All Products
Search

This Product

    :Resolve the "Host key verification failed" error

    Document Center

    :Resolve the "Host key verification failed" error

    Last Updated:Jun 21, 2026

    This topic describes the causes and solutions for the "Host key verification failed" error when you connect to a Linux ECS instance over SSH.

    Symptoms

    • When you connect to a Linux ECS instance over SSH from a client that runs Linux or macOS, you receive the following error message:

      @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that the RSA host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
ae:6e:68:4c:97:a6:91:81:11:38:8d:64:ff:92:13:50.
Please contact your system administrator.
Add correct host key in /root/.ssh/known_hosts to get rid of this message.
Offending key in /root/.ssh/known_hosts:70
RSA host key for x.x.x.x has changed and you have requested strict checking.
Host key verification failed.

    • When you use an SSH client, such as PuTTY or MobaXterm, on a local Windows client to connect to a Linux ECS instance, you receive an error message such as "The host key does not match the one PuTTY has cached for this server" or "remote server identification has changed".

      PuTTY displays a WARNING - POTENTIAL SECURITY BREACH! security warning dialog box. The key type is ssh-ed25519. You can click Accept, Connect Once, or Cancel.

      The MobaXterm warning dialog box provides three options: Accept the new server hostkey and carry on connecting, Refuse the new server hostkey and abort the connection, and Accept and save as additional hostkey (keep the existing ones).

    Cause

    This error occurs when the SSH public key of the ECS instance changes. This can happen after you reinstall the operating system or change account information. As a result, the public key fingerprint saved on your local client no longer matches the one on the server, which triggers the security warning.

    Solution

    The solution depends on the operating system of your local client.

    Local client: Windows

    This section uses PuTTY and MobaXterm as examples. The steps may vary for other SSH clients.

    If you use PuTTY, click Accept. PuTTY automatically updates the cached public key fingerprint, and you can then log in to the instance.

    If you use MobaXterm, click Accept the new server hostkey and carry on connecting. MobaXterm automatically updates the cached public key fingerprint, and you can then log in to the instance.

    Local client: Linux or macOS

    1. On your local client, run the following command to open the known_hosts file for your user account:

      vim ~/.ssh/known_hosts

    2. Press i to enter Insert mode.

    3. Delete the entry that corresponds to the IP address of your ECS instance, as shown in the following example:

      39.105.    ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBEPMCfKNtd5Pkjp4A+ocwNzeTN
fLNrUf3a0EfqXj4X4URJMPEzEl94ftuA7ZltOM0cAMkeZzOql
~

    4. Press the Esc key, enter :wq, and press Enter to save the file and exit.

    5. Reconnect to the Linux ECS instance to verify that the connection is successful.