.TH "DOVEADM-MAILBOX-CRYPTOKEY" "1" "October 2025" "65dfbff" "Dovecot"
.SH "NAME"
\fBdoveadm-mailbox-cryptokey\fR - Mail crypt plugin management
.SH "SYNOPSIS"
.P
\fBdoveadm\fR \[lB]\fB-o\fR \fIcrypt_user_key_password=password\fR\[rB] \[lB]\fIGLOBAL OPTIONS\fR\[rB] \fImailbox cryptokey export|generate|list|password\fR \[lB]\fIoptions\fR\[rB] \[lB]\fIarguments\fR\[rB]
.SH "DESCRIPTION"
.P
Generate new keypair for user or folder. The new keypair is marked as active.
.SH "OPTIONS"
.P
\fBdoveadm mailbox cryptokey\fR can be used to manage user's cryptographic keys.
.SH "GLOBAL OPTIONS"
.P
Global doveadm(1) 
.P
\fB-D\fR
.RS 0
.RS 4
.P
Enables \fIverbosity\fR and debug messages.
.RE 0

.RE 0

.P
\fB-O\fR
.RS 0
.RS 4
.P
Do not read any config file, just use defaults. The \fBdovecot_storage_version\fR setting defaults to the latest version, but can be overridden with 
.RE 0

.RE 0

.P
\fB-k\fR
.RS 0
.RS 4
.P
Preserve entire environment for doveadm, not just \fBimport_environment\fR setting.
.RE 0

.RE 0

.P
\fB-v\fR
.RS 0
.RS 4
.P
Enables verbosity, including progress counter.
.RE 0

.RE 0

.P
\fB-i\fR \fIinstance-name\fR
.RS 0
.RS 4
.P
If using multiple Dovecot instances, choose the config file based on this instance name.
.P
See \fBinstance_name\fR setting for more information.
.RE 0

.RE 0

.P
\fB-c\fR \fIconfig-file\fR
.RS 0
.RS 4
.P
Read configuration from the given \fIconfig-file\fR. By default it first reads config socket, and then falls back to \fI/etc/dovecot/dovecot.conf\fR. You can also point this to config socket of some instance running compatible version.
.RE 0

.RE 0

.P
\fB-o\fR \fIsetting\fR\fB=\fR\fIvalue\fR
.RS 0
.RS 4
.P
Overrides the configuration \fIsetting\fR from \fI/etc/dovecot/dovecot.conf\fR and from the userdb with the given \fIvalue\fR. In order to override multiple settings, the \fB-o\fR option may be specified multiple times.
.RE 0

.RE 0

.P
\fB-f\fR \fIformatter\fR
.RS 0
.RS 4
.P
Specifies the \fIformatter\fR for formatting the output. Supported formatters are:
.P
\fBflow\fR
.RS 4
.P
prints each line with \fIkey\fR\fB=\fR\fIvalue\fR pairs.
.RE 0

.P
\fBjson\fR
.RS 4
.P
prints a JSON array of JSON objects.
.RE 0

.P
\fBpager\fR
.RS 4
.P
prints each \fIkey\fR: \fIvalue\fR pair on its own line and separates records with form feed character (\fB^L\fR).
.RE 0

.P
\fBtab\fR
.RS 4
.P
prints a table header followed by tab separated value lines.
.RE 0

.P
\fBtable\fR
.RS 4
.P
prints a table header followed by adjusted value lines.
.RE 0

.RE 0

.RE 0

.P
\fB-o\fR \fIcrypt_user_key_password=password\fR
.RS 0
.RS 4
.P
Dovecot option, needed if you use password protected keys
.RE 0

.RE 0

.SH "OPTIONS"
.P
\fB-A\fR
.RS 0
.RS 4
.P
If the \fB-A\fR option is present, the \fIcommand\fR will be performed for all users. Using this option in combination with system users from \fBuserdb { driver = passwd }\fR is not recommended, because it contains also users with a lower UID than the one configured with the \fBfirst_valid_uid\fR setting.
.P
When the SQL userdb module is used, make sure that the \fBuserdb_sql_iterate_query\fR setting setting matches your database layout.
.P
When using the LDAP userdb module, make sure that the \fBuserdb_fields\fR setting and \fBuserdb_ldap_iterate_fields\fR setting settings match your LDAP schema. Otherwise doveadm(1) will be unable to iterate over all users.
.RE 0

.RE 0

.P
\fB-F\fR \fIfile\fR
.RS 0
.RS 4
.P
Execute the \fIcommand\fR for all the users in the \fIfile\fR. This is similar to the \fB-A\fR option, but instead of getting the list of users from the userdb, they are read from the given \fIfile\fR. The \fIfile\fR contains one username per line.
.RE 0

.RE 0

.P
\fB--no-userdb-lookup\fR
.RS 0
.RS 4
.P
Do not perform userdb lookup. Use the \fBUSER\fR environment variable to specify the username.
.RE 0

.RE 0

.P
\fB-S\fR \fIsocket_path\fR
.RS 0
.RS 4
.P
The option's argument is either an absolute path to a local UNIX domain socket, or a hostname and port (\fIhostname\fR:\fIport\fR), in order to connect a remote host via a TCP socket.
.P
This allows an administrator to execute doveadm(1) mail commands through the given socket.
.RE 0

.RE 0

.P
\fB-u\fR \fIuser/mask\fR
.RS 0
.RS 4
.P
Run the \fIcommand\fR only for the given \fIuser\fR. It's also possible to use '\fB*\fR' and '\fB?\fR' wildcards (e.g. -u *@example.org).
.RE 0

.RE 0

.SH "SUBCOMMANDS"
.P
\fBexport\fR \[lB]\fB-U\fR\[rB] | \fImailbox-mask\fR
.P
\fB-U\fR
.RS 0
.RS 4
.P
Operate on user keypair only
.RE 0

.RE 0

.P
Exports user's or folder's keypair(s) in PEM format. If the keys are password protected, -o is needed.
.P
\fBgenerate\fR \[lB]\fB-Rf\fR \[lB]\fB-U\fR\[rB] | \fImailbox-mask\fR\[rB]
.P
\fB-U\fR
.RS 0
.RS 4
.P
Operate on user keypair only
.RE 0

.RE 0

.P
\fB-R\fR
.RS 0
.RS 4
.P
Re-encrypt all folder keys with current active user key
.RE 0

.RE 0

.P
\fB-f\fR
.RS 0
.RS 4
.P
Force keypair creation, normally keypair is only created if none found
.RE 0

.RE 0

.P
Generates new keypair for user or folder. If you want to generate new user key and use it to secure your folder keys, use generate -u username -UR.
.P
If you want to password-protect your key here, use -o.
.P
\fBlist\fR \[lB]\fB-U\fR\[rB] | \fImailbox-mask\fR
.P
\fB-U\fR
.RS 0
.RS 4
.P
Operate on user keypair only
.RE 0

.RE 0

.P
List all keys for user or folder. No password is required.
.P
\fBpassword\fR \[lB]\fB-N\fR | \fB-n\fR \fIpassword\fR\[rB] \[lB]\fB-O\fR|\fB-o\fR \fIpassword\fR\[rB] \[lB]\fB-C\fR\[rB]
.P
\fB-O\fR
.RS 0
.RS 4
.P
Ask for old password
.RE 0

.RE 0

.P
\fB-o old-password\fR
.RS 0
.RS 4
.P
Provide old password
.RE 0

.RE 0

.P
\fB-N\fR
.RS 0
.RS 4
.P
Ask for new password
.RE 0

.RE 0

.P
\fB-n new-password\fR
.RS 0
.RS 4
.P
Provide new password
.RE 0

.RE 0

.P
\fB-C\fR
.RS 0
.RS 4
.P
Clear (unset/remove) password. Your key will not be protected by password.
.RE 0

.RE 0

.P
Set, change or clear password from your user key.
.SH "SEE ALSO"
.P
doveadm(1), doveadm-mailbox(1)