GitHub SSH drops SHA-1 RSA and old DH exchange

This only affects users connecting to GitHub over SSH or using the unauthenticated Git protocol on GitHub Enterprise Server; HTTPS remotes are unaffected.

• SSH connections using the ssh-rsa signature type (RSA with SHA-1) will stop working after brownouts and final removal.
• SSH connections using the diffie-hellman-group-exchange-sha256 key exchange method will stop working on the same schedule.
• RSA keys uploaded after October 14, 2026 must be at least 3072 bits; smaller new RSA keys will be rejected.
• Older SSH clients or libraries that don't support RSA with SHA-2 signatures may be unable to authenticate once ssh-rsa is removed.

Act before the removal dates if you rely on RSA-SHA1 signatures or the old Diffie-Hellman exchange.

• Confirm your SSH client or library supports RSA with SHA-2 (rsa-sha2-256/512); most modern versions already use it automatically.
• Check the minimum version table in the announcement (e.g. OpenSSH 7.2p1+, PuTTY 0.82+) and upgrade if needed.
• If you can't upgrade, switch to an Ed25519 or ECDSA key instead.
• When generating new RSA keys, make them at least 3072 bits, or prefer Ed25519.
• Note the brownouts on November 4 and December 9, 2026 as test windows before full removal on January 13, 2027.