# SSL Error during OAuth2
**URL:** https://meta.discourse.org/t/ssl-error-during-oauth2/135257
**Category:** Self-hosting
**Created:** [6 בדצמבר, 2019, 12:20pm UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257 "2019-12-06T12:20:44Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Wurzelseppi](https://meta.discourse.org/u/Wurzelseppi)
#### Post date: [6 בדצמבר, 2019, 12:20pm UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/1 "2019-12-06T12:20:44Z")
This post
> [@Email SSL Errors after Update to 2.4.0.beta4](https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992):
>
> Since upgrading to 2.4.0.beta4, none of my installs that are using Rackspace for outgoing email have been able to send, well, outgoing email. Given that the outgoing email server is, again, Rackspace, I am going to presume that their SSL/TLS settings are correct (and, at any rate, they appear to work in every major email client). Perhaps [this thread](https://meta.discourse.org/t/mailings-do-not-work-anymore-due-to-ssl-errors/128165/3) is related. Although, after applying recent updates (I am unsure as to precisely which change), the error is no longer the same as that mentioned i…
about it has been closed, but I still encounter this problem in version
2.4.0.beta8
It´s happening during oauth2 authentication
```
Excon::Error::Socket (SSL_connect returned=1 errno=0 state=error: dh key too small (OpenSSL::SSL::SSLError))
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/ssl_socket.rb:125:in `connect_nonblock'
```
Last 14 lines of backtrace:
```
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/ssl_socket.rb:125:in `connect_nonblock'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/ssl_socket.rb:125:in `initialize'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/connection.rb:455:in `new'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/connection.rb:455:in `socket'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/connection.rb:116:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/middlewares/mock.rb:56:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/middlewares/instrumentor.rb:34:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/middlewares/idempotent.rb:19:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/middlewares/base.rb:22:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/middlewares/base.rb:22:in `request_call'
/var/www/discourse/vendor/bundle/ruby/2.6.0/gems/excon-0.64.0/lib/excon/connection.rb:270:in `request'
/var/www/discourse/plugins/discourse-oauth2-basic/plugin.rb:127:in `fetch_user_details'
/var/www/discourse/plugins/discourse-oauth2-basic/plugin.rb:164:in `after_authenticate'
/var/www/discourse/app/controllers/users/omniauth_callbacks_controller.rb:37:in `complete'
```
Cheers,
Julian
---
### Author:  [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [6 בדצמבר, 2019, 12:41pm UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/2 "2019-12-06T12:41:22Z")
> [@Wurzelseppi](#):
>
> dh key too small (OpenSSL::SSL::SSLError)
It doesn’t affect email in this case, but the explanation I gave in the topic you linked stays the same. The connection to the OAuth2 server fails because the DH key is too small and therefore considered insecure by OpenSSL.
You can apply the following temporary workaround, but increasing the DH key size on the OAuth2 server is the only solution.
> [@Email SSL Errors after Update to 2.4.0.beta4](https://meta.discourse.org/t/email-ssl-errors-after-update-to-2-4-0-beta4/128992/11):
>
> As a workaround, you should be able to edit `/etc/ssl/openssl.cnf` and remove the `CipherString = DEFAULT@SECLEVEL=2` at the end of the file. Sidekiq should pick up the new OpenSSL settings after restarting the container.
---
### Author:  [@Wurzelseppi](https://meta.discourse.org/u/Wurzelseppi)
#### Post date: [6 בדצמבר, 2019, 12:47pm UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/3 "2019-12-06T12:47:15Z")
sorry, I forgot … now the bad thing … it doesn´t work for me anymore …
I made the mentioned changes to /etc/ssl/openssl.cnf
> [system\_default\_sect]
> MinProtocol = TLSv1.2
> #CipherString = DEFAULT@SECLEVEL=2
Then i left the container and did a
docker restart app
Afterwards I still got the same error in error logs
---
### Author:  [@Wurzelseppi](https://meta.discourse.org/u/Wurzelseppi)
#### Post date: [9 בדצמבר, 2019, 6:58am UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/4 "2019-12-09T06:58:04Z")
Didn´t say the truth, sorry… there error is not the same now:
> Faraday::ConnectionFailed (Connection reset by peer - SSL\_connect)
> /usr/local/lib/ruby/2.6.0/net/protocol.rb:44:in `connect\_nonblock’
---
### Author:  [@Wurzelseppi](https://meta.discourse.org/u/Wurzelseppi)
#### Post date: [9 בדצמבר, 2019, 7:20am UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/5 "2019-12-09T07:20:03Z")
Very strange ☹ … I just tried it again, and again this
> “Oops, The software powering this discussion forum encountered an unexpected problem. We apologize for the inconvenience…”
came up … Then I “F5”´ved a few times (out of frustration 🙂 ) and suddenly the screen changed to
> Sorry, there was an error authorizing your account. Please try again.
Then I had to log in again over my oauth2 provider log in site, and then came the “Ops ..” again, and after another F5 I was in …
Uhmm… either I found a serious security problem, or it´s just about timing …
Probably the latter …
What timeouts are there, that I could try to adjust ?
Thanks and cheers!
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [18 בספטמבר, 2023, 11:05am UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/6 "2023-09-18T11:05:36Z")
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [21 בספטמבר, 2023, 8:55pm UTC](https://meta.discourse.org/t/ssl-error-during-oauth2/135257/7 "2023-09-21T20:55:53Z")