How to fix The RSA host key for hostname has changed in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 230 views

This error occurs when SSH detects a mismatch between the host key stored locally and the key presented by the remote server. It typically happens after server reinstallation, key rotation, or network configuration changes. You can fix this by removing the old key from your known_hosts file.

Quick fix

Fixes The RSA host key for hostname has changed

ssh-keygen -R hostname
# or
ssh-keygen -R 192.168.1.100
  1. Verify the server change is legitimate
  2. Remove the old host key using ssh-keygen
  3. Attempt to reconnect to the server
  4. Accept the new host key
ssh — error
ssh-keygen -R hostname
# or
ssh-keygen -R 192.168.1.100
The RSA host key for hostname has changed

What this error means

SSH uses host key verification to ensure you're connecting to the intended server and not being victim to a man-in-the-middle attack. When SSH detects that the host key doesn't match what's stored in your ~/.ssh/known_hosts file, it refuses the connection and warns you about the change. This is a security feature designed to protect you from impersonation attacks, but it can also occur legitimately when a server is reinstalled, upgraded, or its SSH keys are regenerated.

Typical symptoms

  • SSH connection fails with 'Warning: Remote Host Identification Has Changed'
  • Error message includes the offending hostname or IP address
  • Error indicates the line number in known_hosts file that contains the old key
  • Manual SSH connections are blocked until the issue is resolved
  • Automated scripts or deployments fail when connecting to the affected server

Common causes

  1. The server was reinstalled or upgraded, generating a new SSH host key
  2. The server's SSH keys were manually rotated as a security practice
  3. The network configuration changed (different IP address or hostname mapped to the same server)
  4. You're connecting to a different server with the same IP address or hostname
  5. The known_hosts file on your client machine was corrupted or manually altered

How to fix "The RSA host key for hostname has changed"

1Verify the server change is legitimate

Before proceeding, contact your server administrator or check internal documentation to confirm that the host key change is expected. If you didn't authorize the change and don't have a good reason for it, do not continue—this could indicate a security breach.

2Remove the old host key using ssh-keygen

Use the ssh-keygen command to remove the old key for the affected server. Replace 'hostname' or '192.168.1.100' with your actual hostname or IP address:

bash
ssh-keygen -R hostname
# or
ssh-keygen -R 192.168.1.100

This command removes all keys belonging to that hostname from your ~/.ssh/known_hosts file. It works even if the entries are hashed for privacy.

3Attempt to reconnect to the server

Try connecting to the server again using your normal SSH command:

bash
ssh user@hostname

SSH will now prompt you about the new host key fingerprint.

4Accept the new host key

When prompted with a message like "Are you sure you want to continue connecting?", carefully review the host key fingerprint if you have a way to verify it, then type 'yes' and press Enter. This adds the new key to your known_hosts file and allows the connection to proceed.

5Verify connectivity

After accepting the new key, you should be able to log in successfully. Test a few SSH operations to ensure everything is working correctly:

bash
ssh user@hostname 'echo Connection successful'

Advanced notes

If you have a hashed known_hosts file (entries appear as '|1|...' instead of plain hostnames), ssh-keygen -R still works correctly. For CI/CD pipelines or automated deployments, you may need to handle this error by disabling strict host key checking temporarily with ssh -o StrictHostKeyChecking=accept-new, but use caution and verify the server change first. Some organizations use SSH fingerprint verification tools or scripts to validate key changes before accepting them automatically. For servers behind load balancers or with dynamic IP addresses, consider using SSH jump hosts or bastion servers with stable keys instead.

Frequently asked questions

What does "The RSA host key for hostname has changed" mean?
SSH uses host key verification to ensure you're connecting to the intended server and not being victim to a man-in-the-middle attack. ssh/known_hosts file, it refuses the connection and warns you about the change. This is a security feature designed to protect you from impersonation attacks, but it can also occur legitimately when a server is reinstalled, upgraded, or its SSH keys are regenerated.
How do I fix "The RSA host key for hostname has changed"?
This error occurs when SSH detects a mismatch between the host key stored locally and the key presented by the remote server. It typically happens after server reinstallation, key rotation, or network configuration changes. You can fix this by removing the old key from your known_hosts file.
What causes "The RSA host key for hostname has changed"?
The server was reinstalled or upgraded, generating a new SSH host key The server's SSH keys were manually rotated as a security practice The network configuration changed (different IP address or hostname mapped to the same server)
Is the "The RSA host key for hostname has changed" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading