Commit 5fdd3f4
doc: fix description of TLS dhparam option
The dhparam option is not required for perfect forward secrecy in
general. It is only required for non-ECDHE secrecy, but ECDHE-based
secrecy is generally preferred anyway.
PR-URL: #46949
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Filip Skokan <panva.ip@gmail.com>1 parent ba5ff15 commit 5fdd3f4
1 file changed
Lines changed: 3 additions & 2 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1880,12 +1880,13 @@ changes: | |||
| 1880 | 1880 | client certificate. | |
| 1881 | 1881 | * `crl` {string|string\[]|Buffer|Buffer\[]} PEM formatted CRLs (Certificate | |
| 1882 | 1882 | Revocation Lists). | |
| 1883 | - * `dhparam` {string|Buffer} Diffie-Hellman parameters, required for | ||
| 1883 | + * `dhparam` {string|Buffer} Diffie-Hellman parameters, required for non-ECDHE | ||
| 1884 | 1884 | [perfect forward secrecy][]. Use `openssl dhparam` to create the parameters. | |
| 1885 | 1885 | The key length must be greater than or equal to 1024 bits or else an error | |
| 1886 | 1886 | will be thrown. Although 1024 bits is permissible, use 2048 bits or larger | |
| 1887 | 1887 | for stronger security. If omitted or invalid, the parameters are silently | |
| 1888 | - discarded and DHE ciphers will not be available. | ||
| 1888 | + discarded and DHE ciphers will not be available. [ECDHE][]-based [perfect | ||
| 1889 | + forward secrecy][] will still be available. | ||
| 1889 | 1890 | * `ecdhCurve` {string} A string describing a named curve or a colon separated | |
| 1890 | 1891 | list of curve NIDs or names, for example `P-521:P-384:P-256`, to use for | |
| 1891 | 1892 | ECDH key agreement. Set to `auto` to select the | |
0 commit comments