Server keys and the "key changed" warning

Every SSH server has its own key, a bit like a fingerprint. Checking it proves you're talking to your server and not to something pretending to be it. RemoteAccessApp never sends your password before the key is trusted. If a server refuses the connection or times out before you're asked about its key, see can't connect to a server.

The first connection: "Trust this server?"

The first time you connect, RemoteAccessApp shows the server's key type and its SHA256 fingerprint and asks Trust this server?

1. Check that the fingerprint belongs to your server: run the command below on the server, or ask its admin to read the fingerprint to you.
2. If they match, click Trust and connect. If you're not sure, click Cancel: nothing is sent.

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

From then on, RemoteAccessApp remembers the key and warns you if it ever changes. An AI assistant connected through MCP follows the same rule: it shows you the fingerprint and only trusts the key once you confirm.

"This server's key has changed"

This warning means the server presented a different key from the one you trusted before. That's normal when a server is reinstalled or moved to new hardware. It can also mean someone is intercepting the connection. Either way, your password has not been sent.

1. Click Stop unless you know why the key changed.
2. Ask the server's admin whether the server was reinstalled or its keys were replaced, and get the new fingerprint.
3. Connect again. Only if the new fingerprint matches, click Replace key and connect.

"New kind of server key"

Servers can have keys of several types. If a server starts using a type you haven't trusted before, you're asked about the new key. Check it the same way.

See or remove trusted servers

Open Keys & passwords on the Connections page. Trusted servers lists every server key this PC trusts, and Remove forgets one. Trusted server keys are kept on this PC and aren't synced to your other PCs.

Certificates: FTPS and Remote Desktop on Linux

FTPS hosts, and Remote Desktop in the Linux app, check the server's certificate the same way:

• A certificate your computer already trusts connects straight away.
• A self-signed one shows Trust this certificate? with its SHA-256 fingerprint the first time. Check it with the server's admin, then click Trust and connect.
• If it changes later, you see This server's certificate has changed. Click Stop unless you know why it changed (a renewed or replaced certificate). Your password hasn't been sent.

To turn FTPS on for an FTP host, use its Encryption setting, as copy files with SFTP and FTP explains.

For a Windows PC, ask its admin for the SHA-256 fingerprint of its Remote Desktop certificate.

If a Remote Desktop computer has no certificate to check, you're asked Can't check this computer. Only click Connect anyway if you know it's the right computer.

Trusted certificates are kept on this PC, apart from the trusted server keys.

Commands sent to many servers at once skip a server whose key changed. Connect to it in a tab to check the new key first.