The error “reason=dh key too small” in Sendmail occurs due to the use of an insufficiently large DH key during the creation of a secure connection via TLS. Bobcares, as a part of our Server Management Service offers solutions to every query that comes our way.

Fixing error “reason=dh key too small” in Sendmail

Sendmail is a popular Mail Transfer Agent (MTA) that routes and delivers emails on Unix-based machines. The “dh keys too small” error happened on a newly updated sendmail client, and the server to which it was sending required the dhparams fix. Sites facing these problems may need to stop TLS or revert the OpenSSL update. This method violates the goal of improving DH security.

Here, we’ll look into the troubleshooting steps for the error.

1. In the new NSS library, minimum key lengths are set as follows:

The minimum modulus size for RSA keys is now 512 bits, the minimum modulus size for DSA keys is now 1023 bits, and the minimum modulus size for Diffie-Hellman keys is now 1023 bits.

2. The number of bits must be at least 2048. The 2048-bit length was chosen to improve the security of DH. The following command creates the required dhparams file:

openssl dhparam -out /etc/pki/tls/certs/dhparams.pem 2048

3. Also, stop all ADH ciphers in sendmail.mc:

LOCAL_CONFIG
O CipherList=HIGH:!ADH
O DHParameters=/etc/pki/tls/certs/dhparams.pem

4. Then, follow the next steps:

cd /etc/ssl
openssl req -new -nodes -out req.pem -keyout cert.key -sha256 -newkey rsa:2048
openssl req -new -x509 -days 3650 -key cert.key -out cert.crt -sha256

5. Now, edit the /etc/rc.conf file and add the following lines:

sendmail_cert_create="YES"
sendmail_cert_cn="localhost.mydomain.com"

6. Then, restart sendmail and apply the changes:

service sendmail restart
cd /etc/mail/certs
openssl dhparam -out dh.param 2048
cd /etc/mail && make restart

Switching to 2048 bits should work, as 4096 bits may take too much network capacity and impede connections. Even without rebooting after updating rc.conf, the issue was resolved. The commands listed above should resolve the issue.

[Searching solution for a different question? We’re happy to help.]

Conclusion

To sum up, our Tech team went over the details of fixing “reason=dh key too small” in Sendmail.