How to fix fatal: unable to negotiate: protocol error in Git

First, run a verbose SSH connection to see exactly what the server offers:

ssh -vvv [email protected]

Look for lines like:
- "Their offer: ssh-rsa" (host key algorithm issue)
- "Their offer: diffie-hellman-group1-sha1" (key exchange issue)
- "Their offer: aes128-cbc" (cipher issue)

This tells you which algorithm override you need to configure.

Create or edit your SSH config file at ~/.ssh/config and add settings for the problematic host:

# For ssh-rsa host key issues
Host your-git-server.com
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

# For diffie-hellman key exchange issues
Host your-git-server.com
    KexAlgorithms +diffie-hellman-group1-sha1

# For cipher issues
Host your-git-server.com
    Ciphers +aes128-cbc

The + prefix is important - it appends these algorithms to the default set rather than replacing them, so you still get modern algorithms when the server supports them.

After editing, test the connection:

ssh -T [email protected]

If you prefer not to modify your global SSH config, you can configure Git to use specific SSH options:

# Set for a specific repository
git config core.sshCommand "ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa"

# Or set globally
git config --global core.sshCommand "ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa"

For key exchange issues, use:

git config core.sshCommand "ssh -oKexAlgorithms=+diffie-hellman-group1-sha1"

You can combine multiple options:

git config core.sshCommand "ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -oKexAlgorithms=+diffie-hellman-group1-sha1"

For a single Git command without changing any configuration:

GIT_SSH_COMMAND="ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa" git clone [email protected]:repo.git

This is useful for testing or scripting where you don't want permanent configuration changes.

Git for Windows includes its own OpenSSH. You may need to edit the system-wide SSH config:

1. Open C:\Program Files\Git\etc\ssh\ssh_config as Administrator
2. Add the required algorithm settings:

Host your-git-server.com
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

Alternatively, create a user config at C:\Users\<username>\.ssh\config with the same content.

If you have ssh-agent running, restart it after making config changes (check Task Manager for ssh-agent.exe and end the process).

If the server cannot be updated and you're uncomfortable enabling deprecated algorithms, switch to HTTPS:

# Change existing repository remote
git remote set-url origin https://your-git-server.com/username/repo.git

# For new clones
git clone https://your-git-server.com/username/repo.git

For authentication, you can use:
- Personal access tokens (recommended)
- Git credential manager
- Username/password (if the server allows it)

# Store credentials for HTTPS
git config --global credential.helper store

The most secure solution is to have the server administrator upgrade the SSH configuration to support modern algorithms:

- rsa-sha2-256 and rsa-sha2-512 for host keys (secure RSA with SHA-2)
- curve25519-sha256 or ecdh-sha2-nistp256 for key exchange
- chacha20-poly1305 or aes256-gcm for ciphers

For server administrators, update the SSH server configuration (/etc/ssh/sshd_config) and regenerate host keys if necessary:

# Generate new host keys with modern algorithms
sudo ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N ""
sudo ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key -N ""
sudo systemctl restart sshd

This eliminates the need for clients to enable deprecated algorithms.