---
sourceDocument: Australia ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/australia/servicenow-platform

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# MID Server SSH cryptographic algorithms

# MID Server SSH cryptographic algorithms {#ariaid-title1}

Release version: Australia  
Updated March 12, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of MID Server SSH cryptographic algorithms

The MID Server uses SSH clients to perform various discovery actions, establishing secure communications through an SSH handshake process.
During this handshake, the client and server negotiate supported cryptographic algorithms, with the client selecting the highest priority algorithm mutually supported.
This selection process applies specifically to key exchange, host key, cipher, and MAC algorithms.
Show full answer Show less  

## Default Supported SSH Algorithms

* **Key Exchange Algorithms:** Includes modern elliptic curve and Diffie-Hellman group algorithms prioritized from ecdh-sha2-nistp256 to diffie-hellman-group-exchange-sha1.
* **Host Key Algorithms:** Includes ssh-ed25519, ecdsa-sha2 variants, rsa-sha2 variants, ssh-rsa, and ssh-dss. These algorithms are used for public key signatures during authentication.
* **Cipher Algorithms:** Includes AES in CTR and CBC modes with 128, 192, and 256-bit keys.
* **MAC Algorithms:** Includes HMAC variants such as hmac-sha2-256, hmac-sha1, hmac-sha2-512, and legacy MD5-based HMACs.

## Customizing SSH Algorithm Priorities

ServiceNow customers can customize the priority and selection of SSH algorithms to meet specific security requirements by configuring four MID Server properties:

* **mid.ssh.algorithms.kex** - for Key Exchange algorithms
* **mid.ssh.algorithms.hostkey** - for Host Key algorithms
* **mid.ssh.algorithms.cipher** - for Cipher algorithms
* **mid.ssh.algorithms.mac** - for MAC algorithms

Each property accepts a comma-separated list of algorithms with operators to modify the default list:

* **+ operator:** Appends algorithms to the default list.
* **- operator:** Removes algorithms from the default list.
* **\^ operator:** Places algorithms at the front of the default list.

When a list is provided without operators, it replaces the entire default algorithm list. Note that these customizations apply only to the MID Server and do not affect Glide Import operations, which use SNCSSH on the instance side.

## Practical Implications for ServiceNow Customers

By understanding and configuring SSH cryptographic algorithm priorities, customers can strengthen MID Server security, comply with organizational policies, and ensure compatibility with target SSH servers during discovery and other automated tasks. The ability to customize algorithms helps maintain secure communications aligned with evolving cryptographic standards.

Customers should also be aware of related MID Server security features, such as certificate policies, authentication methods, and FIPS mode enforcement, to build a comprehensive security posture.  
The MID Server utilizes SSH clients to perform many discovery actions. During the SSH
handshake, both the client and server first determine which algorithms both parties support,
then client picks the highest priority algorithm. For the Host Key Algorithm, the client picks
highest priority algorithm which both parties support that matches the key type.

|-|
|   |
[ ]

{#mid-ssh-algorithms__table_kvf_3v4_nhb}

## Default supported SSH algorithms by priority {#mid-ssh-algorithms__section_gjv_cpr_xnb}

Key Exchange Algorithm

1. ecdh-sha2-nistp256
2. ecdh-sha2-nistp384
3. ecdh-sha2-nistp521
4. diffie-hellman-group-exchange-sha256
5. diffie-hellman-group14-sha256
6. diffie-hellman-group16-sha512
7. diffie-hellman-group14-sha1
8. diffie-hellman-group1-sha1
9. diffie-hellman-group-exchange-sha1
{#mid-ssh-algorithms__ol_hgp_bpr_xnb}  
Host Key Algorithm (used for public key signature during authentication)

1. ssh-ed25519-cert-v01@openssh.com
2. rsa-sha2-512-cert-v01@openssh.com
3. rsa-sha2-256-cert-v01@openssh.com
4. ssh-ed25519
5. ecdsa-sha2-nistp256
6. ecdsa-sha2-nistp384
7. ecdsa-sha2-nistp521
8. rsa-sha2-512
9. rsa-sha2-256
10. ssh-rsa-cert-v01@openssh.com
11. ssh-rsa
12. ssh-dss
{#mid-ssh-algorithms__ol_x4h_jpr_xnb}  
Cipher Algorithm

1. aes128-ctr
2. aes192-ctr
3. aes256-ctr
4. aes128-cbc
5. aes192-cbc
6. aes256-cbc
{#mid-ssh-algorithms__ol_trm_qpr_xnb}  
MAC Algorithm

1. hmac-sha2-256
2. hmac-sha1
3. hmac-sha2-512
4. hmac-sha1-96
5. hmac-md5-96
6. hmac-md5
{#mid-ssh-algorithms__ol_fdf_5pr_xnb}

## Customize the SSH algorithms priority
list {#mid-ssh-algorithms__section_ogk_bqr_xnb}

The MID Server SSH algorithm priorities can be customized based on security
needs. Each algorithm is controlled by one of the following MID Server
properties.  
Note:  
Glide Import on the instance uses the default algorithm list. The four MID Server properties do not affect Glide Import because it is not run on the MID server. SNCSSH is used for Glide Import on instance for SFTP and SCP.  
* Key Exchange algorithms: mid.ssh.algorithms.kex​

* Host Key algorithms: mid.ssh.algorithms.host_key​

* Cipher algorithms: mid.ssh.algorithms.cipher​

* MAC algorithms: mid.ssh.algorithms.mac​

{#mid-ssh-algorithms__ul_oxr_ygs_xnb}  
The properties accept comma separated lists with operators. The first name in the list is highest priority, last name in list is lowest priority. Adding a comma separated list without any operators replaces the default algorithm list. The following operators are based on the OpenSSH standard syntax and modify the algorithm priority list.

* The + operator appends the comma separated list of algorithms to the default algorithm list.
* The - operator removes the comma separated list of algorithms from the default algorithm list.
* The \^ operator places the comma separated list of algorithms at the front of the default algorithm list.
{#mid-ssh-algorithms__ul_xs1_x3s_xnb}
**Related concepts**   

* [MID Server certificate check policies](https://www.servicenow.com/docs/8m9x80nAaFWIF8NiDGXc_Q "MID Server uses four kinds of security checks to secure external traffic. The security checks use TLS/SSL certificate validation, hostname validation, Certificate Revocation List (CRL), and Online Certificate Status Protocol (OCSP) validation to improve security. Control these security checks with the MID Server certificate check policies table.")
* [MID Server authentication methods comparison](https://www.servicenow.com/docs/z5ydkOwSzufzHuISkzAUeg "The MID Server can authenticate to your instance using basic authentication, mTLS, or IPKI methods. The methods differ in what the MID Server presents, who issues and manages the certificate, and how access is revoked.")
* [MID Server authentication credentials and SOAP requests](https://www.servicenow.com/docs/4p8crGngPgOAfdbk8pjYFg#mid-authentication-soap-requests "Set basic authentication credentials to update the web service invocation data. For added security, you can enforce basic authentication on each incoming SOAP request to the MID Server.")
* [MID Server unified key store](https://www.servicenow.com/docs/3iLVsHlOfzGiZISJScyUqg#mid-unified-keystore "The MID Server unified key store allows all products on the MID Server to use common certificates and key pairs. This feature allows applications to use the same secure communication channel to the MID Server that the MID Server uses to connect to the instance.")
* [MID Server Azure Key Vault integration](https://www.servicenow.com/docs/h~EAcaKr8L7MtsoM1T1JZw#mid-azure-key-vault-integration "The MID Server supports three authentication methods to retrieve credentials from Azure Key Vault without storing secrets on the instance.")
* [MID Server command audit log](https://www.servicenow.com/docs/vOdzM6rlBeot3UGc~CspQw#mid-audit-log "The command audit log records the commands run by the MID Server for the Discovery application. Review the commands to verify there are no anomalies or errors.")
* [MID Server FIPS Enforced Mode](https://www.servicenow.com/docs/6cyY5imUziFLEBVdeKF8Vg#mid-fips-enforced "The MID Server supports the National Security Cloud (NSC) IL-5 environment, which requires all utilized cryptography to be FIPS validated. The MID server can be run in FIPS Enforced Mode, where only cryptographic algorithms which are FIPS validated are utilized.")
* [MID Server Governance](https://www.servicenow.com/docs/hKi3YlVuzrunJBBe22fUyA "Improve MID Server security by setting an automatic timeout to invalidate and shut down inactive MID Servers. You can enable this feature and set the inactivity timeout period globally and for each MID Server.")
* [MID Server IPKI authentication](https://www.servicenow.com/docs/6MMmX~_xgLOT1WZhS4caBA "Instance PKI (IPKI) lets a MID Server authenticate to its instance using a JSON Web Token (JWT) signed by an instance-issued certificate. Use IPKI when you want to authenticate MID Servers with certificates that the instance issues.")  
**Related tasks**   

* [Encrypt or decrypt MID Server configuration file values](https://www.servicenow.com/docs/G4CBpk2iPfTHLSDWAWDJ5g "The value of any MID Server parameter in the config.xml file can be encrypted. The attributes for all encrypted values are managed from within the configuration file, including the security attribute of the login password.")
* [Enable MID Server mutual authentication](https://www.servicenow.com/docs/1x5Mg3ah2iZZJWtCmt7MHA "Configure the MID Server to use a client certificate for authenticating to the instance. This avoids the need to create a basic authentication credentials in the Key Store for the MID Server's configuration.")
* [Rekey a MID Server](https://www.servicenow.com/docs/cfw_kaXQmtxZLN_QCG2fMA "Rekey a MID Server to generate a new private key. Private keys are used to decrypt automation credentials, so that MID Servers can transmit information securely. Key pairs are initially generated when a MID Server is validated, and MID Servers should be rekeyed periodically to meet security requirements.")
* [Add SSL certificates for the MID Server](https://www.servicenow.com/docs/8cWDoJ9T_h_b8ifC0ZkXbQ#add-ssl-certificates "Configure the MID Server to connect to a source over SSL.")
* [Specify an external TrustStore for the MID Server](https://www.servicenow.com/docs/3RNiYmqV0dQbg~jmllLB_g "The MID Server JVM can utilize a TrustStore external to the MID installation directory so any certificates added to the TrustStore are not overwritten during an upgrade. It is important that this TrustStore file reside outside of the MID installation directory, and the Truststore location can be specified by adding additional parameters to the MID Server's wrapper-override.conf file.")
* [Attach a script file to a file synchronized MID Server](https://www.servicenow.com/docs/DmB6BsY304iOeBhp4zOVQQ#mid-server-script-attach "You can attach a script file to synchronize to a connected MID Server.")  
**Related reference**   

* [MID Server configuration file security](https://www.servicenow.com/docs/Pqv4zoe2goe4CNWzxvGNvA "Sensitive MID Server configuration data can be protected using several different schemes, including internal and external data encryption and external data storage.")