Weak Deffie-Hellman and a B rating in SSL Labs Test

calendar2020-06-07 · 1 min read · sslcert tlscert csr deffie-hellman ssllabs troubleshoot  ·
Share on: linkedincopy

You can fix it by creating .a 'dhparam' file as follows in nginx:

1cd /etc/ssl/certs
2openssl dhparam -dsaparam -out ./dhparam.pem 4096

NOTE: "-dsaparam" is significant. Otherwise, it would take creation of dhparam.pem almost 24hours or more. See https://security.stackexchange.com/questions/95178/diffie-hellman-parameters-still-calculating-after-24-hours

then add this to nginx config

1ssl_dhparam /etc/ssl/certs/dhparam.pem;