HTTPS weak DH key exchange (1k only)

[dreamax 7]

Hi there,

 

your are using an 4096bit RSA certificate, this fine, but you rely on 1024bit key length for diffie-hellmann key exchange only.

That is far too little, you should use an much longer one. (eg. 4096bit):

 

 

openssl dhparam -out /path/to/your/certificates/dhparams.pem 4096

 

and tell Nginx to use it

ssl_dhparam /path/to/your/certificates/dhparams.pem;

[dreamax 7]

This problem has been fixed.