SSL_CTX_set_tmp_dh failed: dh key too small SSL / TLS Origin: Network Last updated 4 Nov 2026

Nginx: [emerg] SSL_CTX_set_tmp_dh("/etc/ssl/dhparam.pem") failed (SSL: error:1401E0A8:SSL routines:... dh key too small)

The Diffie-Hellman parameters file is too weak (e.g. 512 or 768 bit) for the current OpenSSL security level.

Exact message you may see SSL_CTX_set_tmp_dh failed dh key too small[emerg] SSL_CTX_set_tmp_dh failed (SSL: error:1401E0A8:SSL routines:SSL_CTX_set_tmp_dh:dh key too small)dh key too smallSSL_CTX_set_tmp_dh failed
Explore the map of this error Full error map →
Seen on: SSL Nginx Linux

Meaning

Modern OpenSSL refuses small DH parameters. Generate a new 2048-bit (or larger) file with openssl dhparam -out dhparam.pem 2048, or use ECDHE-only ciphers and remove ssl_dhparam. Old copy-pasted guides sometimes ship a 1024-bit file.

Common causes

  • Old weak dhparam.pem file
  • Copied dhparam from an outdated tutorial
  • OpenSSL security level raised
  • Client Java 7 limitations when raising to 4096
  • Wrong file path

⚡ Quick fix

  1. openssl dhparam -out /etc/ssl/dhparam.pem 2048
  2. Reference it: ssl_dhparam /etc/ssl/dhparam.pem;
  3. Or drop DHE ciphers and use ECDHE only

Detailed fix by platform

Nginx

  1. sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048 && sudo nginx -t && sudo systemctl reload nginx

How to diagnose

  1. Bits — Current dhparam size?
  2. Config — ssl_dhparam path?
  3. Ciphers — ECDHE only?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

AH01909: server certificate does NOT include an ID which matches the server name — Apache: [ssl:warn] AH01909: example.com:443:0 server certificate does NOT include an ID which matches the server name (SSL / TLS)AH01909: server certi…bind() failed (98: Address already in use) — nginx: [emerg] bind() to 0.0.0.0:80 failed (98: Address already in use) (Linux)bind() failed (98: Ad…ca md too weak / ee key too small — OpenSSL: error:0A00018E:SSL routines::ca md too weak / error:140AB18F:SSL routines:SSL_CTX_use_certificate:ee key too small (SSL / TLS)ca md too weak / ee k…Could not automatically find a matching server block — Certbot: Could not automatically find a matching server block for example.com. Set the `server_name` directive to use the Nginx installer (SSL / TLS)Could not automatical…no "ssl_certificate" is defined for the "listen ... ssl" directive — Nginx: [emerg] no "ssl_certificate" is defined for the "listen ... ssl" directive in /etc/nginx/sites-enabled/default:3 (SSL / TLS)no "ssl_certificate" …SSL_CTX_use_PrivateKey_file failed (key values mismatch) — Nginx: [emerg] SSL_CTX_use_PrivateKey_file("/etc/ssl/server.key") failed (SSL: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch) (SSL / TLS)SSL_CTX_use_PrivateKe…ssl_stapling ignored, no OCSP responder URL — Nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/ssl/cert.pem" (SSL / TLS)ssl_stapling ignored,…Timeout during connect (likely firewall problem) — Let's Encrypt: Fetching http://example.com/.well-known/acme-challenge/token: Timeout during connect (likely firewall problem) (SSL / TLS)Timeout during connec…SSL_CTX_s…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.