Home / server / Questions / 670393
Accepted
Emanuil Rusev
Asked: 2015-02-22 06:26:20 +0800 CST

The authenticity of the server when accessing it through a domain name instead of an IP

  • 772

When I do ssh [email protected], I log into the server fine. However, if I do ssh [email protected], where example.com points to the same IP addrees, I get:

The authenticity of host 'example.com (123.123.123.12)' can't be established.

If it is the same IP, why can't the authenticity be established?

ssh

1 Answers

  1. Best Answer

    It's by design. When you accept a SSH fingerprint, you're basically associating that fingerprint with the hostname, whether example.com, www.example.com or 123.123.123.12. So the next time, once it's been added to your known_hosts, you know you are safely doing what you have said you are, eg ssh user@example.com.

    Suppose example.com changes A record, then that fingerprint from example.com will still work; that's not the case if fingerprints were solely associated with IP addresses. Yes, it's the same SSH fingerprint, used to authenticate the same server with the same key, but the semantics of what you are doing is different.

    • 3