# RSA key size 1024 bits is too small: key exchange failed

- **ID:** `security/weak-rsa-key-size-rejected`
- **Domain:** security
- **Category:** config_error
- **Error Code:** `SSL_R_WRONG_RSA_KEY_SIZE`
- **Verification:** ai_generated
- **Fix Rate:** 92%

## Root Cause

The RSA key is only 1024 bits, which is below the minimum recommended size (2048 bits) and is rejected by security policies.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| OpenSSL 1.1.1 | active | — | — |
| OpenSSL 3.0 | active | — | — |
| Java 8 | active | — | — |
| Java 11 | active | — | — |
| Nginx 1.20 | active | — | — |

## Workarounds

1. **Generate a new RSA key with 2048 or 4096 bits. OpenSSL: `openssl genrsa -out newkey.pem 2048` then reissue the certificate.** (95% success)
   ```
   Generate a new RSA key with 2048 or 4096 bits. OpenSSL: `openssl genrsa -out newkey.pem 2048` then reissue the certificate.
   ```
2. **If you control the client, configure it to allow 1024-bit keys only for testing, e.g., Java: `-Djava.security.properties=...` to relax policy, but avoid in production.** (30% success)
   ```
   If you control the client, configure it to allow 1024-bit keys only for testing, e.g., Java: `-Djava.security.properties=...` to relax policy, but avoid in production.
   ```
3. **Use ECDSA keys (e.g., P-256) instead, which provide equivalent security with smaller key sizes: `openssl ecparam -genkey -name prime256v1 -out eckey.pem`.** (85% success)
   ```
   Use ECDSA keys (e.g., P-256) instead, which provide equivalent security with smaller key sizes: `openssl ecparam -genkey -name prime256v1 -out eckey.pem`.
   ```

## Dead Ends

- **** — Increasing the key size on the server without regenerating the certificate doesn't work; the certificate is separate from the key. (80% fail)
- **** — Setting the cipher suite to a different RSA variant doesn't change the key size requirement. (60% fail)
- **** — Disabling the security policy globally is not recommended and often fails due to other compliance checks. (50% fail)