SSH Key Exchange Algorithm Mismatch – Fix Fast

You're staring at Unable to negotiate with 192.168.1.100 port 22: no matching key exchange method found and you're probably thinking, "why can't this just work?" I get it. Had a client last month whose entire print queue died because of this – turns out their old Cisco switch only spoke SHA-1, and OpenSSH 8.8+ dropped it by default. Here's the fix.

The One-Liner Fix (Client Side)

Open your SSH client config – usually ~/.ssh/config. Add this line under the host you're connecting to:

Host old-server
    HostName 192.168.1.100
    KexAlgorithms +diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

If you don't have a config file, create one with touch ~/.ssh/config && chmod 600 ~/.ssh/config. The + sign is key – it appends these older algorithms to the default list instead of replacing them. Without the plus, you'll break connections to modern servers.

Why This Happens

Starting with OpenSSH 7.0 (released 2016), the team started cutting old crypto. By OpenSSH 8.8 (2021), they disabled SHA-1-based key exchanges entirely. Your server – likely an old Cisco, HP, or Linux box with OpenSSH 6.x or earlier – doesn't support anything newer. The client offers a list like curve25519-sha256@libssh.org, ecdh-sha2-nistp256, etc. The server sits there with its bag of 15-year-old algorithms and says "nope." The error message tells you both lists, which is actually helpful – look for any diffie-hellman-* entries in the server's list.

Quick Check Without Editing Config

For one-off connections, use the -o flag:

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 user@old-server

This saves you a config edit if you're just testing. But if you manage more than one old box, write the config file.

Less Common Variations

Sometimes the issue isn't KexAlgorithms – it's the host key algorithm. You'll see:

Unable to negotiate with ... port 22: no matching host key type found

Old servers often use ssh-rsa (RSA/SHA-1) host keys, also dropped in OpenSSH 8.8+. Fix:

Host old-server
    HostKeyAlgorithms +ssh-rsa

Another variation: cipher mismatch. Old Cisco or Solaris boxes only support aes128-cbc or 3des-cbc. You'll get:

Unable to negotiate with ... port 22: no matching cipher found

Fix:

Ciphers +aes128-cbc,3des-cbc

I've also seen MAC algorithm failures (message authentication code). Error:

Unable to negotiate with ... port 22: no matching MAC found

Fix:

MACs +hmac-sha1,hmac-md5

If you're dealing with all three, just stack them:

Host old-cisco
    HostName 10.0.0.1
    KexAlgorithms +diffie-hellman-group1-sha1
    HostKeyAlgorithms +ssh-rsa
    Ciphers +aes128-cbc
    MACs +hmac-sha1

The Server-Side Fix (If You Control the Server)

If you can update the server, don't skip this. On the server, edit /etc/ssh/sshd_config and add:

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256

Then restart SSH: sudo systemctl restart sshd (or sudo service ssh restart on older systems). This forces the server to support modern key exchanges. But if it's a switch or appliance where you can't change SSH, stick with the client config.

Prevention for Next Time

Three things I do:

1. Track SSH versions on all gear. Run ssh -V on clients, sshd -V on servers. Anything under OpenSSH 7.0 is going to cause problems.
2. Keep a standard config snippet for legacy devices. Name it ~/.ssh/config.d/legacy and include it with Include config.d/legacy in your main config.
3. Test after updates. Every time OpenSSH updates on your client, check your connections to old boxes. Major distros backport security fixes but sometimes also roll out algorithm removals. I got burned by this on Ubuntu 22.04 – dropped RSA/SHA-1 silently.

One last thing: if you're still seeing the error after adding KexAlgorithms, double-check you didn't miss the plus sign. Without it, you're telling SSH to only use those old algorithms, which modern servers won't accept. The plus says "add these to the list." That tiny detail cost me an hour once.