Playbook: GitHub SSH drops SHA-1 RSA signatures on January 13, 2027

3 Reply templates

Answer the question first. Link only if it helps. Always keep the disclosure line. Never post the same text twice.

Helpful first

Sorry you have to deal with this. You can stay on GitHub. Here is what to change before January 13, 2027:

1. Check your remotes. Run git remote -v. Remotes that start with https:// are not affected.
2. Update old SSH clients. Use OpenSSH 7.2p1 or later, libssh2 1.11.0 or later, or PuTTY 0.82 or later. Check build servers too.
3. Remove forced old settings. Look in SSH config and CI scripts for ssh-rsa or diffie-hellman-group-exchange-sha256 set as the only choice.

If they would rather leave, describe a verified way <your product> can help: <your link>
[Disclosure: I build <your product>.]

Short answer

You have until January 13, 2027. You can stay on GitHub. First: check your remotes. Then update old SSH clients.
Happy to help if you get stuck.
[Disclosure: I build <your product>.]

4 Switch-page builder

Create a draft “Switch from GitHub” page. Add your product, review every claim, then copy HTML or Markdown. Your product claims need your own evidence.

Add your product name to replace “Your product”.

Preview

Switch from GitHub to Your product

Git over SSH to GitHub from old SSH clients: a change is due by January 13. You can stay on GitHub. If you would rather leave, here is how to move to Your product.

What changes at GitHub

On January 13, 2027, GitHub stops accepting the ssh-rsa signature type, which means RSA keys signed with SHA-1. It also drops the diffie-hellman-group-exchange-sha256 key exchange. Test brownouts run on November 4 and December 9, 2026. Git remotes that use HTTPS are not affected.

Removal: January 13, 2027 (GitHub)
What is removed: The ssh-rsa signature type (RSA keys using SHA-1) and the diffie-hellman-group-exchange-sha256 key exchange (GitHub)
Brownouts: November 4, 2026 and December 9, 2026 (GitHub)
New RSA keys: Must be at least 3072 bits if uploaded after October 14, 2026 (GitHub)
Remotes that start with https://: Not affected (GitHub)
Existing RSA keys: Keep working with rsa-sha2-256 or rsa-sha2-512; you do not need a new key (GitHub)
Clients that already sign RSA keys the new way by default: RSA with SHA-2 from OpenSSH 7.2p1, libssh2 1.11.0, PuTTY 0.82, Go SSH 0.16.0, TeamCity 2021.2.3 (GitHub)
If you cannot upgrade: Use an Ed25519 or ECDSA key (GitHub)
GitHub Enterprise Server: Same removal in version 3.25 (GitHub)
Announced: September 22, 2026 (GitHub)
SSH clients that only sign with SHA-1: Cannot use these algorithms after January 13, 2027 (GitHub)

You can stay on GitHub if you make the change. This page is for people who would rather leave.

What Your product gives you

Write two or three short lines here. Say what Your product does, who it is for, and what it costs. Use only facts you can show.

How to move from GitHub to Your product

Save what you need from GitHub. Keep a copy before you cancel anything.
Import into Your product. Say which files you accept and how long an import takes.

Tell readers the key date: January 13, 2027.

Questions people ask

If Your product has a direct answer to one of these, add it here. Keep it short and true.

How to help new users settle in

Send one short email. Say what changed, where to find you now, and what they need to do. Put the most important line first.

If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.

Sources

Security improvements for SSH — GitHub (primary), checked 2026-10-17

GitHub SSH drops SHA-1 RSA signatures on January 13, 2027

1 Related discussions

2 What people ask