ipsec-newhostkey8
Generate a new raw rsa authentication key for a host
Usage
ipsec newhostkey
[{[--quiet] | [--verbose]}]
[--nssdirnssdir]
[--password
password]
[--bits
bits]
[--curve
curve]
[{--keytype
rsa | ecdsa}]
[--seeddev
device]
Overview
newhostkey generates an RSA public/private key pair suitable for authenticating this host is generated and stored in the NSS database.
See ipsec-showhostkey(8) for how to extract the public key from the NSS database.
Output Options
-
--quiet -
The
--quietoption suppresses both thersasigkeynarrative and the existing-file warning message.
-
--nssdir /var/lib/ipsec/nss -
The
--nssdiroption specifies the NSS DB directory where the certificate key, and modsec databases reside (default /var/lib/ipsec/nss)
-
--password password -
The
--passwordoption specifies a module authentication password that may be required if FIPS mode is enabled.
-
--bits bits -
The
--bitsoption specifies the number of bits in the RSA key; the current default is a random (multiple of 16) value between 3072 and 4096. The minimum allowed is 2192.
-
--curve curve -
The
--curveoption specifies the named curve used in the ECDSA key; the current default is secp256r1. See ipsec-ecdsasigkey(8) for the available curve names.
-
--keytype rsa|ecdsa -
The
--keytypeoption specifies the type of key, which can either be rsa (RSA) or ecdsa (ECDSA); if omitted the current default is rsa.
-
--seeddev device -
The
--seeddevis used to specify the random device (default /dev/random used to seed the crypto library RNG.
Files
/dev/random, /dev/urandom