Apache issue with "Client does not support DH parameters > 1024 bits"
However, the developers of the software have told me that their software can't connect. The error message is "Client does not support DH parameters > 1024 bits".
I've upgraded Apache to 2.4.18, OpenSSL to 1.0.2 and have added the "SSLOpenSSLConfCmd DHParameters "/etc/ssl/private/dhparams_4096.pem"" to the Virtual host file for the website. However, testing the site on the Qualsys website still delivered the "Client does not support…" error.
So what can i do or have I missed anything?
2 Replies
You can regenerate this file
openssl dhparam -out dhparam.pem 1024
1024-bit DH is not secure.
You should tell your third-party "friends" to stop using garbage obsolete crypto in garbage obsolete Java versions.
Java 8 supports up to 2048-bit DH, which is large enough to be secure, though not as slow and hipster as 4096 bits.
Java 7 and newer also support ECDHE cipher suites, which are better in almost every way. (You should ensure they're enabled on your server.)