Generate Diffie-Hellman parameters

[alexlemann]

run: openssl dhparam -out dhparam.pem 4096 or maybe 2048?

and use it in nginx.conf: ssl_dhparam /path/to/dhparam.pem;

See:

• https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
• https://weakdh.org/sysadmin.html

[alexlemann]

@kmtracey

[kmtracey]

Hmm, that openssl dhparam command says when it starts "This is going to take a long time". Do we have any idea how long? I gather it is indeterminate but do we have some idea of realistically how long this will take? (I gave up my quick try after 12 minutes...)

[alexlemann]

Just took me an hour to run it with 4096

[dpoirier]

Only an hour?!

[mlavin]

1024 is the minimum that modern browsers are supposed to support. Most recommendations seem to state that 2048 is sufficient.

[dpoirier]

On my laptop, it took 18 minutes for 4096 bits, but only 69 seconds for 2048. 69 seconds still seems a bit long, but acceptable for something that only has to be done once on a system.

[vkurup]

caktus/margarita#62 is now tracking this.