How to fix Error: DH parameter is too small in Node.js

What this error means

This error indicates that the TLS/SSL handshake failed because the server attempted to use Diffie-Hellman (DH) key exchange parameters that are too small to meet current security standards. Diffie-Hellman is a cryptographic protocol used to establish shared secrets over an insecure channel during TLS connections. Modern versions of OpenSSL (which Node.js uses for TLS) have minimum security requirements for DH parameters. OpenSSL 1.1.0 and later reject DH keys smaller than 1024 bits by default, and best practices recommend 2048 bits or higher. When a server offers weak DH parameters (512 or 768 bits), the Node.js client terminates the connection to prevent potential security vulnerabilities. This is a deliberate security measure introduced to protect against the Logjam attack, a cryptographic vulnerability that allows attackers to downgrade TLS connections and potentially decrypt traffic when weak DH groups are used.

Typical symptoms

• TLS/SSL connection fails when making HTTPS requests to certain servers
• Error message contains "dh key too small" or "DH parameter is too small"
• OpenSSL error code SSL_R_DH_KEY_TOO_SMALL appears in logs
• Connection succeeds with older Node.js versions but fails with newer ones
• npm install or package downloads fail with TLS errors
• Docker containers running Node.js applications cannot connect to external services

Common causes

1. The remote server is configured with weak DH parameters (512 or 768 bits)
2. The server is using outdated TLS configuration that predates modern security standards
3. Legacy systems or embedded devices with old OpenSSL/TLS implementations
4. The server administrator has not updated DH parameters since the Logjam vulnerability disclosure
5. Proxy or load balancer in the connection path uses weak DH groups
6. OpenSSL security level is set to 2 or higher, enforcing stricter requirements

How to fix "Error: DH parameter is too small"

# Test the TLS connection
node -e "require('https').get('https://example.com', (res) => console.log('OK'))"

openssl s_client -connect example.com:443 -cipher "DHE"

openssl dhparam -out /path/to/dhparam.pem 2048

ssl_dhparam /path/to/dhparam.pem;

SSLOpenSSLConfCmd DHParameters /path/to/dhparam.pem

const tls = require('tls');
const fs = require('fs');

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  dhparam: fs.readFileSync('dhparam.pem')
};

tls.createServer(options, (socket) => {
  // server code
});

const https = require('https');
const tls = require('tls');

const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET',
  minDHSize: 512  // Lower threshold (not recommended for production)
};

https.get(options, (res) => {
  console.log('Connected');
});

process.env.NODE_OPTIONS = '--tls-min-dh-size=512';

const https = require('https');

const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET',
  ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:!DHE'
};

https.get(options, (res) => {
  console.log('Connected using ECDHE');
});

FROM node:18
RUN sed -i "s/SECLEVEL=2/SECLEVEL=1/g" /etc/ssl/openssl.cnf

export OPENSSL_CONF=/path/to/custom-openssl.cnf

Advanced notes

Frequently asked questions

What does "DH_KEY_TOO_SMALL" mean?

This error indicates that the TLS/SSL handshake failed because the server attempted to use Diffie-Hellman (DH) key exchange parameters that are too small to meet current security standards. Diffie-Hellman is a cryptographic protocol used to establish shared secrets over an insecure channel during TLS connections. js uses for TLS) have minimum security requirements for DH parameters.

How do I fix "DH_KEY_TOO_SMALL"?

This error occurs when a Node.js TLS client refuses to connect because the server offers Diffie-Hellman key exchange parameters smaller than the minimum security threshold (typically 1024 bits). Modern OpenSSL versions reject weak DH groups to protect against cryptographic attacks like Logjam.

What causes "DH_KEY_TOO_SMALL"?

The remote server is configured with weak DH parameters (512 or 768 bits) The server is using outdated TLS configuration that predates modern security standards Legacy systems or embedded devices with old OpenSSL/TLS implementations

Is the "DH_KEY_TOO_SMALL" error serious?

Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Related errors

• Error: UNSUPPORTED_PROTOCOL: TLS version mismatch (incompatible protocol versions)

  TLS Protocol Version Mismatch

  HIGH

• Error: no ciphers available (TLS cipher list is empty or invalid)

  No ciphers available - TLS cipher list is empty or invalid

  HIGH

• Error: ERR_TLS_SESSION_TICKET_APP_DISABLED

  TLS session ticket disabled in application

  MEDIUM

• Error: SSL_ERROR_BAD_HANDSHAKE (TLS handshake failed)

  SSL_ERROR_BAD_HANDSHAKE - TLS handshake failed

  HIGH

• Error: zlib error Z_DATA_ERROR (corrupted compressed data)

  Z_DATA_ERROR: Corrupted compressed data

  MEDIUM

• Error: Could not find package.json in current directory (npm module resolution)

  How to fix "Could not find package.json in current directory" in Node.js

  MEDIUM

Official resources & further reading

• 📚Node.js Official Documentation
• 📖
  Node.js TLS documentation - DHE parameters(Official Docs)
• 🐙
  Add warning for DH parameters less than 2048 bits(GitHub)
• 🐙
  DH key too small error in http-proxy(GitHub)