<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; } @font-face { font-family: "Cambria Math"; } @font-face { font-family: Calibri; } p.MsoNormal, li.MsoNormal, div.MsoNormal { margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; } a:link, span.MsoHyperlink { color: blue; text-decoration: underline; } a:visited, span.MsoHyperlinkFollowed { color: purple; text-decoration: underline; } pre { margin: 0in 0in 0.0001pt; font-size: 10pt; font-family: "Courier New"; } span.EmailStyle17 { font-family: Calibri, sans-serif; color: windowtext; } span.HTMLPreformattedChar { font-family: "Courier New"; } .MsoChpDefault { } @page WordSection1 { margin: 1in; } div.WordSection1 { }--></style>
</head>
<body dir="ltr" style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Helvetica,Sans-Serif;">
<p></p>
<p style="font-family: Helvetica, sans-serif; font-size: 13.3333px;">OpenSSL was probably updated on your proxy an it reports a problem on the server you are testing (NNN.NNN.NNN.NNN). This server is using a weak DH key within the key exchange and recent versions
of OpenSSL enforce a non-weak DH key because of the Logjam attack (https://weakdh.org/).<br>
</p>
<p style="font-family: Helvetica, sans-serif; font-size: 13.3333px;"><br>
</p>
<p style="font-family: Helvetica, sans-serif; font-size: 13.3333px;">Dominique<br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
</div>
</div>
<div style="color: rgb(33, 33, 33);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>De :</b> Xymon <xymon-bounces@xymon.com> de la part de Root, Paul T <Paul.Root@CenturyLink.com><br>
<b>Envoyé :</b> vendredi 21 avril 2017 20:40<br>
<b>À :</b> xymon@xymon.com<br>
<b>Objet :</b> [Xymon] error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small</font>
<div> </div>
</div>
<div>
<div class="WordSection1">
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">We patched our OS on our xymon proxy servers, and now we get the error in the xymonnet test</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal" style="background:black"><font size="2" color="#d8d8bf" face="Courier New"><span style="font-size:10.0pt; font-family:"Courier New"; color:#D8D8BF">Error output:</span></font></p>
<p class="MsoNormal" style="background:black"><font size="2" color="#d8d8bf" face="Courier New"><span style="font-size:10.0pt; font-family:"Courier New"; color:#D8D8BF">Unspecified SSL error in SSL_connect to https (47873/tcp) on host NNN.NNN.NNN.NNN: error:14082174:SSL
routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">It looks like it’s some sort of issue with an openssl patch.</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">The machines in question are CentOS 6.9, and xymon is 4.3.21, that we packaged ourselves.
</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">I vaguely remember others having issues with SSL certs and xymon last year late.
</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">Does anybody have an explanation or solution?</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"> </span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">Thanks,</span></font></p>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt">Paul.</span></font></p>
</div>
<center>This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately
notify the sender by reply e-mail and destroy all copies of the communication and any attachments.</center>
</div>
</div>
</body>
</html>