Hi @kapa.ai I used to have a SSH connection to MySQL. Overnight the server for MySQL was changed to a debian12 and now the connection is broken. Also if it helps you understand. I used the same SSH tunnel host/ key on my Dbeaver and I managed to connect with the new server. The Airbyte logs say the following (I anonymised IDs) : 2026-07-01 163100 info 2026-07-01 163100 info Transitioning workload to running state 2026-07-01 163100 info Connector exited, processing output 2026-07-01 163100 info ----- START CHECK ----- 2026-07-01 163100 info Output file jobOutput.json found 2026-07-01 163100 info 2026-07-01 163100 info Connector exited with exit code 0 2026-07-01 163100 info Reading messages from protocol version 0.2.0 2026-07-01 163100 info INFO main i.m.c.e.DefaultEnvironment(<init>):168 Established active environments: [k8s, cloud, cli, source, connector] 2026-07-01 163100 info INFO main i.a.c.AirbyteConnectorRunnable(run):35 Executing class io.airbyte.cdk.check.CheckOperation operation. 2026-07-01 163100 info INFO main i.a.c.c.CheckOperation(execute):33 Parsing connector configuration JSON object. 2026-07-01 163100 info INFO main i.a.c.c.CheckOperation(execute):35 Building internal connector configuration object. 2026-07-01 163100 info INFO main i.a.i.s.m.MySqlSourceConfigurationFactory(makeWithoutExceptionHandling):143 SSL mode: preferred 2026-07-01 163100 info INFO main i.a.i.s.m.MySqlSourceConfigurationFactory(makeWithoutExceptionHandling):188 maxConcurrencyLegacy: 1. maxDBConnections: null. socket paths: 0 2026-07-01 163100 info INFO main i.a.i.s.m.MySqlSourceConfigurationFactory(makeWithoutExceptionHandling):207 Effective concurrency: 1 2026-07-01 163100 info INFO main i.a.c.c.CheckOperation(execute):37 Connecting for config check. 2026-07-01 163100 info INFO main i.a.c.s.TunnelSessionKt(createTunnelSession):74 Creating SSH client. 2026-07-01 163100 info INFO main o.a.s.c.u.s.AbstractSecurityProviderRegistrar(getOrCreateProvider):112 getOrCreateProvider(EdDSA) created instance of net.i2p.crypto.eddsa.EdDSASecurityProvider 2026-07-01 163100 info INFO main o.a.s.c.i.DefaultIoServiceFactoryFactory(getIoServiceProvider):70 Using MinaServiceFactoryFactory 2026-07-01 163100 info INFO main i.a.c.s.TunnelSessionKt(createTunnelSession):79 Creating SSH client session. 2026-07-01 163100 info INFO main o.a.s.c.c.h.ConfigFileHostEntryResolver(resolveEffectiveResolver):89 resolveEffectiveResolver(**:22/null) no configuration file at /home/airbyte/.ssh/config 2026-07-01 163100 info INFO MinaProcessor-2 o.a.s.c.k.DHGClient(next):194 Ignoring invalid certificate * host key org.apache.sshd.common.SshException: Found invalid signature alg ecdsa-sha2-nistp256 for key ID=mon_id host key at org.apache.sshd.client.kex.DHGClient.verifyCertificate(DHGClient.java:246) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.client.kex.DHGClient.next(DHGClient.java:187) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:762) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:622) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:546) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68) ~[sshd-common-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:545) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1718) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:506) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64) ~[sshd-core-2.13.2.jar:2.13.2] at org.apache.sshd.mina.MinaService.messageReceived(MinaService.java:163) ~[sshd-mina-2.13.2.jar:2.13.2] at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:997) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:641) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:48) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:1114) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:121) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:641) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:634) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:539) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$1200(AbstractPollingIoProcessor.java:68) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1236) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1225) ~[mina-core-2.0.27.jar:?] at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:683) ~[mina-core-2.0.27.jar:?] at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64) ~[mina-core-2.0.27.jar:?] at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) ~[?:?] at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) ~[?:?] at java.base/java.lang.Thread.run(Thread.java:1583) [?:?] Stack Trace: org.apache.sshd.common.SshException: Found invalid signature alg ecdsa-sha2-nistp256 for key ID=mon_id host key at org.apache.sshd.client.kex.DHGClient.verifyCertificate(DHGClient.java:246) at org.apache.sshd.client.kex.DHGClient.next(DHGClient.java:187) at org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:762) at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:622) at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:546) at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68) at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:545) at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1718) at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:506) at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64) at org.apache.sshd.mina.MinaService.messageReceived(MinaService.java:163) at org.apache.mina.core.filterchain.DefaultIoFilterChain$TailFilter.messageReceived(DefaultIoFilterChain.java:997) at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:641) at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:48) at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:1114) at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:121) at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:641) at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:634) at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:539) at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$1200(AbstractPollingIoProcessor.java:68) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1236) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1225) at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:683) at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1583) 2026-07-01 163100 warn WARN MinaProcessor-2 o.a.s.c.k.StaticServerKeyVerifier(handleAcceptance):59 Server at * presented unverified EdDSA key: SHA256:REMZsrxB2MhTbBflTboABoJbMJQTLb6HKMqV/uSHdFk 2026-07-01 163100 info INFO MinaProcessor-2 o.a.s.c.k.e.p.HostBoundPubkeyAuthentication(parseExtension):58 Server announced support for publickey-hostbound@openssh.com version 0 2026-07-01 163100 info INFO main i.a.c.c.CheckOperation(execute):48 Config check failed. 2026-07-01 163100 info INFO main i.a.c.AirbyteConnectorRunnable(run):47 Flushing output consumer prior to shutdown. 2026-07-01 163100 info INFO main i.a.c.AirbyteConnectorRunnable(run):49 Completed integration: airbyte/source-mysql. 2026-07-01 163100 info Checking for optional control message... 2026-07-01 163100 info Writing output of e39bfbad-eb9c-4326-9ad3-a641d6cf564a_34844b7f-034b-4aed-acbf-e0f70ae3c18e_0_check to the doc store 2026-07-01 163100 info Workload successfully transitioned to running state 2026-07-01 163100 info Marking workload e39bfbad-eb9c-4326-9ad3-a641d6cf564a_34844b7f-034b-4aed-acbf-e0f70ae3c18e_0_check as successful 2026-07-01 163100 info Deliberately exiting process with code 0. 2026-07-01 163100 info 2026-07-01 163100 info ----- END CHECK ----- 2026-07-01 163100 info

SSH Tunnel Connection Failure After Server Migration to Debian 12 The error in your logs is clear:

Found invalid signature alg ecdsa-sha2-nistp256 for key ID=mon_id host key

followed by:

WARN Server at *** presented unverified EdDSA key: SHA256:REMZsrxB2MhTbBflTboABoJbMJQTLb6HKMqV/uSHdFk

What's happening When the server was migrated to Debian 12, the SSH host keys were regenerated (this is normal when a server is rebuilt). Airbyte's SSH client (

apache-sshd 2.13.2

) is: 1. Receiving an

ecdsa-sha2-nistp256

certificate during key exchange but finding the signature invalid — likely because the new server is presenting a different host key than what was previously trusted/cached. 2. Falling back and seeing an EdDSA (Ed25519) host key that it cannot verify because there is no known-hosts entry for it (

no configuration file at /home/airbyte/.ssh/config

). DBeaver connects successfully because it either accepted the new host key interactively or has its own known-hosts store that it updated. Why Airbyte fails Airbyte's SSH tunnel implementation does not have an interactive prompt to accept new host keys. The

StaticServerKeyVerifier

warning indicates the server's new host key is being presented but cannot be verified against any stored known-hosts entry. How to fix it The knowledge sources do not contain specific documentation on how to update or clear Airbyte's SSH known-hosts store, so I cannot give you a definitive step-by-step for your deployment type. However, based on the error, here are the likely remediation paths: 1. Re-save your SSH connection in Airbyte: Go to your MySQL source in Airbyte, edit the connection, and re-save it (even without changes). In some versions, this triggers a fresh host key acceptance. If there is a "Test connection" button, use it — some Airbyte versions will accept and store the new host key at that point. 2. Check if Airbyte stores a known-hosts file: The log shows Airbyte looked for

/home/airbyte/.ssh/config

and found nothing. If you have access to your Airbyte deployment (self-managed), you could pre-populate

/home/airbyte/.ssh/known_hosts

with the new server's host key. You can get the new host key by running:ssh-keyscan -H your-ssh-tunnel-hostand adding the output to the known-hosts file inside the Airbyte container/pod. 3. If on Airbyte Cloud: Open a support ticket at support.airbyte.com referencing this issue, as you won't have direct access to the underlying infrastructure. The root cause is a server host key change on the new Debian 12 server, not a problem with your private key or credentials (which is why DBeaver works fine). [SSH Tunnel Docs] 👍 0 button 👎 0 button ℹ️ Tip: Mention @kapa.ai in the thread for follow-ups or DM the app for 1-to-1 help.