If git clone succeeds over HTTPS but fails over SSH, the repository itself is usually reachable. The two URLs use different connection paths: SSH must choose the correct host and git login, negotiate a host key, present a private key, authenticate that key to the intended account, pass repository authorization, and usually reach TCP port 22. Test those layers separately instead of repeatedly retrying the clone command.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Start with the exact SSH URL, run a direct authentication test, then follow the error-specific branch below. A successful ssh -T test proves authentication, not permission to every repository; a failure there does not prove that the repository path is wrong.
As an Amazon Associate I earn from qualifying purchases.
What HTTPS success does—and does not—prove
HTTPS and SSH are independent Git transports. HTTPS success confirms that the repository path works through the HTTPS endpoint and that your HTTPS credentials, token, or credential helper were accepted. It says nothing about your SSH key, SSH account name, known-hosts file, SSH configuration, or network access to port 22.
| Layer | HTTPS clone | SSH clone | Typical SSH failure |
|---|---|---|---|
| URL syntax | Usually https://host/OWNER/REPO.git |
git@host:OWNER/REPO.git or an ssh:// URL |
Wrong host, owner, repository, or URL form |
| Login identity | Your HTTPS account is selected by credentials or a token | The SSH login is normally the literal user git |
Using your personal username instead of git |
| Authentication | Password, token, or credential helper | Private key matched to a public key registered with the hosting account | Permission denied (publickey) |
| Server identity | Validated by HTTPS certificate and trust store | Validated against ~/.ssh/known_hosts (or the Windows equivalent) |
Host key verification failed |
| Network path | Normally TCP 443 | Normally TCP 22 | Timeout or connection refused |
| Repository authorization | Checked for the HTTPS account | Checked for the account represented by the accepted SSH key | Repository not found after authentication |
Because each layer is independent, changing an HTTPS credential cannot repair an SSH key or a blocked SSH port. Diagnose the first failing layer and change only that layer.
Capture the failure before changing configuration
Run the commands as the same operating-system user who will run Git. Save the complete error text; wording distinguishes a key problem from a host-key or network problem.
git remote -v
ssh -T [email protected]
ssh -vT [email protected]git remote -vshows the URL Git is actually using, which may differ from the URL you intended.ssh -Tperforms authentication without attempting to open a shell. A normal success message says that authentication succeeded and that shell access is unavailable.ssh -vTprints the selected host, port, configuration files, identity files, and final authentication result. Do not paste private-key contents or tokens when sharing a log.
On Windows, use the OpenSSH client included with current Windows versions or the client installed with your Git distribution. The command syntax is the same; key files are commonly under C:Users<name>.ssh.
Step 1: Correct the remote URL and SSH user
Copy the SSH clone URL from the repository’s own “Code” menu rather than converting the HTTPS URL by hand. A conventional GitHub-style URL is:
[email protected]:OWNER/REPO.gitThe equivalent explicit form is:
ssh://[email protected]/OWNER/REPO.gitIn both forms, git is the SSH account. The owner and repository portion identifies the project; it is not the SSH login. Using [email protected]:OWNER/REPO.git, for example, asks the server to authenticate an operating-system user named alice and normally fails.
- Inspect the current remote:
git remote -v. - Replace it with the copied SSH URL:
git remote set-url origin [email protected]:OWNER/REPO.git. - Verify the result with
git remote -v. - Run
ssh -T [email protected]before trying the clone or fetch again.
If the hostname is an internal server rather than GitHub, use that server’s documented SSH hostname and keep its documented SSH login. Do not assume that every provider uses the same host or port.
Step 2: Test SSH authentication directly
A direct test removes Git’s repository-path logic from the equation. Run:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11ssh -T [email protected]If it fails, repeat with verbosity:
ssh -vT [email protected]Read the verbose output in this order:
- Host and port: confirm that the client resolved the intended hostname and is attempting the expected port.
- Configuration: note which system and user SSH configuration files were read and which
Hostblock matched. - Identity files: see which private keys were found and offered. A key listed as “type -1” or “identity file … not accessible” is not available to the client.
- Host-key decision: determine whether the server identity was accepted from
known_hostsor rejected. - Authentication result: distinguish “no mutual signature algorithm,” “sign_and_send_pubkey,” and “Permission denied (publickey).”
A successful test normally ends with an authentication confirmation and a statement that interactive shell access is not provided. That is expected for a Git-only account; it does not indicate a failed test.
Fixing Permission denied (publickey)
This message means the server rejected every public key the client offered. Check the key, the local key-selection process, and the account to which the public key was added.
Confirm that a matching key pair exists
List the SSH directory and identify the private key and its matching public-key file. Common pairs include id_ed25519/id_ed25519.pub and id_rsa/id_rsa.pub. Never upload or disclose the private file; only the .pub file belongs in an account’s SSH-key settings.
ls -la ~/.ssh
ssh-keygen -y -f ~/.ssh/id_ed25519The second command derives a public key from the private key, allowing you to compare it with the public key registered at the hosting service. If the private key has a different name, substitute that path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Register the public key with the intended account
Open the hosting account that should own the Git operations and add the complete contents of the matching .pub file to its SSH-key settings. A key uploaded to a different account will authenticate that account, not the one you expected. If the organization uses repository deploy keys, check whether the key is attached to the correct repository; a deploy key can be limited to one project.
Load the key in ssh-agent or select it explicitly
Start or use an agent, then add the private key:
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -lssh-add -l should list the key’s fingerprint. On systems that manage an agent through a desktop service, start that service using the operating system’s normal controls instead of launching a second competing agent.
To test one key without changing the agent, specify it directly:
ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes -vT [email protected]If this succeeds while plain ssh -T [email protected] fails, the key is valid but automatic selection is wrong. Keep the explicit selection in an SSH configuration block rather than adding random keys until one works.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Make the right key win when several accounts exist
Multiple work, personal, or organization accounts often leave several keys loaded. SSH may offer them in an order that reaches the wrong account or exceeds the server’s allowed attempts. Use host aliases and an explicit identity for each account.
Host github-work
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_work
IdentitiesOnly yes
Host github-personal
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_personal
IdentitiesOnly yesSave this in ~/.ssh/config, protect the file as required by your operating system, and test each alias:
ssh -T git@github-work
ssh -T git@github-personalUse the alias in the Git remote so the selection is deterministic:
git remote set-url origin git@github-work:OWNER/REPO.gitWhen authentication works for only one account, ssh -vT reveals which Host block and identity file were selected. Fix that mapping rather than moving keys between accounts.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Standard size: 4 pink server note pads, Each Book Comes with 50 bound order slips - that's 200 ticket sheets total! Check Pads Size 6.75 x 3.5 inch.
- Convenient Work: These guest check books for servers have a tear-free dotted line that is easy to rip off. You can give as a customer copy or keep for record keeping. We've provided extra rows on the back for additional note taking.Perfect For Restaurants, Lounges, Hotels, Cafes, And Waiters To Use.
- Record Important Information: These server note pads can record important information.Each ticket has a unique serial number printed at the top, dates, order details, number of guests, order amount, table numbers etc. They are lightweight, small and can fit most aprons. They can be used on-demand and can help decrease errors in orders, while improving work efficiency.
- High Quality: Sturdy, Not Drop Powder, It's Thick, You Can Write On The Back And Front Easily.Their whole page printing has clear handwriting and a reasonable layout. On the customer retention part of each guest check, "THANK YOU" on the back to make customers feel appreciated.
- Contact Us: We're confident that the quality of the server note pads will go beyond your expectation. If you experience an issue, contact us, we'll appreciate it to learn from your experience, and we'll make it better
Do not change user context with sudo
A key created and loaded for your normal account is not automatically available to the elevated account. Running sudo git clone ... can therefore produce a public-key failure even though the same command works without elevation. Use one consistent user and key context. If a protected destination genuinely requires administrative rights, clone into a user-owned location first and move files with an appropriate, separately authorized operation; do not use sudo as the first SSH troubleshooting step.
When authentication succeeds but cloning still fails
If ssh -T [email protected] succeeds, the key and SSH account have authenticated. A clone can still fail because the repository path or authorization is wrong.
Verify the owner and repository spelling
Compare the SSH URL character for character with the repository’s current path. Check capitalization where the service treats names distinctly, and remove accidental extra path components. A repository moved, renamed, or made private can leave an old URL in a script or local remote.
Verify access for the authenticated account
Sign in to the hosting account represented by the successful SSH key and confirm that it can read the repository. HTTPS may have used a different account or token, so browser access under another account is not proof that the SSH identity is authorized.
Check deploy-key scope
A deploy key may be intentionally restricted to one repository. If the key authenticates but another repository reports “not found,” inspect the deploy-key attachment and repository permissions. A “repository not found” response can mean either that the path does not exist or that the authenticated account cannot see it.
Handle Host key verification failed safely
Host-key verification protects you from connecting to an unexpected server. Do not blindly accept a changed key or delete every entry in known_hosts.
- Record the hostname and port shown in the error. A key for
github.comis distinct from a key for a nonstandard port or an alias. - Obtain the hosting provider’s current published fingerprint through its official security documentation or administrator.
- Compare that fingerprint with the key presented by your SSH client. If they do not match, stop and investigate a DNS, proxy, server-replacement, or interception problem.
- If the fingerprint is confirmed, inspect the matching entry with
ssh-keygen -F github.comand remove only the obsolete entry, for example withssh-keygen -R github.com, then reconnect and record the verified key.
For an internal host, ask the server administrator to confirm the replacement fingerprint out of band. A changed host key is a security event, not merely a nuisance to suppress.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover from a timeout or connection refusal on port 22
Corporate firewalls, captive portals, proxies, and some residential networks block outbound SSH even when HTTPS is allowed. A timeout usually indicates that the client could not complete the network connection; it is not evidence that your key is invalid.
Recommended Free Tools
For GitHub.com, test the documented SSH-over-443 endpoint:
ssh -T -p 443 [email protected]The hostname for port 443 is ssh.github.com, not github.com. If the test succeeds, clone with the explicit URL:
git clone ssh://[email protected]:443/OWNER/REPO.gitTo keep ordinary GitHub-style URLs while using port 443, add:
Host github.com
Hostname ssh.github.com
Port 443
User gitThen retest:
ssh -T [email protected]This workaround still depends on a proxy allowing SSH traffic inside the HTTPS port. If a proxy performs protocol inspection or requires its own authentication, ask the network administrator for the approved route. The documented port-443 workaround does not apply to GitHub Enterprise Server.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Error-to-action map
| Symptom | Most likely layer | Next action |
|---|---|---|
Permission denied (publickey) |
Key selection, account registration, or SSH user | Run ssh -vT; confirm the git user, private-key availability, agent state, and public-key registration. |
Host key verification failed |
known_hosts entry or changed server identity |
Verify the published fingerprint, inspect the matching entry, and replace only a confirmed obsolete key. |
| Timeout or connection refused on port 22 | Firewall, proxy, routing, or blocked port | Test port 443 where the hosting service supports it; otherwise use the network-approved route or HTTPS. |
Repository not found after SSH authentication |
Owner/repository path or repository permission | Recheck spelling, authenticated account access, and deploy-key scope. |
| Authentication works only with one account | Multiple keys or SSH configuration selection | Use ssh -vT, an explicit IdentityFile, and host aliases with IdentitiesOnly yes. |
Choose the remedy by scope, risk, and portability
| Remedy | Failure layer addressed | Scope | Security and portability notes |
|---|---|---|---|
Correct the URL and use git |
URL or SSH login | One remote | Portable across clients; no credential changes. |
| Register and load the matching key | Public-key authentication | Account or machine | Preserves key-based access; requires account settings access. |
| SSH host alias with explicit key | Multiple-account selection | Selected hosts or repositories | Portable when the same config is maintained; prevents accidental account mixing. |
| Verify and replace a stale host key | Host identity | One host entry | Highest security sensitivity; fingerprint verification is mandatory. |
| SSH over port 443 | Blocked port 22 | All remotes covered by the host block | Keeps SSH authentication; depends on provider support and proxy policy. |
| HTTPS fallback | Unchangeable SSH or network policy | Repository or environment | Valid when organizational policy permits it; it does not repair the underlying SSH configuration. |
End-to-end recovery checklist
- Copy the provider’s SSH clone URL and confirm it uses the
gitSSH user. - Run
ssh -T [email protected], thenssh -vT [email protected]if it fails. - For a public-key error, identify the offered key, verify its matching public key is registered to the intended account, and test with
ssh-addor-i. - If several accounts are configured, add host aliases and set
IdentitiesOnly yes. - Do not use
sudoto change the key context. - If authentication succeeds, check repository spelling, account authorization, and deploy-key scope.
- For a host-key error, verify the fingerprint before changing
known_hosts. - For a port-22 timeout, test
ssh -T -p 443 [email protected]and configure port 443 if supported. - Retest SSH directly, then run
git cloneor update the remote and fetch.
The decisive test is not whether HTTPS can clone; it is which SSH layer fails first. Once the URL, git login, key, account authorization, host identity, and network route each pass independently, the SSH clone uses the same repository path without further special treatment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
