Host Key Verification Failed
Host key verification failed - No ED25519 host key is known - WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!
Host Key Verification Failed
Symptom
The host is unknown and strict checking is on:
No ED25519 host key is known for ssh.<INSTANCE>.git.eu and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.
The host key changed since your last connection:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
...
Offending ED25519 key in ~/.ssh/known_hosts:1
remove with:
ssh-keygen -f '~/.ssh/known_hosts' -R 'ssh.<INSTANCE>.git.eu'
...
Host key verification failed.
Cause
- Unknown host:
~/.ssh/known_hostsholds no key for the server, and the client refuses to ask (StrictHostKeyChecking yes, common in CI). - Changed key: the server key differs from the one you saved. The instance may have been reinstalled or its key replaced, or another machine answers in its place.
git.eu does not publish its host key fingerprints yet: ask your instance operator for the fingerprint, through a channel other than this connection.
Diagnose
Print the fingerprint the server shows now:
ssh-keyscan -t ed25519 ssh.<INSTANCE>.git.eu | ssh-keygen -lf -
Compare the SHA256: value with the one your instance operator gives you.
Fix
Option A - Unknown host: save the confirmed key (recommended)
Once the fingerprint matches, save the key:
ssh-keyscan -t ed25519 ssh.<INSTANCE>.git.eu >> ~/.ssh/known_hosts
Option B - Changed key: replace it after confirmation
Only after the operator confirms the new fingerprint, remove the old key, then save the new one as in Option A:
ssh-keygen -R 'ssh.<INSTANCE>.git.eu'
Warning. Never remove the old key without that confirmation: a changed key can mean someone is intercepting the connection.
Verify
git ls-remote git@ssh.<INSTANCE>.git.eu:<USERNAME>/<REPO>.git
No Host key verification failed line appears.
Prevent
- In CI, pin the confirmed key in the job's
known_hostsinstead of turning host checks off.