no matching key exchange method found in OpenSSH handshake

Key Exchange Negotiation Failure

During the initial SSH handshake, the client and server must agree on a mutually supported key exchange (KEX) algorithm. If the intersection of the supported algorithm lists is empty, the connection is aborted before authentication occurs.

This behavior is common when connecting modern OpenSSH clients (version 8.8 or 9.0+) to legacy embedded systems or appliances that only support deprecated methods such as diffie-hellman-group1-sha1 or diffie-hellman-group14-sha1, which are disabled by default in recent releases to prevent vulnerabilities like Logjam.

While the KexAlgorithms directive in ssh_config or sshd_config allows for the manual re-enabling of these methods, this creates a conflict between maintaining connectivity to legacy hardware and enforcing modern cryptographic standards.

• How can an administrator determine the most secure minimum KEX baseline that balances legacy compatibility with forward secrecy?
• Is there a mechanism to dynamically negotiate a weaker KEX only for specific trusted host fingerprints without globally lowering the security posture?