diff --git a/src/rpc/virnettlscontext.c b/src/rpc/virnettlscontext.c
index 3b6687e7f4..55da485f96 100644
--- a/src/rpc/virnettlscontext.c
+++ b/src/rpc/virnettlscontext.c
@@ -38,8 +38,6 @@
 #include "virthread.h"
 #include "configmake.h"
 
-#define DH_BITS 2048
-
 #define LIBVIRT_PKI_DIR SYSCONFDIR "/pki"
 #define LIBVIRT_CACERT LIBVIRT_PKI_DIR "/CA/cacert.pem"
 #define LIBVIRT_CACRL LIBVIRT_PKI_DIR "/CA/cacrl.pem"
@@ -718,6 +716,15 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
      * security requirements.
      */
     if (isServer) {
+        unsigned int bits = 0;
+
+        bits = gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH, GNUTLS_SEC_PARAM_MEDIUM);
+        if (bits == 0) {
+            virReportError(VIR_ERR_SYSTEM_ERROR, "%s",
+                           _("Unable to get key length for diffie-hellman parameters"));
+            goto error;
+        }
+
         err = gnutls_dh_params_init(&ctxt->dhParams);
         if (err < 0) {
             virReportError(VIR_ERR_SYSTEM_ERROR,
@@ -725,7 +732,7 @@ static virNetTLSContext *virNetTLSContextNew(const char *cacert,
                            gnutls_strerror(err));
             goto error;
         }
-        err = gnutls_dh_params_generate2(ctxt->dhParams, DH_BITS);
+        err = gnutls_dh_params_generate2(ctxt->dhParams, bits);
         if (err < 0) {
             virReportError(VIR_ERR_SYSTEM_ERROR,
                            _("Unable to generate diffie-hellman parameters: %s"),