I got this error when connecting to my Raspberry Pi over SSH, using its IP address (raspberrypi.local gives the same result):

ssh [email protected]
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256:+nhOSw/fjrJ5J477c5HPQsWiGxYT6+jR2Aj4vce+9z0.
Please contact your system administrator.
Add correct host key in /path/to/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /path/to/.ssh/known_hosts:11

The first time you connect to a machine, SSH saves its host key, a kind of fingerprint, in a file called known_hosts. Every connection after that, it checks the fingerprint matches. If it does not, SSH refuses to connect, because a changed fingerprint is also what you would see if someone were intercepting the connection.

With a Raspberry Pi, the cause is usually harmless. If you reflash the SD card, the Pi creates a new host key the first time it boots. Your router may also have given the same IP address to a different device. In both cases the old fingerprint saved in known_hosts is out of date. If you know you reinstalled the Pi or changed devices, the fix is to delete the old entry. If you did not change anything and see this on a network you do not trust, stop and find out why first.

Red error warning illustration

You can remove the entry by hand:

  1. Locate the known_hosts file: The file is typically located at ~/.ssh/known_hosts on Unix-like systems (Linux, macOS) and at C:\Users\<YourUsername>\.ssh\known_hosts on Windows.

  2. Open the known_hosts file: Any text editor works: nano or vim on Linux and macOS, Notepad on Windows.

  3. Find and remove the offending key: The warning message specifies the line number where the offending key is located. In the example above, it's line 11. Remove the entire line 11 from the file.

  4. Save the changes and close the editor.

Or, more simply, let SSH do it for you. This works in a terminal on Linux and macOS and in Command Prompt or PowerShell on Windows:

ssh-keygen -R 192.168.xxx.xxx

It removes every saved key for that address and keeps a backup of the old file as known_hosts.old. If you connect with raspberrypi.local, run it for that name too.

Then connect again:

ssh [email protected]

SSH treats it as a new machine and asks whether to trust the new host key. Type yes if you are confident it is your Pi. Then enter the password when prompted. Nothing appears on screen while you type it, not even dots, which catches a lot of people out. Type it anyway and press Enter.

If it worked, the prompt changes to your username and the Pi's hostname, like in the screenshot below.

Terminal after a successful SSH login to the Raspberry Pi

Error illustration: source

Up next: Part 2 of 9 in Quick Tech Fixes

Cover image for Fixing the Git Error: RPC Failed; curl 92 HTTP/2 Stream Not Closed Cleanly

Fixing the Git Error: RPC Failed; curl 92 HTTP/2 Stream Not Closed Cleanly

If you've encountered the following error while using Git, you're not alone: error: RPC failed; curl 92 HTTP/2 stream 5 was not closed cleanly before end of the underlying stream...

How-to Guides 1 min read