I'm trying to stop a server using Diffie Hellman algorithms of less than 2048 bits ..but I'm getting confusing results

I've run

Get-TlsCipherSuite | Format-Table Name, Exchange, Cipher, Hash, Certificate

and I can see



......all of which I know to use only 1024 bits

I've run IIS crypto 3.2 and set the DHE minimum Key Length to 2048 and rebooted...but I can still see the 4 cipher suites above when I run the Get-TlsCipherSuite command.... Is IIS crypto actually doing what I want it to do? Am I missing something?..am I misunderstanding something? any help gratefully received


  • 1
    $\begingroup$ This sounds like a question about software configuration. You'll probably have better like in an IIS forum or maybe ServerFault. $\endgroup$
    – bmm6o
    May 5 at 15:54
  • $\begingroup$ it does say "Cryptography" at the top of this website $\endgroup$
    – Mick8695
    May 5 at 17:31

1 Answer 1


In the TLS protocol, the group size is not tied to the ciphersuite (in TLS 1.2, whether you use a group at all is; however the size is not). That is, there is no specific reason why insisting on a 2048 bit group size (which is quite sensible) should disable the listed ciphersuites.

Now, it's possible that whatever software you're running does tie them together. However, unless you specifically know that's the case, I wouldn't assume that...

  • $\begingroup$ Hi, do you know of a way that I could prove that I am not still using Diffie -Hellman less than 2048 bits? I've researched the internet , used nmap/zenmap and Diffie-Hellman sizes of 1024 are still showing in there...whether the server is actually using them or not..I just don't know. $\endgroup$
    – Mick8695
    May 5 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.