How to verify droplet's SSH public key fingerprint?

Question

Before SSHing to a droplet for the first time, is there a way to verify the public key fingerprint? This question was asked last year, but there wasn’t any good way to do this back then. Any updates?

As the previous asker suggested, “Ideally it would be part of the response body when a new droplet is created or have its own API call”. The fingerprint could also be displayed in the web interface for each droplet.

jarland · Answer

Hey friend! Currently the only way to do this would be to log in through the web console and check it there before accepting it over SSH. I suppose no matter how you spin it, you’re accepting something remote as truth, so I don’t know the most flawless answer. It is an interesting thought experiment, I fear it will plague my mind for the remainder of the evening. Jarland

SomeTechie · Answer

how about as @orric suggests, but instead of your own server display it in the webconsole? e.g. When creating the droplet, enable “User data” and put in a the following script? #!/bin/bash ssh-keygen -lv -f /etc/ssh/ssh_host_ecdsa_key >> /etc/issue And then clicking the console in the control panel to see the key fingerprint in the pre-login banner?Obviously edit key file to taste.

orric · Answer

I found another solution for this: when creating the droplet, enable “User data” and put in a script which installs a web server and publishes the server’s SSH key fingerprint. You can verify the key hasn’t been modified in transit using an HMAC with a shared secret. Here’s an example script: #!/bin/bash # install web server apt-get -y update apt-get -y install apache2 # put the public ssh key fingerprint in the default webroot ssh-keygen -lv -f /etc/ssh/ssh_host_ed25519_key > /var/www/html/key chmod o+r /var/www/html/key # generate the HMAC of /var/www/html/key cat /var/www/html/key | openssl dgst -sha256 -hmac "SECRET" > /var/www/html/hmac chmod o+r /var/www/html/hmac Replace SECRET. Then you can access http://your-droplets-ip/key to see the public key and http://your-droplets-ip/hmac to get the HMAC. To make sure that a MITM hasn’t modified the key file in transit, you can verify the HMAC on your computer: curl -s http://your-droplets-ip/key | openssl dgst -sha256 -hmac "SECRET" curl -s http://your-droplets-ip/hmac The output of these commands must be identical. Alternatively, you can also have the script email you the key & hmac. Cheers!

Become a contributor for community

DigitalOcean Documentation

Resources for startups and AI-native businesses

The developer cloud

Start building today

Report this

How to verify droplet's SSH public key fingerprint?

Related questions

PHP Critical Vulnerabilities upgrade dd 21 Oktober 2026

Abuse report ticket 12854899 submitted Sept 29, still no response

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?

Report this

How to verify droplet's SSH public key fingerprint?

Related questions

PHP Critical Vulnerabilities upgrade dd 21 Oktober 2026

Abuse report ticket 12854899 submitted Sept 29, still no response

Digital Ocean Team SSO with Entra ID - Work Around?

Post-Incident Security Validation: Rebuild or Trust the Existing Droplet

Best way to securely access a homelab remotely without relying only on Tailscale?

VLESS VPN connects but no traffic passes through (DigitalOcean VPS + x-ui + Xray)

What’s the status of CopyFail patches in shared hosts?

How are you handling the Axios supply chain attack in your deployments?

Keeps signing me out (even more frequently than before)

What’s the best way to secure a DigitalOcean Droplet running WordPress against brute-force attacks?

prevent firewall ssh lock out

how do I find my droplet's username and password?