diff --git a/command/agent/agent.go b/command/agent/agent.go
index 225c813a9c..16c1e33e51 100644
--- a/command/agent/agent.go
+++ b/command/agent/agent.go
@@ -739,3 +739,19 @@ func loadKeyringFile(keyringFile string) *memberlist.Keyring {
 	// Success!
 	return keyring
 }
+
+// ListKeysLAN returns the keys installed on the LAN gossip pool
+func (a *Agent) ListKeysLAN() map[string]int {
+	if a.server != nil {
+		return a.server.ListKeysLAN()
+	}
+	return a.client.ListKeysLAN()
+}
+
+// ListKeysWAN returns the keys installed on the WAN gossip pool
+func (a *Agent) ListKeysWAN() map[string]int {
+	if a.server != nil {
+		return a.server.ListKeysWAN()
+	}
+	return nil
+}
diff --git a/command/agent/rpc.go b/command/agent/rpc.go
index caf97cef1f..e35615de56 100644
--- a/command/agent/rpc.go
+++ b/command/agent/rpc.go
@@ -41,16 +41,24 @@ const (
 )
 
 const (
-	handshakeCommand  = "handshake"
-	forceLeaveCommand = "force-leave"
-	joinCommand       = "join"
-	membersLANCommand = "members-lan"
-	membersWANCommand = "members-wan"
-	stopCommand       = "stop"
-	monitorCommand    = "monitor"
-	leaveCommand      = "leave"
-	statsCommand      = "stats"
-	reloadCommand     = "reload"
+	handshakeCommand     = "handshake"
+	forceLeaveCommand    = "force-leave"
+	joinCommand          = "join"
+	membersLANCommand    = "members-lan"
+	membersWANCommand    = "members-wan"
+	stopCommand          = "stop"
+	monitorCommand       = "monitor"
+	leaveCommand         = "leave"
+	statsCommand         = "stats"
+	reloadCommand        = "reload"
+	listKeysLANCommand   = "list-keys-lan"
+	listKeysWANCommand   = "list-keys-wan"
+	installKeyLANCommand = "install-key-lan"
+	installKeyWANCommand = "install-key-wan"
+	useKeyLANCommand     = "use-key-lan"
+	useKeyWANCommand     = "use-key-wan"
+	removeKeyLANCommand  = "remove-key-lan"
+	removeKeyWANCommand  = "remove-key-wan"
 )
 
 const (
@@ -103,6 +111,13 @@ type joinResponse struct {
 	Num int32
 }
 
+type keysResponse struct {
+	Messages map[string]string
+	NumNodes int
+	NumResp  int
+	Keys     map[string]int
+}
+
 type membersResponse struct {
 	Members []Member
 }
@@ -373,6 +388,32 @@ func (i *AgentRPC) handleRequest(client *rpcClient, reqHeader *requestHeader) er
 	case reloadCommand:
 		return i.handleReload(client, seq)
 
+	case listKeysLANCommand:
+		return i.handleListKeysWAN(client, seq)
+
+	case listKeysWANCommand:
+		return i.handleListKeysLAN(client, seq)
+
+		/*
+			case installKeyLANCommand:
+				return i.handleInstallKeyLAN(client, seq)
+
+			case installKeyWANCommand:
+				return i.handleInstallKeyWAN(client, seq)
+
+			case useKeyLANCommand:
+				return i.handleUseKeyLAN(client, seq)
+
+			case useKeyWANCommand:
+				return i.handleUseKeyWAN(client, seq)
+
+			case removeKeyLANCommand:
+				return i.handleRemoveKeyLAN(client, seq)
+
+			case removeKeyWANCommand:
+				return i.handleRemoveKeyWAN(client, seq)
+		*/
+
 	default:
 		respHeader := responseHeader{Seq: seq, Error: unsupportedCommand}
 		client.Send(&respHeader, nil)
@@ -583,6 +624,24 @@ func (i *AgentRPC) handleReload(client *rpcClient, seq uint64) error {
 	return client.Send(&resp, nil)
 }
 
+func (i *AgentRPC) handleListKeysLAN(client *rpcClient, seq uint64) error {
+	header := responseHeader{
+		Seq:   seq,
+		Error: "",
+	}
+	resp := i.agent.ListKeysLAN()
+	return client.Send(&header, resp)
+}
+
+func (i *AgentRPC) handleListKeysWAN(client *rpcClient, seq uint64) error {
+	header := responseHeader{
+		Seq:   seq,
+		Error: "",
+	}
+	resp := i.agent.ListKeysWAN()
+	return client.Send(&header, resp)
+}
+
 // Used to convert an error to a string representation
 func errToString(err error) string {
 	if err == nil {
diff --git a/command/keys.go b/command/keys.go
index da8e743d1c..e63b460150 100644
--- a/command/keys.go
+++ b/command/keys.go
@@ -3,8 +3,9 @@ package command
 import (
 	"flag"
 	"fmt"
-	"github.com/mitchellh/cli"
 	"strings"
+
+	"github.com/mitchellh/cli"
 )
 
 // KeysCommand is a Command implementation that handles querying, installing,
@@ -30,6 +31,13 @@ func (c *KeysCommand) Run(args []string) int {
 		return 1
 	}
 
+	client, err := RPCClient(*rpcAddr)
+	if err != nil {
+		c.Ui.Error(fmt.Sprintf("Error connecting to Consul agent: %s", err))
+		return 1
+	}
+	defer client.Close()
+
 	// Only accept a single argument
 	found := listKeys
 	for _, arg := range []string{installKey, useKey, removeKey} {
@@ -40,14 +48,9 @@ func (c *KeysCommand) Run(args []string) int {
 		found = found || len(arg) > 0
 	}
 
-	client, err := RPCClient(*rpcAddr)
-	if err != nil {
-		c.Ui.Error(fmt.Sprintf("Error connecting to Consul agent: %s", err))
-		return 1
-	}
-	defer client.Close()
-
 	if listKeys {
+		km := client.KeyManager()
+		fmt.Println(km.ListKeys())
 		return 0
 	}
 
diff --git a/consul/client.go b/consul/client.go
index 28838bf795..fb02cdcd0d 100644
--- a/consul/client.go
+++ b/consul/client.go
@@ -206,6 +206,11 @@ func (c *Client) UserEvent(name string, payload []byte) error {
 	return c.serf.UserEvent(userEventName(name), payload, false)
 }
 
+// KeyManager returns the Serf keyring manager
+func (c *Client) KeyManager() *serf.KeyManager {
+	return c.serf.KeyManager()
+}
+
 // lanEventHandler is used to handle events from the lan Serf cluster
 func (c *Client) lanEventHandler() {
 	for {
diff --git a/consul/server.go b/consul/server.go
index 2adbc7edbb..8f913ed464 100644
--- a/consul/server.go
+++ b/consul/server.go
@@ -551,6 +551,16 @@ func (s *Server) IsLeader() bool {
 	return s.raft.State() == raft.Leader
 }
 
+// KeyManagerLAN returns the LAN Serf keyring manager
+func (s *Server) KeyManagerLAN() *serf.KeyManager {
+	return s.serfLAN.KeyManager()
+}
+
+// KeyManagerWAN returns the WAN Serf keyring manager
+func (s *Server) KeyManagerWAN() *serf.KeyManager {
+	return s.serfWAN.KeyManager()
+}
+
 // inmemCodec is used to do an RPC call without going over a network
 type inmemCodec struct {
 	method string