IPSEC_NEWHOSTKEY(8)

📦
version 4.15 · 4 versions
, in centos-stream 9

💅 IPSEC_NEWHOSTKEY(8) 💅

ok so bestie, welcome to the ipsec_newhostkey page — it lives in the Executable programs manual, and it's genuinely one of the most useful little gremlins in the libreswan toolbox. pull up a chair 🎀

✨ NAME ✨

ipsec_newhostkey — generate a new raw RSA authentication key for a host 🌸

🎀 SYNOPSIS 🎀

ipsec newhostkey [[--quiet] | [--verbose]] [--nssdirnssdir]
      [--password password] [--bits bits] [--curve curve]
      [--keytype rsa|ecdsa] [--seeddev device]

🦋 DESCRIPTION 🦋

okay so here's the vibe: newhostkey generates an RSA public/private key pair that's suitable for authenticating this host, and then it stores that key pair in the NSS database. that's it, that's the whole job, and it does it beautifully 💖

and if you're sitting there like "cool but how do i actually get the public key back out?" — breathe, bestie, that's literally what ipsec_showhostkey(8) is for. go see her. she's iconic for that.

🌸 Output Options 🌸

  • --quiet — the --quiet option suppresses both the rsasigkey narrative and the existing-file warning message. so it just shuts up and works. no cap 🤫
  • --nssdir nssdir — this one tells it where the NSS DB directory lives, i.e. the place where the certificate, key, and modsec databases reside. the default is /var/lib/ipsec/nss 🗂️
  • --password password — specifies a module authentication password, which you might need if FIPS mode is enabled. think of it as the secret handshake ✨
  • --bits bits — sets how many bits go in the RSA key. the current default is a random value that's a multiple of 16, somewhere between 3072 and 4096. the minimum allowed is 2192 — go below that and it's not it, bestie 😭
  • --curve curve — specifies the named curve used in the ECDSA key. current default is secp256r1. for the full list of available curve names, go check ipsec_ecdsasigkey(8) 🌀
  • --keytype rsa|ecdsa — picks the type of key: either rsa (RSA) or ecdsa (ECDSA). if you omit it entirely, the current default is rsa 🔑
  • --seeddev device — used to specify the random device (default /dev/random) used to seed the crypto library RNG. main character energy for entropy purposes 🌈

⭐ FILES ⭐

/dev/random, /dev/urandom — the randomness girlies 🍓

🔥 SEE ALSO 🔥

ipsec_rsasigkey(8), ipsec_showhostkey(8), ipsec.secrets(5) — go read these too, iykyk 👑

👑 HISTORY 👑

originally written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry Spencer. later updated by Paul Wouters. a whole lineage, honestly 🫶

💀 BUGS 💀

ok so real talk, this is the part where you do not get to be impatient. as with rsasigkey, the run time is difficult to predict — because depletion of the system's randomness pool can cause arbitrarily long waits for random bits for seeding the NSS library, and the prime-number searches can also take unpredictable (and potentially large) amounts of CPU time. so like… go make a snack, bestie. it'll be done when it's done 😭

see ipsec_rsasigkey(8) for more on that.

fr fr do not assume this returns fast. it is not giving speedrun energy.

🫶 AUTHOR 🫶

Paul Wouters

  • placeholder to suppress warning 🙈

and that's the whole page, bestie! this one's from libreswan, dated 10/19/2026 — slay, go generate some keys, and remember: --quiet if you can't handle the narration 💜✨

📦 where this page comes from