I work on Windows 10.

I PuTTY ssh into physical:CentOS7, virtualbox:CentOS6,7 & Ubuntu 16.

On 1st ssh FROM Win TO vb:Ubuntu & I get the regular ole server/fingerprint not a known host popup. No big deal. But I wondered: how could I confirm there's no "man in the middle" ?

Simplest case: I'm sitting in front of the target (called 'local' from here on) and check its fingerprint directly.

Turns out: trying to local view the public machine key fingerprint using ssh-keygen -lf <filename> (file: /etc/ssh/ssh_host_rsa_key.pub) on the Ubuntu 16 gave me a fingerprint I couldn't match against any warning from a remote ssh.

By anywhere, I mean that:

  1. the string "2048 SHA256:NPAUL **** 4QQ [email protected] (RSA)" is not what appears in the PuTTy popup and
  2. when I copy the pub key file to CentOS6 or 7 and run ssh-keygen -l -f against it, they match each other but not the one from running ssh-keygen locally on Ubuntu (like, the implementations differ).

    2a. doing the scp was just a way I thought I might test things out.

The nut of the question is: how can I confirm the fingerprint ssh ui shows me is correct before I tell it 'yes' I'll accept it?

Local view of fingerprint (approx): "2048 SHA256:NPAULv10 **** lic4QQ [email protected] (RSA)"

Remote view of fingerprint (using Win PuTTy): "The new rsa2 key fingerprint is: ssh-rsa 2048 ce:e9:43 **** :cb"

Remote view of fingerprint (using CentOS6&7 terminal): "2048 ce:e9:43 **** :cb" filename (RSA)


  1. The remotely viewed fingerprint has colons in it.
  2. The bubblebabble digests (from -B) are match but they aren't fingerprints.
  3. local ssh-keygen -lf on /etc/ssh*.pub (i.e.: *dsa_key.pub, *ecdsa_key.pub, *ed25519_key.pub & *rsa_key.pub) didn't output a match for the fingerprint seen remotely either.
  4. I've overlookedly something probably, I did check the std man pages, ubuntu docs ... don't know what I'm missing.

1 Answer 1


Use the -E switch to the ssh-keygen:

ssh-keygen -l -f -E md5

This is available in recent OpenSSH versions and prints the "old" MD5 fingerprint, same as PuTTY.

  • Thanks a lot! I went over the std man, ubuntu man... I even took a quick look at rfc4716 thinking I might see what I missed but no luck; that md5 looks like magic and the -m wasn't necessary. This one really stumped me. Thanks again!
    – iletras
    Nov 7, 2016 at 19:51
  • It is claimed in the following article that the -E switch is not available to ssh-keygen before OpenSSH v6.8. See the section: "Displaying fingerprints in other formats" in: phcomp.co.uk/Tutorials/Unix-And-Linux/…
    – iletras
    Nov 7, 2016 at 23:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .