tree af5f7cb55e096bfccbb679038eb75efce599b052
parent 43041aaefd5d42092021161539c861894fbcfdc1
author Remi Tricot-Le Breton <rlebreton@haproxy.com> 1649755914 +0200
committer William Lallemand <wlallemand@haproxy.org> 1650468652 +0200

MINOR: ssl: Use DH parameters defined in RFC7919 instead of hard coded ones

RFC7919 defined sets of DH parameters supposedly strong enough to be
used safely. We will then use them when we can instead of our hard coded
ones (namely the ffdhe2048 and ffdhe4096 named groups).
The ffdhe2048 and ffdhe4096 named groups were integrated in OpenSSL
starting with version 1.1.1. Instead of duplicating those parameters in
haproxy for older versions of OpenSSL, we will keep using our own
parameters when they are not provided by the SSL library.
We will also need to keep our 1024 bits DH parameters since they are
considered not safe enough to have a dedicated named group in RFC7919
but we must still keep it for retrocompatibility with old Java clients.

This request was described in GitHub issue #1604.