diff --git a/CHANGES b/CHANGES
index 796ed2b38c..e2f835d70a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2977.	[bug]		'nsupdate -l' report if the session key is missing.
+			[RT #21670]
+
 2976.	[bug]		named could die on exit after negotiating a GSS-TSIG
 			key. [RT #22573]
 			
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 8a36aa96ad..6ba76d83f4 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.183 2010/12/02 23:22:41 marka Exp $ */
+/* $Id: nsupdate.c,v 1.184 2010/12/03 00:37:33 marka Exp $ */
 
 /*! \file */
 
@@ -901,9 +901,12 @@ setup_system(void) {
 
 	if (keystr != NULL)
 		setup_keystr();
-	else if (local_only)
-		read_sessionkey(mctx, lctx);
-	else if (keyfile != NULL)
+	else if (local_only) {
+		result = read_sessionkey(mctx, lctx);
+		if (result != ISC_R_SUCCESS)
+			fatal("can't read key from %s: %s\n",
+			      keyfile, isc_result_totext(result));
+	} else if (keyfile != NULL)
 		setup_keyfile(mctx, lctx);
 }
 
diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index 0d6bd3aa29..83f661090e 100644
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: clean.sh,v 1.18 2010/11/30 23:46:55 tbox Exp $
+# $Id: clean.sh,v 1.19 2010/12/03 00:37:33 marka Exp $
 
 #
 # Clean up after zone transfer tests.
@@ -28,3 +28,4 @@ rm -f random.data
 rm -f ns2/example.bk
 rm -f ns2/update.bk
 rm -f */named.memstats
+rm -f nsupdate.out
diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index c70f697da7..ae4f8af077 100644
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -15,7 +15,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.30 2010/11/30 23:46:55 tbox Exp $
+# $Id: tests.sh,v 1.31 2010/12/03 00:37:33 marka Exp $
 
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh
@@ -239,5 +239,14 @@ $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd updated4.example.nil.\
 	@10.53.0.1 a -p 5300 > dig.out.ns1 || status=1
 $PERL ../digcomp.pl knowngood.ns1.afterstop dig.out.ns1 || status=1
 
+ret=0
+echo "I:check that 'nsupdate -l' with a missing keyfile reports the missing file"
+$NSUPDATE -l -p 5300 -k ns1/nonexistant.key 2> nsupdate.out < /dev/null
+grep ns1/nonexistant.key nsupdate.out > /dev/null || ret=1
+if test $ret -ne 0
+then
+echo "I:failed"; status=1
+fi
+
 echo "I:exit status: $status"
 exit $status