nessuscli fetch --reset: Complete Command Reference (2026)
The nessuscli fetch subcommand manages Nessus license activation and deactivation from the command line. You need it when moving Nessus to a new server, recovering from a corrupted license, or reactivating after a reset. This reference covers every fetch flag, the nessus.license file location, and common troubleshooting steps on Ubuntu and Kali Linux.
Prerequisites
- Nessus installed on Linux (Ubuntu 22.04/24.04 or Kali Linux)
- Root or
sudoaccess on the host - An active Tenable account with a valid activation code
The nessuscli binary lives at /opt/nessus/sbin/nessuscli on all standard Linux installations. All commands below must be run as root or with sudo. Stop the Nessus daemon before running license operations unless otherwise noted:
sudo systemctl stop nessusd
nessuscli fetch --reset
sudo /opt/nessus/sbin/nessuscli fetch --reset
--reset deactivates the current license on Tenable's activation server and removes the local registration, leaving the installation in an unactivated state. After the reset completes you can re-enter an activation code through the web UI or the fetch --register command.
Expected output:
License has been reset.
If the operation fails you will instead see a network error — see the Troubleshooting section below.
When to use --reset
- Before decommissioning a server or cloning a VM — the license must be freed before it can be activated on another host.
- After a license becomes corrupted and the web UI shows activation errors.
- When Tenable support instructs you to reset as part of a licensing fix.
nessuscli fetch --check
sudo /opt/nessus/sbin/nessuscli fetch --check
--check queries Tenable's servers and reports the current license state without making any changes. Use it to confirm connectivity and license validity before attempting a reset or reactivation.
Sample output — valid license:
Registered to: [email protected]
License type: Nessus Professional
Expiration: 2027-01-15
Plugin updates: enabled
Status: Active
Sample output — no license or after a reset:
Nessus is not registered.
Sample output — network unreachable:
Fetch failed. Unable to connect to plugins.nessus.org.
Run --check after any license operation to confirm the change took effect.
nessuscli fetch --deactivate
sudo /opt/nessus/sbin/nessuscli fetch --deactivate
--deactivate removes the activation from the current host and frees the license seat on Tenable's portal, but leaves the Nessus installation intact. Use it as part of a planned migration:
- Stop nessusd:
sudo systemctl stop nessusd - Deactivate:
sudo /opt/nessus/sbin/nessuscli fetch --deactivate - Uninstall or move the host
- Install Nessus on the new server and activate with the same code
This is the cleanest way to move a Nessus license. If you skip deactivation and simply uninstall, Tenable may hold the license seat for up to 24 hours before it is released automatically.
nessuscli fetch --unregister
sudo /opt/nessus/sbin/nessuscli fetch --unregister
--unregister performs a full unregistration from Tenable cloud. It removes the activation, deletes the locally stored registration token, and severs the plugin update channel. After this operation:
- Plugin updates stop until the installation is re-registered.
- The activation code is freed and can be used on a different host immediately.
- The local
nessus.licensefile is removed.
Use --unregister when permanently decommissioning a Nessus instance. For temporary migrations, prefer --deactivate.
nessus.license File Location
/opt/nessus/var/nessus/nessus.license
This file stores the activation token that Nessus uses to verify its license at startup and during plugin updates. It is a binary or encoded file — not a plain-text license key you can read and copy. The actual activation code you enter in the UI is stored separately; nessus.license is the server-side token returned after successful registration.
When to manually delete this file
Only delete nessus.license when explicitly instructed by Tenable support. Deleting it without first running --reset or --deactivate can strand the license seat on Tenable's portal, requiring support intervention to free it.
If support instructs you to delete it:
sudo systemctl stop nessusd
sudo rm /opt/nessus/var/nessus/nessus.license
sudo systemctl start nessusd
After restart, Nessus will return to an unactivated state and prompt for an activation code at https://localhost:8834.
Troubleshooting
"This installation is password-protected"
This error appears when the Nessus instance was locked with an installation-level password, blocking normal web UI access. This is a separate issue from the license.
The fix is nessuscli fix --reset — note the difference:
sudo /opt/nessus/sbin/nessuscli fix --reset
fix --reset resets the Nessus database and removes the installation password. It does not affect the license. After running it, complete the setup wizard at https://localhost:8834 to create a new admin account.
fetch --reset resets the license. fix --reset resets the database and admin password. They are different commands with different effects.
"Fetch failed" / timeout errors
If fetch --check, fetch --reset, or fetch --deactivate returns a fetch failure:
Fetch failed. Unable to connect to plugins.nessus.org.
Work through these checks:
Verify outbound HTTPS connectivity from the host:
shell curl -I https://plugins.nessus.orgIf behind a proxy, set the proxy in Nessus:
shell sudo /opt/nessus/sbin/nessuscli fix --set proxy=your.proxy.host:8080Check that DNS resolves
plugins.nessus.org:shell nslookup plugins.nessus.orgConfirm the system clock is accurate — Tenable's servers reject requests with a large time skew:
shell timedatectl status
Re-activating after a reset
After fetch --reset or fetch --unregister, reactivate through the Nessus web UI:
- Start nessusd:
sudo systemctl start nessusd - Open
https://localhost:8834in a browser - Navigate to Settings → Activation
- Enter your activation code and click Activate
Alternatively, re-register from the command line:
sudo /opt/nessus/sbin/nessuscli fetch --register YOUR-ACTIVATION-CODE
After successful registration, restart the daemon and trigger a plugin update:
sudo systemctl restart nessusd
sudo /opt/nessus/sbin/nessuscli update --all
Quick Reference Table
| Command | What it does |
|---|---|
nessuscli fetch --reset | Reset license for reactivation |
nessuscli fetch --check | Check current license status |
nessuscli fetch --deactivate | Deactivate before moving server |
nessuscli fetch --unregister | Full unregister from Tenable |
nessuscli fix --reset | Reset admin password / database (not license!) |