The error means your SSH client cannot establish trust in the GitLab server identity. Do not bypass the warning blindly. First confirm that you are connecting to the correct hostname, inspect the key and its SHA-256 fingerprint, and compare that fingerprint with GitLab.com’s published fingerprint or the fingerprint supplied by your Self-Managed or Dedicated administrator. If the server was rebuilt and its identity should remain unchanged, restore the original SSH host keys. If the key was intentionally replaced, remove only the stale entry with ssh-keygen -R, then accept the replacement after independent verification.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What “host key verification failed” means
SSH performs two separate checks when you connect to GitLab. The first is server identity: the GitLab host presents an SSH host key, and your client compares it with entries in ~/.ssh/known_hosts and, on some systems, a system-wide known-hosts file. Only after that check succeeds does SSH proceed to authenticate your GitLab account with a user key.
As an Amazon Associate I earn from qualifying purchases.
A failure therefore does not usually mean that your GitLab username, deploy key, or access token is wrong. It means the client cannot trust the server identity because the key is missing, the key differs from the saved value, or the connection is reaching a host you did not intend to contact. GitLab Support describes this protection as “The error is a security feature, not a bug.”
A changed key can be legitimate after a GitLab server rebuild, migration, reinstallation, hostname reuse, load-balancer change, or deliberate SSH reconfiguration. It can also indicate DNS misdirection or a man-in-the-middle attack. Treat the warning as a decision point, not as a prompt to disable host checking.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Before changing anything: confirm the destination
Use the exact GitLab hostname from the repository’s SSH URL. Do not paste the full repository path into an SSH diagnostic. For example, if the remote is [email protected]:team/project.git, the host is gitlab.example.com and the SSH account is git.
- Check spelling, capitalization, and any alternate DNS name.
- Confirm whether the server requires a corporate VPN or private network route.
- Check DNS resolution from the affected machine and compare it with the address expected by your administrator.
- Consider whether a recent DNS, load-balancer, migration, or hostname-reuse change could have sent traffic to a different machine.
- Make sure your SSH configuration is not rewriting the hostname with a
HostorHostNamerule in~/.ssh/configor/etc/ssh/ssh_config.
A stale resolver or an incorrectly typed host can produce exactly the same warning as a genuine key rotation. Resolve that uncertainty before editing known_hosts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect the key and fingerprint safely
Run a verbose connection test that does not require a repository operation:
ssh -Tvvv [email protected]Replace the hostname with your actual GitLab host. The output shows the host-key algorithm offered by the server and the SHA-256 fingerprint that your client sees. Save the fingerprint and the resolved destination while you investigate; do not answer an authenticity prompt simply because the command is asking for confirmation.
Compare with an authoritative fingerprint
For GitLab.com, compare the displayed fingerprint with GitLab’s published host-key fingerprint page. For Self-Managed or Dedicated GitLab, use the instance’s /help/instance_configuration#ssh-host-keys-fingerprints page when it is available, or obtain the fingerprint through a separate trusted channel from the GitLab administrator. A fingerprint copied from the same untrusted connection is not independent verification.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When the displayed value matches the authoritative value and the hostname and network path are correct, the key is safe to add. When it does not match, stop. Ask the administrator whether a planned rotation, migration, load-balancer change, or rebuild explains the difference. If nobody can account for the change, investigate DNS and network interception before proceeding.
Free tools Windows power users keep installed
One-click scans. No signup required.
Repair an entry on an individual server
Case 1: the host is new and no key is stored
If the fingerprint is verified but the host is absent from your known-hosts files, connect normally:
ssh -T [email protected]At the authenticity prompt, confirm that the fingerprint exactly matches the authoritative value, then answer yes. SSH writes the accepted key to the applicable known-hosts file. A successful host check may be followed by GitLab’s welcome response; that confirms server identity and network access, not repository authorization.
Case 2: the saved key is stale after a legitimate change
Remove only the entry for the affected hostname:
ssh-keygen -R gitlab.example.comUse the hostname exactly as it appears in the SSH command. If you connect through an explicit port or an IP address, remove the corresponding bracketed host-and-port form or address entry as well. The command updates the local known-hosts file; it does not change the GitLab server.
Reconnect:
ssh -T [email protected]SSH will ask you to trust the newly presented key. Verify its fingerprint with the GitLab administrator or the appropriate published fingerprint page before answering yes. If the replacement cannot be independently verified, leave the old entry removed only while investigating; do not accept an unknown key to make the error disappear.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Case 3: the server was rebuilt but should keep its identity
The safest operational choice after a rebuild is usually to preserve the original host identity. GitLab Support recommends copying the original /etc/ssh/ssh_host_* keys to the replacement server, restoring the correct ownership and permissions, and restarting sshd. This lets existing clients continue to recognize the server without a fleet-wide known-hosts update.
Use a protected administrative channel to transfer the original files. On the replacement host, verify that the files are owned by root, are readable only as required by the SSH daemon, and have not been altered during transfer. Then restart the SSH service using the service name used by your operating system, for example:
sudo systemctl restart sshdAfter the service restarts, run ssh -Tvvv [email protected] from a client and confirm that the fingerprint is the original expected value. Do not copy host keys from an arbitrary machine or generate a replacement merely to silence a warning; that would create a new identity without proving which server you are contacting.
Separate host verification from GitLab account authentication
Once host verification succeeds, a different failure may appear:
Recommended Free Tools
Permission denied (publickey)This message concerns user authentication, not the server’s host key. Check the following independently:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- The public key corresponding to your private key is added to the correct GitLab user, deploy key, or service account.
- The intended private key is selected by your SSH configuration or command-line options.
- The key is loaded in
ssh-agentwhen your workflow depends on an agent. - The private key file and its parent directory have permissions accepted by your SSH client.
- You are using the expected SSH account, normally
gitfor GitLab repository access.
Do not delete a verified host key or repeatedly rotate server keys to solve a public-key authentication problem. Diagnose the account key after the server identity check has passed.
GitLab CI/CD and deployment runners
Ephemeral runners need a deterministic, preverified known-hosts file. For a private server or GitLab instance that a job must reach over SSH, collect the destination host key from a trusted network, ideally from the private server or another controlled administrative environment. Review the output independently and confirm its fingerprint before storing it.
Store the vetted output as a file-type CI/CD variable named SSH_KNOWN_HOSTS. In the job’s before_script, copy that variable into the runner’s SSH directory and set readable file permissions:
before_script:
- cp "$SSH_KNOWN_HOSTS" ~/.ssh/known_hosts
- chmod 644 ~/.ssh/known_hostsGitLab explicitly warns against running ssh-keyscan directly in a CI job and trusting the result immediately. An attacker who can influence the network or destination at job time could make the job record an attacker-controlled key. The safe pattern is to run the scan in a trusted environment, review the result independently, and inject the approved file as a protected variable.
Preloaded values also make unexpected changes visible. If a server is rebuilt or its key is rotated, jobs should fail with a host-key error until the variable is deliberately updated and the new fingerprint has been checked. That loud failure is preferable to silently trusting whatever key is returned during a deployment.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Self-Managed and Helm deployments
When the GitLab fingerprint page cannot show host keys
If the Self-Managed /help/instance_configuration page reports that SSH host keys are unavailable, inspect /etc/ssh directly on the GitLab host through an administrative session. Confirm that the expected ssh_host_* files exist, that the SSH daemon can read them, and that the service is using the intended configuration. Missing or inaccessible files can prevent the instance from exposing the fingerprints administrators need for client verification.
Helm chart webservice access
In a Helm chart deployment, the webservice component may not be able to read the host keys unless the chart is configured to mount them. Set this value in values.yaml:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →webservice:
sshHostKeys:
mount: trueApply the chart change according to your normal release process, then recheck the instance configuration page and compare the resulting fingerprint with the value presented to clients. Mounting the keys makes them available to the webservice; it does not by itself prove that a client’s existing stale entry should be replaced.
Choose the remediation that matches the event
| Situation | Preferred action | Identity outcome | Verification required |
|---|---|---|---|
| First connection to a verified host | Connect with ssh -T and accept the prompt only after comparing fingerprints |
Adds the verified key to known-hosts | Published GitLab.com value or administrator-confirmed instance value |
| Rebuilt server with the same intended identity | Restore the original /etc/ssh/ssh_host_* files and restart sshd |
Preserves the existing identity for clients | Client fingerprint matches the original value |
| Planned host-key rotation | Remove only the stale hostname entry with ssh-keygen -R, then reconnect |
Replaces the old key with a deliberately verified key | Administrator or authoritative fingerprint confirmation |
| Unexpected mismatch with no change record | Stop, check DNS, VPN, routing, and possible interception | Leaves trust unchanged until the discrepancy is explained | Independent confirmation of the intended server and key |
| Ephemeral CI runner | Use a reviewed file-type SSH_KNOWN_HOSTS variable |
Each job starts with the approved key | Trusted collection and independent review before storage |
Troubleshoot the common failure branches
The warning returns after running ssh-keygen -R
You may be connecting through a different name than the one you removed. Check aliases, canonical hostnames, IP addresses, and non-default ports in the SSH command and configuration. Hashed known-hosts entries are still handled by ssh-keygen -R when you provide the matching hostname, but an entry saved under another alias remains separate.
The fingerprint differs on different machines
Confirm that every machine resolves the hostname to the same intended service and uses the same VPN or split-DNS path. A load balancer can legitimately present different keys if its back-end nodes are not configured consistently; the administrator should either standardize the host identity or document the complete expected key set. Do not average conflicting fingerprints or accept whichever one appears first.
The connection never reaches an authenticity prompt
Verbose output can reveal a network-level failure before host-key negotiation, such as an unreachable address, blocked port, wrong proxy, or SSH configuration override. Check VPN access, routing, and the destination port before editing known-hosts data.
The GitLab welcome response appears but Git operations fail
Host verification and basic SSH reachability are working. Investigate repository authorization, project membership, deploy-key scope, branch protection, or the remote URL separately. A successful ssh -T test does not grant access to every project.
Security checklist for closing the incident
- Record the hostname, resolved destination, key algorithm, and verified SHA-256 fingerprint.
- Document whether the event was a rebuild, migration, rotation, DNS change, load-balancer change, or unexplained mismatch.
- Update only the affected known-hosts entry, not the entire file.
- Keep the original host keys backed up securely when preserving server identity is part of the recovery plan.
- For CI, protect the approved
SSH_KNOWN_HOSTSvariable and review changes to it like any other deployment credential. - Retest with
ssh -T git@your-gitlab-host, then perform the intended Git operation.
The correct fix is the one that makes the observed fingerprint match a server identity you can explain and verify. Removing a line or disabling strict checking without that explanation only hides the warning while leaving the underlying trust problem unresolved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
