I need a openssl generated diffie-hellman params for work with ECDHE or DHE cipher suites on TLSv1.2 nginx server?
openssl dhparam 2048, wait, write output to file. Use file in ssl_dhparam in nginx config.
No need to keep the file secret like a private key, your server will output the content of the file to any client that supports DHE. You can reuse the file for many servers.
It is considered more secure to use custom params than to use those from an RFC, because the adversary can pre-compute breaking the params from the RFCs and then spend little compute per connection to decrypt your connections. In theory. 2048 bit params should be secure.
Use same params file with postfix's confusingly named smtpd_tls_dh1024_param_file if you have postfix server.
Apache doesn't need to configure DHE params.
Chrome, Golang and boringssl don't support DHE anymore, so no need to configure params for servers using Go or boringssl (e.g. Caddy, Envoy).
AWS ELB don't support DHE.
You can just not support DHE at all and then you don't need to configure params.
ECDHE doesn't need params. I would limit ECDHE to only X25519 and NIST P-256, but whatever.