How to setup external concourse workers? - concourse

Question

I have a concourse-web and concourse-server instance but am having issues getting the worker to successfully connect with the web-server.
Apr 21 15:42:26 concourse-worker concourse[24460]: {"timestamp":"1492789346.467736244","source":"worker","message":"worker.beacon.restarting","log_level":2,"data":{"error":"failed to dial: failed to construct client connection:%!(EXTRA *errors.errorString=ssh: handshake failed: remote host public key mismatch)","session":"3"}}
I have added the workers public key (id_worker_rsa.pub) to authorized_worker_keys file on the web server but the issue remains. Is there any documentation on how to do this?
concourse:
worker:
config:
garden-dns-server: 10.x.y.z
tsa-host: web.concourse.service.consul
tsa-public-key: /etc/concourse/.ssh/id_web_rsa.pub
tsa-worker-private-key: /etc/concourse/.ssh/id_worker_rsa
work-dir: /var/concourse/worker
service: True

Answer 1

When you start concourse-web you need to provide --tsa-host-key with path to your TSA server key and --tsa-authorized-keys with path to file containing worker public key.
When you start worker you need to provide --tsa-public-key with path to your TSA server public key and --tsa-worker-private-key with path to worker private key.
See here: https://concourse-ci.org/binaries.html