IPSEC_CHECKNSS(8)

✨ NAME ✨

okay so ipsec_checknss — yes, that's the ipsec_checknss(8) manual page, section 8, hiii 👋 — is literally the vibe for Initialise the IPsec NSS database. That's the whole name, no cap 💅

---

🎀 SYNOPSIS 🎀

ipsec checknss [--nssdir /var/lib/ipsec/nss] [--settrusts]

bestie, this is the exact shape of the command. The flags are --nssdir /var/lib/ipsec/nss and --settrusts, and we are keeping them exactly as written 🫶

---

🌸 DESCRIPTION 🌸

So checknss checks or initialises the NSS database — and that database is the main-character storage spot where all private keys for RSA and certificate keypairs are stored. iconic, honestly 👑

If you wanna remove an existing IPsec NSS database, the move is: remove all the *.db files and pkcs11.txt from the NSS data directory. The default NSS data directory is /var/lib/ipsec/nss. That's the exact path, don't @ me 💖

lowkey important: those are the files to remove if you're clearing out the existing database: all *.db files and pkcs11.txt in the NSS data directory. default: /var/lib/ipsec/nss ✨

---

🦋 SEE ALSO 🦋

• ipsec.conf(5)
• ipsec(8)
• ipsec_auto(8)
• ipsec_initnss(8)

go read those too, iykyk 📚💜

---

💀 BUGS 💀

none. literally none. the bugs section said none and we're respecting it 😌✨

---

👑 AUTHOR 👑

Tuomo Soini. that's the author, periodt 💅

---

mwah 💋 — this cutie page comes from libreswan, dated 10/19/2026. bye bestie, slay responsibly 🎀🦋💖