Question Re: Catching com.jcraft.jsch.JSchException: Algorithm negotiation fail in Technology Q&A

Catching com.jcraft.jsch.JSchException: Algorithm negotiation fail

Former Member — Thu, 27 Sep 2018 17:30:11 GMT

Hi,

I received Algorithm negotiation fail error when trying to connect to External SFTP server.

External server told that SAP PI key exchange algorithm need to be changed to any of the below for successful connection.

DH_GROUP_EXCHANGE_SHA256

ECDH_NISTP256

I ran the SFTP trace and found the same issue. Where can we change the key exchange algorithm settings in SAP PI to reflect to any of above more secure key exchange algorithms.

I do not think upgrade to latest patch is required. as we are in SAP 7.4. SFTP adapter version is 4, path 18.

Thanks!!!

Re: Catching com.jcraft.jsch.JSchException: Algorithm negotiation fail

apu_das2 — Fri, 28 Sep 2018 06:41:52 GMT

SHA1/SHA256 is used for signing the data and in SFTP adapter this is required to configure in the module parameter of CC.

If you have already used PGPEncryption standard module then you can change the type of algorithm under parameter name SignatureAlgorithm.

Accordingly, you need to import and mention the certificate name in the parameter

ownPrivateKey and the passphrase under pwdOwnPrivateKey

Re: Catching com.jcraft.jsch.JSchException: Algorithm negotiation fail

PavanKumar — Fri, 28 Sep 2018 08:13:01 GMT

Hi Venu,

Please refer the below Note

2344454 - "com.jcraft.jsch.JSchException: Algorithm negotiation fail" error in Message Monitoring while using SFTP Receiver Adapter

Regards

Pavan

Re: Catching com.jcraft.jsch.JSchException: Algorithm negotiation fail

manoj_khavatkopp — Fri, 28 Sep 2018 11:33:38 GMT

This has nothing to do with PGP. The algorithm negotiation happens for SSH handshake.

@Venu: I would suggest you run xpi_inspector and see what algo does your PI adapter uses, I remember there is an option to set externally in Advantaco SFTP adapter but not in SAP, I would highly recommend you to check below note provided by pavan.

And in case of you are using SSH keys for authentication make sure you generated with the required algo.