SFTP connection problem from Azure Data Factory to a server that only supports rsa-sha2-256/512

Question

SFTP connection problem from Azure Data Factory to a server that only supports rsa-sha2-256/512

Luigia Costabile 70

Hello,

I am trying to connect from Azure Data Factory (both with Managed IR and Self-Hosted IR) to the SFTP server of a supplier. But i receive the following error:

"Failed to connect to Sftp server 'xxxxxx'.

The connection was closed by the server: Unable to negotiate key exchange for server host key algorithms

(client: ssh-ed25519, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, ssh-rsa, ssh-dss server: rsa-sha2-256, rsa-sha2-512) (KeyExchangeFailed).

"
Do you have any suggestions to solve this problem?

Keelan Sears (DEN) 5 Reputation points

2025-09-22T20:00:21.79+00:00

@Luigia Costabile This has caused over a month of chaos on our team as we naturally discovered this bug, where there currently isn't any Microsoft documentation on this issue aside from your comment Luigia, so THANK YOU for asking the question! We have an active production ADF integration that is using rsa-sha2-256 with no issues, ~~but when attempting to create a new connection we are getting the same undocumented error, and we've been banging our heads against the wall.~~ So it would appear that it's the initial handshake when setting the integration up that is failing.

EDIT: Different error, same issue. See my other comment regarding ADF's antiquated version of ssh.net!
Keelan Sears (DEN) 5 Reputation points

2025-09-29T20:43:11.4733333+00:00

@Microsoft PLEASE upgrade your version of ssh.net to something newer than 2016.1.0.

Using a 9 year old version of ssh.net is sooooo silly, and your lack of error handing/documentation has created such a semantically insane environment that it borders on sabotage. From my research, people have been complaining for years about different issues, all of which are directly attributed to this extremely outdated version of ssh.net!

Numerous organizations are actively enforcing stronger encryption algorithms like the aes-gcm variants, and your team is 9 years behind the curve! Please upgrade your ssh.net library to a minimum of 2024.1.0!

For anyone finding this thread via Google or otherwise:

This outdated ssh.net library (2016.1.0) will cause all kinds of issues if you're interacting with a semi-modern SFTP server. "Client encryption algorithm not found" is an error thrown by ADF that specifically refers to the Cipher being used, NOT the host key algorithm or the key exchange algorithm!

BUT be aware that you will also likely run into issues with the host key algorithms and key exchange algorithms as well, as this is also dictated by the weakest link, which is ADF's ssh.net version! Using a Self Hosted Integration Runtime (SHIR) on a newer version is a workaround that Microsoft seems to be pushing to avoid upgrading the Azure Hosted IR ssh.net version. To illustrate how unaware Microsoft is outside this thread: After multiple weeks of working with our Azure Premium support, last week they recommended that we change our host key to an ECDSA key to see if it would fix the issue. ECDSA keys are not supported by ssh.net 2016.1.0! 🤪
John Michael Quinto 0 Reputation points

2026-02-26T14:33:28.3333333+00:00

Hi,

We are having the same issue. Any updates on this?

Thanks

Answer accepted by question author

0 additional answers

Your answer

Keelan Sears (DEN) 5 Reputation points

2025-09-22T20:00:21.79+00:00

@Luigia Costabile This has caused over a month of chaos on our team as we naturally discovered this bug, where there currently isn't any Microsoft documentation on this issue aside from your comment Luigia, so THANK YOU for asking the question! We have an active production ADF integration that is using rsa-sha2-256 with no issues, ~~but when attempting to create a new connection we are getting the same undocumented error, and we've been banging our heads against the wall.~~ So it would appear that it's the initial handshake when setting the integration up that is failing.

EDIT: Different error, same issue. See my other comment regarding ADF's antiquated version of ssh.net!
Keelan Sears (DEN) 5 Reputation points

2025-09-29T20:43:11.4733333+00:00

@Microsoft PLEASE upgrade your version of ssh.net to something newer than 2016.1.0.

Using a 9 year old version of ssh.net is sooooo silly, and your lack of error handing/documentation has created such a semantically insane environment that it borders on sabotage. From my research, people have been complaining for years about different issues, all of which are directly attributed to this extremely outdated version of ssh.net!

Numerous organizations are actively enforcing stronger encryption algorithms like the aes-gcm variants, and your team is 9 years behind the curve! Please upgrade your ssh.net library to a minimum of 2024.1.0!

For anyone finding this thread via Google or otherwise:

This outdated ssh.net library (2016.1.0) will cause all kinds of issues if you're interacting with a semi-modern SFTP server. "Client encryption algorithm not found" is an error thrown by ADF that specifically refers to the Cipher being used, NOT the host key algorithm or the key exchange algorithm!

BUT be aware that you will also likely run into issues with the host key algorithms and key exchange algorithms as well, as this is also dictated by the weakest link, which is ADF's ssh.net version! Using a Self Hosted Integration Runtime (SHIR) on a newer version is a workaround that Microsoft seems to be pushing to avoid upgrading the Azure Hosted IR ssh.net version. To illustrate how unaware Microsoft is outside this thread: After multiple weeks of working with our Azure Premium support, last week they recommended that we change our host key to an ECDSA key to see if it would fix the issue. ECDSA keys are not supported by ssh.net 2016.1.0! 🤪
John Michael Quinto 0 Reputation points

2026-02-26T14:33:28.3333333+00:00

Hi,

We are having the same issue. Any updates on this?

Thanks

Answer 1

Hello Luigia Costabile,

Thank you for asking your question on the Microsoft Q&A portal. Also, I appreciate the response correctly mentioned by our community champion Amira Bedhiafi, ADF’s underlying SSH client does not currently support the rsa-sha2-256 and rsa-sha2-512 host key algorithms required by the server, leading to failed key exchange during connection negotiation.

The SFTP connector in Azure Data Factory uses SSH libraries that, as of now, do not support the rsa-sha2-256 and rsa-sha2-512 host key signature algorithms. Instead, it offers legacy algorithms like ssh-rsa (which uses SHA-1), now considered weak and often disabled on secure servers.

Even though ssh-rsa appears in the client list, many modern OpenSSH servers disable it by default due to security concerns and require rsa-sha2-256/512. Unfortunately, ADF does not yet support these stronger variants. This is a known limitation of the ADF SFTP connector.

I would like to add some possible workarounds which could be as follows on top of our community champion's response.

Use a Self-Hosted Integration Runtime with a Custom Script (Recommended) Since the managed IR has no control over SSH stack, deploy a Self-Hosted IR on a Windows or Linux machine where you have full control, and use a custom activity (e.g., via PowerShell, Python, or command-line sftp/scp) that supports rsa-sha2-256/512. Example using OpenSSH in PowerShell:
```
   sftp -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=rsa-sha2-256,rsa-sha2-512 user@hostname
   
```
Or use tools like WinSCP, PSFTP, or OpenSSH Client with explicit algorithm support. Then orchestrate this script via ADF using a Custom Activity or Azure Batch.
Ask Supplier to Temporarily Re-enable ssh-rsa (Not Recommended Long-Term) If allowed by their security policy, request the supplier to re-enable the ssh-rsa algorithm on their server. Based on my research and findings, Add this line to their sshd_config:
```
   HostKeyAlgorithms +ssh-rsa
   PubkeyAcceptedKeyTypes +ssh-rsa
```
Restart sshd after change. Note: This weakens security and should only be used temporarily for testing. Note
Use Azure Logic Apps (with Custom Connector or Code) Logic Apps has more flexibility with connectors and can run custom code. You can invoke an Azure Function or container that handles the SFTP connection with proper SSH configuration.
Engage Microsoft Support Community to provide feedback and to Confirm Roadmap This capability could be under development. You can provide feedback here on ideas community so that this feature can be worked upon by Microsoft.

Useful links:

Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer 2

Amira Bedhiafi 43,046 MVP Volunteer Moderator

Hello Luigia !

Thank you for posting on Microsoft Learn Q&A.

Based on this old thread, the SSH key exchange algorithm is not supported by the server.

ADF leverages SSH.NET to connect SFTP server, the nuget version is 2016.1.0, the supported key exchange algorithms include:

diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

https://feedback.azure.com/d365community/idea/7258b19f-1b89-ec11-a81b-0022484bfd94

https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-ftp-sftp-http

https://stackoverflow.com/questions/71299696/forming-sftp-connection-in-azure-data-factory-failed-to-negotiate-key-exchange

Shivata Tikoo 0 Reputation points

2026-09-04T09:57:54.6433333+00:00

Hello @Amira Bedhiafi ,

Hope you are doing well.

Please let us know if there is any latest update.
Danny 0 Reputation points

2026-09-04T11:10:41.8233333+00:00

Hi @Amira Bedhiafi ,

Thank you for sharing this information.

Since this answer was posted some time ago, I wanted to check whether there have been any updates regarding the supported SSH key exchange algorithms for SFTP connections in Azure Data Factory.

Has ADF/SSH.NET support been updated to include newer key exchange algorithms, or do the limitations mentioned above still apply?

If there is any updated Microsoft documentation or recommended workaround, I’d really appreciate it if you could point me in the right direction :-) .

Thank you!

SFTP connection problem from Azure Data Factory to a server that only supports rsa-sha2-256/512

@Microsoft PLEASE upgrade your version of ssh.net to something newer than 2016.1.0.

0 additional answers

Your answer