Where is the default dhparam file used by the nginx web server after a fresh install of Debian 11?
Let's say I do a fresh install of nginx on Debian 11:
apt install nginx
And I do not have any ssl_dhparam options set
[root@debian11 /]# grep -irl ssl_dhparam /etc/nginx
[root@debian11 /]#
What is the default dhparam file in-use by my web server? How was it generated? And how big is it?
From the documentation for ssl_dhparam:
By default no parameters are set, and therefore DHE ciphers will not be used.
Prior to version 1.11.0, builtin parameters were used by default.
The commit which removed the builtin parameters and the justification for removing it, is here. The builtin 1024-bit key was:
-----BEGIN DH PARAMETERS-----
MIGHAoGBALu8LcrYRnSQfEP89YDpz9vZWKP1aLQtSwju1OsPs1BMbAMCducQgAxc
y7qokiYUxb7spWWl/fHSh6K8BJvmd4Bg6RqSp1fjBI9osHb302zI8pul34HcLKcl
7OZicMyaUDXYzs7vnqAnSmOrHlj6/UmI0PZdFGdX2gcd8EXP4WubAgEC
-----END DH PARAMETERS-----
which decodes to the following values:
prime:
00:bb:bc:2d:ca:d8:46:74:90:7c:43:fc:f5:80:e9:
cf:db:d9:58:a3:f5:68:b4:2d:4b:08:ee:d4:eb:0f:
b3:50:4c:6c:03:02:76:e7:10:80:0c:5c:cb:ba:a8:
92:26:14:c5:be:ec:a5:65:a5:fd:f1:d2:87:a2:bc:
04:9b:e6:77:80:60:e9:1a:92:a7:57:e3:04:8f:68:
b0:76:f7:d3:6c:c8:f2:9b:a5:df:81:dc:2c:a7:25:
ec:e6:62:70:cc:9a:50:35:d8:ce:ce:ef:9e:a0:27:
4a:63:ab:1e:58:fa:fd:49:88:d0:f6:5d:14:67:57:
da:07:1d:f0:45:cf:e1:6b:9b
generator: 2 (0x2)
BEGIN DH PARAMETERS line to END DH PARAMETERS line)? This was essentially the purpose of this question.
Commented
Oct 18, 2021 at 11:27