IPSEC-NEWHOSTKEY(8)

📦
version 5.4.1 · 10 versions
, in fedora 43, fedora 44

💖 IPSEC-NEWHOSTKEY ✨

okay so bestie, this is ipsec-newhostkey from section 8 of the manual (executable programs, yk the vibe) — and honestly? she's giving key-generation main character energy 👑

🌸 NAME 🌸

ipsec-newhostkey — generate a new raw RSA authentication key for a host

🎀 SYNOPSIS 🎀

ipsec newhostkey [--quiet | --verbose] [--nssdir directory]
      [--nsspw password] [--seeddev device] [--seedbits bits]
      [--bits bits] [--curve curve] [--keytype rsa|ecdsa]

✨ DESCRIPTION ✨

so like. newhostkey makes you an RSA public/private key pair that's suitable for authenticating this host, and then it stores that whole thing in the NSS database. iconic behavior honestly 💅

if you wanna know how to extract the public key out of the NSS database? go read ipsec-showhostkey(8) — she's got you 🫶

🦋 Output Options 🦋

  • --quiet — this one suppresses both the rsasigkey narrative and the existing-file warning message. like, shhh. no notes. 🤫
  • --nssdir directory — tells it where the NSS DB directory lives, the one where the certificate key and modsec databases hang out. default is /var/lib/ipsec/nss 🗂️
  • --password password — sets a module authentication password, which might be required if FIPS mode is turned on. lowkey important, don't sleep on it 🔐
  • --bits bits — the number of bits in the RSA key. current default is a random (multiple of 16) value between 3072 and 4096. the minimum allowed is 2192. so like, don't come at her with a tiny number please 😭
  • --curve curve — names the curve used in the ECDSA key. current default is secp256r1. for the full list of available curve names, go check ipsec-ecdsasigkey(8) 🌈
  • --keytype rsa|ecdsa — picks the type of key: either rsa (RSA) or ecdsa (ECDSA). if you omit it, the current default is rsa. fr fr ✨
  • --seeddev device — specifies the random device (default /dev/random) used to seed the crypto library RNG. slay 🎲

🍓 FILES 🍓

/dev/random, /dev/urandom

💜 SEE ALSO 💜

ipsec-rsasigkey(8), ipsec-showhostkey(8), ipsec.secrets(5)

🌟 HISTORY 🌟

Originally written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry Spencer. Updated by Paul Wouters. a whole legacy, we love to see it 👑

💀 BUGS 💀

okay so, same as with rsasigkey — the run time is difficult to predict. because depletion of the system's randomness pool can cause arbitrarily long waits for random bits for seeding the NSS library, and the prime-number searches can also take unpredictable (and potentially large) amounts of CPU time. like it's not being dramatic, it just. might take a while. 💀

See ipsec-rsasigkey(8).

bestie this is a real warning, not a vibe: long unpredictable waits are genuinely part of the deal here. plan accordingly 🙈

👑 AUTHOR 👑

Andrew Cagney, Daiki Ueno, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

and that's the whole page, bestie!! this was Libreswan 5.4.1, dated 10/23/2026 — tysm for reading, go generate some keys, ily, bye 🎀✨🦋

📦 where this page comes from