Overview
Microsoft is rotating the host keys for their hosted SSH File Transfer Protocol (SFTP). SSH host keys are used by our clients to verify the identity of the SFTP server when connecting. Most SSH clients will present the public key to you during connection with an option to verify and accept the host key, which will allow you to connect to the SFTP server. When Host Keys are rotated by Microsoft, you may need to give explicit permission to your SSH client to accept the new host key.
Please note: these keys are not the public/private key pairs you use to login to the server - this is a separate key used for validation. Host key rotation will have no impact on your SSH keys for login.
What are the new keys?
| Host Key Type | SHA 256 fingerprint 1 | Public Key |
| ecdsa-sha2-nistp256 | 4+nbdL+SufuAtC5yOB5w54AJi0CkR1M6QyltDFhU/tU= | AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO8S1mE/cHDZ6XGNa9G7gfn2vGAMLHNAvODQNxjAY9KD0oNVD3AkpdpoLd0LAci6lZc9YYPgXb4BL0Ev1Tihotk= |
| ecdsa-sha2-nistp384 | yZ40NtCk/3fAWys+3buTjefGUucDMOLGWi4jbjxo4mI= | AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBO+SWbZNFKszpRmvPAlNSLwJhIfnsSzDRKIn8hiIypgOgTqKQUHKySfrs755+W0ALLd5EIA5J0WJXVHFAkg4s1ILxhvm5wJYpt5u3MlJ1PeJDy9HvvMXE707T6hDT60q4A== |
| rsa-sha2-256 | aOIUBoMWE3ZOzlSMwSOI4TFhdA++VsIyslYmLwLQ12g= | AAAAB3NzaC1yc2EAAAADAQABAAABAQDamvcQStpacQeAfB/YUnyNepKBHoMEXh0MJNNlJAzwrfH03ypPu9VdrKcLwXvfEH8rV+KWIV5mZK+piiO2/D6Ed2n2EFZhheW7yEIycE52/e4e5VtHZEx7THjTnDLSZ6le14a6lbjCs4mpSDI1nCIlIo4jksVT+cKu9mfSA5dqjZY93VpfOray532ivdCT3E76c9xPKhnei9k+XXjPnEo20iPyoRFF0SD5u/97uAtjwuvUM7JS+hGJeJos9rEwN4EMV8Gw80s88hOg0nCWvWmsgYk35TkQhVgg3sLRz0pf0iuYVM2Kq2jQESBHSQGHqsMXvrvLQlyL+Pg9d7zFrJRl |
| rsa-sha2-512 | sP18dIvbSZgtEa5a2ea+Fy4P54Wd2ocEkToBq6xG74g= | AAAAB3NzaC1yc2EAAAADAQABAAABAQC3XT+gvZTEoyvOJiiP1YiVSqpWbWxbjF+NNqwnlT3KZWRcnLYi7mwTQIrq+G8vAYW5Q2Q+RGMDfjAMZSzQH9HuGIROQWF549jH8B61TirsfnFYMKrFJWILAkjzli3g+vB8b6i9FTwh7CA6RmN/wqaDccTHz7MXPlqbWHdMiyj3PERS5qaJJoVoyRm5HTGnWr5BG6eQpzBPsZMuFO1Ek7u9ebBsNiQpyGLkZXP7bxU3+wgq5jXAPmGkgcNRj3LMENg949xCaRfCIUBcnctv1DzwKb6YLhoYoAbun2CthRbOsK25FEqTG/Kg+vD220HiaTH0KIixffhTrvkzhlAKdscd |
What do I need to do?
We recommend adding the new host key to your SSH clients list of trusted hosts. This may differ slightly depending on the client you are using, but most clients typically store trusted hosts in known_hosts file or Windows registry key (Windows specific clients).
known_hosts example
This file is often stored under the following local path: ~/.ssh/known_hosts. The file will have a line per known host and each line may follow a format similar to this: <server hostname> <algorithm> <host key>.
There is likely already an entry for your storage account from the first time you connected. A new entry can be added below it with the newer key for the same region and algorithm. Once added, it would look similar to this example for the East US and ecdsa-sha2-nistp256:
awardspringsftpus.blob.core.windows.net ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBGqgdtuQlZCFnVoC07xb1yCqS/6ncURKIwHuxgLGjrlXuGqgOwTu0AkfNIXtpe6JHcufVUO77r+KFYFblDfHDrU=awardspringsftpus.blob.core.windows.net ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBO8S1mE/cHDZ6XGNa9G7gfn2vGAMLHNAvODQNxjAY9KD0oNVD3AkpdpoLd0LAci6lZc9YYPgXb4BL0Ev1Tihotk=The first entry is for the key currently used by the service, which will expire sooner. The second entry is for the next key that will be used after rotation. Having both entries will allow for a smooth transition when the rotation occurs.
Registry Key Example
For a Windows based client such as WinSCP, trusted hosts are stored in a registry key: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SshHostKeys.
When a new host key is presented, WinSCP will prompt you to accept the key. You can compare the SHA256 fingerprint to the relevant key in the table below and accept if it matches. WinSCP will then add the new key to the cache for the future.
FAQs
Can I just accept the new key once the old one expires?
Yes, but because your SIE process is automated you may experience an interruption of your overnight imports. When the old key expires without a new one stored in your trusted hosts your SSH client will give you a warning message and disconnect. The disconnect happens as a safety measure. In order to connect again, the client will need to delete the old entry from known_hosts and then try connecting again. This will give the client an opportunity to verify the host key and accept it. To avoid interruption of imports we recommend you add the new key ahead of time.
How long do I have to make this change?
The old key will expire on 4/30/2026. During this transition both the old and new host key will work.
Why do the host keys expire?
Periodically rotating secrets is a standard security practice and can help reduce attack vectors.
Is it fine to disable strict host key verification?
No, we do not recommend disabling strict host key verification. Verifying the host key presented during connection against the host keys published here allow clients to protect themselves from a potential Man-In-The-Middle (MITM) attack.