IPSEC-NEWHOSTKEY(8) Executable programs IPSEC-NEWHOSTKEY(8)

.SH "NAME" ipsec-newhostkey - generate a new raw RSA authentication key for a host

.SH "SYNOPSIS"

.HP 144u

**ipsec**  
*newhostkey*  
[ | --quiet | --verbose  
]  
\[--nssdir *directory*] \[--nsspw *password*] \[--seeddev *device*] \[--seedbits *bits*]

\[--bits *bits*]  
\[--curve *curve*]  
\[--keytype *rsa|ecdsa*]

.SH "DESCRIPTION"

.PP **newhostkey** generates an RSA public/private key pair suitable for authenticating this host is generated and stored in the NSS database.

.PP See [**ipsec-showhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-showhostkey.8) for how to extract the public key from the NSS database.

.SS "Output Options"

.PP **--quiet**

The **--quiet** option suppresses both the **rsasigkey** narrative and the existing-file warning message.

.RE

.PP **--nssdir /var/lib/ipsec/nss**

The **--nssdir** option specifies the NSS DB directory where the certificate key, and modsec databases reside (default /var/lib/ipsec/nss)

.RE

.PP **--password password**

The **--password** option specifies a module authentication *password* that may be required if FIPS mode is enabled.

.RE

.PP **--bits bits**

The **--bits** option specifies the number of bits in the RSA key; the current default is a random (multiple of 16) value between 3072 and 4096. The minimum allowed is 2192.

.RE

.PP **--curve curve**

The **--curve** option specifies the named curve used in the ECDSA key; the current default is secp256r1. See [**ipsec-ecdsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-ecdsasigkey.8) for the available curve names.

.RE

.PP **--keytype rsa|ecdsa**

The **--keytype** option specifies the type of key, which can either be *rsa* (RSA) or *ecdsa* (ECDSA); if omitted the current default is *rsa*.

.RE

.PP **--seeddev device**

The **--seeddev** is used to specify the random device (default /dev/random used to seed the crypto library RNG.

.RE

.SH "FILES"

.PP /dev/random, /dev/urandom

.SH "SEE ALSO"

.PP [**ipsec-rsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-rsasigkey.8), [**ipsec-showhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-showhostkey.8), [**ipsec.secrets**(5)](/man/enterprise-packages/libreswan/ipsec.secrets.5)

.SH "HISTORY"

.PP Originally written for the Linux FreeS/WAN project <**https://www.freeswan.org**> by Henry Spencer. Updated by Paul Wouters

.SH "BUGS"

.PP As with **rsasigkey**, the run time is difficult to predict, since depletion of the system's randomness pool can cause arbitrarily long waits for random bits for seeding the NSS library, and the prime-number searches can also take unpredictable (and potentially large) amounts of CPU time. See [**ipsec-rsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-rsasigkey.8).

.SH "AUTHOR"

Andrew Cagney, Daiki Ueno, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

10/23/2026 Libreswan v5.4.1-HEAD

---

Document: ipsec-newhostkey(8) from libreswan 5.4.1-r1 (Chainguard OS)
Source: https://github.com/libreswan/libreswan