When creating Diffie Hellman parameters for OpenSSH, there's a two-step process which looks like this to generate and filter secure primes for Diffie Hellman key exchange:

ssh-keygen -b 4096 -G dh4096-insecure
ssh-keygen -f dh4096-insecure -T dh4096

When reading the OpenVPN documentation, they recommend generating DH parameters like so:

openssl dhparam 2048 -out dh2048.pem

Is there a way to filter these primes for safety before using them with OpenVPN?

2 Answers 2


OpenSSL does filter the primes it generates and then outputs a single one.

You should just not use the -dsaparam option.

Source: manpage


A safe prime p is a prime such that p = 2 q + 1, with q also a prime. Actually, there are two ways to find safe primes: one is to generate a prime (that is, a random number, and apply a primality test to its uneven successors) p ; then calculate q = (p - 1)/2 and do a second primality test on q.

However, one can also generate first a prime q (random number, and primality test on uneven successors), calculate p = 2 q + 1, and do a primality test on p.

If both primality tests are reliable, I would think that both procedures are equivalent. I don't know what procedure is more prone to "doctored non-safe primes". In any case, one can easily do such generation one-self.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.