{"id":"3a6bfe0f52bebb34","repo":"rust-lang/cargo","slug":"error-unknown-ssh-host-key-the-ssh-host-key-for","errorCode":null,"errorMessage":"error: unknown SSH host key\nThe SSH host key for `{hostname}` is not known and cannot be validated.\n\nTo resolve this issue, add the host key to {known_hosts_location}\n\nThe key to add is:\n\n{hostname} {key_type_name} {remote_host_key}\n\nThe {key_type_short_name} key fingerprint is: SHA256:{remote_fingerprint}\nThis fingerprint should be validated with the server administrator that it is correct.\n{other_hosts_message}\nSee https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts for more information.\n","messagePattern":"error: unknown SSH host key\nThe SSH host key for `(.+?)` is not known and cannot be validated\\.\n\nTo resolve this issue, add the host key to (.+?)\n\nThe key to add is:\n\n(.+?) (.+?) (.+?)\n\nThe (.+?) key fingerprint is: SHA256:(.+?)\nThis fingerprint should be validated with the server administrator that it is correct\\.\n(.+?)\nSee https://doc\\.rust-lang\\.org/stable/cargo/appendix/git-authentication\\.html#ssh-known-hosts for more information\\.\n","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/sources/git/known_hosts.rs","lineNumber":213,"sourceCode":"            let other_hosts_message = if other_hosts.is_empty() {\n                String::new()\n            } else {\n                let mut msg = String::from(\n                    \"Note: This host key was found, \\\n                    but is associated with a different host:\\n\",\n                );\n                for known_host in other_hosts {\n                    write!(\n                        msg,\n                        \"    {loc}: {patterns}\\n\",\n                        loc = known_host.location,\n                        patterns = known_host.patterns\n                    )\n                    .unwrap();\n                }\n                msg\n            };\n            anyhow::bail!(\n                \"error: unknown SSH host key\\n\\\n                The SSH host key for `{hostname}` is not known and cannot be validated.\\n\\\n                \\n\\\n                To resolve this issue, add the host key to {known_hosts_location}\\n\\\n                \\n\\\n                The key to add is:\\n\\\n                \\n\\\n                {hostname} {key_type_name} {remote_host_key}\\n\\\n                \\n\\\n                The {key_type_short_name} key fingerprint is: SHA256:{remote_fingerprint}\\n\\\n                This fingerprint should be validated with the server administrator that it is correct.\\n\\\n                {other_hosts_message}\\n\\\n                See https://doc.rust-lang.org/stable/cargo/appendix/git-authentication.html#ssh-known-hosts \\\n                for more information.\\n\\\n                \"\n            )\n        }\n        Err(KnownHostError::HostKeyHasChanged {","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/git/known_hosts.rs#L195-L231","documentation":"First-connection case: the SSH host key presented by `hostname` is not found in any known_hosts source (Cargo's bundled list, `~/.ssh/known_hosts`, or Cargo config `net.ssh.known-hosts`). Cargo refuses to trust an unseen key by default to prevent man-in-the-middle attacks. The message shows the exact key line and fingerprint to verify and add.","triggerScenarios":"Cloning a private git dependency over SSH from a host never connected to before; connecting to a self-hosted GitLab/Gitea/Forgejo; using a non-standard port (the code retries without the port before bailing). The `HostKeyNotFound` variant fires when `check_ssh_known_hosts` finds no match.","commonSituations":"New SSH git dependency added to `Cargo.toml`; fresh machine/CI without the host's key in known_hosts; corporate git server not in Cargo's bundled known hosts; non-standard SSH port.","solutions":["Verify the fingerprint with the server administrator, then add the suggested line to `~/.ssh/known_hosts` (or to `net.ssh.known-hosts` in `.cargo/config.toml`).","Connect once via `ssh <host>` (or `ssh -p <port> <host>`) and accept the key, so the system SSH writes it to known_hosts.","Set `net.git-fetch-with-cli = true` and use the system `git`/`ssh` which manages known_hosts interactively.","For CI, pre-seed `~/.ssh/known_hosts` with the host key (e.g. via `ssh-keyscan`)."],"exampleFix":"# before: cargo fetch fails on new SSH host\n# after\nssh-keyscan -H example.com >> ~/.ssh/known_hosts\ncargo fetch","handlingStrategy":"validation","validationCode":"# Pre-seed known_hosts for git deps before cargo fetch:\nHOST=\"$(echo \"$GIT_DEP_URL\" | sed -nE 's#.*@([^:/]+).*#\\1#p')\"\nssh-keyscan -H \"$HOST\" >> ~/.ssh/known_hosts\n# Or configure in .cargo/config.toml:\n# [net.ssh.known-hosts]\n# example.com = \"ssh-ed25519 AAAA...\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always verify fingerprints with the server admin before trusting a new host key.","Pre-seed CI known_hosts via `ssh-keyscan` or commit `net.ssh.known-hosts`.","Prefer `git-fetch-with-cli = true` on developer machines for interactive trust-on-first-use."],"tags":["ssh","git","host-key","known-hosts","security","first-connect"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}