<html><head></head><body><div class="ydpa9a80ba2yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:13px;"><div></div>
<div>That's in the config already. Other ideas?</div><div><br></div>
</div><div id="yahoo_quoted_8986345460" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Thursday, January 31, 2019, 6:13:21 PM EST, Paul Wouters <paul@nohats.ca> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">On Thu, 31 Jan 2019, Mr. Jan Walter wrote:<div class="yqt4883214152" id="yqtfd87403"><br clear="none"><br clear="none">> A couple of differences with the machine certificate installation and how the system actually picks them up, <a shape="rect" ymailto="mailto:userid@zzz.net" href="mailto:userid@zzz.net">userid@zzz.net</a><br clear="none">> makes extra double sure the machine can find the right client cert.<br clear="none">> <br clear="none">> Set the registry DWORD for 2048 DH sets and now I get a policy error and NO_PROPOSAL_CHOSEN on re-key.</div><br clear="none"><br clear="none">That is a known windows bug, try ms-dh-downgrade=yes<br clear="none"><br clear="none">Paul<div class="yqt4883214152" id="yqtfd48226"><br clear="none"></div></div></div>
</div>
</div></body></html>