Name

nix key convert-secret-to-pem - convert a secret key read from standard input to PEM PKCS#8 format

Synopsis

nix key convert-secret-to-pem [option...]

Examples

• Convert an ML-DSA-65 secret key to PEM:

  # nix key generate-secret --key-name cache.example.org-1 --key-type ml-dsa-65 \
    | nix key convert-secret-to-pem
  -----BEGIN PRIVATE KEY-----
  …
  -----END PRIVATE KEY-----
  

• Convert a secret key to PEM and decode it using OpenSSL:

  # nix key convert-secret-to-pem < secret-key \
    | openssl pkey -text -noout
  ML-DSA-87 Private-Key:
  seed:
  …
  

Description

This command reads a Nix signing key generated by nix key generate-secret from standard input and writes the corresponding PEM PKCS#8 private key to standard output. The key name is not included in the PEM output.

Options

Logging-related options

• --debug

  Set the logging verbosity level to 'debug'.

• --log-format format

  Set the format of log output; one of raw, internal-json, bar or bar-with-logs.

• --print-build-logs / -L

  Print full build logs on standard error.

• --quiet

  Decrease the logging verbosity level.

• --verbose / -v

  Increase the logging verbosity level.

Miscellaneous global options

• --help

  Show usage information.

• --offline

  Disable substituters and consider all previously downloaded files up-to-date.

• --option name value

  Set the Nix configuration setting name to value (overriding nix.conf).

• --refresh

  Consider all previously downloaded files out-of-date.

• --version

  Show version information.

Note

See man nix.conf for overriding configuration settings with command line flags.