I would like to know why the first time I run the "ipsec pki" command to get a private key this key is generated quickly, but the next time you try to run the same command to get this key because you have deleted the old one it takes about 5-10 minutes.

1 Answer 1


In its default configuration pki's --gen command generates RSA keys using the random and gmp plugins. Since the random plugin reads from /dev/random this might take a while as that device blocks (i.e. does not return any data) if the system's entropy pool is exhausted.

The wiki page of the --gen command describes possible workarounds, one is configuring the random plugin to use /dev/urandom (which does not block), another is switching to a different plugin to generate the keys (e.g. the openssl plugin).


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .