# SSL: DH\_KEY\_TOO\_SMALL  in ACI module

**URL:** <https://forum.ansible.com/t/ssl-dh-key-too-small-in-aci-module/32423>\
**Category:** Ansible Project\
**Tags:** awx\
**Created:** [March 9, 2020, 4:33pm UTC](https://forum.ansible.com/t/ssl-dh-key-too-small-in-aci-module/32423 "2020-03-09T16:33:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ben\_Sikkens](https://avatars.discourse-cdn.com/v4/letter/b/85f322/32.png) [@Ben\_Sikkens](https://forum.ansible.com/u/Ben_Sikkens)\
**Post date:** [March 9, 2020, 4:33pm UTC](https://forum.ansible.com/t/ssl-dh-key-too-small-in-aci-module/32423/1 "2020-03-09T16:33:00Z")

</div>

Hi,

I ran into an issue after updating to Ansible 2.8.5 (in AWX 9.1.1)

This used to work in the previous version (Ansible 2.8.1, AWX 6.0.0.0)

I fixed some issues from the python 2 to 3 but this one eludes me.

I’m trying here to create a Bridge Domain

I can provide extra info tomorrow as the networking guys who maintain this project are already gone. So if you need any extra info please ask.

{  
“msg”: “Connection failed for [https://host.name/api/mo/uni/tn-VALUE/BD-BD\_000\_ACI\_test.json](https://host.name/api/mo/uni/tn-VALUE/BD-BD_000_ACI_test.json). Request failed: \<urlopen error [SSL: DH\_KEY\_TOO\_SMALL] dh key too small (\_ssl.c:877)\>”,  
“changed”: false,  
“invocation”: {  
“module\_args”: {  
“hostname”: “host.name”,  
“username”: “cw-user”,  
“password”: “VALUE\_SPECIFIED\_IN\_NO\_LOG\_PARAMETER”,  
“bd”: “BD\_000\_ACI\_test”,  
“arp\_flooding”: true,  
“l3\_unknown\_multicast”: “flood”,  
“enable\_routing”: true,  
“vrf”: “VALUE”,  
“tenant”: “VALUE”,  
“l2\_unknown\_unicast”: “flood”,  
“state”: “present”,  
“validate\_certs”: false,  
“host”: “host.name”,  
“output\_level”: “normal”,  
“timeout”: 30,  
“use\_proxy”: true,  
“use\_ssl”: true,  
“port”: null,  
“private\_key”: null,  
“certificate\_name”: null,  
“bd\_type”: null,  
“description”: null,  
“enable\_multicast”: null,  
“endpoint\_clear”: null,  
“endpoint\_move\_detect”: null,  
“endpoint\_retention\_action”: null,  
“endpoint\_retention\_policy”: null,  
“igmp\_snoop\_policy”: null,  
“ip\_learning”: null,  
“ipv6\_nd\_policy”: null,  
“limit\_ip\_learn”: null,  
“mac\_address”: null,  
“multi\_dest”: null,  
“gateway\_ip”: null,  
“scope”: null,  
“subnet\_mask”: null,  
“protocol”: “https”  
}  
},  
“ansible\_facts”: {  
“discovered\_interpreter\_python”: “/usr/libexec/platform-python”  
},  
“\_ansible\_no\_log”: false  
}

---

<div class="post-metadata">

**Author:** ![Ben\_Sikkens](https://avatars.discourse-cdn.com/v4/letter/b/85f322/32.png) [@Ben\_Sikkens](https://forum.ansible.com/u/Ben_Sikkens)\
**Post date:** [March 10, 2020, 8:33am UTC](https://forum.ansible.com/t/ssl-dh-key-too-small-in-aci-module/32423/2 "2020-03-10T08:33:32Z")

</div>

Hi All,

I found out how to test some things turns out there is indeed a certificate with a vulnerable DH Key.  
So this issue is solved.

- Ben

---

<div class="post-metadata">

**Author:** ![Peter\_Smallwood](https://avatars.discourse-cdn.com/v4/letter/p/839c29/32.png) [@Peter\_Smallwood](https://forum.ansible.com/u/Peter_Smallwood)\
**Post date:** [July 2, 2022, 9:52am UTC](https://forum.ansible.com/t/ssl-dh-key-too-small-in-aci-module/32423/3 "2022-07-02T09:52:35Z")

</div>

The solution for me was to increase the size of the HTTPS DH Param setting from default (1024) to 2048 on the ACI APIC Controller  
This setting is found under FabicPolicies\>Policies\>Pod\>ManagementAccess\>default