# Email SSL Errors after Update to 2.4.0.beta4

**URL:** https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992
**Category:** Self-hosting
**Tags:** email
**Created:** [September 19, 2019, 7:23am UTC](https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992 "2019-09-19T07:23:26Z")
**Posts on this page:** 1
**Showing post:** 11

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [October 1, 2019, 3:50am UTC](https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992/11 "2019-10-01T03:50:35Z")

</div>

From [U.S. | Let There Be Change | Accenture](https://www.contextis.com/en/blog/manually-testing-ssl-tls-weaknesses-2016-edition)

> The currently recommended minimum size for DH parameters is 2048 bits. Anything equal or below 1024 is considered insecure.

Okay, so let’s take a look at the DH key by using an older version of Debian:

```plaintext
docker run --rm -it debian:stretch
apt update && apt install -y openssl
openssl s_client -connect secure.emailsrvr.com:465 | grep "Server Temp Key"

```

Yeah, the DH key is definitely too small:

```plaintext
Server Temp Key: DH, 1024 bits

```

I’d say that’s something for Rackspace to fix. As a workaround, you should be able to edit `/etc/ssl/openssl.cnf` and remove the `CipherString = DEFAULT@SECLEVEL=2` at the end of the file. Sidekiq should pick up the new OpenSSL settings after restarting the container.

---

_[View the full topic](https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992)._