In this article, we will guide you through the process of lowering the SSL security level on Ubuntu 20.04. It’s important to note that lowering the SSL security level can introduce vulnerabilities, so proceed with caution. This should be considered as a last resort when other solutions to issues like the “dh key too small” error have been exhausted.
To lower the SSL security level on Ubuntu 20.04, you need to modify the OpenSSL configuration file. This involves adding specific lines to the file and restarting any services or applications that rely on OpenSSL. However, it’s important to note that lowering the SSL security level can introduce vulnerabilities, so proceed with caution and consider it as a last resort.
Understanding SSL Security Level
SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client. The security level in OpenSSL dictates the strength of security applied. By default, Ubuntu 20.04 sets the SSL security level to 2, which can sometimes cause compatibility issues with older systems or software.
Modifying the OpenSSL Configuration
To lower the SSL security level, we need to modify the OpenSSL configuration file (
Opening the Configuration File
Open your terminal and type the following command:
sudo nano /etc/ssl/openssl.cnf
In this command,
sudo gives you root privileges,
nano is a text editor, and
/etc/ssl/openssl.cnf is the path to the OpenSSL configuration file.
Modifying the Configuration File
Once you’ve opened the file, add the following line at the very beginning:
openssl_conf = default_conf
This line tells OpenSSL to use a specific section of the configuration file for its default configuration.
Scroll to the end of the file and add these lines:
[default_conf] ssl_conf = ssl_sect [ssl_sect] system_default = system_default_sect [system_default_sect] MinProtocol = TLSv1 CipherString = DEFAULT@SECLEVEL=1
Here’s what each line does:
[ssl_sect]are section headers.
ssl_conf = ssl_secttells OpenSSL to look in the
ssl_sectsection for SSL settings.
system_default = system_default_secttells OpenSSL to look in the
system_default_sectsection for system default settings.
MinProtocol = TLSv1sets the minimum protocol version to TLSv1.
CipherString = DEFAULT@SECLEVEL=1sets the cipher string to a lower security level.
Saving and Closing the File
After adding these lines, save the changes by pressing
Ctrl + X, then
Finally, restart any services or applications that rely on OpenSSL for the changes to take effect.
Setting a Local Configuration File
If you prefer making changes to a local copy of the config file, you can set the
OPENSSL_CONF environment variable to point to the location of your modified config file. For example:
/path/to/openssl.cnf with the correct path to your modified
This article has guided you through the process of lowering the SSL security level on Ubuntu 20.04. Remember, this should be considered as a last resort, and it’s generally recommended to address the underlying issue causing the “dh key too small” error rather than lowering the security level. Always ensure you understand the potential risks and implications before modifying system security settings.
Lowering the SSL security level can introduce vulnerabilities and should only be done as a last resort. It is generally recommended to address the underlying issue causing compatibility problems or errors rather than lowering the security level.
Lowering the SSL security level may be necessary in cases where older systems or software are unable to establish a secure connection due to compatibility issues. However, it is important to note that this should be considered as a temporary solution and efforts should be made to update the systems or software to support higher security levels.
The default SSL security level on Ubuntu 20.04 is set to 2.
To modify the OpenSSL configuration file, you can use a text editor like
nano to open the
/etc/ssl/openssl.cnf file. Make the necessary changes to the file, save it, and then restart any services or applications that rely on OpenSSL for the changes to take effect.
Yes, you can set a local configuration file by using the
OPENSSL_CONF environment variable. Set the variable to the path of your modified
openssl.cnf file. For example:
export OPENSSL_CONF=/path/to/openssl.cnf. This allows you to make changes to a local copy of the config file without modifying the system-wide configuration.