{"id":"3a01dd24b1dba097","repo":"rust-lang/cargo","slug":"error-key-has-been-revoked-for-hostname","errorCode":null,"errorMessage":"error: Key has been revoked for `{hostname}`\n**************************************\n* WARNING: REVOKED HOST KEY DETECTED *\n**************************************\nThis may indicate that the key provided by this host has been\ncompromised and should not be accepted.\n\nThe host key {key_type_short_name} {remote_host_key} is revoked\nin {location} and has been rejected.\n","messagePattern":"error: Key has been revoked for `(.+?)`\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\n\\* WARNING: REVOKED HOST KEY DETECTED \\*\n\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\\*\nThis may indicate that the key provided by this host has been\ncompromised and should not be accepted\\.\n\nThe host key (.+?) (.+?) is revoked\nin (.+?) and has been rejected\\.\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"critical","filePath":"src/sources/git/known_hosts.rs","lineNumber":298,"sourceCode":"                resolve this error by {old_key_resolution}\\n\\\n                \\n\\\n                The key provided by the remote host is:\\n\\\n                \\n\\\n                {hostname} {key_type_name} {remote_host_key}\\n\\\n                \\n\\\n                See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts \\\n                for more information.\\n\\\n                \"\n            )\n        }\n        Err(KnownHostError::HostKeyRevoked {\n            hostname,\n            key_type,\n            remote_host_key,\n            location,\n        }) => {\n            let key_type_short_name = key_type.short_name();\n            anyhow::bail!(\n                \"error: Key has been revoked for `{hostname}`\\n\\\n                **************************************\\n\\\n                * WARNING: REVOKED HOST KEY DETECTED *\\n\\\n                **************************************\\n\\\n                This may indicate that the key provided by this host has been\\n\\\n                compromised and should not be accepted.\n                \\n\\\n                The host key {key_type_short_name} {remote_host_key} is revoked\\n\\\n                in {location} and has been rejected.\\n\\\n                \"\n            )\n        }\n        Err(KnownHostError::HostHasOnlyCertAuthority { hostname, location }) => {\n            anyhow::bail!(\"error: Found a `@cert-authority` marker for `{hostname}`\\n\\\n                \\n\\\n                Cargo doesn't support certificate authorities for host key verification. It is\\n\\\n                recommended that the command line Git client is used instead. This can be achieved\\n\\\n                by setting `net.git-fetch-with-cli` to `true` in the Cargo config.\\n\\","sourceCodeStart":280,"sourceCodeEnd":316,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/git/known_hosts.rs#L280-L316","documentation":"The `HostKeyRevoked` variant: the host key presented by the remote is explicitly marked as revoked in a known_hosts source (an SSH `@revoked` marker). A revoked key must never be accepted — it signals the key was compromised and withdrawn. Cargo rejects it outright with a high-severity warning.","triggerScenarios":"A `@revoked` line in `~/.ssh/known_hosts` (or Cargo config known_hosts) matches the remote host, and the key the remote presents equals the revoked key. The server is still offering a known-compromised key.","commonSituations":"A compromised key was added to `@revoked` but the server wasn't reconfigured to stop offering it; a revoked key left active on a stale/misconfigured server; an attacker replaying a compromised key; misconfigured known_hosts `@revoked` entry matching the wrong key.","solutions":["Treat as a security incident: do NOT proceed until the server administrator confirms the server is reconfigured with a fresh, non-revoked key.","Have the server administrator replace the host key and publish the new one.","Verify the `@revoked` entry is correct (not a false positive matching a legitimate key by accident).","After the server is fixed and you've verified the new fingerprint, update known_hosts accordingly."],"exampleFix":"// no code fix — this is a security event requiring server-side remediation\n// contact admin, rotate server host key, then update ~/.ssh/known_hosts","handlingStrategy":"validation","validationCode":"# Audit @revoked entries and confirm the server is NOT offering a revoked key:\ngrep '@revoked' ~/.ssh/known_hosts\nssh-keyscan <host> | ssh-keygen -l -f -   # compare against revoked fingerprints\n# Do NOT remove the @revoked marker — fix the server instead.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never bypass a revoked-key rejection — escalate to the server administrator.","Rotate compromised server keys promptly and update all known_hosts.","Audit `@revoked` entries regularly to ensure they target the right keys."],"tags":["ssh","git","security","revoked-key","host-key","compromise"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}