What to do if an SSL connection error (ssl.SSLError: [SSL: DH_KEY_TOO_SMALL]) occurs on Ubuntu 20.04

When I tried SSL communication using Python's third party API on Ubuntu 20.04, the following error occurred. It seems to happen on Ubuntu 20.04.

(Caused by SSLError(SSLError(1, '[SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:1123)')

I will summarize the solution by referring to the QA below. https://askubuntu.com/questions/1233186/ubuntu-20-04-how-to-set-lower-ssl-security-level

Edit openssl.cnf

Check the location directory of the openssl config file with the following command.

% openssl version -d

By the way, it is generally under "/ usr / lib / ssl".

Add the following line to the beginning of the file and save.

openssl_conf = default_conf

Next, add the following to the end of the file.

[ default_conf ]

ssl_conf = ssl_sect

[ssl_sect]

system_default = system_default_sect

[system_default_sect] MinProtocol = TLSv1.2 CipherString = DEFAULT:@SECLEVEL=1

What this is doing is lowering the security level of OpenSSL encryption. This alone should enable SSL communication.

Localization of openssl.cnf

Directly editing the config file under / usr / lib / ssl affects the entire Linux system. If you want to localize the effect when logging in as a specific user, add the following environment variables to .bashrc.

export OPENSSL_CONF=/path/to/my/openssl.cnf

Background to this error

It seems that the cause is that the default setting of Debine type OpenSSL has become more secure. This is the background that became secure. (English) https://weakdh.org/

A brief overview reveals a vulnerability in the key exchange algorithm used by SSL. A DH_KEY_TOO_SMALL error occurs when trying SSL communication corresponding to the vulnerability.

The fundamental solution is to improve the security on the server side, but this time it is impossible because a third party API is used. Therefore, the method of changing the security level described above was adopted.

Recommended Posts

What to do if an SSL connection error (ssl.SSLError: [SSL: DH_KEY_TOO_SMALL]) occurs on Ubuntu 20.04
What to do when an error occurs with import _ssl
What to do if an error occurs when importing numpy with VScode
What to do if you get an error when installing Dlib (Ubuntu)
[OSX] [pyenv] What to do when an SSL error occurs in pip
[Python] What to do if an error occurs in pip (pyinstaller, pyautogui, etc.)
What to do if pyenv install does not proceed with an error
What to do if you get an error when trying to load mnist
[Django] What to do if an Integrity Error occurs when registering data from the management site to the database
What to do if an error occurs in TensorFlow RNN related import or RNN (LSTM) Cell (v 0.11r ~)
What to do if CERTIFICATE_VERIFY_FAILED occurs when nltk.download () is done on macOS pyhon
[python] What to do when an error occurs in send_keys of headless chrome
What to do when SSL error occurs in pip in Windows10, miniconda, VScode environment
What to do if a Unicode Encode Error occurs in Sublime Text Python
What to do if you get an error when installing python with pyenv
What to do if a version error occurs in the selenium Chrome driver
What to do if Japanese language support is not completely installed on Ubuntu 16.04
What to do if SciPy installation fails on CentOS
What to do if an error occurs when loading a python project created with poetry into VS Code
[Python] Type Error:'WebElement' object is not iterable What to do when an error occurs
What to do if you get an "unknown service" error from your gRPC server
What to do if you get "(35,'SSL connect error')" in pycurl (one of them)
What to do if you get an error when importing matplotlib in Python (Mac)
What to do if you get an Import Error when importing matplotlib with Jupyter
What to do if you get the error ʻERR_FEATURE_UNAVAILABLE_ON_PLATFORM` when using ts-node-dev on Linux
What to do if you run python in IntelliJ and end with an error
What to do if `pip install matplotlib` fails on Mac
What to do if you can't use WiFi on Linux
What to do if pip install mysqlclient fails on MacOS
What to do when you get an error saying "Name resolution temporarily failed" on linux
What to do if you get an Undefined error:'Module_six_moves_urllib_parse' object has no attribute'urlencode' on MacOS
What to do if you get an error when running "certbot renew" in CakePHP environment
What to do if you get an Undefined error when trying to use pip with pyenv
What to do if you get an error when vagrant up when you enable public_network or private_network on Vagrant + Arch Linux → Install netctl
What to do when Ubuntu crashes
What to do if yum breaks
What to do if Python doesn't work on Git for Windows
What to do if the inode is exhausted on EC2 Linux
What to do if PyAudio cannot be installed on Python 3.7, 3.8, 3.9 on Windows
What to do if grep: empty (sub) expression appears on Mac grep
What to do if you get an error saying c compiler cannot create executables in configure
What to do if pip --user returns an error in a virtual environment created with pyenv
What to do if you get an error like'Qstring' has already been set to version 1 using mne python
What to do if you forget your login password on Manjaro Linux
What to do if you get stuck during Anaconda installation on Linux
What to do if PyInstaller3.5 gives an error in Python3.8 (TypeError: an integer is required (got type bytes))
What to do if you get a Permission denied (public key) error when trying to pull on Github
What to do if a symbolic link error occurs in import cv while trying to install OpenCV in Python
What to do after installing Linux (Ubuntu)
What to do when psycopg2 throws an error when pipenv lock under Pipenv environment
What to do if you get an error when trying to send a message in tasks.loop () immediately after startup
What to do if you get a "No versions found" error in pipenv
What to do if scrapy doesn't work after installing scrapy with pip on mac
What to do if Django can't load an image from a static folder
What to do if pipreqs results in UnicodeDecodeError
What to do if you can't pipenv shell
Note: What to do if pip install fails
What to do if mod_fcgid cannot resolve UnicodeEncodeError
What to do if rails s doesn't work
What to do if pip cannot be installed
What to do when PermissionError of tempfile.mkstemp occurs