NVME-TLS-KEY(1)

NAME
nvme-tls-key - Manage NVMe TLS PSKs (deprecated)

SYNOPSIS

nvme [<global-options>] tls-key [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--keyfile=<file> | -f <file>]
                        [--import | -i] [--export | -e]
                        [--revoke=<description> | -r <description>]

DESCRIPTION

Deprecated command kept for scripts written against nvme-cli versions older than 3.0. Exactly one of --import, --export, or --revoke must be given; based on which mode is selected, this alias translates the command into the equivalent new keys plugin subcommand and forwards to it:

    • --import translates to nvme-keys-import(1), forwarding --keyring and --keyfile.

    • --export translates to nvme-keys-export(1), forwarding --keyring and --keyfile.

    • --revoke=<description> translates to nvme-keys-revoke(1), forwarding --keyring and --keytype, with <description> passed as --identity.

Only the options relevant to the selected mode are meaningful; e.g. --keytype has no effect with --import or --export since the new import/export subcommands no longer take a key type. This command does not derive or insert a TLS PSK from a configured PSK — use nvme-keys-gen-tls-psk(1) or nvme-keys-insert-tls-psk(1) for that.

New scripts should call nvme keys import, nvme keys export, or nvme keys revoke directly instead. This alias prints a deprecation warning on stderr and may be removed in a future release.

OPTIONS

-k <name>, --keyring=<name>
    Name of the keyring to import into, export from, or revoke from. Default is .nvme.

-t <type>, --keytype=<type>
    Type of the key to revoke. Only used with --revoke. Default is psk.

-f <file>, --keyfile=<file>
    File to read the keys from (--import) or write the keys to (--export) instead of stdin/stdout.

-i, --import
    Import keys in bulk; see nvme-keys-import(1).

-e, --export
    Export all keys from the keyring; see nvme-keys-export(1).

-r <description>, --revoke=<description>
    Revoke the key stored under <description> from the keyring; see nvme-keys-revoke(1).

GLOBAL OPTIONS

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run
    Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing
    Disable probing for 64-bit IOCTL support.

--no-retries
    Disable retry logic on transient errors.

-o <fmt>, --output-format=<fmt>
    Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>
    Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>
    Set the timeout for the command in milliseconds.

-v, --verbose
    Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

EXAMPLES

No Examples

NVME

Part of the nvme-user suite

SEE ALSO

nvme-keys-import(1), nvme-keys-export(1), nvme-keys-revoke(1)