Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If git clone succeeds over HTTPS but fails over SSH, the repository itself is usually reachable; the SSH route is failing at a different layer. Check the SSH URL and git login first, then test authentication directly, verify the key and account, separate repository permissions from login, review host-key warnings, and finally test port 443 if port 22 is blocked.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Why HTTPS can work while SSH fails
HTTPS and SSH are not interchangeable transports with different syntax. A successful HTTPS clone proves that the repository path is valid enough for the HTTPS endpoint and that your HTTPS authentication route is accepted. It does not prove that your SSH URL, SSH user, key selection, host-key database, repository authorization, firewall route, or proxy configuration is correct.
As an Amazon Associate I earn from qualifying purchases.
SSH adds several checks before Git can read objects:
- The URL must use the hosting service’s SSH form, such as
[email protected]:OWNER/REPO.gitor an equivalentssh://URL. - The SSH connection normally logs in as
git, not as your personal account name. - Your local SSH client must select a private key whose public half is registered with the intended hosting account (or is valid for the intended repository).
- The client must trust the server’s host key through
known_hosts. - The authenticated account or deploy key must be authorized to read the exact repository.
- Your network must permit the SSH connection, usually TCP port 22.
That is why a working HTTPS clone and a failed SSH clone can be true at the same time. Diagnose the failing layer instead of changing repository contents or credentials at random.
#1 Best Overall
Run this short diagnostic sequence first
Use the same operating-system user that normally runs Git. Do not begin by adding sudo; elevated commands use a different home directory, SSH configuration, agent, and key context.
- Print or inspect the remote URL. Run
git remote -vinside an existing checkout, or compare the URL you are passing togit clonewith the hosting service’s SSH clone address. Confirm the owner, repository name, and thegituser. - Test SSH without Git. For GitHub, run
ssh -T [email protected]. A successful result normally confirms authentication and explains that interactive shell access is not provided. That is expected; Git hosting uses the SSH session for Git operations rather than a normal shell. - Repeat with diagnostics enabled. Run
ssh -vT [email protected]. Read the output for the host and port, the configuration files read, identity files considered, keys offered, and the final authentication result. The verbose trace tells you whether the failure occurs before a key is offered, during key authentication, or after authentication. - Classify the final message. Treat
Permission denied (publickey),Host key verification failed, a timeout or refusal, andRepository not foundas different problems. Apply the matching branch below.
For another host, replace github.com with that provider’s documented SSH hostname and keep its required SSH user. The exact test host matters: a browser URL or HTTPS hostname is not automatically the SSH endpoint.
Correct the SSH clone URL and login user
Use the provider’s SSH syntax
The familiar scp-style form is:
[email protected]:OWNER/REPO.gitAn equivalent URL-style form is:
ssh://[email protected]/OWNER/REPO.gitReplace OWNER and REPO with the exact case and spelling shown by the hosting service. A small path error can produce a repository-not-found response even when SSH authentication itself is perfect.
Keep the SSH account as git
For GitHub, all remote connections use the git SSH user. Your personal account name belongs in the hosting service’s account settings, not before the @ in the SSH URL. For example, [email protected]:OWNER/REPO.git asks the server for an operating-system user named alice and fails; [email protected]:OWNER/REPO.git selects the Git service endpoint.
Check an existing remote before recloning
If a checkout was created with the wrong transport, inspect it with:
git remote -vChange only the URL when the repository path is correct:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →git remote set-url origin [email protected]:OWNER/REPO.gitThen run the direct SSH test before retrying fetch or clone. This avoids confusing a URL problem with a key problem.
Rank #2
Fix Permission denied (publickey)
This message means the server rejected the public-key authentication attempt. It does not identify which key, account, or SSH user was wrong, so use the verbose trace and verify each item in order.
1. Confirm that a private key exists for the same local user
Look in the normal user’s SSH directory (commonly ~/.ssh) for the private key you intend to use and its matching public-key file. The key must be available to the process running Git. If you created the key while logged in as one user but run Git as another, the second user cannot automatically use the first user’s files or agent.
2. Register the matching public key with the intended account
Upload the public half of the key to the hosting account that should access the repository. GitHub’s key-generation guidance treats this registration step as what enables SSH Git operations. Do not upload a different key from the one the verbose trace shows being offered. If several keys exist, compare the offered identity in ssh -vT with the public key registered in account settings.
Recommended Free Tools
3. Load or select the key explicitly
If your setup uses ssh-agent, make sure the intended private key is loaded in the agent used by the current session. A typical sequence is:
ssh-add ~/.ssh/KEY-FILE
ssh-add -lIf you do not want to rely on agent selection, test a specific key directly:
ssh -i ~/.ssh/KEY-FILE -vT [email protected]When the explicit test succeeds, make the selection persistent with an SSH configuration entry or use the same identity selection for Git. The important result is that the key offered by the client belongs to the account that is authorized for this repository.
4. Keep one account and key context
Do not prepend sudo to the clone as a first remedy. The elevated user normally has a different HOME, SSH configuration, known-hosts file, and agent socket. A key that works for your normal account may therefore be invisible to the elevated process. Fix ownership, paths, or configuration while staying with one consistent user instead of creating another, unrelated key context.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →5. Re-run the test, then retry Git
Only retry git clone after ssh -T [email protected] succeeds with the intended key. If the direct test still ends in Permission denied (publickey), the verbose output should show whether no key was found, the wrong key was offered, or the server rejected the offered key. Those cases require different changes; repeatedly cloning does not add information.
Separate SSH authentication from repository authorization
A successful ssh -T proves that the host accepted your SSH identity. It does not grant that identity access to every repository.
When authentication succeeds but clone fails
- Recheck the owner and repository spelling in the clone URL, including punctuation and capitalization shown by the host.
- Confirm that the account identified by the SSH key can read the repository. Membership, team access, or organization policy may differ from the account you use for HTTPS.
- Check whether the key is a deploy key. A deploy key can be attached to a particular repository and may not authorize access to another repository or organization.
- Interpret a repository-not-found response carefully. It can mean that the path does not exist, but it can also mean that the authenticated account is not allowed to see it.
Use the exact repository SSH URL copied from the host after confirming the account associated with the successful SSH test. Changing keys is not a repository-permission fix unless the new key belongs to an account that actually has access.
Handle Host key verification failed safely
Host-key verification protects you from connecting to an unexpected server. The error concerns the server identity in your local known_hosts file, not the repository’s read permission and not your account’s public key.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsInspect before changing anything
Identify the host and port shown in the error, then inspect the corresponding entry in the relevant user’s known_hosts file. A changed key can result from a legitimate provider migration, a changed endpoint, a stale entry, or an interception attempt. Do not blindly delete the entry and accept whatever key appears next.
Compare the fingerprint with an authoritative source
Compare the presented fingerprint with the hosting provider’s published fingerprints. Proceed only when the fingerprint is confirmed for the hostname and port you are using. If the fingerprint cannot be verified, stop and involve the host or network administrator rather than weakening host-key checking.
Account for alternate endpoints
The host recorded for standard SSH and the host recorded for a port-443 workaround can be different. Keep their entries and fingerprints distinct; changing one does not validate the other.
Rank #4
Work around a network that blocks port 22
Timeouts and connection refusals before authentication usually indicate a firewall, proxy, or routing problem. Some networks refuse SSH entirely even though HTTPS traffic is allowed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Test GitHub’s SSH endpoint on port 443
GitHub documents an SSH service on port 443. The hostname is ssh.github.com, not github.com. Test it directly:
ssh -T -p 443 [email protected]If that test authenticates successfully, clone with the port and hostname included:
git clone ssh://[email protected]:443/OWNER/REPO.gitMake the workaround transparent to Git
Instead of rewriting every URL, add a host rule to the SSH configuration used by the same local user:
Host github.com
Hostname ssh.github.com
Port 443
User gitWith that rule, the ordinary-looking command uses the alternate endpoint:
ssh -T [email protected]
git clone [email protected]:OWNER/REPO.gitRead the verbose output to confirm that the alias resolves to ssh.github.com and port 443. A corporate proxy can still interfere with this method, and GitHub Enterprise Server does not support this particular port-443 workaround according to the cited GitHub guidance.
Know when to stop changing SSH
If port 22 is blocked and port 443 is unavailable or prohibited by the network, HTTPS remains a valid fallback. It is better to use the approved HTTPS route than to bypass firewall policy or accept an unverified host key.
Best Value
Make multiple SSH accounts select the right key
Multiple keys commonly cause a clone to authenticate as the wrong account. The server may accept one of your keys, but that account may not have access to the requested repository.
Use the verbose trace to identify selection
Run ssh -vT for the host and look for the configuration files read, identity files considered, and key offered. If the trace shows an unexpected key, correct the SSH configuration or agent contents rather than changing repository permissions.
Pin an identity for a host alias
For two accounts on the same provider, define separate aliases with explicit identity files. For example:
Host github-personal
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_personal
IdentitiesOnly yes
Host github-work
HostName github.com
User git
IdentityFile ~/.ssh/id_ed25519_work
IdentitiesOnly yesUse the alias in the SSH URL:
git clone git@github-work:ORG/REPO.gitThe URL’s user remains git; the alias controls the hostname and key. Test each alias with ssh -T before cloning so an account mix-up is visible immediately.
Keep deploy keys scoped
If one key is a repository-specific deploy key and another is an account key, pin the deploy key only to the repository that uses it. A successful SSH login with a deploy key does not imply organization-wide access.
Error-to-action map
| Symptom | Likely failure layer | Action |
|---|---|---|
Permission denied (publickey) |
SSH user, key selection, key registration, or account | Run ssh -vT; confirm the git user, private key availability, agent or explicit identity, and public-key registration. |
Host key verification failed |
known_hosts entry or changed server identity |
Inspect the matching host and port, verify the fingerprint with the provider, then update the entry only after verification. |
| Timeout or connection refused on port 22 | Firewall, proxy, route, or blocked SSH service | Test the provider’s supported port-443 SSH endpoint; otherwise use the approved HTTPS route. |
Repository not found after SSH authentication |
Wrong path or insufficient repository permission | Recheck owner and repository spelling, account access, and deploy-key scope. |
| Authentication works only with one account | Multiple keys or SSH configuration selection | Use ssh -vT, explicit IdentityFile, IdentitiesOnly, or separate host aliases. |
Choose the remedy by scope and risk
| Remedy | Best when | Scope | Security and access considerations |
|---|---|---|---|
Correct the SSH URL and git user |
The URL uses a personal username, HTTPS syntax, or the wrong path | One remote or repository | Low risk; no key or host-trust change. |
| Register and select the correct key | The server returns Permission denied (publickey) |
One account, key, or host configuration | Requires access to the intended hosting account; keep the private key in the correct user context. |
| Fix repository authorization | ssh -T succeeds but cloning returns not found or denied |
One repository, organization, or deploy key | May require owner or organization-administrator action; changing local SSH settings cannot grant repository permission. |
Verify and repair known_hosts |
The host identity changed or the stored entry is wrong | One host and port | Highest verification sensitivity; never accept an unverified replacement key. |
| Use SSH over port 443 | Port 22 is blocked but the provider supports an alternate endpoint | All matching URLs on that host alias | Preserves key-based SSH, but proxies may still block it and support varies by hosting product. |
| Stay on HTTPS | Network policy blocks SSH or the organization does not permit an SSH change | Selected repositories or all Git traffic | Valid fallback; do not weaken firewall or host-key policy merely to force SSH. |
Verify the fix without guessing
- Run
ssh -vTwith the exact hostname, alias, port, and user used by the clone URL. - Confirm that the trace shows the intended configuration and identity file, and that the server accepts authentication.
- Confirm that the authenticated account can read the repository and that any deploy key is attached to the correct repository.
- Use the exact owner and repository path copied from the hosting service’s SSH URL.
- Run
git clonewithoutsudoand as the same user whose SSH test succeeded. - If the network workaround is enabled, verify that the trace uses
ssh.github.comon port 443 rather than silently returning to port 22.
After a successful clone, inspect the resulting remote with git remote -v. This catches a common follow-up problem in which the initial clone used the intended transport but a later script rewrites the remote back to an incorrect URL.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When HTTPS is the correct permanent choice
SSH is not mandatory for Git. If your network blocks both standard and alternate SSH endpoints, or your organization’s policy requires HTTPS, keep using the HTTPS clone URL that already works. The goal is reliable, authorized repository access; changing transport is optional. Use SSH when its key management, account separation, and network path fit your environment, not because a working HTTPS route is somehow defective.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
