RSA SSH Host Key Rotation on GitHub.com
On March 24 at approximately 05:00 UTC, GitHub replaced the RSA SSH host key used for Git operations on GitHub.com. The replacement was performed out of caution after the private key was briefly exposed in a public repository. GitHub states the key does not provide access to infrastructure or customer data, and the exposure is believed to be inadvertent rather than the result of a system compromise.
The change affects only RSA-based SSH connections to GitHub.com. ECDSA and Ed25519 keys remain unchanged, and users connecting via HTTPS or web traffic are unaffected.
Why the key was replaced
GitHub detected that the RSA SSH private key had been momentarily visible in a public repository. After containing the exposure and investigating, the company concluded that no GitHub systems or customer data were compromised. The key replacement was completed ahead of the announced time; some users may have observed the new key appearing as early as 02:30 UTC during preparation. GitHub says there is no evidence the exposed key was misused.
Required actions for affected users
Users of the ECDSA or Ed25519 keys need to take no action. If your SSH client reports a host key mismatch when connecting to GitHub.com, you must update your known_hosts file to remove the old RSA entry and add the new one.
To remove the old key, run:
$ ssh-keygen -R github.com
Alternatively, manually delete the corresponding GitHub.com line from ~/.ssh/known_hosts.
The new RSA public key can be added manually by appending the following entry to ~/.ssh/known_hosts:
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
Or you can update the key automatically with:
$ ssh-keygen -R github.com
$ curl -L https://api.github.com/meta | jq -r '.ssh_keys | .[]' | sed -e 's/^/github.com /' >> ~/.ssh/known_hosts
After updating, verify the connection by confirming the fingerprint shown below is being presented:
SHA256:uNiVztksCsDhcc0u9e8BujQXVUpKZIDTMczCvj3tD2s
Impact on GitHub Actions users
Workflows that use actions/checkout with the ssh-key option may fail after this rotation. GitHub is updating the action across its supported tags (@v2, @v3, and @main). If your workflow pins the action to a specific commit SHA, you must update the referenced SHA to a version that includes the new key. Further details are available in the Actions security hardening documentation.
