diff --git a/lib/ssh.js b/lib/ssh.js
index <HASH>..<HASH> 100644
--- a/lib/ssh.js
+++ b/lib/ssh.js
@@ -2638,8 +2638,22 @@ function onKEXDH_REPLY(self, info, callback) { // client
       // change bare signature r and s values to ASN.1 DER values for OpenSSL
       var asnSigWriter = new Ber.Writer();
       asnSigWriter.startSequence();
-      asnSigWriter.writeBuffer(rawsig.slice(0, 20), Ber.Integer);
-      asnSigWriter.writeBuffer(rawsig.slice(20), Ber.Integer);
+      var rBuf = rawsig.slice(0, 20);
+      var sBuf = rawsig.slice(20);
+      if (rBuf[0] & 0x80) {
+        var rNew = new Buffer(21);
+        rNew[0] = 0x00;
+        rBuf.copy(rNew, 1);
+        rBuf = rNew;
+      }
+      if (sBuf[0] & 0x80) {
+        var sNew = new Buffer(21);
+        sNew[0] = 0x00;
+        sBuf.copy(sNew, 1);
+        sBuf = sNew;
+      }
+      asnSigWriter.writeBuffer(rBuf, Ber.Integer);
+      asnSigWriter.writeBuffer(sBuf, Ber.Integer);
       asnSigWriter.endSequence();
       rawsig = asnSigWriter.buffer;
     }
SSH2Stream: check for needed leading zeros in dss signatures