Issue Station
Sign In
Tools hereToolbox

claude-code - 💡(How to fix) Fix [BUG] SSH: Handshake fails with Teleport proxy — no matching host key format (SSH certificates not supported) [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
anthropics/claude-code#48116•Fetched 2026-04-15 06:32:44
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
mehdiataeimehdiataei
Participants
mehdiataeimehdiataei
Timeline (top)
labeled ×4

Claude Code Desktop's built-in SSH connection fails when connecting through a Teleport proxy with the error:

Handshake failed: no matching host key format

Error Message

Claude Code Desktop's built-in SSH connection fails when connecting through a Teleport proxy with the error:

Error Messages/Logs

Root Cause

Teleport's SSH proxy only presents SSH certificate host keys ([email protected]). The embedded SSH library in Claude Code Desktop does not support the [email protected] certificate host key format, causing the handshake to fail.

The system's OpenSSH client handles this fine — ssh <host> from a terminal works without issues.

Code Example

Host myhost
  HostName <hostname>
  User <user>
  ProxyCommand "tsh" proxy ssh --cluster=<cluster>.teleport.sh --proxy=<cluster>.teleport.sh:443 %r@%h:%p

---

debug2: peer server KEXINIT proposal
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com
debug1: kex: host key algorithm: ecdsa-sha2-nistp256-cert-v01@openssh.com

---
RAW_BUFFERClick to expand / collapse

Preflight Checklist

  • I have searched existing issues and this hasn't been reported yet
  • This is a single bug report (please file separate reports for different bugs)
  • I am using the latest version of Claude Code

What's Wrong?

Summary

Claude Code Desktop's built-in SSH connection fails when connecting through a Teleport proxy with the error:

Handshake failed: no matching host key format

Root Cause

Teleport's SSH proxy only presents SSH certificate host keys ([email protected]). The embedded SSH library in Claude Code Desktop does not support the [email protected] certificate host key format, causing the handshake to fail.

The system's OpenSSH client handles this fine — ssh <host> from a terminal works without issues.

SSH Config

Host myhost
  HostName <hostname>
  User <user>
  ProxyCommand "tsh" proxy ssh --cluster=<cluster>.teleport.sh --proxy=<cluster>.teleport.sh:443 %r@%h:%p

Verbose SSH Output (relevant lines)

debug2: peer server KEXINIT proposal
debug2: host key algorithms: [email protected]
debug1: kex: host key algorithm: [email protected]

The server offers only the certificate variant. The embedded SSH library has no matching algorithm.

What Should Happen?

Claude Code Desktop should support SSH certificate host key formats (*[email protected]), or optionally delegate to the system SSH binary for connection handling.

Error Messages/Logs

Steps to Reproduce

  1. Configure an SSH host that connects through a Teleport proxy using tsh proxy ssh as the ProxyCommand
  2. In Claude Code Desktop, add an SSH connection pointing to that host
  3. Attempt to connect — handshake fails immediately

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

No response

Claude Code Version

1.2581.0 (Desktop App)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other

Additional Information

No response

extent analysis

TL;DR

The most likely fix is to update the embedded SSH library in Claude Code Desktop to support SSH certificate host key formats (*[email protected]).

Guidance

  • Verify that the system's OpenSSH client is working correctly by running ssh <host> from a terminal to confirm the issue is specific to Claude Code Desktop.
  • Check the Teleport proxy configuration to ensure it is presenting the correct SSH certificate host keys.
  • Consider delegating to the system SSH binary for connection handling as a potential workaround.
  • Review the embedded SSH library documentation to see if there are any configuration options or updates available to support the required host key format.

Example

No code snippet is provided as the issue is related to the embedded SSH library and its configuration.

Notes

The issue is specific to Claude Code Desktop and does not affect the system's OpenSSH client. The Teleport proxy is presenting the correct SSH certificate host keys, but the embedded SSH library does not support the required format.

Recommendation

Apply a workaround by delegating to the system SSH binary for connection handling, as updating the embedded SSH library may not be feasible at this time. This will allow users to connect to the Teleport proxy using the system's OpenSSH client until a permanent fix is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#search optimization#API routing#API middleware#SSR setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING