diff --git a/CHANGES b/CHANGES
index 4a0a9c42a7..adecacce8b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2935.	[bug]		nsupdate: improve 'file not found' error message.
+			[RT #21871]
+
 2934.	[bug]		Use ANSI C compliant shift range in lib/isc/entropy.c.
 			[RT #21871]
 
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 8ab369f33d..6d24a27062 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: nsupdate.c,v 1.180 2010/07/09 23:46:51 tbox Exp $ */
+/* $Id: nsupdate.c,v 1.181 2010/08/10 09:51:47 marka Exp $ */
 
 /*! \file */
 
@@ -488,6 +488,19 @@ parse_hmac(dns_name_t **hmac, const char *hmacstr, size_t len) {
 	return (digestbits);
 }
 
+static int
+basenamelen(const char *file) {
+        int len = strlen(file);
+
+        if (len > 1 && file[len - 1] == '.')
+                len -= 1;
+        else if (len > 8 && strcmp(file + len - 8, ".private") == 0)
+                len -= 8;
+        else if (len > 4 && strcmp(file + len - 4, ".key") == 0)
+                len -= 4;
+	return (len);
+}
+
 static void
 setup_keystr(void) {
 	unsigned char *secret = NULL;
@@ -641,8 +654,9 @@ setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	}
 
 	if (result != ISC_R_SUCCESS) {
-		fprintf(stderr, "could not read key from %s: %s\n",
-			keyfile, isc_result_totext(result));
+		fprintf(stderr, "could not read key from %.*s.{private,key}: "
+				"%s\n", basenamelen(keyfile), keyfile,
+				isc_result_totext(result));
 		return;
 	}