| IPSEC-NEWHOSTKEY(8) | Executable programs | IPSEC-NEWHOSTKEY(8) |
.SH "NAME" ipsec-newhostkey - generate a new raw RSA authentication
key for a host
.SH "SYNOPSIS"
.HP 144u
ipsec
newhostkey
[ | --quiet | --verbose
]
[--nssdir directory] [--nsspw password]
[--seeddev device] [--seedbits bits]
[--bits bits]
[--curve curve]
[--keytype rsa|ecdsa]
.SH "DESCRIPTION"
.PP newhostkey generates an RSA public/private key pair suitable for
authenticating this host is generated and stored in the NSS database.
.PP See ipsec-showhostkey(8) for how to extract the public key from
the NSS database.
.SS "Output Options"
.PP --quiet
The --quiet option suppresses both the rsasigkey narrative and the existing-file warning message.
.RE
.PP --nssdir /var/lib/ipsec/nss
The --nssdir option specifies the NSS DB directory where the certificate key, and modsec databases reside (default /var/lib/ipsec/nss)
.RE
.PP --password password
The --password option specifies a module authentication password that may be required if FIPS mode is enabled.
.RE
.PP --bits bits
The --bits option specifies the number of bits in the RSA key; the current default is a random (multiple of 16) value between 3072 and 4096. The minimum allowed is 2192.
.RE
.PP --curve curve
The --curve option specifies the named curve used in the ECDSA key; the current default is secp256r1. See ipsec-ecdsasigkey(8) for the available curve names.
.RE
.PP --keytype rsa|ecdsa
The --keytype option specifies the type of key, which can either be rsa (RSA) or ecdsa (ECDSA); if omitted the current default is rsa.
.RE
.PP --seeddev device
The --seeddev is used to specify the random device (default /dev/random used to seed the crypto library RNG.
.RE
.SH "FILES"
.PP /dev/random, /dev/urandom
.SH "SEE ALSO"
.PP ipsec-rsasigkey(8), ipsec-showhostkey(8),
ipsec.secrets(5)
.SH "HISTORY"
.PP Originally written for the Linux FreeS/WAN project
<https://www.freeswan.org> by Henry Spencer. Updated by Paul
Wouters
.SH "BUGS"
.PP As with rsasigkey, the run time is difficult to predict, since
depletion of the system's randomness pool can cause arbitrarily long waits
for random bits for seeding the NSS library, and the prime-number searches
can also take unpredictable (and potentially large) amounts of CPU time. See
ipsec-rsasigkey(8).
.SH "AUTHOR"
Andrew Cagney, Daiki Ueno, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose
Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini
| 10/06/2026 | Libreswan v5.4.1-HEAD |