SSL Configuration Diffie-Hellman prime

[nestle2377]

Hi to all. I've an installation of keycloak on quark distribution. My security office during an audit has found that keycloak has this vulnerability:
Diffie-Hellman prime is less than 2048 bits.

I immagine that to configure 2048 bits is something related to quarkus environment.

Do you know how to fix it? is there some configurations?

thanks

[codespearhead]

@nestle2377 Is your Keycloak instance running behind a reverse proxy? If so, the reverse proxy deals with TLS/SSL whereas everything behind the reverse proxy doesn't, correct?

[codespearhead]

@nestle2377 Can you confirm the Keycloak version you're running and that you're serving it over HTTPS? Because that might have to do with a problem in an old Quarkus version (and therefore, an old Keycloak version).

[nestle2377]

keycloak version is 21.1.2, is this affected?
thanks!

[codespearhead]

@nestle2377 Keycloak 21.x uses Quarkus 2.13.8, which is affected by #21569 unlike Quarkus 3.2, which is the first LTS release of Quarkus.

(The Red Hat build of) Keycloak 22.x is the first LTS release of this project, and it uses Quarkus 3.2.

Hence, I suggest upgrading to at least version 22. Ideally you'd upgrade to the latest major version of Keycloak.

[nestle2377]

Thanks! All is clear! Thanks for your time.

[codespearhead]

You're welcome! If that solves your problem, can you mark this discussion as answered?