GitHub X25519 TLS Ends October 7: Fix GHE.com Clients

Quick answer: Beginning October 7, 2026, GitHub Enterprise Cloud with data residency no longer accepts HTTPS connections from clients that offer only X25519 for TLS key agreement. GitHub says current browsers, operating systems, GitHub CLI releases, and commonly used TLS libraries already support the FIPS-approved P-256 group, so most customers should not notice a change. The risk is concentrated in older or deliberately hardened clients, proxies, appliances, or runtimes configured to advertise X25519 and nothing else.

The change is easy to misunderstand because X25519 itself is not being removed from the broader internet, and GitHub is not turning off HTTPS or SSH. This is a targeted compatibility change for GitHub Enterprise Cloud with data residency endpoints.

What changes on October 7, 2026?

GitHub’s official changelog says GHE.com endpoints covered by the data-residency offering will stop accepting TLS handshakes when the client offers only the X25519 key-agreement group. The affected endpoints will continue to support P-256 (secp256r1) and P-384 (secp384r1).

Who should actually worry?

The highest-risk systems are not normal developer laptops. They are infrastructure components that have a manually restricted TLS configuration. Examples include reverse proxies, outbound web gateways, custom enterprise agents, security appliances, old Java or OpenSSL builds, embedded clients, and workloads whose crypto policy was explicitly changed to advertise only one curve.

If your application uses the system TLS defaults on a current operating system, it is likely already offering P-256. If your team maintains a custom cipher or supported-groups policy, however, you should verify it rather than assume compatibility.

How to test a client before it breaks

1. Check the TLS library and runtime

Inventory the runtime that makes outbound GitHub requests: OpenSSL, LibreSSL, BoringSSL, Java, .NET, Go, Node.js, curl, a proxy appliance, or another TLS stack. Confirm that P-256 is enabled in the supported groups list.

2. Review custom crypto policies

Search deployment templates, proxy policies, container images, CI runners, security baselines, and host configuration for rules that pin the key-agreement group to X25519. The important distinction is between supporting X25519 and supporting only X25519. The former is not the problem described by GitHub; the latter is.

3. Test from the same network path

A workstation test can pass while a production service fails if a corporate proxy or TLS inspection device changes the handshake. Run validation from the actual runtime and network path used by the affected application.

Recommended migration checklist

• Update the operating system and TLS library to a supported release.
• Update GitHub CLI and other Git tooling where practical.
• Remove any X25519-only supported-groups restriction.
• Ensure secp256r1 / P-256 is enabled.
• Optionally enable P-384 as an additional supported group.
• Test API, Git-over-HTTPS, webhooks or integration traffic that reaches GHE.com.
• Document any appliance or proxy that terminates or re-originates TLS.

What this change does not affect

GitHub explicitly says SSH connectivity is not affected. The announcement is also scoped to GitHub Enterprise Cloud with data residency rather than every GitHub.com user. That makes broad headlines such as “GitHub is dropping X25519” misleading.

Why GitHub is doing this

GitHub’s notice emphasizes continued support for FIPS-approved P-256 and P-384 groups. Enterprise customers operating under regulated cryptographic requirements often need predictable compatibility with approved algorithms and validated implementations. The practical goal for administrators is therefore not to remove X25519 everywhere, but to make sure clients have a supported fallback.

If your connection fails after the change

A sudden HTTPS failure on October 7 should be investigated at the TLS handshake layer before application code is changed. Compare a working modern client with the failing runtime, inspect supported groups, then check any proxy between the client and GitHub. Updating the runtime or removing an X25519-only restriction should be the first remediation path.

For adjacent developer-infrastructure coverage, AVARIXO also tracks major platform changes such as the Cloudflare Web Search API and other fast-moving developer services.

Sources

• GitHub Changelog — X25519-only TLS ends for GHE.com on October 7
• GitHub Changelog — Application Security updates

FAQ

Is GitHub disabling X25519 everywhere?

No. GitHub’s announcement is specifically about clients that offer only X25519 when connecting to GitHub Enterprise Cloud with data residency.

Do I need to change my browser?

Probably not. GitHub says current browsers, operating systems and commonly used TLS libraries already support P-256.

Does this break Git over SSH?

No. GitHub says SSH connectivity is not affected.