diff --git a/ChangeLog b/ChangeLog
index 9c960f1..a21f7b9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -20,6 +20,10 @@
      (re)add socks5 suppport to -D; ok djm@
      now ssh(1) can act both as a socks 4 and socks 5 server and
      dynamically forward ports.
+   - markus@cvs.openbsd.org 2003/07/02 20:37:48
+     [ssh.c]
+     convert hostkeyalias to lowercase, otherwise uppercase aliases will
+     not match at all; ok henning@
 
 20030630
  - (djm) Search for support functions necessary to build our 
@@ -640,4 +644,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from murple@murple.net, diagnosis from dtucker@zip.com.au
 
-$Id: ChangeLog,v 1.2840 2003/07/03 03:55:19 dtucker Exp $
+$Id: ChangeLog,v 1.2841 2003/07/03 06:20:42 dtucker Exp $
diff --git a/ssh.c b/ssh.c
index 0142e7f..a86f920 100644
--- a/ssh.c
+++ b/ssh.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.194 2003/06/12 19:12:03 markus Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.195 2003/07/02 20:37:48 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
@@ -597,6 +597,13 @@
 	if (options.hostname != NULL)
 		host = options.hostname;
 
+	/* force lowercase for hostkey matching */
+	if (options.host_key_alias != NULL) {
+		for (p = options.host_key_alias; *p; p++)
+			if (isupper(*p))
+				*p = tolower(*p);
+	}
+
 	if (options.proxy_command != NULL &&
 	    strcmp(options.proxy_command, "none") == 0)
 		options.proxy_command = NULL;