NVME-GEN-TLS-KEY(1)

📦 version 3.2, in arch rolling

💅 NVME-GEN-TLS-KEY — bestie, it's a whole manual page

okay so real talk: this is nvme-gen-tls-key from the NVMe Manual — part of the nvme command family. Yes she's deprecated. Yes we're still gonna learn her. Let's go 🎀

✨ NAME ✨

nvme-gen-tls-key — generate a NVMe TLS PSK. 🦋

and yes, she's deprecated — noted, moving on, still iconic.

🌸 SYNOPSIS 🌸

nvme [<global-options>] gen-tls-key [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--hostnqn=<nqn> | -n <nqn>]
                        [--subsysnqn=<nqn> | -c <nqn>]
                        [--hmac=<hmac-id> | -m <hmac-id>]
                        [--identity=<id-vers> | -I <id-vers>]
                        [--secret=<secret> | -s <secret>]
                        [--insert | -i]
                        [--compat | -C]
                        [--keyfile=<keyfile> | -f <keyfile>]

like look at her, all those flags, she's serving range 💅

💖 DESCRIPTION 💖

So this command is a deprecated alias for nvme-keys-gen-tls-psk(1). It's kept around for scripts that were written against nvme-cli versions older than 3.0 — legacy support era, we love a nostalgic queen 🙈

But she's not a perfect copy of the old one. There are three differences from nvme-cli 2.x, and honestly? These matter. Pay attention bestie:

  • --insert / -i now reports Inserted TLS PSK <serial>, where 2.x used to say Inserted TLS key <serial>. So if your script matches the old wording, it needs updating. Periodt. No cap, that string match will break 🔥
  • A --secret with an odd number of hexadecimal characters gets rejected. In 2.x it padded the trailing character with a zero and emitted a secret that was never actually given — the exact same behaviour nvme-gen-dhchap-key(1) had. Not anymore. We're honest now ✨
  • The diagnostics that validate --secret go to stdout, where 2.x put them on stderr. Wild, I know. Most of them accompany a non-zero exit, but Skipping excess secret bytes does not — an over-long --secret still exits 0, with the warning sitting on stdout ahead of the key. So a script reading the key off stdout gets the warning instead. 😭💀 That's a trap, fr fr.
⚠️ New scripts should use nvme keys gen-tls-psk instead. This alias prints a deprecation warning on stderr and may be removed in a future release. Don't get attached, she's leaving.

See nvme-keys-gen-tls-psk(1) for the full option reference. That's where the real main character energy lives 👑

🌈 GLOBAL OPTIONS 🌈

These bad boys are defined at the top-level nvme command and are available to this subcommand. Group-chat-wide settings, iykyk:

  • --dry-run — prints the command that would be executed, but doesn't actually execute it. Manifesting the command without running it, honestly iconic 🧚
  • --no-ioctl-probing — disables probing for 64-bit IOCTL support. Just... no probing. None. 🚫
  • --no-retries — disables retry logic on transient errors. One shot, one opportunity, no second chances 💅
  • -o <fmt>, --output-format=<fmt> — sets the reporting format to normal, tabular, json, or binary. Only one output format at a time, okay? Pick one. Choose your fighter ⭐
  • --output-format-version=<version> — selects the output format version. Version 1 uses the original field naming, while version 2 (the default) provides more consistent and script-friendly field names. Other versions get rejected. We don't do off-brand versions here 🙅
  • --quiet — suppresses informational messages. Errors are still reported, and --quiet cancels any --verbose for the library log level. She's quiet but she still will tell you when something's wrong 🫶
  • --set-options=<key=value>[,<key=value>...] — sets libnvme library options for this invocation. Supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir. Customize away, bestie ✨
  • --timeout=<ms> — sets the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). Patience is a virtue, or just... forever 🔥
  • -v, --verbose — increases the level of detail in the output. May be specified multiple times to further increase verbosity. Stack her up, she loves to talk 💬

These options can also be set as machine-wide defaults in nvme-cli.conf(5). And a command-line flag always overrides the file — CLI stays winning, as she should 👑

🍓 EXAMPLES 🍓

No Examples.

(yeah. that's it. that's the section. she gave us nothing but vibes 💀)

🦋 NVME 🦋

Part of the nvme-user suite. Proud member, no cap 🌸

🌟 SEE ALSO 🌟

and that's the whole page!! ngl this one was a little cursed (deprecated AND tricky stdout behaviour, a combo 😭) but we got through it together 🫶

🎀 sign-off time: this beauty comes from NVMe, dated 10/30/2026, and lives under the identifier NVME-GEN-TLS-KEY(1). Take care of her, she's deprecated 💜
📦 where this page comes from