Config servers stopped working with GitHub RSA key error

Products

• Support Only for Spring

Issue/Introduction

Many configs servers started throwing error "You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type." This error is seen in newly-created config servers, while some older config servers that also use RSA keys continue to work.

Environment

Product Version: 2.1

Resolution

In September 2021, GitHub blog "Improving Git Protocol security on Github" announced a change to the SSH keys they would support:

 

"RSA keys (you’ll see ssh-rsa in the public key) are stronger than DSA keys, but older Git clients may use them in combination with a dated signature algorithm that uses SHA-1. Many SSH clients, including OpenSSH 7.2 and newer, support RSA with SHA-2 signatures (signature types rsa-sha2-256 and rsa-sha2-512), which are secure. However, other clients only support the older SHA-1 signatures. SHA-1 is weak, so we’ll stop allowing new RSA client keys to use SHA-1 signatures and require them to use SHA-2 signatures instead. Keys with a valid_after date before the deadline (November 2, 2021) may continue to use SHA-1 signatures for the time being."

 

Config servers created with the older RSA keys, using SHA-1 signatures, may find that they start to throw errors when attempting to contact repos on GitHub. These config servers need to be created with an accepted key type; performing a cf update-service will not remedy the error. 

Existing config servers will continue to work for some time; see the GitHub announcement for details.

 

Some customers have attempted to use RSA keys with SHA-2 signatures and found that they were still not able to connect. Recreating the config server with keys in the ECDSA format has proven successful for more customers.

 

Reference links:
https://stackoverflow.com/questions/71500791/eclipse-git-youre-using-an-rsa-key-with-sha-1-which-is-no-longer-allowed-pl

https://stackoverflow.com/questions/71498990/cannot-resolve-swift-packages-after-15th-march-2022-in-xcode/71498991#71498991