ipsec-showhostkey(8) — Chainguard OS Manuals

IPSEC-SHOWHOSTKEY(8)

Executable programs

IPSEC-SHOWHOSTKEY(8)

.SH "NAME" ipsec-showhostkey - show host's authentication key

.SH "SYNOPSIS"

.HP 432u

ipsec showhostkey

[--verbose]
[--nssdir directory] [--nsspw password] [--seeddev device] [--seedbits bits]

{| --version | --list | --dump | --left | --right | --ipseckey | --pem}

[| --ckaid ckaid | --rsaid rsaid]

[--gateway gateway]
[--precedence precedence]

.SH "DESCRIPTION"

.PP Showhostkey outputs (on standard output) a public key suitable for this host, in the format specified, using the host key information stored in the NSS database.

.PP In general, since only the super-user can access the NSS database, only the super-user can display the public key information.

.SS "Common Options"

.PP --version

Print the libreswan version, then exit.

.RE

.PP --verbose

Increase the verbosity.

.RE

.PP --nssdir nssdir

Specify the libreswan directory that contains the NSS database (default /var/lib/ipsec/nss).

.RE

.PP --password password

Specify the password to use when accessing the NSS database (default contained in /etc/ipsec.d/nsspassword).

.RE

.SS "List Options"

.PP --list

List the private keys.

.RE

.PP --dump

List, with more details, the private keys.

.RE

.SS "Public Key Options"

.PP --ckaid ckaid

Select the public key to display using the NSS ckaid.

.RE

.PP --rsaid rsaid

Select the public key to display using the RSA key ID.

.RE

.PP --pem

Print the selected public key in PEM encoded ASN.1 format.

.RE

.PP --left
--right

Print the selected public key in ipsec.conf(5) format, as a leftrsasigkey or rightrsasigkey parameter respectively. For example, --left might give (with the key data trimmed down for clarity):

.RS 4 leftrsasigkey=0sAQOF8tZ2...+buFuFn/

.RE

.PP --ipseckey

Print the selected public key in a format suitable for use as opportunistic-encryption DNS IPSECKEY record format (RFC 4025). A gateway can be specified with the --gateway, which currently supports IPv4 and IPv6 addresses. For the host name, the value returned by gethostname is used, with a . appended.

For example, --ipseckey --gateway 10.11.12.13 might give (with the key data trimmed for clarity):

.RS 4 IN IPSECKEY 10 1 2 10.11.12.13 AQOF8tZ2...+buFuFn/"

.RE

.PP --gateway gateway

For --ipseckey, specify the gateway to display with the DNS IPSECKEY record.

.RE

.PP --precedence precedence

For --ipseckey, specify the precedence to display with the DNS IPSECKEY record.

.RE

.SH "DIAGNOSTICS"

.PP A complaint about “no pubkey line found” indicates that the host has a key but it was generated with an old version of FreeS/WAN and does not contain the information that showhostkey needs.

.SH "FILES"

.PP /var/lib/ipsec/nss, /etc/ipsec.d/nsspassword

.SH "HISTORY"

.PP Written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry Spencer. Updated by Paul Wouters for the IPSECKEY format.

.SH "BUGS"

.PP Arguably, rather than just reporting the no-IN-KEY-line-found problem, showhostkey should be smart enough to run the existing key through rsasigkey with the --oldkey option, to generate a suitable output line.

.SH "AUTHOR"

Andrew Cagney, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

10/06/2026

Libreswan v5.4.1-HEAD