All Products
Search

This Product

    :Troubleshoot RSA key-based SSH connection failures

    Document Center

    :Troubleshoot RSA key-based SSH connection failures

    Last Updated:Apr 27, 2026

    Fix SSH connection failures caused by the deprecated ssh-rsa (RSA/SHA-1) signature scheme on Ubuntu 22.04, CentOS Stream 9, and similar systems.

    Background

    RSA is an asymmetric algorithm used in public key cryptography. It relies on key pairs consisting of a public key and a private key. ECS key pairs use RSA encryption by default. See Overview.

    The ssh-rsa signature scheme uses the SHA-1 hash algorithm with RSA. Because SHA-1 is vulnerable to attacks, ssh-rsa has been disabled by default since OpenSSH 8.8.

    Note

    Deprecating ssh-rsa does not affect RSA keys themselves. RSA keys support multiple signature schemes:

    • rsa-sha2-256 (RSA/SHA-256)

    • rsa-sha2-512 (RSA/SHA-512)

    • ssh-rsa (RSA/SHA-1)

    Only ssh-rsa (RSA/SHA-1) is disabled by default.

    Error: key type ssh-rsa not in PubkeyAcceptedAlgorithms on Ubuntu 22.04

    Symptom

    Connecting to a Ubuntu 22.04 instance from FinalShell or nuoshell with an RSA key fails. The sshd log shows:

    userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

    Cause

    Ubuntu 22.04 disables ssh-rsa by default. FinalShell and nuoshell support only ssh-rsa (RSA/SHA-1) and cannot negotiate rsa-sha2-256 or rsa-sha2-512, causing the connection to fail.

    Solutions

    Choose one of the following solutions:

    • Method 1: Use a different key algorithm

      Generate a key pair with a different algorithm such as ECDSA or DSA.

    • Method 2: Use a different SSH client

      Connect with a client that supports rsa-sha2-256 or rsa-sha2-512, such as Alibaba Cloud Workbench.

    • Method 3: Re-enable ssh-rsa in sshd configuration

      Important

      ssh-rsa (RSA/SHA-1) may pose security risks. Proceed with caution.

      Allow ssh-rsa in the sshd configuration:

      echo 'PubkeyAcceptedAlgorithms=+ssh-rsa' >> /etc/ssh/sshd_config
systemctl restart sshd

    Error: key type ssh-rsa not in PubkeyAcceptedAlgorithms on CentOS Stream 9 and similar distributions

    Affected operating systems

    • CentOS Stream 9

    • AlmaLinux 9

    • Rocky Linux 9

    • Red Hat Enterprise Linux 9

    • Fedora 33 and later

    Symptom

    Connecting to an instance from FinalShell or nuoshell with an RSA key fails. The sshd log shows:

    userauth_pubkey: key type ssh-rsa not in PubkeyAcceptedAlgorithms [preauth]

    Cause

    CentOS Stream 9 and the other listed systems disable ssh-rsa (RSA/SHA-1) by default. FinalShell and nuoshell support only ssh-rsa and cannot negotiate rsa-sha2-256 or rsa-sha2-512, causing the connection to fail.

    Note

    Run update-crypto-policies --show to view the current cryptographic policy.

    Solutions

    Choose one of the following solutions:

    • Method 1: Use a different key algorithm

      Generate a key pair with a different algorithm such as ECDSA or DSA.

    • Method 2: Use a different SSH client

      Connect with a client that supports rsa-sha2-256 or rsa-sha2-512, such as Alibaba Cloud Workbench. See Methods for connecting to an ECS instance.

    • Method 3: Switch the cryptographic policy to LEGACY

      Important

      The LEGACY policy may pose unknown security risks. Proceed with caution.

      Switch the cryptographic policy to LEGACY:

      update-crypto-policies --set LEGACY
update-crypto-policies --show