Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have set up nginx with ssl. Everything works perfectly, with online tools giving the domain a good score.

Now I am wondering about one particular nginx configuration option; ssl_dhparam. Should I generate and set these parameters? Does it have any influence on security or computational load of ssl?

share|improve this question

Should I generate and set these parameters?


Does it have any influence on [the] security...of ssl?

Yes, when enabling Perfect Forward Secrecy. An appropriate ciphersuite must also be configured.

If a future attacker compromises your TLS, with PFS past traffic they intercepted and retained still cannot be decrypted.

Generate a DHE prime no smaller than your SSL certificate RSA private key. Given a 2048 bit private key:

$ openssl dhparam -out dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2

Does it have any influence on [the]...computational load of ssl?

Too little to worry about.

Google I/O 2014 had a good HTTPS Everwhere talk which covered these and related topics in a broad fashion.

share|improve this answer

Diffie helman is a good algorithm for key exchange but it takes too much time for computation slowing your website down. I recommend using RC4-SHA which is weaker than DH but serve its purpose. If it helps, uses RC4-SHA. You can check out the algorithm for any website using the following:

openssl s_client -host HOSTNAME -port 443

I suggest you check out what kind of key exchange and encryption other websites similar to yours are using and use a suitable algorithm.
Also read out this article on the same topic.

share|improve this answer
Perpetuating weaker security because of perceived costs is outdated and bad advice. – toolbear74 Aug 16 '14 at 22:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.