--- a/.gitignore	Thu Nov 24 14:48:03 2016 +0200
+++ b/.gitignore	Fri Nov 25 00:45:35 2016 +0200
@@ -71,6 +71,7 @@
 doc/man/doveadm-kick.1
 doc/man/doveadm-log.1
 doc/man/doveadm-mailbox.1
+doc/man/doveadm-mailbox-cryptokey.1
 doc/man/doveadm-mount.1
 doc/man/doveadm-move.1
 doc/man/doveadm-penalty.1

--- a/doc/man/Makefile.am	Thu Nov 24 14:48:03 2016 +0200
+++ b/doc/man/Makefile.am	Fri Nov 25 00:45:35 2016 +0200
@@ -38,6 +38,7 @@
 	doveadm-log.1 \
 	doveadm-mailbox.1 \
 	doveadm-mount.1 \
+	doveadm-mailbox-cryptokey.1 \
 	doveadm-move.1 \
 	doveadm-penalty.1 \
 	doveadm-proxy.1 \
@@ -87,6 +88,7 @@
 	doveadm-log.1.in \
 	doveadm-mailbox.1.in \
 	doveadm-mount.1.in \
+	doveadm-mailbox-cryptokey.1.in \
 	doveadm-move.1.in \
 	doveadm-penalty.1.in \
 	doveadm-proxy.1.in \

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/doc/man/doveadm-mailbox-cryptokey.1.in	Fri Nov 25 00:45:35 2016 +0200
@@ -0,0 +1,96 @@
+.\" Copyright (c) 2010-2016 Dovecot authors, see the included COPYING file
+.TH DOVEADM\-MAILBOX\-CRYPTOKEY 1 "2016-01-12" "Dovecot v2.2" "Dovecot"
+.SH NAME
+doveadm\-mailbox\-cryptokey \- Mail crypt plugin management
+.\"------------------------------------------------------------------------
+.SH SYNOPSIS
+.BR doveadm " -o
+.IR plugin/mail_crypt_private_password=password "
+.BR [ " \-Dv " ] [ " \-f
+.IR formatter " ]
+.BR " mailbox cryptokey export|generate|list|password " [ " \-u
+.IR username
+.BR | " \-A " ] [ " \-S " ] [ " \-F "
+.IR file " ]
+.BR [ "
+.IR other "
+.IR options " ]
+.br
+.SH DESCRIPTION
+Generate new keypair for user or folder. The new keypair is marked as active.
+.SH OPTIONS
+.IR options :
+.\"-------------------------------------
+@INCLUDE:option-A@
+.\"-------------------------------------
+@INCLUDE:option-F-file@
+.\"-------------------------------------
+@INCLUDE:option-S-socket@
+.\"-------------------------------------
+@INCLUDE:option-u-user@
+.\"------------------------------------------------------------------------
+.TP
+.BI \-o\  plugin/mail_crypt_private_password=password
+Dovecot option, needed if you use password protected keys
+.SH SUBCOMMANDS
+.BR export " [ " \-U " ] " |
+.IR mailbox-mask 
+.TP
+.B \-U
+Operate on user keypair only
+.PP
+Exports user's or folder's keypair(s) in PEM format.
+If the keys are password protected, \-o is needed.
+.PP
+.\"------------------------------------------------------------------------
+.BR generate " [ " \-Rf "  [ " \-U " ] " | 
+.IR mailbox-mask " ]
+.TP
+.B \-U
+Operate on user keypair only
+.TP
+.BI \-R
+Re-encrypt all folder keys with current active user key
+.TP
+.B \-f
+Force keypair creation, normally keypair is only created if none found
+.PP
+Generates new keypair for user or folder. If you want to generate new user key
+and use it to secure your folder keys, use generate \-u username \-UR.
+.PP
+If you want to password-protect your key here, use \-o.
+.PP
+.\"------------------------------------------------------------------------
+.BR list " [ " \-U " ] " |
+.IR mailbox-mask
+.TP
+.B \-U
+Operate on user keypair only
+.PP
+List all keys for user or folder. No password is required.
+.PP
+.\"------------------------------------------------------------------------
+.BR password " [ " \-N " | " \-n
+.IR password " ]
+.BR " [ " \-O " | " \-o
+.IR password " ]
+.BR [ " \-C " ]
+.TP
+.B \-O
+Ask for old password
+.TP
+.BI \-o\ old-password
+Provide old password
+.TP
+.B \-N
+Ask for new password
+.TP
+.BI \-n\ new-password
+Provide new password
+.TP
+.B \-C
+Clear (unset/remove) password. Your key will not be protected by password.
+.PP
+Set, change or clear password from your user key.
+.SH SEE ALSO
+.BR doveadm(1)

--- a/doc/man/doveadm-mailbox.1.in	Thu Nov 24 14:48:03 2016 +0200
+++ b/doc/man/doveadm-mailbox.1.in	Fri Nov 25 00:45:35 2016 +0200
@@ -64,6 +64,12 @@
 option was given, the created mailboxes will be also added to the user\(aqs
 subscriptions.
 .\"------------------------------------------------------------------------
+.SS mailbox cryptokey
+.B mailbox cryptokey export|generate|list|password
+.PP
+This command is used to manage mail crypt plugin cryptographic keys.
+Please see doveadm-mailbox-cryptokey(1) for more details.
+.\"------------------------------------------------------------------------
 .SS mailbox delete
 .B doveadm mailbox delete
 [\fB\-A\fP|\fB\-u\fP \fIuser\fP|\fB\-F\fP \fIfile\fP]
@@ -319,3 +325,4 @@
 .\"------------------------------------------------------------------------
 .SH SEE ALSO
 .BR doveadm (1)
+.BR doveadm-mailbox-cryptokey(1)