6

I have set up nginx with ssl. Everything works perfectly, with online tools giving the domain a good score.

Now I am wondering about one particular nginx configuration option; ssl_dhparam. Should I generate and set these parameters? Does it have any influence on security or computational load of ssl?

3

Should I generate and set these parameters?

Yes.

Does it have any influence on [the] security...of ssl?

Yes, when enabling Perfect Forward Secrecy. An appropriate ciphersuite must also be configured.

If a future attacker compromises your TLS, with PFS past traffic they intercepted and retained still cannot be decrypted.

Generate a DHE prime no smaller than your SSL certificate RSA private key. Given a 2048 bit private key:

$ openssl dhparam -out dhparam.pem 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
..+..+...............+

Does it have any influence on [the]...computational load of ssl?

Too little to worry about.

Google I/O 2014 had a good HTTPS Everwhere talk which covered these and related topics in a broad fashion.

2

Diffie helman is a good algorithm for key exchange but it takes too much time for computation slowing your website down. I recommend using RC4-SHA which is weaker than DH but serve its purpose. If it helps, google.com uses RC4-SHA. You can check out the algorithm for any website using the following:

openssl s_client -host HOSTNAME -port 443

I suggest you check out what kind of key exchange and encryption other websites similar to yours are using and use a suitable algorithm.
Also read out this article on the same topic.

  • 1
    Perpetuating weaker security because of perceived costs is outdated and bad advice. – toolbear74 Aug 16 '14 at 22:38
  • This was bad advice from the start, and it's now factually incorrect. Running openssl s_client -host google.com -port 443 today gives: Protocol: TLSv1, Cipher: AES128-SHA – CAFxX Aug 26 '16 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.