How To Lower SSL Security Level on Ubuntu 20.04

In this article, we will guide you through the process of lowering the SSL security level on Ubuntu 20.04. It’s important to note that lowering the SSL security level can introduce vulnerabilities, so proceed with caution. This should be considered as a last resort when other solutions to issues like the “dh key too small” error have been exhausted.

Understanding SSL Security Level

SSL (Secure Sockets Layer) is a standard security technology for establishing an encrypted link between a server and a client. The security level in OpenSSL dictates the strength of security applied. By default, Ubuntu 20.04 sets the SSL security level to 2, which can sometimes cause compatibility issues with older systems or software.

Modifying the OpenSSL Configuration

To lower the SSL security level, we need to modify the OpenSSL configuration file (openssl.cnf).

Opening the Configuration File

Open your terminal and type the following command:

sudo nano /etc/ssl/openssl.cnf

In this command, sudo gives you root privileges, nano is a text editor, and /etc/ssl/openssl.cnf is the path to the OpenSSL configuration file.

Modifying the Configuration File

Once you’ve opened the file, add the following line at the very beginning:

openssl_conf = default_conf

This line tells OpenSSL to use a specific section of the configuration file for its default configuration.

Scroll to the end of the file and add these lines:

[default_conf]
ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = TLSv1
CipherString = DEFAULT@SECLEVEL=1

Here’s what each line does:

• [default_conf] and [ssl_sect] are section headers.
• ssl_conf = ssl_sect tells OpenSSL to look in the ssl_sect section for SSL settings.
• system_default = system_default_sect tells OpenSSL to look in the system_default_sect section for system default settings.
• MinProtocol = TLSv1 sets the minimum protocol version to TLSv1.
• CipherString = DEFAULT@SECLEVEL=1 sets the cipher string to a lower security level.

Saving and Closing the File

After adding these lines, save the changes by pressing Ctrl + X, then Y and Enter.

Restarting Services

Finally, restart any services or applications that rely on OpenSSL for the changes to take effect.

Setting a Local Configuration File

If you prefer making changes to a local copy of the config file, you can set the OPENSSL_CONF environment variable to point to the location of your modified config file. For example:

export OPENSSL_CONF=/path/to/openssl.cnf

Replace /path/to/openssl.cnf with the correct path to your modified openssl.cnf file.

Conclusion

This article has guided you through the process of lowering the SSL security level on Ubuntu 20.04. Remember, this should be considered as a last resort, and it’s generally recommended to address the underlying issue causing the “dh key too small” error rather than lowering the security level. Always ensure you understand the potential risks and implications before modifying system security settings.