IPSEC_SHOWHOSTKEY(8)

📦
version 4.15 · 4 versions
, in centos-stream 9

💅 ipsec_showhostkey — like, the whole manual, but make it make sense

Hey bestie, welcome to IPSEC_SHOWHOSTKEY(8) — the ipsec_showhostkey page, rewritten so you actually get it. Sit down, grab a strawberry 🍓, and let's go.

✨ NAME ✨

ipsec_showhostkey — shows off this host's authentication key. That's it. That's the vibe. 👑

🎀 SYNOPSIS 🎀

ipsec showhostkey [--verbose]
      {--version | --list | --dump | --left | --right | --ipseckey | --pem}
      [--ckaid ckaid | --rsaid rsaid]
      [--gateway gateway] [--precedence precedence]
      [--nssdir nssdir] [--password password]

Bestie, look at those curly braces. { } means pick exactly one, no cap. Pick two and it's not gonna be cute for you. 🙈

🌸 DESCRIPTION 🌸

showhostkey prints — on standard output, where all the good stuff goes — a public key that's suitable for this host, in whatever format you specified. Where does it get it? From the host key info chillin' in the NSS database. 🗄️✨

Okay so real talk: generally, since only the super-user can even access the NSS database, only the super-user can display the public key information. That's just how it is, bestie. Not my rules. 💀

💜 Common Options (the everyday girlies)

  • --version — prints the libreswan version and then dips out. Bye! 👋
  • --verbose — turns up the verbosity. More words, more info, more main character energy.
  • --nssdir nssdir — tells it which libreswan directory holds the NSS database. The default is /var/lib/ipsec/nss.
  • --password password — the password used when accessing the NSS database. The default is contained in /etc/ipsec.d/nsspassword.

🦋 List Options (just showing you what's there)

  • --list — lists the private keys.
  • --dump — lists the private keys with more details. She's thorough. 💅

🌈 Public Key Options (the actual key reveal)

  • --ckaid ckaid — selects which public key to display, using the NSS ckaid.
  • --rsaid rsaid — selects which public key to display, using the RSA key ID.
  • --pem — prints the selected public key in PEM encoded ASN.1 format. Fancy. 🎀
  • --left, --right — prints the selected public key in ipsec.conf(5) format, as a leftrsasigkey or rightrsasigkey parameter respectively. So --left might give you this (key data trimmed down for clarity, obviously):
leftrsasigkey=0sAQOF8tZ2...+buFuFn/
  • --ipseckey — prints the selected public key in a format suitable for use as opportunistic-encryption DNS IPSECKEY record format (RFC 4025). You can specify a gateway with the --gateway option, which currently supports IPv4 and IPv6 addresses. For the host name, the value returned by gethostname is used, with a . appended. Literally just a dot tacked on the end. That's the rule. ✨

For example, --ipseckey --gateway 10.11.12.13 might give you this (key data trimmed for clarity):

IN    IPSECKEY  10 1 2 10.11.12.13  AQOF8tZ2...+buFuFn/"
  • --gateway gateway — for --ipseckey, this specifies the gateway to display with the DNS IPSECKEY record.
  • --precedence precedence — for --ipseckey, this specifies the precedence to display with the DNS IPSECKEY record.

😭 DIAGNOSTICS 😭

If it complains about “no pubkey line found” — don't panic, here's the tea: it means the host has a key, but that key was generated with an old version of FreeS/WAN, and it doesn't contain the information that showhostkey needs. Old key, new tool, awkward silence. 🫠

🗂️ FILES 🗂️

  • /var/lib/ipsec/nss
  • /etc/ipsec.d/nsspassword

👀 SEE ALSO 👀

ipsec.conf(5), ipsec rsasigkey(8), ipsec newhostkey(8)

Go read those too, iykyk. 📚

🧚 HISTORY 🧚

Written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry Spencer. Updated by Paul Wouters for the IPSECKEY format. Character development, honestly. 🌱

💀 BUGS 💀

Arguably, rather than just reporting the no-IN-KEY-line-found problem, showhostkey should be smart enough to run the existing key through rsasigkey with the --oldkey option, to generate a suitable output line. Like… it could just fix it for you. It does not. Arguably. 🙈

🔥 AUTHOR 🔥

Paul Wouters

  • placeholder to suppress warning

(That's literally what it says. A placeholder. To suppress a warning. Iconic behaviour, no notes. 👑)

⭐ That's the whole page, bestie — from libreswan, dated 10/19/2026, the IPSEC_SHOWHOSTKEY(8) manual. Now go print a key and slay the day. 💖🦋✨

📦 where this page comes from