Java SSL exception - "Element size must be a multiple of 64 ..."

Question

I am trying to implement an extremely simple SSL client to send an HTTPS POST request to the server, and I came across this seemingly harmless exception. The JSSE Reference Guide was not used. Many thanks.

SSLContext ctx = SSLContext.getInstance("SSL"); // Accept-all trust manager TrustManager[] trustEverything = { new DefaultTrustManager() }; // Keystore file in local directory KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType()); ks.load(new java.io.FileInputStream("keystore"),"123456".toCharArray()); // Key manager KeyManager[] managers; KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509"); kmf.init(ks, "123456".toCharArray()); managers = kmf.getKeyManagers(); ctx.init(managers, trustEverything, new SecureRandom()); SSLSocketFactory sslFact = (SSLSocketFactory) ctx.getSocketFactory(); // Connect to internal SSL-enabled server SSLSocket socket = (SSLSocket) sslFact.createSocket("10.131.149.36", 8443); 

An exception is thrown as soon as I try to do a handshake:

 socket.startHandshake(); 

I tried to find where these parameters are initialized to no avail. Please make me feel stupid.

 Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DHKeyPairGenerator.java:120) at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:658) at sun.security.ssl.DHCrypt.<init>(DHCrypt.java:117) 

Answer 1

It has nothing to do with JCE. This is a hard limit on the DH key size to <= 1024 in Java <1.8.0. The workaround if you have a problem with your Apache HTTPD server could be: http://httpd.apache.org/docs/current/ssl/ssl_faq.html#javadh