Scroll to navigation

NVME-TLS-KEY(1) NVMe Manual NVME-TLS-KEY(1)

NAME

nvme-tls-key - Manage NVMe TLS PSKs (deprecated)

SYNOPSIS

nvme [<global-options>] tls-key [--keyring=<name> | -k <name>]


                        [--keytype=<type> | -t <type>]


                        [--keyfile=<file> | -f <file>]


                        [--import | -i] [--export | -e]


                        [--revoke=<description> | -r <description>]

DESCRIPTION

Deprecated command kept for scripts written against nvme-cli versions older than 3.0. Exactly one of --import, --export, or --revoke must be given; based on which mode is selected, this alias translates the command into the equivalent new keys plugin subcommand and forwards to it:

•--import translates to nvme-keys-import(1), forwarding --keyring and --keyfile.

•--export translates to nvme-keys-export(1), forwarding --keyring and --keyfile.

•--revoke=<description> translates to nvme-keys-revoke(1), forwarding --keyring and --keytype, with <description> passed as --identity.

Only the options relevant to the selected mode are meaningful; e.g. --keytype has no effect with --import or --export since the new import/export subcommands no longer take a key type. This command does not derive or insert a TLS PSK from a configured PSK — use nvme-keys-gen-tls-psk(1) or nvme-keys-insert-tls-psk(1) for that.

New scripts should call nvme keys import, nvme keys export, or nvme keys revoke directly instead. This alias prints a deprecation warning on stderr and may be removed in a future release.

OPTIONS

-k <name>, --keyring=<name>

Name of the keyring to import into, export from, or revoke from. Default is .nvme.

-t <type>, --keytype=<type>

Type of the key to revoke. Only used with --revoke. Default is psk.

-f <file>, --keyfile=<file>

File to read the keys from (--import) or write the keys to (--export) instead of stdin/stdout.

-i, --import

Import keys in bulk; see nvme-keys-import(1).

-e, --export

Export all keys from the keyring; see nvme-keys-export(1).

-r <description>, --revoke=<description>

Revoke the key stored under <description> from the keyring; see nvme-keys-revoke(1).

GLOBAL OPTIONS

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run

Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

Disable probing for 64-bit IOCTL support.

--no-retries

Disable retry logic on transient errors.

-o <fmt>, --output-format=<fmt>

Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

Set the timeout for the command in milliseconds.

-v, --verbose

Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

EXAMPLES

No Examples

NVME

Part of the nvme-user suite

SEE ALSO

nvme-keys-import(1), nvme-keys-export(1), nvme-keys-revoke(1)

09/19/2026 NVMe