How to fix Unable to negotiate with hostname port 22: no matching cipher found. in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 205 views

This error occurs when your SSH client and the remote SSH server cannot agree on a common encryption cipher. Modern SSH clients disable older, weaker ciphers by default for security, causing connections to legacy servers to fail.

Quick fix

Fixes Unable to negotiate with hostname port 22: no matching cipher found.

ssh -v user@hostname
  1. Check what ciphers the server offers
  2. Temporarily add support for legacy ciphers via command line
  3. Configure SSH for the legacy host permanently
  4. Verify the connection works
ssh — error
ssh -v user@hostname
Unable to negotiate with hostname port 22: no matching cipher found.

What this error means

SSH requires both the client and server to support at least one common encryption cipher to secure the connection. When they cannot find a matching cipher, negotiation fails. This typically happens when connecting to older servers or legacy network equipment that only supports deprecated encryption algorithms that modern SSH clients have disabled by default for security reasons.

Typical symptoms

  • SSH connection attempts fail immediately with no timeout
  • Error appears during initial connection negotiation (before authentication)
  • Connection works from other machines or with older SSH clients
  • Network tools show the server is reachable on port 22
  • The error message specifies which ciphers the server offers (e.g., "Their offer: aes256-cbc")

Common causes

  1. Connecting to a legacy SSH server with older OpenSSH version (pre-2013) that only supports weak ciphers like 3des-cbc or aes128-cbc
  2. Modern SSH client disabled weak ciphers in a recent update for security reasons
  3. Restrictive SSH client configuration that limits available ciphers
  4. Network equipment or embedded systems (Cisco switches, printers, etc.) with outdated SSH implementations
  5. Older Linux distribution with legacy SSH server configuration

How to fix "Unable to negotiate with hostname port 22: no matching cipher found."

1Check what ciphers the server offers

Use ssh -v hostname to enable verbose output and see which ciphers the server advertises. Look for "server host key algorithms:" or "offer:" in the output to identify available ciphers.

bash
ssh -v user@hostname

The error message often includes "Their offer: xyz" showing the available ciphers directly.

2Temporarily add support for legacy ciphers via command line

For a one-time connection, use the -o Ciphers option to explicitly enable an old cipher:

bash
ssh -o Ciphers=+aes128-cbc user@hostname

Replace aes128-cbc with the cipher your server offers. The + prefix adds this cipher to the available list without disabling modern ones.

3Configure SSH for the legacy host permanently

Edit your ~/.ssh/config file (create it if it does not exist) and add a Host section for the legacy server:

bash
Host legacy-server
    HostName hostname.example.com
    User username
    Ciphers +aes128-cbc,aes256-cbc,3des-cbc
    KexAlgorithms +diffie-hellman-group1-sha1

Replace legacy-server with a memorable alias and hostname.example.com with the actual hostname. Add only the ciphers that the server supports (from step 1).

Then connect using the alias:

bash
ssh legacy-server
4Verify the connection works

After configuring, test the SSH connection:

bash
ssh user@hostname

If successful, you should receive a prompt for password or key-based authentication. If still failing, double-check that the cipher names match the server's offer (they are case-sensitive).

5Upgrade the remote SSH server (long-term solution)

The best solution is to upgrade the SSH server on the remote machine to a modern version that supports current ciphers. If you control the remote server:

bash
# On the remote server
sudo apt update && sudo apt upgrade openssh-server  # Debian/Ubuntu
sudo yum update openssh-server                      # RHEL/CentOS

After upgrading, you can remove the legacy cipher configuration from your SSH config and use standard secure ciphers.

Advanced notes

SSH cipher negotiation uses a preference list. Your client suggests preferred ciphers in order, and the server chooses the first one it supports. If no intersection exists, negotiation fails. Legacy ciphers like 3des-cbc and aes128-cbc are weak by modern standards (vulnerable to various attacks), so enable them only for legacy systems you trust. Always prefer upgrading the server when possible. For network equipment like Cisco switches, firmware updates may be required instead of simple SSH server upgrades. If the server supports newer ciphers but your client is outdated, consider using a newer SSH client (OpenSSH 7.4+). Some systems use restricted SSH shells that disable certain ciphers; contact the administrator if you cannot modify client-side configuration.

Frequently asked questions

What does "Unable to negotiate with hostname port 22: no matching cipher found." mean?
SSH requires both the client and server to support at least one common encryption cipher to secure the connection. When they cannot find a matching cipher, negotiation fails. This typically happens when connecting to older servers or legacy network equipment that only supports deprecated encryption algorithms that modern SSH clients have disabled by default for security reasons.
How do I fix "Unable to negotiate with hostname port 22: no matching cipher found."?
This error occurs when your SSH client and the remote SSH server cannot agree on a common encryption cipher. Modern SSH clients disable older, weaker ciphers by default for security, causing connections to legacy servers to fail.
What causes "Unable to negotiate with hostname port 22: no matching cipher found."?
Connecting to a legacy SSH server with older OpenSSH version (pre-2013) that only supports weak ciphers like 3des-cbc or aes128-cbc Modern SSH client disabled weak ciphers in a recent update for security reasons Restrictive SSH client configuration that limits available ciphers
Is the "Unable to negotiate with hostname port 22: no matching cipher found." error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading