# Comet: \[Bug\] upgrading to V1.3.1 release2 lost all the certificate, authorized\_keys and ssh server fingerprint! **URL:** \ **Category:** KVM\ **Created:** [July 25, 2025, 2:51pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747 "2025-07-25T14:51:34Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 25, 2025, 2:51pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/1 "2025-07-25T14:51:35Z")
I have just upgraded GL-RM1 to V1.3.1 release2 from V1.3.0. It messed up everything! First it had overwritten the server cert and key! I have encountered this error when access the webpage: ![Screenshot 2025-07-25 at 15.43.37](https://forum-static.gl-inet.com/original/3X/7/8/78504e72768f42c5ce0c8e1de5e0b74cd2dd8d8a.png) Please don't **enable HSTS** if you are going to mess around the server cert on upgrade! Then I ssh’ed to the server and the finderprint of the server has been changed! ```auto $ ssh nuc13-kvm @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the ECDSA key sent by the remote host is SHA256:2bGfdAp+D1Jh19XmmcJ6Wpmj+SmTAeHDDZoencA5Tk8. Please contact your system administrator. Add correct host key in /Users/jason/.ssh/known_hosts to get rid of this message. Offending ECDSA key in /Users/jason/.ssh/known_hosts:43 Host key for nuc13-kvm has changed and you have requested strict checking. Host key verification failed. ``` And I couldn’t log into ssh with my identity file since the file `/root/.ssh/authorized_keys` has been removed! **An upgrade should never messes these security files!** **Please be careful and conscious about upgrade delivery!** ---
**Author:** ![9b9e69c2-4b75-4420](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/9/a587f6/32.png) [@9b9e69c2-4b75-4420](https://forum.gl-inet.com/u/9b9e69c2-4b75-4420)\ **Post date:** [July 25, 2025, 6:33pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/2 "2025-07-25T18:33:55Z")
To be fair this also happens every time a router is flashed with a new release. It's just 'the nature of the beast'. You'd have to backup/restore the private/pubkeys for ssh ea. time afterwards. ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 25, 2025, 9:32pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/3 "2025-07-25T21:32:58Z")
I don’t know what router you use. All the routers, network equipment, IP cams, NAS and so on I use since 1990, none of them have ever forgetten my network settings nor credentials by updating firmware. From crappy TP-Link, to Linksys, to Huawei, to Unifi, to Ring, to Nest, they know what files are replaced / generated by every single user. Can you imagine working in the custom support team and answer the angry customer phone calls? ---
**Author:** ![9b9e69c2-4b75-4420](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/9/a587f6/32.png) [@9b9e69c2-4b75-4420](https://forum.gl-inet.com/u/9b9e69c2-4b75-4420)\ **Post date:** [July 26, 2025, 12:46pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/4 "2025-07-26T12:46:53Z")
Slate AX, Flint v1, Certa, UBNT, etc. GL.iNet firmware and pure OWRT, situation dependent. These GL devices aren't like the disposable devices you cite. They're SBCs more like a RPi than IoT devices or Cisco iOS. I don't have Comet as I'm holding off until the real world reports of the Comet Pro start coming in but I'm to understand these units run on PiKVM. GL has a [GitHub](https://github.com/gl-inet/glkvm) repo for their fork. Why don't you fork their fork, roll your own images which includes pulling down whatever deps you specifically need for your env & private repos? Heck, if you _really_ want to get all kinds of crazy, fork & adapt [ansible-pikvm](https://github.com/bbeaudoin/ansible-pikvm)! Be sure to publish [Ansible Galaxy](https://galaxy.ansible.com/) so you can get _others_ out of the same annoyance you find yourself in! ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 26, 2025, 2:39pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/5 "2025-07-26T14:39:11Z")
You call devices from UBNT, Linksys, Nest, Ring, Synology and TrueNAS disposable? Haha, those **disposable** devices back up their configuration before upgrade and restore full functionality without human intervention. Then what do you call a non-disposal single function appliance requires a profession to upgrade firmware? It is not even funny. And you ask me to work for Gl-inet for free? Unlike you, I paid for the device! For someone using a UUID as username, I am not surprised. Gl-inet employee, reveal yourself! ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 27, 2025, 12:22pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/8 "2025-07-27T12:22:03Z")
On a second thought, NO, PLEASE DO NOT BOTHER REPLY. You are incapable of getting the fact straight, let alone contribute to the solution positively. You are wasting everybody's time. ---
**Author:** ![minmie](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/minmie/32/25223_2.png) [@minmie](https://forum.gl-inet.com/u/minmie)\ **Post date:** [July 28, 2025, 1:45am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/13 "2025-07-28T01:45:10Z")
Will not regenerate tls cert after 1.4.0 ---
**Author:** ![robotluo](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/robotluo/32/17434_2.png) [@robotluo](https://forum.gl-inet.com/u/robotluo)\ **Post date:** [July 28, 2025, 1:50am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/14 "2025-07-28T01:50:10Z")
I'm sorry for the problems caused by the upgrade. I fully understand your usage scenario and purpose. Currently, certificates and keys are not standard features of the firmware, so we ignored this in our testing phase. To facilitate more users, we will add a UI management interface for the certificate and SSH key functions in the future, making it more convenient for users to use as a standard function. ---
**Author:** ![9b9e69c2-4b75-4420](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/9/a587f6/32.png) [@9b9e69c2-4b75-4420](https://forum.gl-inet.com/u/9b9e69c2-4b75-4420)\ **Post date:** [July 28, 2025, 2:58am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/15 "2025-07-28T02:58:30Z")
So when are router users going to have the same feature, @robotluo ? This has been going on for years... yet GL.iNet never addresses it so we write our methods: > [@Router Landing page option!](https://forum.gl-inet.com/t/router-landing-page-option/61633/3): > > Oh I agree it should be buried, I would not expect something like this as a default. Thanks for the backup ideas, I use my own script though... But the login can come in handy, it is way quicker than waiting for an older mango etc to load its pages, and does not tie up that memory(mine is on the edge), and there is very little difference for advanced users, who would be using your 'Advanced' link in the first place, why not place an option THERE to make a second login avaliable or something. … But you lot sure seem to find the dev time to add absurd, security theatre features such as: > [@feature request: SSH toggle](https://forum.gl-inet.com/t/feature-request-ssh-toggle/54974/14): > > GL firmware in after v4.8, add the toggle to allow user to disable SSH. Enable by default. Why should anyone believe it? ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 28, 2025, 8:03am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/16 "2025-07-28T08:03:31Z")
I’m delighted to hear that. Please do fix the overwriting of ssh fingerprint and authorized\_keys on update as well. ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 28, 2025, 8:16am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/17 "2025-07-28T08:16:47Z")
Given that the webui forwards to https and there is no way to use http, it is a surprising overlook. Nonetheless, it is better late than never. Keep up the good work! ---
**Author:** ![goblin](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/goblin/32/26639_2.png) [@goblin](https://forum.gl-inet.com/u/goblin)\ **Post date:** [July 28, 2025, 9:33am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/18 "2025-07-28T09:33:07Z")
To give you a taste of your own medicine: - Stop begging someone else to work for you. - Why don't you fork from their fork? - Roll your own images which includes whatever deps you specifically need for your env & private repos? - Heck, if you _really_ want to get all kinds of crazy, fork & adapt! Be sure to publish so you can get _others_ out of the same annoyance you find yourself in! ---
**Author:** ![9b9e69c2-4b75-4420](https://forum-assets.gl-inet.com/letter_avatar_proxy/v4/letter/9/a587f6/32.png) [@9b9e69c2-4b75-4420](https://forum.gl-inet.com/u/9b9e69c2-4b75-4420)\ **Post date:** [July 28, 2025, 9:34am UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/19 "2025-07-28T09:34:47Z")
Why would I fork anything when I can just publish a whopping **six** (6) lines of code? I can cut that down to two (2) if that's too many to count to. > [@Issue resolving hosts by name](https://forum.gl-inet.com/t/issue-resolving-hosts-by-name/61547/7): > > Weird. I hate to say it but I'd nuke it all & start over. It ain't much but here's something handy to help save states as you build up a clean config: #!/bin/sh HOST="$(uci show system.@system[0].hostname | cut -d "'" -f '2')" DOMAIN="$(uci show dhcp.@dnsmasq[0].domain | cut -d "'" -f '2')" timestamp="$(env TZ=UTC date +'%Y%m%dT%H%M%Z')" sysupgrade --create-backup /tmp/backup-"${HOST}"."${DOMAIN}"-"${timestamp}".tar.gz exit 0 Throw that into a script file & run it as a check point any time … What was that about "medicine," again? ---
**Author:** ![robotluo](https://forum-assets.gl-inet.com/user_avatar/forum.gl-inet.com/robotluo/32/17434_2.png) [@robotluo](https://forum.gl-inet.com/u/robotluo)\ **Post date:** [July 28, 2025, 12:09pm UTC](https://forum.gl-inet.com/t/comet-bug-upgrading-to-v1-3-1-release2-lost-all-the-certificate-authorized-keys-and-ssh-server-fingerprint/61747/20 "2025-07-28T12:09:27Z")