Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help 
IPSEC_SHOWHOSTKEY(8)	       Executable programs	    IPSEC_SHOWHOSTKEY(8)

NAME
     ipsec_showhostkey - show host's authentication key

SYNOPSIS
     ipsec		showhostkey		 [--verbose]		 {--ver-
	   sion | --list | --dump | --left | --right | --ipseckey | --pem}
	   [--ckaid ckaid | --rsaid rsaid]
	   [--gateway gateway] [--precedence precedence]
	   [--nssdir nssdir] [--password password]

DESCRIPTION
     Showhostkey outputs (on standard output) a public	key  suitable  for  this
     host, in the format specified, using the host key information stored in the
     NSS database.

     In general, since only the super-user can access the NSS database, only the
     super-user can display the public key information.

   Common Options
     --version
	 Print the libreswan version, then exit.

     --verbose
	 Increase the verbosity.

     --nssdir nssdir
	 Specify the libreswan directory that contains the NSS database (default
	 /usr/local/etc/ipsec.d).

     --password password
	 Specify  the  password  to use when accessing the NSS database (default
	 contained in /usr/local/etc/ipsec.d/nsspassword).

   List Options
     --list
	 List the private keys.

     --dump
	 List, with more details, the private keys.

   Public Key Options
     --ckaid ckaid
	 Select the public key to display using the NSS ckaid.

     --rsaid rsaid
	 Select the public key to display using the RSA key ID.

     --pem
	 Print the selected public key in PEM encoded ASN.1 format.

     --left, --right
	 Print the selected public key in  ipsec.conf(5)  format,  as  a  leftr-
	 sasigkey  or rightrsasigkey parameter respectively. For example, --left
	 might give (with the key data trimmed down for clarity):

	     leftrsasigkey=0sAQOF8tZ2...+buFuFn/

     --ipseckey
	 Print the selected public key in a format suitable for  use  as  oppor-
	 tunistic-encryption  DNS  IPSECKEY  record format (RFC 4025). A gateway
	 can be specified with the --gateway, which currently supports IPv4  and
	 IPv6 addresses. For the host name, the value returned by gethostname is
	 used, with a .  appended.

	 For  example, --ipseckey --gateway 10.11.12.13 might give (with the key
	 data trimmed for clarity):

	     IN    IPSECKEY  10 1 2 10.11.12.13  AQOF8tZ2...+buFuFn/"

     --gateway gateway
	 For --ipseckey, specify the gateway to display with  the  DNS	IPSECKEY
	 record.

     --precedence precedence
	 For --ipseckey, specify the precedence to display with the DNS IPSECKEY
	 record.

DIAGNOSTICS
     A	complaint about "no pubkey line found" indicates that the host has a key
     but it was generated with an old version of FreeS/WAN and does not  contain
     the information that showhostkey needs.

FILES
     /usr/local/etc/ipsec.d, /usr/local/etc/ipsec.d/nsspassword

SEE ALSO
     ipsec.conf(5), ipsec rsasigkey(8) ipsec newhostkey(8)

HISTORY
     Written for the Linux FreeS/WAN project <https://www.freeswan.org> by Henry
     Spencer. Updated by Paul Wouters for the IPSECKEY format.

BUGS
     Arguably,	rather	than  just  reporting  the no-IN-KEY-line-found problem,
     showhostkey should  be  smart  enough  to	run  the  existing  key  through
     rsasigkey with the --oldkey option, to generate a suitable output line.

AUTHOR
     Paul Wouters
	 placeholder to suppress warning

libreswan			   08/01/2026		    IPSEC_SHOWHOSTKEY(8)

Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=ipsec_showhostkey&sektion=8&manpath=FreeBSD+Ports+15.1.quarterly>

home | help