Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsIf you see “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!”, first determine whether the Droplet’s SSH host key really is duplicated or whether your computer has a stale known_hosts entry for an IP that was reused. Remove a stale client entry only after verifying the new server’s identity. If two Droplets actually share a host key, rotate the affected server keys from trusted administrative access, then verify the new fingerprints.
What “duplicate SSH host keys” can mean
SSH host keys let a client recognize a server. They are not your private login key and are not the user public keys in authorized_keys. DigitalOcean covers host-key troubleshooting separately from user authentication keys in its SSH troubleshooting guide and SSH key documentation.
As an Amazon Associate I earn from qualifying purchases.
The changed-host-key warning does not, by itself, prove that two servers share a key. There are two common situations to distinguish:
Recommended Free Tools
- Stale client record: A Droplet was destroyed, rebuilt, or replaced, and a new server now uses an IP or hostname for which your client already saved an older key. DigitalOcean notes that this can happen after a Droplet is destroyed and a new one is created using its IP.
- Duplicated server identity: Two Droplets present the same SSH host-key fingerprint. This calls for server-side key rotation, not merely deleting a client record.
A changed fingerprint is a security signal. Do not accept it blindly: an unexpected key can also indicate that you are connecting to the wrong endpoint.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the right fix
| Question | Client-side cleanup | Server-side rotation |
|---|---|---|
| What is wrong? | The client has a saved record for a previous server at this IP or hostname. | Two servers actually present the same host public key, or the server identity needs replacement. |
| Where do you make the change? | On each affected SSH client. | On the affected Droplet through trusted administrative access or the recovery console. |
| What changes? | The client’s stored trust record is removed; server keys stay unchanged. | The server gets a new host identity; clients must verify and learn its new fingerprint. |
| Main caution | Verify the endpoint and fingerprint before accepting the new key. | Preserve access and change server host keys only, not user login keys. |
Check which case you have
Record the endpoint and warning
Note the Droplet IP or hostname, the fingerprint shown in the warning, and which Droplet you expect to reach. If you recently replaced a Droplet or assigned its IP to a new one, a stale client record is plausible. DigitalOcean describes IP reuse after a Droplet replacement as a reason for this warning in its OpenSSH connection guide.
Compare fingerprints to test for actual duplication
With trusted console or administrative access, inspect the configured host-key files on each Droplet. Common OpenSSH defaults are under /etc/ssh, although the daemon may be configured to use other paths. Compare the fingerprints derived from the public host-key files for the key types both servers offer. Do not copy, publish, or expose private host-key files. If only one client has an old record and the servers’ fingerprints are distinct, the issue is likely client-side; matching fingerprints across Droplets point to a server-side duplication that needs correction.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Fix a stale known_hosts entry
Use this path only after confirming that the IP or hostname now belongs to the intended Droplet and independently verifying the fingerprint it presents.
- On the affected client, remove the old entry for the Droplet IP:
ssh-keygen -R <droplet-ip> - If you connected using a non-default port or a hostname, use the exact host notation and the relevant
known_hostsfile. DigitalOcean also documents the file-specific formssh-keygen -f <known_hosts-file> -R <droplet-ip>in its Droplet rebuild guidance. - Reconnect, inspect the offered fingerprint, and accept it only if it matches the identity you verified through a trusted channel.
This removes a saved record from that client; it does not change the Droplet’s host keys. Repeat the cleanup on other clients only when their records are stale too.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Rotate genuinely duplicated host keys
Use a trusted DigitalOcean console or another administrative channel before changing keys so you do not lose access. Identify the host-key files actually configured for sshd. Back up relevant configuration if your environment requires it, then move aside or remove only the affected server host-key pairs. Do not remove authorized_keys, user login keys, or your administrator’s local private key.
- On the affected Droplet, preserve trusted access and identify the configured host private and public key files.
- Remove or move aside the confirmed duplicate host-key files, and only those files.
- Generate missing default host keys as root:
sudo ssh-keygen -A - Restart or reload the SSH daemon using the command appropriate to the Droplet’s Linux distribution. There is no single service-management command established for every distribution.
- Confirm that SSH is listening and compare the new public-key fingerprints across the affected Droplets. Each should present the intended, distinct identity.
- After independently verifying the new fingerprint, remove the old entry from each affected client’s
known_hostsfile and reconnect.
DigitalOcean documents sudo ssh-keygen -A for generating host keys when they are missing. The OpenSSH manual specifies that -A generates default host keys if they do not already exist. Therefore, running the command alone does not replace duplicated key files that are still present.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recover if SSH is unavailable
If network access or sshd has failed, DigitalOcean’s Recovery ISO guide describes using the recovery console. Its menu includes “Clear out Cloud-Init cached data (will regenerate host ssh keys).” Follow the current console flow and return the Droplet to booting from its installed local system when recovery is complete. The recovery system uses different SSH host keys; do not treat its fingerprint as the installed Droplet’s identity. Verify the fingerprint after the Droplet has returned to its normal system.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Reduce the chance of a repeat
DigitalOcean documents that cloud-init consumes user data during a Droplet’s first boot and can configure the server. If matching host keys recur after image cloning or automated provisioning, inspect image preparation and first-boot provisioning to ensure that each instance receives unique host keys. This is a diagnostic lead, not proof that cloning or cloud-init caused a particular incident.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Common problems and fixes
- The warning returns after deleting the entry. Check that you removed the entry for the exact hostname, IP, port notation, and
known_hostsfile used by the connection. Verify the endpoint again before accepting a key. ssh-keygen -Aleaves the fingerprint unchanged. The command creates default host keys if absent; it does not overwrite existing files. Confirm the configured host-key paths and remove only the confirmed duplicate server host-key pairs before generating replacements.- You cannot reconnect after rotating keys. Use the DigitalOcean console or Recovery ISO to check that the Droplet booted into its installed system, the daemon is running, and the configured host-key files exist. Then verify the new fingerprint through a trusted channel.
- The recovery console shows a different fingerprint. That system has its own host keys. Return to the installed Droplet before verifying and trusting its normal SSH identity.
- You are unsure whether the key changed legitimately. Do not accept it yet. Confirm the Droplet identity and fingerprint through a trusted administrative route.
Or let it run in the cloud
StreamNeo is unrelated to SSH repair; it keeps a YouTube channel live 24/7 from uploaded videos. Upload a recording or make a playlist, add your YouTube stream key once, and go live. Nothing has to stay on at home; it streams the uploaded quality up to 4K 60fps at one flat price per slot, with automatic recovery if YouTube drops the stream. The first day is free with no card. Monthly pricing is $9.99 per month. Learn more at StreamNeo, or start your free day.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
