> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/connection-methods/sftp/verifying-the-sftp-host-key.md).

# Verifying the SFTP Host Key

An SSH host key lets an SFTP client recognize the server it connected to. ExaVault does not have one universal SFTP fingerprint: each appliance generates its own 4096-bit RSA host key during initial setup and keeps it in the appliance data volume.

Files.com cloud fingerprints and fingerprints from the legacy hosted ExaVault service do not apply to an ExaVault appliance. Obtain the fingerprint from your own appliance and record it in your change-management or secrets system.

## Retrieve the Fingerprint With Nmap

From a system that can reach the appliance on SFTP port `22`, run:

```bash
nmap -p 22 --script ssh-hostkey --script-args ssh_hostkey=sha256 files.example.com
```

Replace `files.example.com` with the fully qualified domain name or IP address used by your SFTP clients. Nmap prints the host key type and SHA-256 fingerprint. See the [Nmap `ssh-hostkey` documentation](https://nmap.org/nsedoc/scripts/ssh-hostkey.html) for other output formats.

Retrieving a key over the same untrusted network as the connection does not by itself prove that the key is authentic. Capture the fingerprint during deployment or maintenance over a trusted administrative path, then provide it to client owners through an independent channel.

## Configure Clients to Verify It

Configure each SFTP client to require the recorded fingerprint or to store the verified host key in its known-hosts file. Avoid settings that automatically accept any new or changed host key.

If a client reports that the host key changed, stop the connection and investigate. Confirm that the hostname and IP address are correct and ask the appliance administrator whether the appliance data, including the SSH host key, was intentionally replaced or regenerated. Accept the new key only after verifying its fingerprint through the trusted process used for the original key.