IPSEC(8) Executable programs IPSEC(8)

.SH "NAME" ipsec - invoke IPsec utilities

.SH "SYNOPSIS"

.HP 144u

**ipsec**  
*command*  
\[*argument*...]

.HP 264u

**ipsec help**

.HP 336u

**ipsec version**

.HP 384u

**ipsec directory**

.SH "DESCRIPTION"

.PP **ipsec** invokes any of several utilities involved in controlling the IPsec encryption/authentication system, running the specified *command* with the specified *argument* as if it had been invoked directly. This largely eliminates possible name collisions with other software, and also permits some centralized services.

.PP **ipsec help** lists the available commands. Most have their own manual pages.

.PP **ipsec version** outputs the software version.

.PP **ipsec directory** reports where the **ipsec** sub-commands are stored.

.SH "COMMANDS"

.PP To get a list of supported commands, use the command **ipsec --help**. The full set of commands are listed below:

.PP **ipsec start**  
**ipsec stop**  
**ipsec restart**  
**ipsec listen**

Used to control the **pluto** daemon using the host init system. Supported init systems are sysv, systemd, upstart and openrc.

See [**ipsec-start**(8)](/man/enterprise-packages/libreswan/ipsec-start.8), [**ipsec-stop**(8)](/man/enterprise-packages/libreswan/ipsec-stop.8), [**ipsec-listen**(8)](/man/enterprise-packages/libreswan/ipsec-listen.8), and [**ipsec-restart**(8)](/man/enterprise-packages/libreswan/ipsec-restart.8).

.RE

.PP **ipsec add**  
**ipsec up**  
**ipsec start**  
**ipsec route**  
**ipsec unroute**  
**ipsec ondemand**  
**ipsec down**  
**ipsec delete**  
**ipsec redirect**  
**ipsec replace**

Used to manually add, remove and manipulate connections.

See [**ipsec-add**(8)](/man/enterprise-packages/libreswan/ipsec-add.8), [**ipsec-redirect**(8)](/man/enterprise-packages/libreswan/ipsec-redirect.8), [**ipsec-up**(8)](/man/enterprise-packages/libreswan/ipsec-up.8), [**ipsec-start**(8)](/man/enterprise-packages/libreswan/ipsec-start.8), [**ipsec-route**(8)](/man/enterprise-packages/libreswan/ipsec-route.8), [**ipsec-unroute**(8)](/man/enterprise-packages/libreswan/ipsec-unroute.8), [**ipsec-ondemand**(8)](/man/enterprise-packages/libreswan/ipsec-ondemand.8), [**ipsec-down**(8)](/man/enterprise-packages/libreswan/ipsec-down.8), [**ipsec-replace**(8)](/man/enterprise-packages/libreswan/ipsec-replace.8), and [**ipsec-delete**(8)](/man/enterprise-packages/libreswan/ipsec-delete.8).

.RE

.PP **ipsec status**  
**ipsec briefstatus**  
**ipsec connectionstatus**  
**ipsec briefconnectionstatus**  
**ipsec trafficstatus**  
**ipsec shuntstatus**

Used to display information about connections and their current status.

See [**ipsec-status**(8)](/man/enterprise-packages/libreswan/ipsec-status.8), [**ipsec-briefstatus**(8)](/man/enterprise-packages/libreswan/ipsec-briefstatus.8), [**ipsec-trafficstatus**(8)](/man/enterprise-packages/libreswan/ipsec-trafficstatus.8), [**ipsec-connectionstatus**(8)](/man/enterprise-packages/libreswan/ipsec-connectionstatus.8), [**ipsec-shuntstatus**(8)](/man/enterprise-packages/libreswan/ipsec-shuntstatus.8), and [**ipsec-briefconnectionstatus**(8)](/man/enterprise-packages/libreswan/ipsec-briefconnectionstatus.8).

.RE

.PP **ipsec initnss**  
**ipsec checknss**  
**ipsec import**  
**ipsec listall**  
**ipsec listcerts**  
**ipsec rereadsecrets**  
**ipsec listpubkeys**  
**ipsec rereadcerts**  
**ipsec listcacerts**  
**ipsec rereadall**  
**ipsec rereadsecrets**

Used to initialise, verify, and manipulate the NSS database that contains all the X.509 certificate information and private RSA keys.

See [**ipsec-initnss**(8)](/man/enterprise-packages/libreswan/ipsec-initnss.8), [**ipsec-rereadall**(8)](/man/enterprise-packages/libreswan/ipsec-rereadall.8), [**ipsec-rereadsecrets**(8)](/man/enterprise-packages/libreswan/ipsec-rereadsecrets.8), [**ipsec-listall**(8)](/man/enterprise-packages/libreswan/ipsec-listall.8), [**ipsec-checknss**(8)](/man/enterprise-packages/libreswan/ipsec-checknss.8), [**ipsec-import**(8)](/man/enterprise-packages/libreswan/ipsec-import.8), [**ipsec-rereadcerts**(8)](/man/enterprise-packages/libreswan/ipsec-rereadcerts.8), [**ipsec-listcerts**(8)](/man/enterprise-packages/libreswan/ipsec-listcerts.8), [**ipsec-listcacerts**(8)](/man/enterprise-packages/libreswan/ipsec-listcacerts.8), [**ipsec-fips**(8)](/man/enterprise-packages/libreswan/ipsec-fips.8), [**ipsec-rereadsecrets**(8)](/man/enterprise-packages/libreswan/ipsec-rereadsecrets.8), [**ipsec-listpubkeys**(8)](/man/enterprise-packages/libreswan/ipsec-listpubkeys.8), and [**ipsec-pk12status**(8)](/man/enterprise-packages/libreswan/ipsec-pk12status.8).

.RE

.PP **ipsec fetchcrls**  
**ipsec listcrls**

Update and display the Certificate Revocation List.

See [**ipsec-fetchcrls**(8)](/man/enterprise-packages/libreswan/ipsec-fetchcrls.8), and [**ipsec-listcrls**(8)](/man/enterprise-packages/libreswan/ipsec-listcrls.8).

.RE

.PP **ipsec certutil**  
**ipsec crlutil**  
**ipsec modutil**  
**ipsec pk12util**  
**ipsec vfychain**

Wrappers around the NSS **pk12util**, **modutil**, **certutil**, and **crlutil** that can be used to directly manipulate Libreswan's NSS database.

See [**ipsec-certutil**(8)](/man/enterprise-packages/libreswan/ipsec-certutil.8), [**ipsec-crlutil**(8)](/man/enterprise-packages/libreswan/ipsec-crlutil.8). [**ipsec-modutil**(8)](/man/enterprise-packages/libreswan/ipsec-modutil.8), [**ipsec-pk12util**(8)](/man/enterprise-packages/libreswan/ipsec-pk12util.8), and [**ipsec-vfychain**(8)](/man/enterprise-packages/libreswan/ipsec-vfychain.8).

.RE

.PP **ipsec checkconfig**  
**ipsec readwriteconf**

Used to validate and dump the ipsec file (default /etc/ipsec.conf).

See [**ipsec-checkconfig**(8)](/man/enterprise-packages/libreswan/ipsec-checkconfig.8), and [**ipsec-readwriteconf**(8)](/man/enterprise-packages/libreswan/ipsec-readwriteconf.8).

.RE

.PP **ipsec checknflog**  
**ipsec stopnflog**

Used to initialise and delete iptable rules for the nflog devices when specified via the nflog= or nflog-all= configuration options.

See [**ipsec-checknflog**(8)](/man/enterprise-packages/libreswan/ipsec-checknflog.8), and [**ipsec-stopnflog**(8)](/man/enterprise-packages/libreswan/ipsec-stopnflog.8).

.RE

.PP **ipsec whack**

Low-level utility for manipulating Libreswan's daemon **pluto**.

See [**ipsec-whack**(8)](/man/enterprise-packages/libreswan/ipsec-whack.8).

.RE

.PP **ipsec pluto**

Libreswan's daemon that implements the Internet Key Exchange protocols.

See [**ipsec-pluto**(8)](/man/enterprise-packages/libreswan/ipsec-pluto.8).

.RE

.PP **ipsec showhostkey**  
**ipsec newhostkey**  
**ipsec ecdsasigkey**  
**ipsec eddsasigkey**  
**ipsec rsasigkey**

Generate and display raw host keys stored in the NSS database. **ipsec eddsasigkey** is not built by default.

See: [**ipsec-showhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-showhostkey.8), [**ipsec-newhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-newhostkey.8), [**ipsec-ecdsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-ecdsasigkey.8), [**ipsec-eddsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-eddsasigkey.8), [**ipsec-rsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-rsasigkey.8).

.RE

.PP **ipsec algparse**

Utility for displaying and verifying cryptographic proposals.

See: [**ipsec-algparse**(8)](/man/enterprise-packages/libreswan/ipsec-algparse.8).

.RE

.PP **ipsec showroute**

Utility for displaying the routing information.

See: [**ipsec-showroute**(8)](/man/enterprise-packages/libreswan/ipsec-showroute.8).

.RE

.PP **ipsec letsencrypt**

Utility for generating letsencrypt keys.

See: [**ipsec-letsencrypt**(8)](/man/enterprise-packages/libreswan/ipsec-letsencrypt.8).

.RE

.PP **ipsec fipsstatus**  
**ipsec cavp**

Display FIPS status and run FIPS crypto tests for CAVP complance.

See: [**ipsec-fipsstatus**(8)](/man/enterprise-packages/libreswan/ipsec-fipsstatus.8), [**ipsec-cavp**(8)](/man/enterprise-packages/libreswan/ipsec-cavp.8).

.RE

.SH "RETURN CODE"

.PP The ipsec command passes the return code of the sub-command back to the caller. The only exception is when **ipsec pluto** is used without **--nofork**, as it will fork into the background and the ipsec command returns success while the pluto daemon may in fact exit with an error code after the fork.

# [FILES](#FILES)

.PP /usr/libexec/ipsec usual utilities directory

# [SEE ALSO](#SEE_ALSO)

.PP [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5), [**ipsec-add**(8)](/man/enterprise-packages/libreswan/ipsec-add.8), [**ipsec-algparse**(8)](/man/enterprise-packages/libreswan/ipsec-algparse.8), [**ipsec-briefconnectionstatus**(8)](/man/enterprise-packages/libreswan/ipsec-briefconnectionstatus.8), [**ipsec-briefstatus**(8)](/man/enterprise-packages/libreswan/ipsec-briefstatus.8), [**ipsec-certutil**(8)](/man/enterprise-packages/libreswan/ipsec-certutil.8), [**ipsec-checkconfig**(8)](/man/enterprise-packages/libreswan/ipsec-checkconfig.8), [**ipsec-checknflog**(8)](/man/enterprise-packages/libreswan/ipsec-checknflog.8), [**ipsec-checknss**(8)](/man/enterprise-packages/libreswan/ipsec-checknss.8), [**ipsec-connectionstatus**(8)](/man/enterprise-packages/libreswan/ipsec-connectionstatus.8), [**ipsec-crlutil**(8)](/man/enterprise-packages/libreswan/ipsec-crlutil.8), [**ipsec-delete**(8)](/man/enterprise-packages/libreswan/ipsec-delete.8), [**ipsec-down**(8)](/man/enterprise-packages/libreswan/ipsec-down.8), [**ipsec-ecdsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-ecdsasigkey.8), [**ipsec-fetchcrls**(8)](/man/enterprise-packages/libreswan/ipsec-fetchcrls.8), [**ipsec-fipsstatus**(8)](/man/enterprise-packages/libreswan/ipsec-fipsstatus.8), [**ipsec-globalstatus**(8)](/man/enterprise-packages/libreswan/ipsec-globalstatus.8), [**ipsec-import**(8)](/man/enterprise-packages/libreswan/ipsec-import.8), [**ipsec-initnss**(8)](/man/enterprise-packages/libreswan/ipsec-initnss.8), [**ipsec-letsencrypt**(8)](/man/enterprise-packages/libreswan/ipsec-letsencrypt.8), [**ipsec-listall**(8)](/man/enterprise-packages/libreswan/ipsec-listall.8), [**ipsec-listcacerts**(8)](/man/enterprise-packages/libreswan/ipsec-listcacerts.8), [**ipsec-listcerts**(8)](/man/enterprise-packages/libreswan/ipsec-listcerts.8), [**ipsec-listcrls**(8)](/man/enterprise-packages/libreswan/ipsec-listcrls.8), [**ipsec-listen**(8)](/man/enterprise-packages/libreswan/ipsec-listen.8), [**ipsec-listpubkeys**(8)](/man/enterprise-packages/libreswan/ipsec-listpubkeys.8), [**ipsec-modutil**(8)](/man/enterprise-packages/libreswan/ipsec-modutil.8), [**ipsec-newhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-newhostkey.8), [**ipsec-ondemand**(8)](/man/enterprise-packages/libreswan/ipsec-ondemand.8), [**ipsec-pk12util**(8)](/man/enterprise-packages/libreswan/ipsec-pk12util.8), [**ipsec-pluto**(8)](/man/enterprise-packages/libreswan/ipsec-pluto.8), [**ipsec-purgeocsp**(8)](/man/enterprise-packages/libreswan/ipsec-purgeocsp.8), [**ipsec-redirect**(8)](/man/enterprise-packages/libreswan/ipsec-redirect.8), [**ipsec-replace**(8)](/man/enterprise-packages/libreswan/ipsec-replace.8), [**ipsec-rereadall**(8)](/man/enterprise-packages/libreswan/ipsec-rereadall.8), [**ipsec-rereadcerts**(8)](/man/enterprise-packages/libreswan/ipsec-rereadcerts.8), [**ipsec-rereadsecrets**(8)](/man/enterprise-packages/libreswan/ipsec-rereadsecrets.8), [**ipsec-restart**(8)](/man/enterprise-packages/libreswan/ipsec-restart.8), [**ipsec-route**(8)](/man/enterprise-packages/libreswan/ipsec-route.8), [**ipsec-rsasigkey**(8)](/man/enterprise-packages/libreswan/ipsec-rsasigkey.8), [**ipsec-setup**(8)](/man/enterprise-packages/libreswan/ipsec-setup.8), [**ipsec-showhostkey**(8)](/man/enterprise-packages/libreswan/ipsec-showhostkey.8), [**ipsec-showroute**(8)](/man/enterprise-packages/libreswan/ipsec-showroute.8), [**ipsec-showstates**(8)](/man/enterprise-packages/libreswan/ipsec-showstates.8), [**ipsec-shuntstatus**(8)](/man/enterprise-packages/libreswan/ipsec-shuntstatus.8), [**ipsec-start**(8)](/man/enterprise-packages/libreswan/ipsec-start.8), [**ipsec-status**(8)](/man/enterprise-packages/libreswan/ipsec-status.8), [**ipsec-stop**(8)](/man/enterprise-packages/libreswan/ipsec-stop.8), [**ipsec-trafficstatus**(8)](/man/enterprise-packages/libreswan/ipsec-trafficstatus.8), [**ipsec-unroute**(8)](/man/enterprise-packages/libreswan/ipsec-unroute.8), [**ipsec-up**(8)](/man/enterprise-packages/libreswan/ipsec-up.8), [**ipsec-vfychain**(8)](/man/enterprise-packages/libreswan/ipsec-vfychain.8), [**ipsec-whack**(8)](/man/enterprise-packages/libreswan/ipsec-whack.8)

.SH "AUTHOR"

Andrew Cagney, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

10/23/2026 Libreswan v5.4.1-HEAD

---

Document: ipsec(8) from libreswan 5.4.1-r1 (Chainguard OS)
Source: https://github.com/libreswan/libreswan