When first connecting to my server, a Digital Ocean droplet virtual server instance running FreeBSD initialized with the contents of my
.pub public key file, on first trying to connect with
ssh 220.127.116.11 I get the message:
The authenticity of host '18.104.22.168 (22.214.171.124)' can't be established.
ECDSA key fingerprint is SHA256:tjdoQBGbHexAm+uwZ5rZwxyJH0nxjMC08QtO47QGQjE.
This does not appear to match the SHA256 returned by
ssh-keygen when I created the key files.
Some sites seem to say I should ignore this issue. They claim the key fingerprint that appears when connecting to my server via ssh is unrelated to the fingerprint of the ssh public key file’s content I uploaded to Digital Ocean for use in creating that server instance. I find this difficult to fathom.
- What point is there in Digital Ocean insisting I supply a SSH public key to use in configuring my new server if it is ignored or is irrelevant?
- What stops a Man-In-The-Middle attack if I am to ignore the fingerprint reported during the first attempt at establishing a ssh connection/session?
- Why does ssh even report a key fingerprint if we are to ignore it?