Is it possible to create a diffie-hellman param .pem file to force the openssl ctx to use only a certain type of dh exchange. For example, I know that it can be used to set the length of the dh key, but what about the type?

1 Answer 1


No. The type of exchange is set by the cipher suite, which agreed upon by the client and server during the handshake. As such you cannot specify, say, DHE vs. ECDHE in the DH parameters file. If you want to control that you should configure the supported cipher suites and the preferred cipher suite order on your server.

  • ... through TLS1.2. In 1.3 keyexchange is now separated from the ciphersuite and controlled directly by the supported_groups and key_share extensions -- but in 1.3 non-EC DHE must use only standardized groups (from rfc7919) so the concept of a DH parameters file becomes moot. Mar 8, 2019 at 6:54
  • @dave_thompson_085 Good point.
    – Polynomial
    Mar 8, 2019 at 10:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .