# Nginx: [emerg] SSL_CTX_set_tmp_dh("/etc/ssl/dhparam.pem") failed (SSL: error:1401E0A8:SSL routines:... dh key too small)

**Code:** `SSL_CTX_set_tmp_dh failed: dh key too small` · **Category:** SSL / TLS · **Seen on:** SSL, Nginx, Linux

The Diffie-Hellman parameters file is too weak (e.g. 512 or 768 bit) for the current OpenSSL security level.

## Meaning

Modern OpenSSL refuses small DH parameters. Generate a new 2048-bit (or larger) file with `openssl dhparam -out dhparam.pem 2048`, or use ECDHE-only ciphers and remove `ssl_dhparam`. Old copy-pasted guides sometimes ship a 1024-bit file.

## Common causes

- Old weak dhparam.pem file
- Copied dhparam from an outdated tutorial
- OpenSSL security level raised
- Client Java 7 limitations when raising to 4096
- Wrong file path

## Quick fix

1. `openssl dhparam -out /etc/ssl/dhparam.pem 2048`
2. Reference it: `ssl_dhparam /etc/ssl/dhparam.pem;`
3. Or drop DHE ciphers and use ECDHE only

## Detailed fix by platform

### Nginx

1. `sudo openssl dhparam -out /etc/nginx/dhparam.pem 2048 && sudo nginx -t && sudo systemctl reload nginx`

## How to diagnose

1. **Bits** — Current dhparam size?
2. **Config** — ssl_dhparam path?
3. **Ciphers** — ECDHE only?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/ssl/nginx-dh-key-too-small)