timetobail
My stack

GitHub · Forced move · Announced September 22, 2026 · Sources checked Oct 17

Time to bail on Git over SSH to GitHub from old SSH clients?

Time to Bail · Boarding pass

FromGit over SSH to GitHub from old SSH clients
ToYour pick

Act. You can stay.

From January 13, 2027, GitHub drops SHA-1 RSA signatures over SSH. Update old SSH clients or use an Ed25519 key.[1]

Act means: change a setting or plan before the date. You can stay.

Gate closes
Removal
Time left
87days
Status
Act

GitHub SSH drops SHA-1 RSA signatures on January 13, 2027

On January 13, 2027, GitHub stops accepting the ssh-rsa signature type, which means RSA keys signed with SHA-1. It also drops the diffie-hellman-group-exchange-sha256 key exchange. Test brownouts run on November 4 and December 9, 2026. Git remotes that use HTTPS are not affected.

Email me 7 days before Jan 13

One email with the first steps. Nothing else.

We email you one link to confirm (double opt-in). Nothing starts until you click it. Unsubscribe any time. How we use your email.

Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar

How it is winding down

  1. Sep 22, 2026AnnouncedDone
  2. Nov 4, 2026BrownoutsNext
  3. Jan 13Removal

What to do before January 13

Tick steps as you go. Your progress stays in this browser.

  1. Check your remotes

    Run git remote -v. Remotes that start with https:// are not affected.

  2. Update old SSH clients

    Use OpenSSH 7.2p1 or later, libssh2 1.11.0 or later, or PuTTY 0.82 or later. Check build servers too.

  3. Remove forced old settings

    Look in SSH config and CI scripts for ssh-rsa or diffie-hellman-group-exchange-sha256 set as the only choice.

  4. Or switch keys

    If a tool cannot be upgraded, make an Ed25519 key and add it to GitHub.

Email me 7 days before Jan 13

One email with the first steps. Nothing else.

We email you one link to confirm (double opt-in). Nothing starts until you click it. Unsubscribe any time. How we use your email.

Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar

Facts we checked

Facts and their sources
RemovalJanuary 13, 2027[1]
What is removedThe ssh-rsa signature type (RSA keys using SHA-1) and the diffie-hellman-group-exchange-sha256 key exchange[1]
BrownoutsNovember 4, 2026 and December 9, 2026[1]
New RSA keysMust be at least 3072 bits if uploaded after October 14, 2026[1]
Remotes that start with https://Not affected[1]
Existing RSA keysKeep working with rsa-sha2-256 or rsa-sha2-512; you do not need a new key[1]
Clients that already sign RSA keys the new way by defaultRSA with SHA-2 from OpenSSH 7.2p1, libssh2 1.11.0, PuTTY 0.82, Go SSH 0.16.0, TeamCity 2021.2.3[1]
If you cannot upgradeUse an Ed25519 or ECDSA key[1]
GitHub Enterprise ServerSame removal in version 3.25[1]
AnnouncedSeptember 22, 2026[1]
SSH clients that only sign with SHA-1Cannot use these algorithms after January 13, 2027[1]

Sources

Check it yourself. Every fact above links here.

  1. Security improvements for SSH GitHub · primary · checked Oct 17
Read the published editorial report

What changed

Time to bail on Git over SSH to GitHub from old SSH clients? Act. You can stay. From January 13, 2027, GitHub drops SHA-1 RSA signatures over SSH. Update old SSH clients or use an Ed25519 key.

On our scale this is Act: change a setting or plan before the date. You can stay.

On January 13, 2027, GitHub stops accepting the ssh-rsa signature type, which means RSA keys signed with SHA-1. It also drops the diffie-hellman-group-exchange-sha256 key exchange. Test brownouts run on November 4 and December 9, 2026. Git remotes that use HTTPS are not affected.

Here are the facts we checked:

  • Removal: January 13, 2027 (GitHub)
  • What is removed: The ssh-rsa signature type (RSA keys using SHA-1) and the diffie-hellman-group-exchange-sha256 key exchange (GitHub)
  • Brownouts: November 4, 2026 and December 9, 2026 (GitHub)
  • New RSA keys: Must be at least 3072 bits if uploaded after October 14, 2026 (GitHub)
  • Remotes that start with https://: Not affected (GitHub)
  • Existing RSA keys: Keep working with rsa-sha2-256 or rsa-sha2-512; you do not need a new key (GitHub)
  • Clients that already sign RSA keys the new way by default: RSA with SHA-2 from OpenSSH 7.2p1, libssh2 1.11.0, PuTTY 0.82, Go SSH 0.16.0, TeamCity 2021.2.3 (GitHub)
  • If you cannot upgrade: Use an Ed25519 or ECDSA key (GitHub)
  • GitHub Enterprise Server: Same removal in version 3.25 (GitHub)
  • Announced: September 22, 2026 (GitHub)
  • SSH clients that only sign with SHA-1: Cannot use these algorithms after January 13, 2027 (GitHub)

You can stay on GitHub. You have to change a setting or plan before the date.

Leaving is a choice here, not a must.

GitHub is the main source for this page. GitHub has not said more than what is listed here. If a fact is not on this page, we do not know it yet.

Who is affected

SSH clients that only sign with SHA-1: Cannot use these algorithms after January 13, 2027.

The date to remember is January 13, 2027. Make the change before then.

What to do before January 13

  1. Check your remotes. Run git remote -v. Remotes that start with https:// are not affected.
  2. Update old SSH clients. Use OpenSSH 7.2p1 or later, libssh2 1.11.0 or later, or PuTTY 0.82 or later. Check build servers too.
  3. Remove forced old settings. Look in SSH config and CI scripts for ssh-rsa or diffie-hellman-group-exchange-sha256 set as the only choice.
  4. Or switch keys. If a tool cannot be upgraded, make an Ed25519 key and add it to GitHub.

A few tips:

  • Make the change yourself before the date. Do not wait for the last reminder email.
  • Write down your current plan or settings first, so you can compare after the change.
  • After the change, open your settings again and check that it worked.

How to tell your users

If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.

If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.

Options people mention

Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.

Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.

Questions people ask

No questions collected yet.

Sources

Thanks.

Did this answer your question?

Run SaaS spend at work? Get these changes before the invoice

Arrivals · for builders

Building where they land?

People on Git over SSH to GitHub from old SSH clients can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.

Listing is free. An editor checks it. Not ranked. Not paid.

Open the playbookList your product