I want to increase the security of my Tomcat and to configure diffie-hellman module size 2048. I want to add to my CATALINA_OPTS -Djdk.tls.ephemeralDHKeySize=2048 What happens if I have configured it 2048 but the Tomcat SSL key has size 1024?

Will handshake success?

Will server start?


The certificate key size is 1024.

  • DH is used for generation of session keys, so when you open a new session it'll use 2048 bits key . Would it work? I wouldn't be so comfortable because it can use shared public parameters of RSA SSL certificate. Or client should send new information of DH public parameters to the server. Also it's confusing when two sizes of RSA keys are used.
    – VovCA
    Commented Jun 12, 2018 at 21:04
  • Are you talking about the DH modulus size being 1024 or the certificate being 1024?
    – forest
    Commented Jun 13, 2018 at 1:56
  • The certificate key size is 1024
    – Michael
    Commented Jun 13, 2018 at 14:06

1 Answer 1


Note that increasing DH bit size to 2048-bit means that the DH public key will be 2048-bit.

Now the server has to make a digital signature on the public key of 2048-bit. You are using a 1024bit private key to do this. The DH key is hashed and signed by your 1024-bit key (i.e: RSA). The hash function shrinks data to fit on a target size.

Sounds good to me. Furthermore, in every exchange the DH public key will be different, since it's using an ephemeral scheme.

  • I will happy for the clarification. The certificate key size is 1024, therefore I guess its public key is 1024 bit. Will it work?
    – Michael
    Commented Jun 13, 2018 at 14:09
  • They key contained in the certificate is a 1024-bit public key thus the private key is 1024-bit too. The DH public key is 2048-bit but signing with it with your 1024-bit private key Will yield a 1024-bit signature, I think is pretty clear.
    – kub0x
    Commented Jun 13, 2018 at 15:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .