shc cluster cert rotate

shc cluster cert rotate [flags]

      --algo string   cluster-ca only: key algorithm for the NEW generation (rsa4096|p256, default rsa4096); ignored when resuming a parked rotation
      --force         cluster-ca/global-root: proceed past unverified/unreachable nodes or a cold consumer that cannot be recreated (STRANDED once the retiring generation drops); combines with --rollback
  -h, --help          help for rotate
      --rollback      cluster-ca/global-root: abandon an in-flight rotation pre-drop, phased and resumable (restores the old CA as sole trust anchor)
  -T, --type string   targeted rotation (cluster-ca|global-root|nebula-ca|mtls|due)
  -y, --yes           skip confirmation prompt

      --config stringArray   extra YAML config file to layer on top of auto-discovered config; repeatable, later files win
  -d, --debug                enable debug mode (default: $SHC_DEBUG)
  -e, --environment string   environment name (default: $SHC_ENVIRONMENT)
      --exclude string       comma-separated dotted paths to drop
      --fields string        comma-separated columns/keys to show (and their order)
      --filter string        comma-separated dotted paths to keep (drops everything else)
  -o, --output string        output format: tty|text|json|yaml (default: $SHC_OUTPUT)
  -s, --stack string         stack name (default: $SHC_STACK)
  -t, --tenant string        tenant name (default: $SHC_TENANT)
  -v, --verbose              verbose output (default: $SHC_VERBOSE)