That file has no dependency on any certificate or private key. It is not secret either. It can even be shared between various servers that don't necessarily trust or even know each other.
dh1024.pem file contains Diffie-Hellman parameters. The DH key exchange is an algorithm played in a given finite group; namely, integers modulo a prime p. For a successful DH:
- There are known parameters p (a big prime) and g (a conventional integer in the 2 to p-2 range, known as the generator).
- Party A generates a random secret value a, computes ga mod p, and sends that to party B.
- Party B generates a random secret value b, computes gb mod p, and sends that to party A.
- Party A computes (gb)a mod p (raising the value received from B to its secret exponent a).
- Party B computes (ga)b mod p (raising the value received from A to its secret exponent b).
The magic of DH is that both A and B end up with the same value, that eavesdropper cannot recompute from the two values that were sent across the wires.
In all of this, the p and g values are the "parameters" and must be known to both parties; but they are not secret. Security is ensured as long as:
- p is large enough (at least 1024 bits; arguably, 2048 bits would be better).
- p was not generated with a "special structure" that makes discrete logarithm easier.
- g generates a subgroup of integers modulo p whose size is a multiple of a big enough prime (the order of g modulo p is the smallest integer r ≥ 1 such that gr mod p = 1; it is required that the greatest prime divisor of r has length at least 160 bits, preferably 256 bits or more).
The whole World could use the same parameters; but many people prefer to generate their own parameters, just to be sure that their parameters were not "cooked". This is what
build-dh does. The resulting file (
dh1024.pem) contains p and g, but nothing else. These values are not secret. They do not depend upon any external element, neither certificate, private key, or anything else.