iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A REMOTE HOST IDENTIFICATION HAS CHANGED warning means SSH received a host key that does not match the identity saved by the client. The server may have been rebuilt or its key rotated—or the connection may be reaching an impostor. The warning alone cannot distinguish those cases. Verify the replacement fingerprint through a trusted, independent channel before changing your trust store.
What the warning means
An SSH host key identifies a server to an SSH client. It is different from your personal private key, which proves your identity to the server. When you connect, the client compares the server’s presented host key with the entry it has recorded for that host. OpenBSD’s sshd(8) manual describes this comparison as a check that the host key has not changed.
A mismatch can follow routine infrastructure changes, such as replacing a machine, rebuilding an instance, rotating host keys, or changing which endpoint a hostname resolves to. It can also indicate spoofing or a man-in-the-middle attack. SSH stops or warns because it cannot establish that the endpoint is the same one previously trusted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Verify the new identity before editing known_hosts
- Record the exact destination. Read the complete error and note the hostname, port, and any IP address shown. Check the actual SSH command and configuration, including aliases, to confirm which endpoint the deploy is contacting.
- Ask the infrastructure owner about the change. Request the expected host-key fingerprint through an authenticated channel independent of the connection producing the warning. Confirm that the reported change applies to the same hostname and port.
- Compare fingerprints. Compare the trusted fingerprint with the key presented by the endpoint. Do not treat a key as trustworthy simply because it appears after retrying the connection or running
ssh-keyscan. - Update only the matching trust entry. After verification, locate and remove the stale entry, or update it through your team’s managed known-hosts configuration.
- Retry with checking enabled. Reconnect only after the verified replacement key is in the trust store used by the SSH process.
OpenBSD documents ssh-keygen -F for finding a host entry and ssh-keygen -R for removing matching entries, including hashed hostnames. Use the same host-and-port form as the SSH client. For example, to inspect and remove an entry for a default-port host:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh-keygen -F deploy.example.net
ssh-keygen -R deploy.example.netFor a non-default port, SSH commonly identifies the host in known_hosts as [hostname]:port; use that form when searching or removing the entry. Confirm the form used by your connection and configuration rather than removing a broader entry than intended.
Why ssh-keyscan is not verification
ssh-keyscan can collect the key an endpoint presents, which is useful for preparing a known-hosts file. But collecting a key does not prove the endpoint’s identity. OpenBSD’s ssh-keyscan(1) manual warns that an attacker able to intercept network traffic could substitute a key and impersonate the server.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use scan output only after comparing its fingerprint with one obtained through a trusted, independent channel, or when the network and endpoint are already trusted by an appropriate process. A scan from the same network path that produced the warning is not independent confirmation.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchMake CI trust the right host key
SSH checks the host database available to the client process running the deployment. A key accepted on a developer’s laptop does not automatically establish trust for a separate runner. First identify the runner account and its HOME, SSH configuration, destination alias, and whether its filesystem persists between jobs. Provision the verified host key—or a trusted host-certificate configuration—in the trust store that process actually reads.
The exact setup depends on the CI platform and deployment configuration, but the security requirement is the same: distribute the expected identity through an authenticated configuration or certificate process. Do not make a potentially untrusted scan the source of truth, and do not disable host-key checking just to make a job pass.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose checking behavior without weakening mismatch protection
OpenBSD’s current ssh_config(5) manual describes these StrictHostKeyChecking behaviors:
| Setting | New host key | Changed host key | What it means in practice |
|---|---|---|---|
ask (the documented default) |
Added only after confirmation | Refused | Prompts a person for first-time trust while protecting against an unexpected change. |
accept-new |
Added automatically | Refused | Removes the first-connection prompt but does not resolve or accept a changed key. |
no or off |
May be accepted subject to restrictions | May be allowed subject to restrictions | Weakens protection by relaxing checks; it is not a safe fix for a mismatch. |
These settings do not make an unverified first key trustworthy. For automation, establish host identity through a trusted provisioning or certificate process, and keep changed-key rejection in place.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
