GitHub scheduled the new RSA upload minimum for October 14, 2026. Graphic: MacDigest.
GitHub has scheduled a 3,072-bit minimum for new RSA SSH key uploads for October 14, 2026. It covers authentication and signing keys. Existing RSA keys are not automatically invalidated by this upload rule. Here’s what to check on a Mac and in CI.
Check the remote and client
In a local checkout, these read-only commands show the remote URLs and the SSH client version available in that terminal:
git remote -v
ssh -VHTTPS Git transport is unaffected; the size requirement still matters if you upload an RSA SSH signing key. An SSH remote might look like git@github.com:owner/repository.git.
Terminal’s result does not establish which client a GUI app or CI job uses. Check those environments separately. Git’s core.sshCommand setting can select a different command, and GIT_SSH_COMMAND can override it. GitHub lists OpenSSH 7.2p1 as its minimum for robust RSA/SHA-2 support with default settings.
Inspect the public key
Replace this placeholder with the path to the public key you want to inspect:
ssh-keygen -lf /path/to/key.pubRead the key type and bit count. If the selected key is RSA, compare its size with the new 3,072-bit threshold. This command inspects the specified file; it does not tell you which key a Git connection actually uses.
The SHA256: fingerprint identifies the key. It does not prove that an SSH connection negotiates a SHA-2 signature. Likewise, an ssh-rsa label on a public key does not establish SHA-1 use: existing RSA keys can use SHA-2.
For a new key, GitHub’s Mac guide uses Ed25519, with 4,096-bit RSA as a compatibility fallback. There’s no need to replace every working key just to run this check.
Put the later dates on your list
GitHub’s SHA-1 signature retirement has brownouts on November 4 and December 9, 2026, followed by removal on January 13, 2027. Those dates also cover removal of the diffie-hellman-group-exchange-sha256 key-exchange method.
GitHub Enterprise Server follows version-based timing: the RSA size rule and both removals arrive in 3.25. Check your server version before applying the cloud schedule.
Start with older GUI clients and CI runners, where a working Mac terminal can hide a different setup. This checklist follows the announced schedule; rollout completion has not been independently confirmed.
