4 ms·
Can you link to a config example for nginx for what you’re describing in your first paragraph? Or a web framework in any language? I’ve never seen that done bef
by coder543 6y ago
Can you link to a config example for nginx for what you’re describing in your first paragraph? Or a web framework in any language? I’ve never seen that done before, where the DH shares don’t match the certificate type. But, I’m definitely not an expert on the low level details of TLS.
- wolf550e 6y agoAll your DH shares don't match the certificate type already because you use ECDH with either NIST P-256 or X25519 and you likely use an RSA certificate. The two asymmetric systems (one for key exchange and one for authentication) have nothing to do with each other, you can mix and match them freely (e.g. post-quantum key exchange experiments ran by google and cloudflare). The nginx config to specify the curve (using its openssl name) is this: https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_ecdh_curve https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_...