When an administrator selects the ssh-rsa algorithm as the Certificate Signing Algorithm for an Okta Advanced Server Access (ASA) project, an SSH handshake failure occurs when connecting to Red Hat 9.4. This happens because Red Hat Enterprise Linux (RHEL) 9 restricts the Secure Hash Algorithm 1 (SHA-1) by default. Resolve this by enabling the SHA-1 subpolicy on the server or updating the project to use the ssh-ed25519 algorithm. The following error message appears during the connection attempt:

ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey], no supported methods remain

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Okta Advanced Server Access (ASA)
• Red Hat 9.4

The default cryptographic policy in RHEL 9 restricts the use of the SHA-1 algorithm for creating and verifying signatures. The ssh-rsa algorithm relies on SHA-1. Okta Advanced Server Access displays a warning message starting with version 1.72.1 when a user attempts to sign in to a project configured with the deprecated ssh-rsa algorithm.

How is the SHA-1 subpolicy enabled on the Red Hat server?

If legacy servers enrolled in the project require ssh-rsa, enable the SHA-1 subpolicy on the Red Hat server by modifying the SSH daemon configuration and updating the cryptographic policies.

1. Add the following directive to the server /etc/ssh/sshd_config file and restart sshd.

   CASignatureAlgorithms +ssh-rsa

2. Run the following command on the Red Hat server and reboot the server.

   update-crypto-policies --set DEFAULT:SHA1

NOTE: Enabling the SHA-1 subpolicy weakens the security of the server. Okta recommends moving away from the deprecated ssh-rsa algorithm.

How is the certificate signing algorithm updated to ssh-ed25519?

If no legacy server is enrolled in the project, update the certificate signing algorithm to ssh-ed25519 by modifying the project settings in the Okta Advanced Server Access dashboard.

1. Log in to the Okta Advanced Server Access dashboard.
2. Go to Projects > [project] > Actions > Edit > SSH Certificate Signature Algorithm.
3. Choose ssh-ed25519 in the dropdown menu and select Submit.
   

Related References

• Create a project