New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


How can I generate a DH key that is longer than the existing default key in PRTG?

Votes:

0

Your Vote:

Up

Down

As I can read in your blog article Logjam Vulnerability: PRTG Is Safe Since Version 14.4.12 (October 2014), PRTG uses pre-generated Diffie-Hellman (DH) parameters with a 1024-bit key by default. Is it possible to enhance this key, for example, to a 2048-bit key?

diffie-hellman encryption prtg security

Created on May 21, 2015 12:23:37 PM by  Gerald Schoch [Paessler Support]



3 Replies

Accepted Answer

Votes:

2

Your Vote:

Up

Down

This article applies to PRTG Network Monitor 14.4.2 or later

Modifying Key Length for Diffie-Hellman Parameters

PRTG comes with a high security standard that makes your network monitoring as secure as possible. All communication in PRTG is secured by SSL encryption where only the most secure ciphers are supported. We describe important security features of PRTG in the article What security features does PRTG include?

As of PRTG version 14.4.12, PRTG uses unique pre-defined Diffie-Hellman (DH) parameters with a 1024-bit key by default. This key length is sufficient for most scenarios, but if you want to enhance this key and generate a key that is longer than 1024-bits, you can do so as well. For example, you can manually generate a key with 2048-bits.

Creating a Longer Key for DH Parameters

Please follow the steps below to adjust the key length for Diffie-Hellman parameters:

  1. On your PRTG server, navigate to the \cert subfolder of your PRTG installation directory.
  2. Open the file generatedh.bat with a text editor. By default, it contains the following command: ..\openssl.exe dhparam -out dh.pem -2 1024 2> dh.log
  3. To create DH parameters with a 2048-bit key, replace 1024 with 2048 in generatedh.bat. When executed, this results in the file dh.pem with this key length.
  4. Please note that the longer the generated key is, the longer will it need to be generated. Because of this, we recommend that you temporarily use another output file for generatedh.bat. So, in the .bat file, change dh.pem to dh-long.pem, for example: ..\openssl.exe dhparam -out dh-long.pem -2 2048 2> dh.log
  5. Stop the PRTG core server.
  6. Change the name of the newly created file dh-long.pem to the original name dh.pem
  7. Start the PRTG core server.

Done! PRTG now uses DH parameters with a 2048-bit key.

Created on May 21, 2015 12:27:36 PM by  Gerald Schoch [Paessler Support]

Last change on May 21, 2015 2:53:54 PM by  Martina Wittmann [Paessler Support]



Votes:

1

Your Vote:

Up

Down

Is this related with the generating PDF´s ?

Created on Apr 11, 2017 4:08:00 PM by  Giacometti (21) 1



Votes:

1

Your Vote:

Up

Down

Hi there,

Yes. In one of the lastest version we introduced ECC (Elliptic Curve Cryptography) and some older versions hadn't generated the DH.pem files yet.

Best regards.

Created on Apr 12, 2017 10:53:25 AM by  Dariusz Gorka [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.