📖 ~1 min read
Table of contents
Symptom & Impact
Clients refuse to connect with `REMOTE HOST IDENTIFICATION HAS CHANGED` after host reimaging.
Environment & Reproduction
Common after rebuilding a host without preserving SSH host keys.
Root Cause Analysis
New host keys conflict with the entries stored in client known_hosts files.
Quick Triage
Confirm new fingerprint with `ssh-keyscan -t ed25519 host`.
Step-by-Step Diagnosis
Compare against the known_hosts entry and verify the rebuild was authorized.

Solution – Primary Fix
Remove the stale entry with `ssh-keygen -R host` and trust the new fingerprint.
Still having issues? Our IT Solutions & Services team can diagnose and resolve this for you. Get in touch for a free consultation.

Solution – Alternative Approaches
Use SSH certificates so client trust is anchored on a CA rather than per-host keys.
Verification & Acceptance Criteria
Clients connect without host key warnings.
Rollback Plan
Restore prior host keys from backup if available to avoid re-trusting from scratch.
Prevention & Hardening
Back up `/etc/ssh/ssh_host_*` to your config management vault for restoration.
Related Errors & Cross-Refs
Related to client known_hosts churn and SSH CA rotation events.
Related tutorial: View the step-by-step tutorial for centos-stream-10.
View all centos-stream-10 tutorials on the Tutorials Hub →
Browse all common problems & solutions on the Tutorials Hub.
References & Further Reading
OpenSSH host key management documentation.
Need Expert Help?
If you cannot resolve this yourself, our team offers hands-on Server Management, Managed IT Services, and flexible Support Plans. Contact us today — we respond within one business day.