When first connecting via SSH with keys to a newly minted Digital Ocean droplet VM running FreeBSD (per this tutorial), we get a message about “The authenticity of host blah-blah can’t be established”. I understand this means my computer has no stored fingerprint against which to compare. So my SSH client has no way of knowing if the SSH server on the other side is legitimate or not.
At this point, we have two choices:
- We can blindly forge on by accepting this connection per the TOFU “Trust On First Use” anti‑security model. If we are the subject of a Man in the Middle attack, we are falling prey to their trap.
- Or we can discover the fingerprint of the server by some other means, to compare against the fingerprint being presented here in this first connection.
Amazon provides such a mechanism for their EC2 instances, to learn the new server’s fingerprint, as discussed here.
➥ Is there such a mechanism for a Digital Ocean “droplet” virtual machine instance, to learn the server’s fingerprint?