title: DH ServerKeyExchange does not comply to algorithm constraints
body: <p>We recently upgraded one of our tools (uses java implementation) and it now has a hard time connecting to one of our company internal endpoints. For other endpoints it works fine. Lets say the endpoint against which it doesn't work is xyz.abc.com
  The error we see each time is</p>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>javax.net.ssl.SSLHandshakeException: DH ServerKeyExchange does not comply to algorithm constraints
          at sun.security.ssl.Alert.createSSLException(Alert.java:131)
          at sun.security.ssl.Alert.createSSLException(Alert.java:117)
          at sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
          at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
          at sun.security.ssl.TransportContext.fatal(TransportContext.java:258)
          at sun.security.ssl.DHServerKeyExchange$DHServerKeyExchangeConsumer.consume(DHServerKeyExchange.java:540)
          at sun.security.ssl.ServerKeyExchange$ServerKeyExchangeConsumer.consume(ServerKeyExchange.java:111)
          at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377)
          at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
          at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422)
          at sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
          at sun.security.ssl.SSLTransport.decode(SSLTransport.java:149)
          at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1143)
          at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1054)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:394)
          at sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:708)
          at sun.security.ssl.SSLSocketImpl.access$100(SSLSocketImpl.java:72)
          at sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:961)
          at sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:933)</code></pre>
  </div>
  </div>
  
  I followed the suggestions under :-</p>
  <p><a href="https://stackoverflow.com/questions/52419688/what-does-reason-dhpublickey-does-not-comply-to-algorithm-constraints-mean">What does &quot;Reason: DHPublicKey does not comply to algorithm constraints&quot; mean?</a></p>
  <p>However that didn't seem to work.</p>
  <p>Since this issue is prevalent now only after our upgrade of the tool and we wonder if it could be due to newer jvm security restrictions being enforced,is there anything we could possibly pass as jvm argument or may be just modify under the java.security file or elsewhere to fix this annoying error.We do not want to change anything on the certificates used by that endpoint.
  I am a novice in cryptography and hence any help or suggestions here would be greatly appreciated as always.</p>