There is a command group 'az_keyvault_certificate'. This group of commands could 'manage certificates'. The group of commands has global parameter '--debug' which means 'Increase logging verbosity to show all debug logs.'. The group of commands has global parameter '--help -h' which means 'Show this help message and exit.'. The group of commands has global parameter '--only-show-errors' which means 'Only show errors, suppressing warnings.'. The group of commands has global parameter '--output -o' which means 'Output format.'. The group of commands has global parameter '--query' which means 'JMESPath query string. See <a href="http://jmespath.org/">http://jmespath.org/</a> for more information and examples.'. The group of commands has global parameter '--subscription' which means 'Name or ID of subscription. You can configure the default subscription using `az account set -s NAME_OR_ID`.'. The group of commands has global parameter '--verbose' which means 'Increase logging verbosity. Use --debug for full debug logs.'. This group contains a child command 'az_keyvault_certificate_download'.The syntax is: az keyvault certificate download --file
                                 [--encoding {der, pem}]
                                 [--id]
                                 [--name]
                                 [--vault-name]
                                 [--version]. The 1th example of the child command would be to use it to 'download a certificate as pem and check its fingerprint in openssl', the syntax is: az keyvault certificate download --vault-name vault -n cert-name -f cert.pem && \
openssl x509 -in cert.pem -inform PEM  -noout -sha1 -fingerprint. The 2th example of the child command would be to use it to 'download a certificate as der and check its fingerprint in openssl', the syntax is: az keyvault certificate download --vault-name vault -n cert-name -f cert.crt -e DER && \
openssl x509 -in cert.crt -inform DER  -noout -sha1 -fingerprint. The parameter '--file -f' is required. It is used to file to receive the binary certificate contents.. The parameter '--encoding -e' is optional. encoding of the certificate. der will create a binary der formatted x509 certificate, and pem will create a base64 pem x509 certificate.. The parameter '--id' is optional. id of the certificate. if specified all other 'id' arguments should be omitted.. The parameter '--name -n' is optional. name of the certificate. required if --id is not specified.. The parameter '--vault-name' is optional. name of the key vault. required if --id is not specified.. The parameter '--version -v' is optional. the certificate version. if omitted, uses the latest version.. 