I generated DH parameters and set at server side. it always select cipher suite DHE_RSA? Is there any reason that DH parameter have to set server side only.
Ephemeral DH: what is changed P and g every session ? or private key ?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Fixed DH means a DH certificate. Nobody uses this. You want DHE with RSA certificate. Actually, you want ECDHE over NIST P-256 for compatibility and X25519 for security and performance with modern browsers. New versions of Google Chrome don't support DHE.
If you use DHE (which I think your server should support), your server should generate safe params with same bit size as the RSA key in the certificate (generally 2048 bits). With nginx, you should use
openssl dhparam command to generate a file and
ssl_dhparam nginx configuration statement to point to that file. Other web servers and TLS terminators have different methods of generating safe DH params of appropriate size.