SSH remembers server host keys in known_hosts. A changed key can follow a legitimate rebuild, but can also mean you reached the wrong machine or an intercepted connection. Stop and confirm the destination hostname and port before trying to make the warning disappear.

Obtain the expected new fingerprint from the administrator through an independently trusted channel or a trusted provider console. Compare the full fingerprint. The key offered by the connection that triggered the warning cannot, by itself, prove that the change is legitimate.

The OpenSSH ssh-keygen manual documents -F for finding a host entry and -R for removing that host’s entries, including hashed entries. Only after verification, back up known_hosts and remove the entry for the exact host and port. A non-default port uses the documented [hostname]:port form.

Reconnect and compare the presented fingerprint with the independently verified one before accepting it. Do not delete the whole known_hosts file or turn off host-key checking to bypass the warning. On a managed system, follow the administrator’s host-certificate or key-rotation process instead of changing policy locally.