<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.emailstyle17
{mso-style-name:emailstyle17;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.htmlpreformattedchar0
{mso-style-name:htmlpreformattedchar;
font-family:"Courier New";}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span style="font-size:11.0pt;color:#1F497D">My keys are all 2048.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#1f497d" face="Calibri"><span style="font-size:11.0pt;color:#1F497D"><o:p> </o:p></span></font></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";font-weight:bold">From:</span></font></b><font size="2" face="Tahoma"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Dominique
Frise [mailto:dominique.frise@unil.ch] <br>
<b><span style="font-weight:bold">Sent:</span></b> Monday, April 24, 2017 1:42 AM<br>
<b><span style="font-weight:bold">To:</span></b> Root, Paul T; xymon@xymon.com<br>
<b><span style="font-weight:bold">Subject:</span></b> RE: error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small<o:p></o:p></span></font></p>
</div>
</div>
<p class="MsoNormal"><font size="2" face="Calibri"><span style="font-size:11.0pt"><o:p> </o:p></span></font></p>
<p><font size="2" color="black" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:black">OpenSSL was probably updated on your proxy an it reports a problem on the server you are testing (NNN.NNN.NNN.NNN). This server
is using a weak DH key within the key exchange and recent versions of OpenSSL enforce a non-weak DH key because of the Logjam attack (<a href="https://weakdh.org/">https://weakdh.org/</a>).<o:p></o:p></span></font></p>
<p><font size="2" color="black" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:black"><o:p> </o:p></span></font></p>
<p><font size="2" color="black" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:black">Dominique<o:p></o:p></span></font></p>
<div>
<div class="MsoNormal" align="center" style="text-align:center"><font size="2" color="#212121" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#212121">
<hr size="2" width="98%" align="center">
</span></font></div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><font size="2" color="black" face="Calibri"><span style="font-size:11.0pt;color:black;font-weight:bold">De :</span></font></b><font color="black"><span style="color:black"> Xymon <<a href="mailto:xymon-bounces@xymon.com">xymon-bounces@xymon.com</a>>
de la part de Root, Paul T <<a href="mailto:Paul.Root@CenturyLink.com">Paul.Root@CenturyLink.com</a>><br>
<b><span style="font-weight:bold">Envoyé :</span></b> vendredi 21 avril 2017 20:40<br>
<b><span style="font-weight:bold">À :</span></b> <a href="mailto:xymon@xymon.com">
xymon@xymon.com</a><br>
<b><span style="font-weight:bold">Objet :</span></b> [Xymon] error:14082174:SSL routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small</span></font><font size="2" color="#212121" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#212121">
<o:p></o:p></span></font></p>
<div>
<p class="MsoNormal"><font size="2" color="#212121" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#212121"> <o:p></o:p></span></font></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">We patched our OS on our xymon proxy servers, and now we get the error in the xymonnet test<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal" style="background:black"><font size="2" color="#d8d8bf" face="Courier New"><span style="font-size:10.0pt;font-family:"Courier New";color:#D8D8BF">Error output:</span></font><font color="#212121"><span style="color:#212121"><o:p></o:p></span></font></p>
<p class="MsoNormal" style="background:black"><font size="2" color="#d8d8bf" face="Courier New"><span style="font-size:10.0pt;font-family:"Courier New";color:#D8D8BF">Unspecified SSL error in SSL_connect to https (47873/tcp) on host NNN.NNN.NNN.NNN: error:14082174:SSL
routines:SSL3_CHECK_CERT_AND_ALGORITHM:dh key too small</span></font><font color="#212121"><span style="color:#212121"><o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">It looks like it’s some sort of issue with an openssl patch.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">The machines in question are CentOS 6.9, and xymon is 4.3.21, that we packaged ourselves.
<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">I vaguely remember others having issues with SSL certs and xymon last year late.
<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">Does anybody have an explanation or solution?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121"> <o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">Thanks,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" color="#212121" face="Calibri"><span style="font-size:11.0pt;color:#212121">Paul.<o:p></o:p></span></font></p>
</div>
<p class="MsoNormal" align="center" style="text-align:center"><font size="2" color="#212121" face="Helvetica"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif";color:#212121">This communication is the property of CenturyLink and may contain
confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately notify the sender by reply e-mail and destroy all copies of the
communication and any attachments.<o:p></o:p></span></font></p>
</div>
</div>
</div>
<center>This communication is the property of CenturyLink and may contain confidential or privileged information. Unauthorized use of this communication is strictly prohibited and may be unlawful. If you have received this communication in error, please immediately
notify the sender by reply e-mail and destroy all copies of the communication and any attachments.</center>
</body>
</html>