# Getting Vulnerability for the Elastic 9200 SSL/TLS

**URL:** <https://forum.opensearch.org/t/getting-vulnerability-for-the-elastic-9200-ssl-tls/7462>\
**Category:** Open Source Elasticsearch and Kibana\
**Tags:** security-issue\
**Created:** [October 28, 2021, 4:02pm UTC](https://forum.opensearch.org/t/getting-vulnerability-for-the-elastic-9200-ssl-tls/7462 "2021-10-28T16:02:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![wazuhsai](https://avatars.discourse-cdn.com/v4/letter/w/dec6dc/32.png) [@wazuhsai](https://forum.opensearch.org/u/wazuhsai)\
**Post date:** [October 28, 2021, 4:02pm UTC](https://forum.opensearch.org/t/getting-vulnerability-for-the-elastic-9200-ssl-tls/7462/1 "2021-10-28T16:02:51Z")

</div>

Hello ,

I am using the Elasticsearch version 7.10.2 .For security assessment we have scanned with the Green bone Vulnerability scanner,but after scanning getting with the SSL.TLS as

SSL/TLS: Diffie-Hellman Key Exchange Insufficient DH Group Strength Vulnerability

Any suggestion ,how to overcome this vulnerability.

Thanks,

![Screenshot_3](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/88cc2b6490f1229b68589696ef286cc76e6755ea.jpeg)

 ![Screenshot_2](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/8061f1901841ce9b7bd1867aabd0ad035f8bb1e8.jpeg)

---

<div class="post-metadata">

**Author:** ![ralph](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/ralph/32/1194_2.png) [@ralph](https://forum.opensearch.org/u/ralph)\
**Post date:** [October 28, 2021, 4:42pm UTC](https://forum.opensearch.org/t/getting-vulnerability-for-the-elastic-9200-ssl-tls/7462/2 "2021-10-28T16:42:04Z")

</div>

i would presume that this is related to the key(s) you’re using for TLS - you’ll need to generate a key with a bigger key size (or use something other than DH, e.g. elliptic curves) and use that?

---

<div class="post-metadata">

**Author:** ![wazuhsai](https://avatars.discourse-cdn.com/v4/letter/w/dec6dc/32.png) [@wazuhsai](https://forum.opensearch.org/u/wazuhsai)\
**Post date:** [October 28, 2021, 5:11pm UTC](https://forum.opensearch.org/t/getting-vulnerability-for-the-elastic-9200-ssl-tls/7462/3 "2021-10-28T17:11:38Z")

</div>

Thanks for reply,

Here i am using the following commands to create the certs for elasticsearch

mkdir /etc/elasticsearch/certs

cd /etc/elasticsearch/certs

curl -so ~/search-guard-tlstool-1.8.zip [https://maven.search-guard.com/search-guard-tlstool/1.8/search-guard-tlstool-1.8.zip](https://maven.search-guard.com/search-guard-tlstool/1.8/search-guard-tlstool-1.8.zip)

unzip ~/search-guard-tlstool-1.8.zip -d ~/searchguard

curl -so ~/searchguard/search-guard.yml [https://raw.githubusercontent.com/wazuh/wazuh-documentation/4.0/resources/open-distro/searchguard/search-guard-aio.yml](https://raw.githubusercontent.com/wazuh/wazuh-documentation/4.0/resources/open-distro/searchguard/search-guard-aio.yml)

~/searchguard/tools/sgtlstool.sh -c ~/searchguard/search-guard.yml -ca -crt -t /etc/elasticsearch/certs/  
By the above process the certs for elasticsearch is creating ,here which file we need to changes the keysize to bigger.

If possible can you please provide some example/ref link to check on it

Thanks…