What is bitbucket RSA key fingerprint?

[Mikko Koivunen]

Where can I check the current Bitbucket RSA key fingerprint?

I'm getting these when connecting, but I don't want to 'trust on first connect' without confirmation from other source.

RSA key fingerprint is 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40.

RSA key fingerprint is SHA256:zzXQOXSRBEiUtuE8AikJYKwbHaxvSc0ojez9YXaGp1A.

[jredmond · Accepted solution]

That is the correct fingerprint, in both cases, for the RSA key we use for SSH. You can confirm this at https://confluence.atlassian.com/bitbucket/use-the-ssh-protocol-with-bitbucket-cloud-221449711.html#UsetheSSHprotocolwithBitbucketCloud-KnownhostorBitbucket'spublickeyfingerprints

[binki]

When I follow that link it redirects me to a different page and I can’t find where the fingerprints are listed on it. Where’s a good place to find this information these days? Or could you give me step-by-step instructions on how far to scroll into the page and what things to expand to find it?

[Bryan Fox]

This page currently lists PK fingerprints:  https://confluence.atlassian.com/bitbucket/troubleshoot-ssh-issues-271943403.html

[Deleted user]

https://confluence.atlassian.com/bitbucket/ssh-keys-935365775.html

presents the information most clearly.

[Randall Babaoye]

These links are all dead already.

[Mikko Koivunen]

All 3 links are ok when I try.

[Randall Babaoye]

Perhaps I just don't have access?  I get:

"Something went wrong.

We're moving mountains to get it sorted."

[John Hutchinson]

Correct me if I'm wrong but these pages only list the bitbucket.org finger prints.  Where is the altssh.bitbucket.org:443 finger print published?

[jon_tjs]

As of just now, that page no longer lists the fingerprints:

The suggestion to use ssh-keyscan amounts to not checking the fingerprint at all (see https://security.stackexchange.com/questions/251496/is-getting-server-host-key-with-ssh-keyscan-secure).

[archi3315]

Has Atlassian changed it RSA fingerprint?

I'm getting this since now

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the RSA key sent by the remote host is
SHA256:3XxnFBKg0mjT5ZBCiHv2nT0HxT3HsRCJoqiJF8zMc+A.

The fingerprint is different from the one detailed in the wiki posted before.

[jredmond]

No, the key has not changed, so that fingerprint is invalid. Are you connecting through a proxy?

[archi3315]

Thanks, it was a proxy. Working now