NVME-CHECK-TLS-KE(1) NVMe Manual NVME-CHECK-TLS-KE(1)

nvme-check-tls-key - Check a NVMe TLS PSK (deprecated)

nvme [<global-options>] check-tls-key [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--hostnqn=<nqn> | -n <nqn>]
                        [--subsysnqn=<nqn> | -c <nqn>]
                        [--keydata=<key> | -d <key>]
                        [--identity=<id-vers> | -I <id-vers>]
                        [--compat | -C]

Deprecated alias for nvme-keys-check-tls-psk(1), kept for scripts written against nvme-cli versions older than 3.0, with two differences from nvme-cli 2.x:

•--insert/-i and --keyfile/-f are gone. 2.x used them to derive a TLS PSK and store it in the keyring; the new check-tls-psk never modifies the keyring — that moved to nvme-keys-insert-tls-psk(1).
•The identity is no longer the first line of stdout. 2.x printed it alone; the alias prints Configured PSK is valid (HMAC <id>, length <len>) first and reports the keyring state after it, so a script taking the identity with head -1 reads the wrong line. Searching the keyring is itself new, and a keyring that does not exist is reported as a failure: the command exits 1 where 2.x exited 0.

New scripts should use nvme keys check-tls-psk instead. This alias prints a deprecation warning on stderr and may be removed in a future release.

See nvme-keys-check-tls-psk(1) for the full option reference.

The following options are defined at the top-level nvme command and are available to this subcommand:

--dry-run

Print the command that would be executed, but do not actually execute it.

--no-ioctl-probing

Disable probing for 64-bit IOCTL support.

--no-retries

Disable retry logic on transient errors.

-o <fmt>, --output-format=<fmt>

Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time.

--output-format-version=<version>

Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names.

--timeout=<ms>

Set the timeout for the command in milliseconds.

-v, --verbose

Increase the level of detail in the output. May be specified multiple times to further increase verbosity.

These options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file.

No Examples

Part of the nvme-user suite

nvme-keys-check-tls-psk(1), nvme-keys-insert-tls-psk(1)

09/18/2026 NVMe