Resolving an SSH host-key warning in the HPE Morpheus Manager installer on Windows

While deploying HPE Morpheus Manager from Windows, the installer reported:

Connection failed: SECURITY WARNING: Host key for 192.0.2.50:22 has changed!
This could indicate a man-in-the-middle attack. Connection refused.

This means the SSH client used by the installer had a previously saved host key for 192.0.2.50:22, but the remote system now presented a different one. This commonly happens after rebuilding a server, restoring a VM, changing an IP assignment, or regenerating SSH host keys. It must always be treated as a potential security issue until the new host fingerprint has been verified independently.

Initial Windows SSH checks

The first assumption was that the key was stored in the normal Windows OpenSSH cache at C:\Users\<username>\.ssh\known_hosts. I checked for the IP:

ssh-keygen -R 192.0.2.50

The result was:

Host 192.0.2.50 not found in C:\Users\jdoe\.ssh\known_hosts

The local OpenSSH directory existed, but its known_hosts file did not contain a matching entry.

I also checked PuTTY’s standard registry location:

reg query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s |
  Select-String '192\.0\.2\.50'

This returned nothing — the stale fingerprint wasn’t held by PuTTY either.

Identifying the installer process

The warning came from the HPE Morpheus Manager installer, not from an interactive Windows SSH session. I identified the installer processes:

Get-Process |
  Where-Object { $_.ProcessName -match 'morpheus|hpe|manager|install' } |
  Select-Object ProcessName, Id, Path

To get the full command line and app-data location, I used an elevated PowerShell session:

Get-CimInstance Win32_Process |
  Where-Object { $_.Name -like '*Morpheus*' } |
  Select-Object ProcessId, Name, ExecutablePath, CommandLine

The process arguments contained:

--user-data-dir="C:\Users\jdoe\AppData\Roaming\morpheus-manager-installer"

That confirmed the installer is an Electron application with its own persistent profile directory. The multiple Morpheus Manager Installer.exe processes were Electron helpers (renderer, GPU, network, crash-report) — not separate deployment jobs.

Locating the SSH trust store

I examined the Electron user-data directory:

$profile = "$env:APPDATA\morpheus-manager-installer"

Get-ChildItem $profile -Recurse -Force |
  Select-Object FullName, Length, LastWriteTime |
  Sort-Object LastWriteTime -Descending

The key discovery:

C:\Users\jdoe\AppData\Roaming\morpheus-manager-installer\known_hosts.json

This was the installer’s own SSH host-key store — separate from Windows OpenSSH (%USERPROFILE%\.ssh\known_hosts), PuTTY, Windows Credential Manager, and other clients such as WinSCP, MobaXterm, or WSL. Its timestamp matched a previous installation attempt, which strongly suggested it held the old trusted fingerprint.

Manual removal procedure

Before deleting a stored host key, verify the server’s new SSH fingerprint from a trusted management path — Proxmox console, iLO, iDRAC, Hyper-V console, or physical console.

On the target Linux server, show the ED25519 host-key fingerprint:

sudo ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

After validating the fingerprint, close the installer and open this folder in File Explorer:

%APPDATA%\morpheus-manager-installer

Delete known_hosts.json — or preserve it as a backup by renaming:

Rename-Item `
  "$env:APPDATA\morpheus-manager-installer\known_hosts.json" `
  "known_hosts.json.bak"

When the installer is launched again, it recreates its SSH host-key cache and can accept the verified current host key for 192.0.2.50:22.

Useful troubleshooting commands

Locate standard Windows OpenSSH entries:

ssh-keygen -F 192.0.2.50 -f "$env:USERPROFILE\.ssh\known_hosts"
ssh-keygen -F "[192.0.2.50]:22" -f "$env:USERPROFILE\.ssh\known_hosts"

Remove a standard OpenSSH entry:

ssh-keygen -R 192.0.2.50
ssh-keygen -R "[192.0.2.50]:22"

Search PuTTY host keys:

reg query "HKCU\Software\SimonTatham\PuTTY\SshHostKeys" /s |
  Select-String '192\.0\.2\.50'

Identify Morpheus installer user data:

Get-CimInstance Win32_Process |
  Where-Object { $_.Name -like '*Morpheus*' } |
  Select-Object ProcessId, Name, ExecutablePath, CommandLine

List files in the installer profile:

Get-ChildItem "$env:APPDATA\morpheus-manager-installer" -Recurse -Force |
  Select-Object FullName, Length, LastWriteTime |
  Sort-Object LastWriteTime -Descending

Key takeaway

When an SSH warning appears inside a Windows-based installer, don’t assume the host key lives in Windows OpenSSH or PuTTY. Modern installers — especially Electron-based ones — may ship their own SSH implementation and maintain an application-specific trust store. For the HPE Morpheus Manager installer, the relevant cache is:

%APPDATA%\morpheus-manager-installer\known_hosts.json

Always verify a changed SSH fingerprint before removing the old record and trusting the replacement.