For whomever - following ColdFusion (2021 release) Update 17, our SFTP connections are breaking with the error below. I saw a note in the update to add JVM args. I've added these, but to no avail. -Dcoldfusion.sftp.enable-ssh-rsa=TRUE -Dcoldfusion.sftp.fingerprint=md5 Anyone else dealing with this? Error: Algorithm negotiation fail: algorithmName="kex" jschProposal="curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com" serverProposal="diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1"

We had this error after the latest CF2023 update, but in our case the ServerProposal was ssh-rsa and adding the JVM arg -Dcoldfusion.sftp.enable-ssh-rsa=TRUE resolved it.

Later versions of Java disabled the use of sha1 in the negotiation and transport for secure applications (like SFTP). sha1 crptos are easily cracked these days and shouldn't be used. Adding them to the JVM arg like Chris mentioned will make the server fail basic security tests (like automated PCI-DSS scans and others). It's recommended that the servers you are connecting to that require less secure cryptos be upgraded. If they only support them, that means they haven't been patched in several years.

For any who may be interested, we're still not able to connect to entities that only propose SHA1, whether the argument is present or not. Adobe suggested that we reach out to the entities we're trying to send to and recommend they allow SSH2. Has anyone else had the pleasure of reaching out to various third-party vendors to suggest they up their SSH protocol level?

I usually throw out that they are at LEAST 3 years, but most likely closer to 4 years without a security patch for whatever software they are running.

@quetwo, I've gotten a couple third-party vendors to run the update patches on their end and it DOES allow it to work. So, "yay me" for helping these companies get more secure!