SSH warning: host key changed

When connecting to your server via SSH, you suddenly get the warning REMOTE HOST IDENTIFICATION HAS CHANGED and the connection is refused? It looks alarming, but there is usually a harmless reason.

What does the warning mean?

On the first connection, your SSH client stores your server’s fingerprint (its key identifier) in the file known_hosts. If the fingerprint differs later, SSH deliberately warns you very clearly so that you are not unknowingly connected to the wrong server.

Where does the change come from?

Often it is not the server but your own computer: after an update of your SSH client or a changed security setting, it uses a different key type (for example ED25519 instead of the previously stored ECDSA key), although nothing has changed on the server. You can see this in the message from the lines «The fingerprint for the ED25519 key» and «Offending ECDSA key».

Less often, the keys were regenerated on the server itself, for example by an OpenSSH update within your system or a reinstallation.

How to check it safely

• Show the stored entry with: ssh-keygen -l -F server.musterdomain.ch (for a port other than 22: ssh-keygen -l -F '[server.musterdomain.ch]:2222').
• If you are unsure, open a ticket. We will tell you the fingerprints your server currently presents.
• If everything matches, remove the old entry with ssh-keygen -R server.musterdomain.ch (or ssh-keygen -R '[server.musterdomain.ch]:2222') and confirm the new key on your next connection.

Do not remove the entry without checking if you cannot explain why it changed.