When setting up a web server with TLS support I've generated my dhparams with
openssl dhparam -C 2048 some.pem. I understand that the output in
some.pem are the parameters by which DH key exchange will be done and that they are by nature public values. With empirical testing it seems that I can rotate the dh parameters without clients programs complaining, but a few questions arise that I can't find answers to.
- If I rotate the parameters with some cadence is there any benefit to doing so?
- Is there any downside to rotation? ie could an attacker more easily masquerade as my web server?
Naively it seems that rotation of parameters would marginally increase security in the event that one particular set of parameters is compromised, but this seems unlikely. Does anyone have input on this?