I have a simple program using netconf client version ncclient 0.6.13 with Python3 running on PPC64LE Red hat Version Red Hat Enterprise Linux release 9.2 (Plow) which is using netconf yang to connect to the remote Cisco router.

import os
from ncclient import manager

# Define the device connection details

# Define the NETCONF filter for DHCP pool configuration
filter = """
<filter xmlns="urn:ietf:params:xml:ns:netconf:base:1.0">
  <native xmlns="http://cisco.com/ns/yang/Cisco-IOS-XE-native">

# Establish a NETCONF session with the device
with manager.connect(host="", port=830, username="test user", password="password", hostkey_verify=False, allow_agent=False,  look_for_keys=False, device_params={'name':'csr'}) as m:
    response = m.get_config("running", filter)
    # Print the XML response

and I am getting this error:

    Traceback (most recent call last):                                             
      File "/usr/lib/powerns-vpn/alpha.py", line 26, in <module>         
        with manager.connect(host="", port=830, username="admin", password="Pwr4cld!", hostkey_verify=False, allow_agent=False,  look_for_keys=False, device_params={'name':'csr'}) as m:
      File "/usr/local/lib/python3.9/site-packages/ncclient/manager.py", line 176, in connect
        return connect_ssh(*args, **kwds)                                 
      File "/usr/local/lib/python3.9/site-packages/ncclient/manager.py", line 143, in connect_ssh
        session.connect(*args, **kwds)                                    
      File "/usr/local/lib/python3.9/site-packages/ncclient/transport/ssh.py", line 331, in connect
      File "/usr/local/lib/python3.9/site-packages/paramiko/transport.py", line 660, in start_client
        raise e                                                                   
      File "/usr/local/lib/python3.9/site-packages/paramiko/transport.py", line 2075, in run
        self.kex_engine.parse_next(ptype, m)       
      File "/usr/local/lib/python3.9/site-packages/paramiko/kex_ecdh_nist.py", line 53, in parse_next
        return self._parse_kexecdh_reply(m)
      File "/usr/local/lib/python3.9/site-packages/paramiko/kex_ecdh_nist.py", line 136, in _parse_kexecdh_reply
        self.transport._verify_key(K_S, sig)
      File "/usr/local/lib/python3.9/site-packages/paramiko/transport.py", line 1886, in _verify_key
        if not key.verify_ssh_sig(self.H, Message(sig)):                               
      File "/usr/local/lib/python3.9/site-packages/paramiko/rsakey.py", line 133, in verify_ssh_sig
      File "/usr/local/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 582, in verify
      File "/usr/local/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 308, in _rsa_sig_verify
        pkey_ctx = _rsa_sig_setup(
      File "/usr/local/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py", line 236, in _rsa_sig_setup
        raise UnsupportedAlgorithm(
    cryptography.exceptions.UnsupportedAlgorithm: sha1 is not supported by this backend for RSA signing.
  • 1
    As it says, it does not support SHA1. You need to use newer than that.
    – Ron Maupin
    Aug 15 at 17:01
  • Is this key coming from the Router Side... If this key is generated at the client side, what params I have to use for it so it is not SHA1. Aug 15 at 17:12
  • As I understand, this key coming from the Router Side. Is there a way on how to set this so the IOS-XE router does not send SHA1 Key. Aug 15 at 17:27
  • That would depend on what router hardware you have and which firmware version it is using. You might find help here, if your version of IOS-Xe is similar: cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/… Aug 15 at 18:30
  • Thanks a bunch. @FrameHowitzer. This is the version I have on my Router. Strange thing is that it does work on Redhat 8.6 (PPC64LE) and RedHat 9.1( X86_64). By the way this is the version I am having Cisco IOS XE Software, Version 17.03.04a Aug 15 at 20:06


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.