How do I verify an SSH host fingerprint before the first login?
A host fingerprint identifies the server key presented during SSH setup. Obtain the expected fingerprint through an independent trusted channel, then compare the full value and algorithm. The prompt itself is not proof that the server is genuine.
Before you start
- A trusted independent way to obtain this server’s host-key fingerprint.
Instructions
1. Obtain the expected fingerprint independently
Use the provider’s authenticated console or an existing verified administration session for this exact server. The command below reads the public host key only.
ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pubThis example reads an Ed25519 host public key. Compare the fingerprint for the same algorithm that the client presents.
2. Start the client connection
Check that you are connecting to the approved hostname or address and port.
ssh adminuser@203.0.113.10For a previously unknown host, SSH displays a key fingerprint before asking whether to trust it.
3. Compare and record trust only when it matches
Compare the entire SHA256 fingerprint, not a few characters. Accept the key only when the independent value matches. If you cannot obtain a trusted value, stop the connection and resolve server identity with the administrator.
Check the result
- The full algorithm and fingerprint match the independently verified server record.
- Later connections use the expected saved host identity.
Troubleshooting
- The console shows a different key algorithm
- Retrieve the corresponding public host-key fingerprint for the algorithm presented by the client.
- The values differ
- Check the endpoint and whether a rebuild or legitimate key rotation occurred; do not bypass verification.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.