diff --git a/lib/ssconf.py b/lib/ssconf.py
index 7e34b5d3b5b9a19effd79275f363370e219e5c79..7823e6624fe4f3784c8c43631f51870519424904 100644
--- a/lib/ssconf.py
+++ b/lib/ssconf.py
@@ -387,3 +387,17 @@ def VerifyClusterName(name, _cfg_location=None):
   else:
     if name != local_name:
       raise errors.GenericError("Current cluster name is '%s'" % local_name)
+
+
+def VerifyKeys(keys):
+  """Raises an exception if unknown ssconf keys are given.
+
+  @type keys: sequence
+  @param keys: Key names to verify
+  @raise errors.GenericError: When invalid keys were found
+
+  """
+  invalid = frozenset(keys) - _VALID_KEYS
+  if invalid:
+    raise errors.GenericError("Invalid ssconf keys: %s" %
+                              utils.CommaJoin(sorted(invalid)))
diff --git a/test/ganeti.ssconf_unittest.py b/test/ganeti.ssconf_unittest.py
index 1db88e8896c2be36960044e4bed2bddc59a70aac..958859b35efb6aed3a71bd23413d5a2a3c9b6b69 100755
--- a/test/ganeti.ssconf_unittest.py
+++ b/test/ganeti.ssconf_unittest.py
@@ -169,5 +169,20 @@ class TestVerifyClusterName(unittest.TestCase):
                         "cluster.example.com", _cfg_location=self.tmpdir)
 
 
+class TestVerifyKeys(unittest.TestCase):
+  def testNoKeys(self):
+    ssconf.VerifyKeys({})
+
+  def testValidKeys(self):
+    ssconf.VerifyKeys(ssconf._VALID_KEYS)
+
+    for key in ssconf._VALID_KEYS:
+      ssconf.VerifyKeys([key])
+
+  def testInvalidKeys(self):
+    for key in ["", ".", " ", "foo", "bar", "HelloWorld"]:
+      self.assertRaises(errors.GenericError, ssconf.VerifyKeys, [key])
+
+
 if __name__ == "__main__":
   testutils.GanetiTestProgram()