How to fix Host key verification failed. fatal: Could not read from remote repository. in Git

GitBEGINNERMEDIUMUpdated Dec 6, 2025· 139 views

This error occurs when SSH cannot verify the remote server's identity because its host key is missing from or mismatched in your known_hosts file. The fix typically involves adding the server's host key to your SSH configuration.

Quick fix

Fixes Host key verification failed. fatal: Could not read from remote repository.

ssh -T git@github.com
# Or for other hosts:
ssh -T git@gitlab.com
ssh -T git@bitbucket.org
  1. Test SSH connection to verify the issue
  2. Accept the host key interactively
  3. Add host key using ssh-keyscan
  4. Remove outdated host key and add the new one
git — error
ssh -T git@github.com
# Or for other hosts:
ssh -T git@gitlab.com
ssh -T git@bitbucket.org
Host key verification failed. fatal: Could not read from remote repository.

What this error means

When you connect to a Git remote server via SSH (like GitHub, GitLab, or Bitbucket), your SSH client checks the server's identity against a list of known hosts stored in the `~/.ssh/known_hosts` file. This security feature helps prevent man-in-the-middle attacks by ensuring you're connecting to the legitimate server. The "Host key verification failed" error appears when: 1. You're connecting to the server for the first time and the host key hasn't been added yet 2. The server's host key has changed (which could indicate a legitimate server update or a potential security threat) 3. The known_hosts file is missing, corrupted, or has incorrect permissions 4. You're running in an automated environment (CI/CD) where there's no interactive prompt to accept the key This is a security-first design - SSH refuses to connect rather than risk connecting to an impersonated server.

Typical symptoms

  • Git clone, pull, push, or fetch commands fail when using SSH URLs
  • Error message appears immediately when trying to connect
  • Works fine with HTTPS URLs but fails with git@hostname URLs
  • CI/CD pipelines fail at repository checkout step
  • SSH connections to the Git host fail with the same error
  • Automated scripts that previously worked suddenly fail after server key rotation

Common causes

  1. First-time connection to the Git server without accepting the host key
  2. Server's SSH host key was rotated or changed (e.g., GitHub key rotation in March 2023)
  3. The known_hosts file is missing or has been deleted
  4. Incorrect permissions on ~/.ssh directory or known_hosts file
  5. Running in a fresh CI/CD container without pre-configured known hosts
  6. Multiple entries for the same host with conflicting keys
  7. Using a different hostname or IP than what's stored in known_hosts
  8. Corporate proxy or firewall intercepting SSH connections

How to fix "Host key verification failed. fatal: Could not read from remote repository."

1Test SSH connection to verify the issue

First, test the SSH connection to identify the exact problem:

bash
ssh -T git@github.com
# Or for other hosts:
ssh -T git@gitlab.com
ssh -T git@bitbucket.org

You should see either a prompt to accept the key, the verification error, or a success message.

2Accept the host key interactively

If prompted "Are you sure you want to continue connecting (yes/no)?" type yes and press Enter. Simply pressing Enter without typing yes will not add the key.

bash
ssh -T git@github.com
# The authenticity of host 'github.com (...)' can't be established.
# ED25519 key fingerprint is SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU.
# Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Verify the fingerprint matches the official one published by your Git hosting provider before accepting.

3Add host key using ssh-keyscan

For automated environments or if you want to add the key non-interactively:

bash
# For GitHub
ssh-keyscan -t ed25519 github.com >> ~/.ssh/known_hosts
ssh-keyscan -t rsa github.com >> ~/.ssh/known_hosts

# For GitLab
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts

# For Bitbucket
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts

This fetches and appends the server's current public key to your known_hosts file.

4Remove outdated host key and add the new one

If the server's key has changed (after a legitimate key rotation), remove the old entry first:

bash
# Remove the old key
ssh-keygen -R github.com

# Add the new key
ssh-keyscan -t ed25519 github.com >> ~/.ssh/known_hosts

# Test the connection
ssh -T git@github.com

Only do this if you've verified the key change is legitimate (check official announcements from your Git hosting provider).

5Fix permissions on SSH directory and files

SSH requires specific permissions to trust its configuration files:

bash
# Set correct permissions
chmod 700 ~/.ssh
chmod 600 ~/.ssh/known_hosts
chmod 600 ~/.ssh/config
chmod 600 ~/.ssh/id_*
chmod 644 ~/.ssh/*.pub

# Verify ownership
ls -la ~/.ssh

The .ssh directory should only be readable by you. Incorrect permissions cause SSH to ignore the known_hosts file.

6Use HTTPS as an alternative

If you can't resolve the SSH issue immediately, switch to HTTPS:

bash
# Clone using HTTPS instead
git clone https://github.com/user/repo.git

# Change existing remote from SSH to HTTPS
git remote set-url origin https://github.com/user/repo.git

# Verify the change
git remote -v

HTTPS uses different authentication (username/password or personal access token) and doesn't require SSH host key verification.

Advanced notes

### CI/CD Environments

For automated pipelines, add host keys in your CI configuration:

GitHub Actions:

yaml
- name: Add SSH known hosts
  run: |
    mkdir -p ~/.ssh
    ssh-keyscan github.com >> ~/.ssh/known_hosts

GitLab CI:

yaml
before_script:
  - mkdir -p ~/.ssh
  - ssh-keyscan gitlab.com >> ~/.ssh/known_hosts

Jenkins:
Go to Manage Jenkins > Configure Global Security > Git Host Key Verification Configuration, and set the strategy appropriately.

### GitHub Key Rotation (March 2023)

GitHub rotated their RSA SSH host key on March 24, 2023. If you're seeing this error after that date with GitHub, you likely need to update your known_hosts file. GitHub published their new keys at https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/

### Security Considerations

Never use StrictHostKeyChecking=no in production or on shared systems. While this bypasses the error, it completely disables host key verification and exposes you to man-in-the-middle attacks:

bash
# DON'T do this in production!
ssh -o StrictHostKeyChecking=no git@github.com

Instead, always verify host keys against official sources:
- GitHub: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
- GitLab: https://docs.gitlab.com/ee/user/gitlab_com/#ssh-host-keys-fingerprints

### Multiple Hosts with Same IP

If you have multiple git servers behind a load balancer or using the same IP, you may need to handle hostname aliasing in ~/.ssh/config:

bash
Host github-work
    HostName github.com
    User git
    IdentityFile ~/.ssh/id_work

Frequently asked questions

What does "Host key verification failed. fatal: Could not read from remote reposi" mean?
ssh/known_hosts file. This security feature helps prevent man-in-the-middle attacks by ensuring you're connecting to the legitimate server. The "Host key verification failed" error appears when: 1.
How do I fix "Host key verification failed. fatal: Could not read from remote reposi"?
This error occurs when SSH cannot verify the remote server's identity because its host key is missing from or mismatched in your known_hosts file. The fix typically involves adding the server's host key to your SSH configuration.
What causes "Host key verification failed. fatal: Could not read from remote reposi"?
First-time connection to the Git server without accepting the host key Server's SSH host key was rotated or changed (e.g., GitHub key rotation in March 2023) The known_hosts file is missing or has been deleted
Is the "Host key verification failed. fatal: Could not read from remote reposi" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading