SSH host key verification ssh-host-keys
Commerce Intelligence uses strict SSH host key verification for encrypted (SSH tunnel) database connections, including MySQL, MongoDB, and PostgreSQL.
During Save & Test, the system enrolls the SSH bastion host keys for your connection and stores them securely per connection. After enrollment, replication and tunneling only succeed when the live bastion host keys match the enrolled keys.
This model improves security by blocking man-in-the-middle attacks and unexpected host changes. It also means that host key rotation, missing trust material, or infrastructure changes can surface as SSH host key errors on the connection instead of generic tunnel failures.
You do not edit, upload, or manage known_hosts files. Enrollment and refresh run on Adobe infrastructure assigned to your account.
Save & Test save-and-test
Save & Test performs initial SSH host key enrollment only. It is conservative by design and does not rotate or overwrite keys that are already enrolled for the connection.
After a successful first enrollment, later Save & Test runs validate credentials and connection settings but leave enrolled SSH host keys unchanged.
Refresh SSH Host Keys refresh-ssh-host-keys
Refresh SSH Host Keys updates enrolled SSH host keys when the bastion has changed or when trust material must be repaired. An Admin starts the refresh from the connection in Data > Connections.
The refresh runs asynchronously on Adobe infrastructure assigned to your account. Commerce Intelligence returns after the refresh is queued. It does not run the scan on your workstation.
A refresh rewrites enrolled host keys only when one of these conditions is true:
- Enrolled host keys are missing
- Enrolled host keys are empty
- Enrolled host keys cannot be read
- Enrolled host keys fail validation
- A new scan returns different host key lines than the enrolled keys
- Fingerprints from the scan and enrolled keys do not match
If enrolled keys are current and valid, the refresh completes without changing them.
Account migration migration
You do not trigger account migration. Adobe performs data-server moves during maintenance or scaling and copies enrolled SSH host keys so strict verification continues to work after the move.
After Adobe notifies you that migration is complete:
- Run Save & Test to confirm the connection. Enrollment should be skipped if keys were copied successfully.
- If SSH host key errors persist, ask an Admin to run Refresh SSH Host Keys, wait a few minutes, then run Save & Test again.
- Contact Adobe Support if errors continue after Save & Test and up to two Refresh SSH Host Keys attempts.
SSH host key error messages ssh-host-key-errors
Connection status shows a single user-friendly SSH host key message. Raw OpenSSH errors are not shown in the dashboard.
The following table maps common messages to likely causes and typical next steps.
Troubleshooting checklist troubleshooting
- Confirm Remote Address, SSH Port, and Linux user settings match your bastion settings.
- Confirm your firewall allows the Commerce Intelligence IP addresses shown on your database credentials page.
- Ask your infrastructure team whether SSH host keys on the bastion changed recently.
- Run Save & Test to validate settings and enroll keys if none exist yet.
- Ask an Admin to run Refresh SSH Host Keys, wait a few minutes, then run Save & Test again. If the first refresh does not resolve the error, repeat this step.
- If the connection still shows an SSH host key error after two refresh attempts, click Contact Support on the connection page (or your account support channel).
When to contact Adobe Support contact-support
Contact support when:
- SSH host key errors continue after an Admin runs Refresh SSH Host Keys twice and Save & Test still fails
- Refresh SSH Host Keys never completes or the connection status does not change after 15–30 minutes
- Errors began immediately after Adobe notified you of account migration or data server maintenance
- Bastion settings and firewall allowlisting are correct, your team has not rotated host keys, and you still cannot connect
- You need an Admin to run Refresh SSH Host Keys but no Admin is available on the account
Include the connection name, approximate time of the last Save & Test or refresh attempt, and whether bastion host keys changed recently. Do not send private keys or passphrases.