What should I do when SSH says the host key has changed?
A changed-host-key warning means the server identity differs from the identity previously trusted. A rebuild can cause this, but so can connecting to the wrong endpoint. Verify the new fingerprint independently before changing your local trust record.
Instructions
1. Confirm the reason and new identity
Check the server address, port and any recent rebuild or IP reassignment. Obtain the new fingerprint through the authenticated provider console or a verified administrator, using the same host-key algorithm as the warning.
2. Remove only the verified stale record
Only after the independent fingerprint check succeeds, remove the single hostname record. Use the bracketed hostname-and-port form instead for a custom port.
ssh-keygen -R vps.example.com -f "$env:USERPROFILE\.ssh\known_hosts"This changes the local known-host file for the named endpoint. It does not change server keys. OpenSSH may retain an old copy of the local file.
3. Reconnect and compare again
The newly presented fingerprint must match the independently verified value.
ssh adminuser@vps.example.comAccept the new record only after the exact fingerprint comparison succeeds.
Check the result
- The new fingerprint matches the trusted independent record.
- The next connection succeeds without an identity-change warning.
Troubleshooting
- No rebuild or rotation is known
- Investigate endpoint identity with the administrator before altering trust.
- The warning remains
- Check whether it references a different IP, port or known-host file. Do not delete unrelated entries.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.