SSH host key/TLS host certificate fingerprint “…” does not match pattern “…”

You get these errors, when the SSH host key fingerprint provided to SessionOptions.SshHostKeyFingerprint or TLS host certificate fingerprint provided to SessionOptions.TlsHostCertificateFingerprint have a wrong format.

(In PowerShell, when setting the properties via -Property switch of New-Object cmdlet, the error is disguised by PowerShell as “The value supplied is not valid, or the property is read-only. Change the value, and then try again.”)

Examples of the correct format of the fingerprints:

• Base64-encoded SHA-256 SSH host key fingerprint:
  ssh-rsa 2048 2EPqmpSRaRtUIqwvm15rzavssrhHxJ3avJWh9mBaz8M=
• Hex-encoded SHA-256 TLS host certificate fingerprint:
  b0:ea:9e:a2:0b:90:58:72:4c:dc:bc:5d:83:0e:bf:02:ef:28:9d:b8:8e:26:bc:25:bd:36:4b:17:50:1b:c8:da

Easiest way to get the fingerprints in the correct format is to have WinSCP generate a code template in your preferred language for you. For other options, see also Where do I get SSH host key fingerprint to authorize the server?

Also make sure you use the same version (ideally the latest) of WinSCP both for obtaining the fingerprint in WinSCP GUI and using the fingerprint in WinSCP .NET assembly. Older versions do not support modern SHA-256 fingerprints. So the fingerprint formats may be incompatible (and less safe).

A common mistake is to substitute SessionOptions.TlsHostCertificateFingerprint with SessionOptions.SshHostKeyFingerprint (or vice versa). The SSH host key is used with SSH-based protocols SFTP and FTP. The TLS host certificate is used with SSL-based protocols FTPS, WebDAVS and S3.