How to fix Error: DH parameter is too small in Node.js

Node.jsINTERMEDIATEHIGH

This error occurs when a Node.js TLS client refuses to connect because the server offers Diffie-Hellman key exchange parameters smaller than the minimum security threshold (typically 1024 bits). Modern OpenSSL versions reject weak DH groups to protect against cryptographic attacks like Logjam.

What this error means

This error indicates that the TLS/SSL handshake failed because the server attempted to use Diffie-Hellman (DH) key exchange parameters that are too small to meet current security standards. Diffie-Hellman is a cryptographic protocol used to establish shared secrets over an insecure channel during TLS connections. Modern versions of OpenSSL (which Node.js uses for TLS) have minimum security requirements for DH parameters. OpenSSL 1.1.0 and later reject DH keys smaller than 1024 bits by default, and best practices recommend 2048 bits or higher. When a server offers weak DH parameters (512 or 768 bits), the Node.js client terminates the connection to prevent potential security vulnerabilities. This is a deliberate security measure introduced to protect against the Logjam attack, a cryptographic vulnerability that allows attackers to downgrade TLS connections and potentially decrypt traffic when weak DH groups are used.

How to fix "Error: DH parameter is too small"

1Identify the server with weak DH parameters

First, verify which server is causing the issue. The error usually includes the hostname or IP address:

bash

# Test the TLS connection
node -e "require('https').get('https://example.com', (res) => console.log('OK'))"

If you see the DH key error, that server needs to be fixed. You can also use OpenSSL directly to test:

bash

openssl s_client -connect example.com:443 -cipher "DHE"

2Fix the server configuration (recommended)

The best solution is to upgrade the server's DH parameters to at least 2048 bits. Generate new DH parameters:

bash

openssl dhparam -out /path/to/dhparam.pem 2048

Then configure your web server to use them. For Nginx:

nginx

ssl_dhparam /path/to/dhparam.pem;

For Apache:

apache

SSLOpenSSLConfCmd DHParameters /path/to/dhparam.pem

For Node.js TLS servers:

javascript

const tls = require('tls');
const fs = require('fs');

const options = {
  key: fs.readFileSync('server-key.pem'),
  cert: fs.readFileSync('server-cert.pem'),
  dhparam: fs.readFileSync('dhparam.pem')
};

tls.createServer(options, (socket) => {
  // server code
});

3Adjust minDHSize on the client (temporary workaround)

If you cannot control the server, you can temporarily lower the minimum DH size on the client side. Warning: This reduces security.

javascript

const https = require('https');
const tls = require('tls');

const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET',
  minDHSize: 512  // Lower threshold (not recommended for production)
};

https.get(options, (res) => {
  console.log('Connected');
});

Or set it globally:

javascript

process.env.NODE_OPTIONS = '--tls-min-dh-size=512';

4Disable DHE ciphers and use ECDHE instead

A more secure alternative is to disable DHE ciphers entirely and rely on ECDHE (Elliptic Curve Diffie-Hellman):

javascript

const https = require('https');

const options = {
  hostname: 'example.com',
  port: 443,
  path: '/',
  method: 'GET',
  ciphers: 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:!DHE'
};

https.get(options, (res) => {
  console.log('Connected using ECDHE');
});

This approach maintains strong security by avoiding weak DH groups altogether.

5Lower OpenSSL security level (not recommended)

As a last resort for testing only, you can lower the OpenSSL security level. This should never be used in production.

In Docker:

dockerfile

FROM node:18
RUN sed -i "s/SECLEVEL=2/SECLEVEL=1/g" /etc/ssl/openssl.cnf

Or set via environment variable:

bash

export OPENSSL_CONF=/path/to/custom-openssl.cnf

This allows connections to servers with 1024-bit DH parameters but should only be temporary.

How to fix Error: DH parameter is too small in Node.js

What this error means

Typical symptoms

Common causes

How to fix "Error: DH parameter is too small"

Advanced notes

Related errors

Official resources & further reading