PureDevOps Community

Unable to connect SSH repository: unknown error: ERROR: You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type

#1

The issue that happened to the systems which had integrations with Github it has impacted .
For example Jenkins connecting to Github, or ArgoCd connecting to github repos.

From the Github documentation

What’s changing?

We’re changing which keys are supported in SSH and removing unencrypted Git protocol. Specifically we are:

  • Removing support for all DSA keys
  • Adding requirements for newly added RSA keys
  • Removing some legacy SSH algorithms (HMAC-SHA-1 and CBC ciphers)
  • Adding ECDSA and Ed25519 host keys for SSH
  • Turning off the unencrypted Git protocol

Only users connecting via SSH or git:// are affected. If your Git remotes start with https://, nothing in this post will affect you. If you’re an SSH user, read on for the details and timeline.

We recently removed support for passwords over HTTPS. These SSH changes, while unrelated on a technical level, are part of the same drive to keep GitHub’s customer data as secure as possible.

Ref: Improving Git protocol security on GitHub | The GitHub Blog

#2

If the Impact is for ArgoCd then below is the solution

Switching to Ed25519 as per GitHub’s recommendation worked for me. You can update existing repositories this way.

ssh-keygen -t ed25519 -a 100 # Source: encryption - What are ssh-keygen best practices? - Information Security Stack Exchange

Add cat ~/.ssh/id_ed25519.pub as a new repo deploy key in GitHub/Bitbucket/etc.

cat ~/.ssh/id_ed25519 | base64 -w 0 && echo # copy output

kubectl get secrets -n argocd kubectl edit -n argocd secret repo-

Replace sshPrivateKey: <encoded_private_key> with your new encoded private key.

Ref: SSH SHA-256 key not accepted · Issue #7600 · argoproj/argo-cd · GitHub