When creating Diffie Hellman parameters for OpenSSH, there's a two-step process which looks like this to generate and filter secure primes for Diffie Hellman key exchange:

ssh-keygen -b 4096 -G dh4096-insecure
ssh-keygen -f dh4096-insecure -T dh4096

When reading the OpenVPN documentation, they recommend generating DH parameters like so:

openssl dhparam 2048 -out dh2048.pem

Is there a way to filter these primes for safety before using them with OpenVPN?

2 Answers 2


OpenSSL does filter the primes it generates and then outputs a single one.

You should just not use the -dsaparam option.

Source: manpage


A safe prime p is a prime such that p = 2 q + 1, with q also a prime. Actually, there are two ways to find safe primes: one is to generate a prime (that is, a random number, and apply a primality test to its uneven successors) p ; then calculate q = (p - 1)/2 and do a second primality test on q.

However, one can also generate first a prime q (random number, and primality test on uneven successors), calculate p = 2 q + 1, and do a primality test on p.

If both primality tests are reliable, I would think that both procedures are equivalent. I don't know what procedure is more prone to "doctored non-safe primes". In any case, one can easily do such generation one-self.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .