What to Do When SSH Says the Host Key Has Changed

An SSH host-key warning means the server identity differs from the key your client remembers. A reinstall or address reassignment can explain it, but so can connecting to the wrong machine. Verify the new fingerprint before replacing the stored record.

Use a separate trusted access path

1. Check that the hostname and IP match your current service details.
2. Confirm whether an OS reinstall, restore or intentional host-key rotation occurred.
3. Open the trusted provider console or use another independently authenticated channel.
4. Obtain the fingerprint for the host-key type shown in the warning.
5. Compare the complete fingerprint before accepting the new identity.

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Run this read-only Linux command on the server through the trusted console when it uses an Ed25519 host key. Other key types use different public-key files. Do not share or copy the corresponding private host-key file.

Replace only the verified entry

ssh-keygen -R server.example.com

Run this on your client only after verification, substituting the exact saved hostname or address. For a non-default port, known_hosts commonly uses the form [server.example.com]:2222. Removing an entry merely allows a new trust decision; it does not establish that the replacement key is genuine.

Confirm the destination and account

Reconnect, compare the presented fingerprint again, and verify the expected server identity and application state. Keep a private record of the intentional change so teammates do not have to guess why their clients also warn.

If the change is unexplained or you cannot verify the fingerprint, stop the connection attempt and investigate the address and service with support. Do not disable host-key checking globally to silence the warning.

Use the reinstall checklist for planned OS changes and the Linux security guide for account access controls.