-1

I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?

Improve this question
5
  • 1
    I'm not sure what you are asking. First, you don't need openssl generated params for ECDHE. Then you might use openssl generated params for DHE but you can also use the builtin predefined ones. No idea if this has actually answered your question.
    – Steffen Ullrich
    Dec 27, 2019 at 18:51
  • Please be more specific. Also describe what you have done so far and where you have difficulties.
    – mentallurg
    Dec 28, 2019 at 10:33
  • @SteffenUllrich so, i need generated params for DHE and not for ECDHE? i did some more research, ECDHE is generated at moment of connection, is this right?
    – NWStryker
    Dec 28, 2019 at 20:12
  • @mentallurg I am trying to understand and deploy ECDHE on my server, i have a root ca EC key, and a ECDSA certificate on server.
    – NWStryker
    Dec 28, 2019 at 20:15
  • @NWStryker: Since 1.11.0 nginx will no longer use default dhparam but you have to define your own if you want to use DHE (generate with openssl dhparam).. With ECDHE it will use a predefined set of curves but you can also use ssl_ecdh_curve to specify your own set. And it does not matter if you have an ECDSA or RSA certificate - both can be used with DHE and ECDHE key exchange.
    – Steffen Ullrich
    Dec 28, 2019 at 20:37

1 Answer 1

Reset to default
1

For DHE:

openssl dhparam 2048, wait, write output to file. Use file in ssl_dhparam in nginx config.

No need to keep the file secret like a private key, your server will output the content of the file to any client that supports DHE. You can reuse the file for many servers.

It is considered more secure to use custom params than to use those from an RFC, because the adversary can pre-compute breaking the params from the RFCs and then spend little compute per connection to decrypt your connections. In theory. 2048 bit params should be secure.

Use same params file with postfix's confusingly named smtpd_tls_dh1024_param_file if you have postfix server.

Apache doesn't need to configure DHE params.

Chrome, Golang and boringssl don't support DHE anymore, so no need to configure params for servers using Go or boringssl (e.g. Caddy, Envoy).

AWS ELB don't support DHE.

You can just not support DHE at all and then you don't need to configure params.

ECDHE doesn't need params. I would limit ECDHE to only X25519 and NIST P-256, but whatever.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .