View source for Disable DH 1024

=Disable diffie helman (DH 1024) at mailbox level= 
<hr>
{{KB|{{WIP}}|{{ZCS 8.8}}|{{ZCS 9.0}}}}
<hr> 
__FORCETOC__
====Problem====
Updating "<code>zimbraSSLDHParam</code>" affects at proxy level only. In case you want steps to configure the proxy and other Internet facing services read: https://wiki.zimbra.com/wiki/Cipher_suites. In below article you find steps on how to update diffie helman (DH) key size at mailbox level.

====Solution====
By adding "<code>jdk.tls.ephemeralDHKeySize</code>" into the <code>mailboxd_java_options</code> DH key size can be changed (or disable weak DH 1024) at mailbox level.

'''Notes:'''

These commands are restricted to run on mailbox servers only.

JDK 17 supports max key size value 2048. 

'''Step 1:'''
:Get existing value of the <code>mailboxd_java_options</code>.

:Example:
:<pre>$ zmlocalconfig mailboxd_java_options&#10;mailboxd_java_options = -server -Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols=TLSv1.2 -Djava.awt.headless=true -Dsun.net.inetaddr.ttl= -Dorg.apache.jasper.compiler.disablejsr199=true -XX:+UseG1GC -XX:SoftRefLRUPolicyMSPerMB=1 -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=15 -XX:G1MaxNewSizePercent=45 -XX:-OmitStackTraceInFastThrow -verbose:gc -Xlog:gc*=info,safepoint=info:file=/opt/zimbra/log/gc.log:time:filecount=20,filesize=10m -Djava.security.egd=file:/dev/./urandom --add-opens java.base/java.lang=ALL-UNNAMED</pre>

'''Step 2:'''
: Add "<code>-Djdk.tls.ephemeralDHKeySize=2048</code>" to <code>mailboxd_java_options</code>.

:Example:
:<pre>$ zmlocalconfig -e mailboxd_java_options="-server -Dhttps.protocols=TLSv1.2,TLSv1.3 -Djdk.tls.client.protocols=TLSv1.2,TLSv1.3 -Djdk.tls.ephemeralDHKeySize=2048 -Djava.awt.headless=true -Dsun.net.inetaddr.ttl= -Dorg.apache.jasper.compiler.disablejsr199=true -XX:+UseG1GC -XX:SoftRefLRUPolicyMSPerMB=1 -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=15 -XX:G1MaxNewSizePercent=45 -XX:-OmitStackTraceInFastThrow -verbose:gc -Xlog:gc*=info,safepoint=info:file=/opt/zimbra/log/gc.log:time:filecount=20,filesize=10m -Djava.security.egd=file:/dev/./urandom --add-opens java.base/java.lang=ALL-UNNAMED"</pre>

'''Step 3:'''
:Restart mailbox services
:<pre>$ zmmailboxdctl restart</pre>

'''Step 4:'''
:Verify using nmap
:<pre>nmap --script ssl-enum-ciphers -p 8443 your-mailbox-server.example.com</pre>

'''Ref:'''
https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#jsse-impl-security-property

'''Further Reading:'''
Update DH parameters at proxy level

https://wiki.zimbra.com/wiki/Cipher_suites#DH_parameters

{{SubmittedBy|Raghu Noti}}

{{Article Footer|ZCS 8.8.15, ZCS 9.0|2022-12-01}}