AE REST API curl throws dh key too small
search cancel

AE REST API curl throws dh key too small

book

Article ID: 262753

calendar_today

Updated On:

Products

CA Automic Workload Automation - Automation Engine

Issue/Introduction

When launching the Rest API where SSL is enabled, the curl command fails with "dh key too small":

curl -v -f -H "${automicAuth}" ${automicServer}/executions -H "Content-Type:application/json" -d "${desc}"

  • Trying IP...
  • TCP_NODELAY set
  • Connected to HOSTNAME (IP) port 8088 (#0)
  • ALPN, offering h2
  • ALPN, offering http/1.1
  • successfully set certificate verify locations:
  • CAfile: /etc/pki/tls/certs/ca-bundle.crt

  CApath: none

  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.2 (IN), TLS handshake, Certificate (11):
  • TLSv1.2 (IN), TLS handshake, Server key exchange (12):
  • TLSv1.2 (OUT), TLS alert, handshake failure (552):
  • error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small
  • Closing connection 0

curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small

 

How can we avoid this error?

Environment

Release : 12.x and 21.x

Component: Automation Engine

Scope: Rest API

Cause

This error means the JCP SSL setup is vulnerable because it supports small DH keys, and this is getting rejected by "recent" versions of OpenSSL / curl

Resolution

Workaround:

Explained here, enable the legacy cipher suites on the Linux system where curl command is launched with:

update-crypto-policies --set LEGACY

Solution:

You should setup again the SSL in the JCP regenerating the keystore/certificates of the JCP Rest API and use an updated Java version that block these short cyphers.

The steps are described here