salt-key

List all keys (accepted, pending, and rejected)

$ salt-key -L

$ salt-key -a [minion_id]

$ salt-key -A

$ salt-key -r [minion_id]

$ salt-key -d [minion_id]

$ salt-key -f [minion_id]

$ salt-key -F

salt-key [options]

salt-key manages Salt minion public keys on a Salt master server. In SaltStack's architecture, minions use public-key cryptography to authenticate with the master. When a minion first connects, it sends its public key to the master, which must be explicitly accepted before communication can occur.
Keys exist in three states: unaccepted (pending), accepted, or rejected. The salt-key command allows administrators to list, accept, reject, and delete keys. Fingerprint verification enables secure identification of minions before accepting their keys.

-L, --list-all

List all accepted, pending, and rejected minion keys

List keys: pre/un/unaccepted, acc/accepted, rej/rejected, or all

Accept the specified minion key

Accept all pending minion keys

Reject the specified minion key

Reject all pending minion keys

Delete the specified minion key

Delete all keys

Print the fingerprint of the specified key

Print fingerprints of all keys

Answer yes to all questions (use with caution)

Specify Salt configuration directory (default: /etc/salt)

Generate a keypair with the specified name

Directory to save generated keypair

Key size for generated keys (minimum 2048)

/etc/salt/pki/master/

Directory containing accepted, pending, and rejected minion public keys managed by salt-key.

Master configuration file where key acceptance policies and auto-sign settings are defined.

Always verify minion identity before accepting keys by comparing fingerprints. Deleting keys is permanent and prevents the minion from connecting until its key is regenerated. The -y flag bypasses confirmation prompts and should be used cautiously, especially with -A, -D, or -R. Requires root privileges or appropriate permissions on /etc/salt/pki/master/.

salt-key is part of SaltStack (now Salt Project), an open-source configuration management and remote execution tool created by Thomas Hatch in 2011. The key management system provides the security foundation for Salt's master-minion architecture.

salt(1), salt-master(8), salt-minion(8), salt-call(1)