MOVEit Transfer - TLS/SSL Ciphers, SSH Key Exchange Algorithms, SSH Ciphers, SSH Hash Functions, SSH Host Key Algorithms

This article outlines how to find TLS/SSL and SSH algorithms that MOVEit Transfer supports, as well as what feature enhancements are currently requests.

Jul 2, 2026
Knowledge

Title

URL Name

MOVEit-Transfer-SSH-Key-Exchange-KEX-Algorithms-and-Ciphers

Article Number

000194253

Environment

Product: MOVEit Transfer Version: All Supported Versions OS: All Supported Platforms

Question/Problem Description

Many organizations need confirmation about which SSH algorithms are available for the Key Exchange (KEX) ciphers in the MOVEit Transfer product. This article will assist with the Key Exchanges available so administrators can enable or disable algorithms appropriate for their systems.

Is there a way to see which SSH Ciphers and SSH Key Exchange algorithms are being actively used by end users? The security team requested admins to disable some of the weaker ciphers, and knowing if there are some that are not being used would be a big help. Is there information that can be pull in logs or through a built-in report?

Security said there are less secure SSH Algorithms that they need to be disabled. Is there a report that will list users that use these algorithms to connect to Transfer so they may be alerted to the available algorithm changes?

Is there a report that will show the SSL or TLS ciphers users connected with the last time they logged in to MOVEit Transfer?

Steps to Reproduce

1) Log on to the MOVEit Transfer server itself. 2) Open the Configuration Utility. 3) Click on the SSH Ciphers tab or the SSL tab.

Clarifying Information

The algorithms in this page integrate with certain registry keys for the server overall, and the MOVEit Transfer service user must have the Administrator permissions enabled so they can update these registry keys from the Config Utility.

Here is an image showing what the Config Utility > TLS tab looks like (it is labeled as the SSL tab in some previous versions):

Here is an image of the SSH Ciphers tab:

*Please note, MOVEit Transfer support both RSA and DSA SSH client keys. Versions 15.0 and later also support elliptic curve client keys: https://docs.progress.com/bundle/moveit-transfer-release-notes-2023/page/Whats-New-in-MOVEit-Transfer-2023.html

Client keys authenticate the user connecting to an SSH/SFTP server, whereas host keys ensure that the SFTP client is connected to the correct server. For more information on SSH keys, see this documentation: Generate and Install Keys (SSH) - https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2024/page/Generate-and-Install-Keys-SSH.html

Not all traffic to/from the MOVEit server will be encrypted according to the settings that belong to MOVEit. If traffic is seen that does not seem to abide by the settings in the config utility, check encryption settings on storage devices, domain controllers, and other components outside of MOVEit. It is the connections between users' client applications and the MOVEit server that are encrypted according to the settings above.

Error Message

Defect Number

Enhancement Number

MOVEIT-I-181

Cause

A user can see what ciphers et al the MOVEit Transfer server has available but there is no information available relative to what cipher was actually used by a client to connect to the MOVEit Transfer server.

The ciphers used for each connection to the Transfer server are not stored in the database, so there is currently no way to report on past cipher usage.

This is expected behavior. There is no way to see which Algorithms users are connecting with when they connect to Transfer, and the audit logs or reports will not display this information. The reason is that these negotiations occur at the server level and they occur each time a user connects for the duration of that event.

It is recommended to send a message to the entire userbase to let them know that cipher changes will take effect and they should update their clients/processes accordingly.

Resolution

The MOVEit Transfer Config Utility > TLS tab (or SSL tab in some previous versions) shows what TLS versions and TLS cipher suites are available. For more information, see this documentation: Selecting SSL/TLS Support - https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2024/page/Selecting-SSLTLS-Support_2.html

The MOVEit Transfer Config Utility > SSH Ciphers tab shows what SSH key exchange (KEX) algorithms, encryption ciphers, hash functions, and host key algorithms (as of 15.1.4 - for previous versions, see this article: How to disable old SSH host key algorithms in MOVEit Transfer 14.1+ (2022.1+).) are available. These algorithms are well documented in the section about SSH services in the MOVEit Transfer Administrator guide (SSH - Configuration - https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2024/page/SSH-Configuration-and-IP-address-bindings.html).

The list of available TLS and SSH algorithms is not available in the MOVEit Transfer Administrator guide.

There are several third-party utilities available to assist with viewing and validating TLS and SSH configurations. For example:

There is no way to add new ciphers, hash functions, or algorithms to MOVEit Transfer's list of currently supported items, although the available items may differ from version to version. Please submit an enhancement request for any additional desired algorithms not found on the TLS tab or SSH Ciphers tab in the latest version.

Storing and reporting on information about the actual ciphers used in a connection is considered an enhancement request. It was determined that the Progress product is functioning as designed. An enhancement request has been submitted for this idea on the Progress Community. To promote the Idea, click on this link: https://moveit.ideas.aha.io/ideas/MOVEIT-I-181. Customer feedback is valuable and Idea submissions are monitored by our Product Management team. Enhancement requests are reviewed during the planning phase of each new product release and a list of the enhancements chosen for implementation can be found in the Release Notes documents that accompany each release. Once an Idea is submitted the Progress Software Community will have the opportunity to comment on and vote for the Idea. Its priority will be evaluated as customer demand weighs in through Article Feedback and through vote count in the Ideas Portal

For detailed information on how to submit an Idea, please refer to the Knowledge Base article How to submit an enhancement request for a Progress product?.

Workaround

At present, a network sniffer such as Wireshark might be used to monitor the traffic between a client and a transfer server. Progress does not specifically promote one third part product over another.

Notes

Progress article(s):
MOVEit Transfer - Hardening SSH Server
How to disable Ciphers in MOVEit Transfer
SSL/TLS Cipher and Version Best Practices

For information about the available SSH Ciphers available in other MOVEit products, Automation and Cloud, see below:
What SSH Ciphers, KEX and hmac algorithms does Moveit Automation(Central) Support?
What key exchanges, hashing ciphers, and SSH Ciphers are in use in MOVEit Cloud?
SSH Weak Key Exchanges/Ciphers Sunset on 2/13/2022

Keyword Phrase

Key Exchange, Ciphers, Algorithms, HMAC, hash functions, KEX, host key, OpenSSH, SSH

Last Modified Date

7/2/2026 8:35 PM

MOVEit Transfer - TLS/SSL Ciphers, SSH Key Exchange Algorithms, SSH Ciphers, SSH Hash Functions, SSH Host Key Algorithms

Files(0)

Was this article helpful?

Was this article helpful?

MOVEit Transfer - TLS/SSL Ciphers, SSH Key Exchange Algorithms, SSH Ciphers, SSH Hash Functions, SSH Host Key Algorithms

Information

Related Articles