# Git SSH "kex_exchange_identification: Connection closed" in CI

> Fix Git SSH "kex_exchange_identification: Connection closed by remote host" in CI - the SSH handshake was cut before key exchange, often a blocked port 22, rate limit, or proxy.

Source: https://latchkey.dev/learn/git/git-kex-exchange-identification  
Updated: 2026-06-25

The remote closed the SSH connection before key exchange even began. This is a transport-level cutoff - a blocked or proxied port 22, a transient rate limit, or a network interruption - not a key or permissions problem.

## Diagnose it: depth, refs, or credentials?

```Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v
```

> `actions/checkout` fetches depth 1 on a detached HEAD. Anything diffing against a base, reading a branch name, or running `git describe` needs `fetch-depth: 0`.

## FAQ

### What causes Git SSH "kex_exchange_identification: connection closed" in CI?

There are 2 common causes: port 22 blocked or proxied and transient rate limit or network blip. A firewall or network that does not allow outbound SSH on port 22 closes the connection before the handshake completes.

### How do I fix Git SSH "kex_exchange_identification: connection closed" in CI?

There are 2 fixes depending on which cause you have: use ssh over the https port (443) and retry the transient failure. Work through them in order, since the first is the most common.

### What does Git SSH "kex_exchange_identification: connection closed" in CI actually mean?

An SSH clone/fetch fails with kex_exchange_identification: Connection closed by remote host and fatal: Could not read from remote repository.

### How do I stop Git SSH "kex_exchange_identification: connection closed" in CI happening again?

Allow outbound SSH (port 22), or use ssh.github.com:443 on locked-down networks. The prevention section lists 3 changes that keep it from recurring.

### Can Latchkey fix this automatically?

Yes. Latchkey runs your GitHub Actions on managed runners that detect this failure, apply the fix, and retry the job automatically - self-healing is on by default.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt