tree fa565c395a66d09eaf2e03371aca293776f6d8a9
parent b7f1cfc8463382fdb230b537bf297f1ce4854d49
author Remi Gacogne <rgacogne[at]aquaray[dot]fr> 1402577920 +0200
committer Willy Tarreau <w@1wt.eu> 1402582343 +0200
encoding latin1

MEDIUM: ssl: Add the option to use standardized DH parameters >= 1024 bits

When no static DH parameters are specified, this patch makes haproxy
use standardized (rfc 2409 / rfc 3526) DH parameters with prime lenghts
of 1024, 2048, 4096 or 8192 bits for DHE key exchange. The size of the
temporary/ephemeral DH key is computed as the minimum of the RSA/DSA server
key size and the value of a new option named tune.ssl.default-dh-param.