IPSEC-SHOWHOSTKEY(8)

📦
version 5.4.1 · 10 versions
, in fedora 43, fedora 44

💖 IPSEC-SHOWHOSTKEY(8) 💖

okay bestie, gather round, because this little cutie lives in section 8 of your manual (executable programs, yk the "the grown-ups run this" zone) and it's literally just here to show you your host's authentication key. her whole name is ipsec-showhostkey — colloquially showhostkey. she's giving backstage-pass energy.

✨ NAME ✨

ipsec-showhostkey — show host's authentication key 👑

🎀 SYNOPSIS 🎀

ipsec showhostkey [--verbose] [--nssdir directory] [--nsspw password]
                  [--seeddev device] [--seedbits bits]
                  {--version | --list | --dump | --left | --right | --ipseckey | --pem}
                  [--ckaid ckaid | --rsaid rsaid]
                  [--gateway gateway] [--precedence precedence]

🌸 DESCRIPTION 🌸

so basically 💅 showhostkey prints out — on standard output, she's not shy — a public key that's suitable for this host, in the format you asked for, using the host key info that's chillin' in the NSS database.

and ngl, there's a gatekeeping thing here: since only the super-user can even get into the NSS database, in general only the super-user gets to display the public key info. main character privileges only. 🔥

🌈 Common Options

  • --version — print the libreswan version and then dip. that's it, that's the whole job. ✨
  • --verbose — turn the verbosity up. more talking. 💬
  • --nssdir nssdir — pick which libreswan directory holds the NSS database. the default is /var/lib/ipsec/nss. 📁
  • --password password — say which password to use when you go knocking on the NSS database. the default one lives in /etc/ipsec.d/nsspassword. 🔐

🦋 List Options

  • --list — list the private keys. just the keys, no drama. 🗒️
  • --dump — same list energy but with more details. she's an over-sharer and we love her. 💅

💜 Public Key Options

  • --ckaid ckaid — pick which public key to display by using the NSS ckaid. 🎯
  • --rsaid rsaid — pick which public key to display by using the RSA key ID. 🎯
  • --pem — print that selected public key in PEM encoded ASN.1 format. fancy little certificate-girl vibe. 🎀
  • --left, --right — print the selected public key in ipsec.conf(5) format, as a leftrsasigkey or rightrsasigkey parameter respectively. like, for example, --left might give you this (key data trimmed down so you can actually read it):
leftrsasigkey=0sAQOF8tZ2...+buFuFn/
  • --ipseckey — print the selected public key in a format that works as the opportunistic-encryption DNS IPSECKEY record format (RFC 4025). you can specify a gateway with --gateway, which rn supports IPv4 and IPv6 addresses. as for the host name, whatever gethostname hands back is what gets used, with a . appended. ok so for example, --ipseckey --gateway 10.11.12.13 might give you this (key data trimmed for clarity):
IN    IPSECKEY  10 1 2 10.11.12.13  AQOF8tZ2...+buFuFn/"
  • --gateway gateway — for --ipseckey, say which gateway to display alongside the DNS IPSECKEY record. 🚪
  • --precedence precedence — for --ipseckey, say which precedence to display alongside the DNS IPSECKEY record. 📊

😭 DIAGNOSTICS 😭

if you ever see a complaint about “no pubkey line found”, that means your host does have a key, but it was generated with an old version of FreeS/WAN and it doesn't have the info that showhostkey needs. vintage, but not in the cute way. 💀

📂 FILES 📂

/var/lib/ipsec/nss, /etc/ipsec.d/nsspassword

🫶 SEE ALSO 🫶

ipsec.conf(5), ipsec-rsasigkey(8), ipsec-newhostkey(8)

📜 HISTORY 📜

written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry Spencer. then Paul Wouters updated it for the IPSECKEY format. glow-up, honestly. ✨

💀 BUGS 💀

arguably — and bestie they said arguably, this is their words not mine — instead of just reporting the no-IN-KEY-line-found problem, showhostkey should be smart enough to run the existing key through rsasigkey with the --oldkey option, so it could generate a suitable output line. like c'mon girl, do the work. 🙈

👑 AUTHOR 👑

Andrew Cagney, Daniel Kahn Gillmor, D. Hugh Redelmeier, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

okay that's the whole page, we ate and left no crumbs 🍓💅 this was Libreswan 5.4.1, dated 10/23/2026, and it's literally the IPSEC-SHOWHOSTKEY(8) page so you know exactly where to find her again. periodt. 🌈⭐

📦 where this page comes from