IPSEC-SHOWHOSTKEY(8) Executable programs IPSEC-SHOWHOSTKEY(8)

.SH "NAME" ipsec-showhostkey - show host's authentication key

.SH "SYNOPSIS"

.HP 432u

**ipsec showhostkey**

\[--verbose]  
\[--nssdir *directory*] \[--nsspw *password*] \[--seeddev *device*] \[--seedbits *bits*]

{| --version | --list | --dump | --left | --right | --ipseckey | --pem}

\[| --ckaid *ckaid* | --rsaid *rsaid*]

\[--gateway *gateway*]  
\[--precedence *precedence*]

.SH "DESCRIPTION"

.PP *Showhostkey* outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database.

.PP In general, since only the super-user can access the NSS database, only the super-user can display the public key information.

.SS "Common Options"

.PP **--version**

Print the libreswan version, then exit.

.RE

.PP **--verbose**

Increase the verbosity.

.RE

.PP **--nssdir nssdir**

Specify the libreswan directory that contains the NSS database (default /var/lib/ipsec/nss).

.RE

.PP **--password password**

Specify the password to use when accessing the NSS database (default contained in /etc/ipsec.d/nsspassword).

.RE

.SS "List Options"

.PP **--list**

List the private keys.

.RE

.PP **--dump**

List, with more details, the private keys.

.RE

.SS "Public Key Options"

.PP **--ckaid ckaid**

Select the public key to display using the NSS ckaid.

.RE

.PP **--rsaid rsaid**

Select the public key to display using the RSA key ID.

.RE

.PP **--pem**

Print the selected public key in PEM encoded ASN.1 format.

.RE

.PP **--left**  
**--right**

Print the selected public key in [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) format, as a *leftrsasigkey* or *rightrsasigkey* parameter respectively. For example, **--left** might give (with the key data trimmed down for clarity):

.RS 4 leftrsasigkey=0sAQOF8tZ2...+buFuFn/

.RE

.PP **--ipseckey**

Print the selected public key in a format suitable for use as opportunistic-encryption DNS IPSECKEY record format (RFC 4025). A gateway can be specified with the **--gateway**, which currently supports IPv4 and IPv6 addresses. For the host name, the value returned by *gethostname* is used, with a *.* appended.

For example, **--ipseckey --gateway 10.11.12.13** might give (with the key data trimmed for clarity):

.RS 4 IN IPSECKEY 10 1 2 10.11.12.13 AQOF8tZ2...+buFuFn/"

.RE

.PP **--gateway gateway**

For **--ipseckey**, specify the *gateway* to display with the DNS IPSECKEY record.

.RE

.PP **--precedence precedence**

For **--ipseckey**, specify the *precedence* to display with the DNS IPSECKEY record.

.RE

.SH "DIAGNOSTICS"

.PP A complaint about “no pubkey line found” indicates that the host has a key but it was generated with an old version of FreeS/WAN and does not contain the information that *showhostkey* needs.

.SH "FILES"

.PP /var/lib/ipsec/nss, /etc/ipsec.d/nsspassword

.SH "SEE ALSO"

.PP [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5), [**ipsec-rsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-rsasigkey.8), [**ipsec-newhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-newhostkey.8)

.SH "HISTORY"

.PP Written for the Linux FreeS/WAN project <**https://www.freeswan.org**> by Henry Spencer. Updated by Paul Wouters for the IPSECKEY format.

.SH "BUGS"

.PP Arguably, rather than just reporting the no-IN-KEY-line-found problem, **showhostkey** should be smart enough to run the existing key through *rsasigkey* with the **--oldkey** option, to generate a suitable output line.

.SH "AUTHOR"

Andrew Cagney, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

08/30/2026 Libreswan v5.4-HEAD

---

Document: ipsec-showhostkey(8) from libreswan 5.4-r2 (Chainguard OS)
Source: https://github.com/libreswan/libreswan