Easily Remove Stale Entries from ~/.ssh/known_hosts When a Host Rebuilds with ssh-keygen ‑R -

When a host rebuilds, its SSH key changes

A fresh install or a system rebuild swaps the host’s RSA/ED25519 key pair.
If you still have the old key in ~/.ssh/known_hosts, the next SSH connection will trigger a “WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!” message.
That warning is a safety feature, but it also blocks automation and forces users to manually edit the file.

The quickest, safest way to clean up stale entries is to let OpenSSH do the work with ssh-keygen -R. The command removes every key that matches the supplied hostname or IP, regardless of whether the entry is hashed or plain.

The simplest way: `ssh-keygen -R`

# Remove all keys for the host by name
ssh-keygen -R example.com

# Remove all keys for the host by IP
ssh-keygen -R 192.0.2.42

# Specify the file if you’re not using the default
ssh-keygen -R example.com -f ~/.ssh/known_hosts

ssh-keygen scans the file, deletes every matching line, and rewrites the file. It preserves the rest of the entries, so you don’t lose any other hosts.

The command works with both plain and hashed hostnames.
If you use the -H option when adding keys, the hostname is stored as a hash; -R still finds the correct line because it hashes the supplied name internally before comparison.

Reference – The ssh-keygen manual page explains the -R option in detail: https://man.openbsd.org/ssh-keygen

Removing multiple entries at once

If you’re cleaning up a whole subnet or a set of servers, you can list several targets in one invocation:

ssh-keygen -R example.com -R 192.0.2.42 -R old.example.org -f ~/.ssh/known_hosts

The command processes each argument sequentially, so you can delete dozens of entries in a single line. For very large known_hosts files, this is faster than opening the file in an editor and deleting lines manually.

Handling hashed hostnames

When you add a host with ssh-keygen -H, the entry looks like:

|1|kZ+3g5hJt8y...|xYz9...  ecdsa-sha2-nistp256 AAAAE2VjZHNh...

ssh-keygen -R still works because it hashes the supplied hostname on the fly. If you prefer to see the plain names, you can temporarily unhash the file:

ssh-keygen -H -f ~/.ssh/known_hosts -o -F example.com

But for most workflows, leaving the file hashed is preferable for privacy.

Adding the new key back

After removing the stale entry, you can fetch the current key and add it automatically:

ssh-keyscan -H example.com >> ~/.ssh/known_hosts

ssh-keyscan grabs the key from the target host and appends it to the file. The -H flag ensures the new entry is hashed, matching your existing configuration.

If you’re scripting this for a cluster, you can combine the steps:

ssh-keygen -R example.com -f ~/.ssh/known_hosts
ssh-keyscan -H example.com >> ~/.ssh/known_hosts

Trade‑offs and pitfalls

Approach	Pros	Cons
Edit `known_hosts` by hand	Full control; no extra commands needed	Prone to typos; can miss duplicate entries
`ssh-keygen -R`	Fast, reliable, handles hashed entries automatically	Requires knowing the exact hostname/IP to remove
`ssh-keyscan` + `ssh-keygen -R`	Keeps file tidy and up‑to‑date; automatable	Adds an extra round‑trip; may add a key that’s still
		stale if the host is rebooting during the scan

Quick sanity check

After the cleanup, try connecting:

ssh -o StrictHostKeyChecking=no example.com

If the connection goes through without the warning, you’re good to go.
If you still see a mismatch, double‑check the hostname you passed to -R and make sure there isn’t a typo or a stray entry with a different IP.

TL;DR

Run ssh-keygen -R <host> to drop old keys.
If you want to add the fresh key back, run ssh-keyscan -H <host>.

That’s all the heavy lifting. No manual edits, no surprises during automation.