Page 1 of 1
Problem with ssl cert and DH param
Posted: Thursday 31 May 2018 7:58
by nicky14
I've installed on my raspberry pi 3 with the Domoticz latest stable version a let's encrypt certs. I've generated a DH param and cat to the certs chain and it has the following config:
Code: Select all
-----BEGIN PRIVATE KEY-----
XXXX
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
XXXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXXX
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
XXXXX
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
XXXXX
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
XXXXX
-----END CERTIFICATE-----
-----BEGIN X9.42 DH PARAMETERS-----
XXXXX
-----END X9.42 DH PARAMETERS-----
The SSL config and certs works fine, but often Domoticz log an error like this:
Code: Select all
Error: [web:8484] missing SSL DH parameters from file /home/pi/domoticz/server_cert.pem
I've tried to generete and attach either DH with 2048 key and 4096 but still generate the error. What's wrong? Thanks
Re: Problem with ssl cert and DH param
Posted: Sunday 08 July 2018 20:59
by nicky14
Anybody?
Re: Problem with ssl cert and DH param
Posted: Sunday 08 July 2018 21:40
by felix63
I have the same... but no solution.
Re: Problem with ssl cert and DH param
Posted: Wednesday 11 July 2018 18:07
by joys
Same problem here. I'm on stable version v4.9701.
any idea? thanks, bye.
Re: Problem with ssl cert and DH param
Posted: Thursday 12 July 2018 23:01
by triton
Looks like working for me, my PEM order is like this, certificate at the top, followed by the intermediates and the private key. DH params generated and added to the end of the file. I'm using 2048 bits DH params, not 4096 (4096 is perhaps a bit paranoid currently)
Code: Select all
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
-----END PRIVATE KEY-----
-----BEGIN DH PARAMETERS-----
-----END DH PARAMETERS-----
this should do to generate, just append to to the pem file.
Code: Select all
openssl dhparam -out dh2048.pem 2048
Re: Problem with ssl cert and DH param
Posted: Tuesday 17 July 2018 10:38
by joys
Hi,
thank, working with these command:
cd /etc/ssl/certs
sudo openssl dhparam -out dhparam.pem 2048
In the wiki there is this command:
sudo openssl dhparam -dsaparam -out dhparam.pem 4096
The problem I think is "-dsaparam" flag. The wiki should be updated.
thanks.
Re: Problem with ssl cert and DH param
Posted: Tuesday 17 July 2018 11:31
by felix63
verified. I have taken the liberty to update the wiki.
Re: Problem with ssl cert and DH param
Posted: Saturday 28 February 2026 6:53
by lemassykoi
Re: Problem with ssl cert and DH param
Posted: Saturday 28 February 2026 10:50
by waltervl
Why? There is no reference there to the dhparam command option. The wiki page links to page
https://wiki.domoticz.com/Native_secure ... ts_Encrypt for further instructions.
Re: Problem with ssl cert and DH param
Posted: Sunday 01 March 2026 17:10
by lemassykoi
First, because the page is not up to date.
Second, I didn't want to use let's encrypt (custom internal CA), then I didn't click your link
I faced errors in domoticz log and I had to discover that I needed a .pem file, with cert, private key and dh params (found info from this thread)
not working with a .crt file without private key, nor without dh params