key]'
    'no_sigdump[do not give a hexadecimal dump of the certificate signature]'
    'no_aux[do not print out certificate trust information]'
    'no_extensions[do not print out any X509V3 extensions]'
    'ext_default[retain default extension behavior]'
    'ext_error[print an error message for unsupported certificate extensions]'
    'ext_parse[ASN1 parse unsupported extensions]'
    'ext_dump[Hex dump unsupported extensions]'
    'ca_default[equivalent to no_issuer, no_pubkey, no_header and no_version]'
  )

  _values -s , options $options
}

_openssl_tls_protocols() {
  local -a protocols=(SSLv3 TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 DTLSv1 DTLSv1.2 None)
  _values protocols $protocols
}

_openssl "$@"

# Local Variables:
# mode: Shell-Script
# sh-indentation: 2
# indent-tabs-mode: nil
# sh-basic-offset: 2
# End:
# vim: ft=zsh sw=2 ts=2 et