How to fix Unsupported cipher in SSH

SSHINTERMEDIATEMEDIUMUpdated Jan 4, 2026· 332 views

SSH client and server cannot agree on an encryption algorithm. This occurs when connecting newer SSH clients to legacy servers, or when ciphers are disabled for security reasons.

Quick fix

Fixes Unsupported cipher

ssh -Q cipher
  1. Check supported ciphers on your system
  2. Try connecting with a compatible cipher
  3. Configure SSH client for persistent workaround
  4. Upgrade SSH on the legacy server (recommended)
ssh — error
ssh -Q cipher
Unsupported cipher

What this error means

This error means the SSH client and server cannot negotiate a common cipher (encryption algorithm) that both support. SSH requires both sides to agree on which encryption method to use for the connection. When they cannot find a match, the connection fails. This typically happens when one side has disabled older, less secure ciphers, or when there's a significant version mismatch between the client and server.

Typical symptoms

  • SSH connection fails immediately with 'Unsupported cipher' message
  • Works with some servers but not others
  • Worked before after upgrading SSH software
  • Remote git operations fail with cipher negotiation errors
  • Secure copy (scp) and SFTP commands fail with the same error

Common causes

  1. OpenSSH has disabled deprecated ciphers (common after version 7.0+)
  2. Server is running very old SSH software with outdated algorithms
  3. Client is running very new SSH version with restricted cipher policy
  4. System administrator has restricted ciphers in sshd_config for security
  5. Mismatch between client and server cipher support

How to fix "Unsupported cipher"

1Check supported ciphers on your system

First, see what ciphers your SSH client supports:

bash
ssh -Q cipher

This lists all available ciphers in priority order. Your system likely supports modern ciphers like aes256-ctr, aes128-ctr, or chacha20-poly1305@openssh.com.

2Try connecting with a compatible cipher

Attempt to connect using one of the modern ciphers supported by both client and server:

bash
ssh -c aes256-ctr user@hostname
ssh -c aes128-ctr user@hostname
ssh -c chacha20-poly1305@openssh.com user@hostname

If one of these works, you've found a compatible cipher.

3Configure SSH client for persistent workaround

If you need to connect regularly, add the server to your SSH config file at ~/.ssh/config:

bash
Host problematic-server
    HostName hostname.example.com
    User yourusername
    Ciphers aes256-ctr,aes128-ctr

This allows seamless connections without specifying the cipher each time.

4Upgrade SSH on the legacy server (recommended)

The best long-term solution is upgrading OpenSSH on the server:

Ubuntu/Debian:

bash
sudo apt update
sudo apt upgrade openssh-server

CentOS/RHEL:

bash
sudo yum update openssh-server

macOS:

bash
brew upgrade openssh

After upgrading, restart the SSH service:

bash
sudo systemctl restart sshd
5Enable legacy ciphers on server (temporary workaround only)

If upgrading immediately isn't possible, you can temporarily re-enable deprecated ciphers on the server by editing /etc/ssh/sshd_config:

bash
sudo nano /etc/ssh/sshd_config

Add or modify the Ciphers line:

bash
Ciphers aes256-cbc,aes192-cbc,aes128-cbc,aes256-ctr,aes128-ctr

Then restart SSH:

bash
sudo systemctl restart sshd

⚠️ Warning: Only enable legacy ciphers as a temporary fix. Older ciphers have known weaknesses. Upgrade the server as soon as feasible.

Advanced notes

Modern OpenSSH versions (7.0+) disable weak ciphers by default for security. Ciphers like DES, 3DES, and RC4 are no longer available. If you control both systems, upgrade both to the same recent version of OpenSSH and use modern ciphers like ChaCha20-Poly1305 or AES-GCM. For enterprise environments, use Mozilla's OpenSSH hardening guidelines which recommend: curve25519-sha256@libssh.org, ecdh-sha2-nistp256, and aes256-gcm@openssh.com as key exchange and cipher algorithms. Rootless containers and isolated network environments may also enforce stricter cipher policies.

Frequently asked questions

What does "Unsupported cipher" mean?
This error means the SSH client and server cannot negotiate a common cipher (encryption algorithm) that both support. SSH requires both sides to agree on which encryption method to use for the connection. When they cannot find a match, the connection fails.
How do I fix "Unsupported cipher"?
SSH client and server cannot agree on an encryption algorithm. This occurs when connecting newer SSH clients to legacy servers, or when ciphers are disabled for security reasons.
What causes "Unsupported cipher"?
OpenSSH has disabled deprecated ciphers (common after version 7.0+) Server is running very old SSH software with outdated algorithms Client is running very new SSH version with restricted cipher policy
Is the "Unsupported cipher" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading