3 ms·
I use a similar directive in my apache2 configuration. Would I see an performance improvement in removing the DH option from the cipher suite? Or is this only d
by giberson 15y ago
I use a similar directive in my apache2 configuration. Would I see an performance improvement in removing the DH option from the cipher suite? Or is this only directly related to ngix and how it implements its ssl protocol?
Secondly, by removing the DH method do I restrict any browsers from connecting my site? Ie, are their any browsers, or security settings on browsers that prevent the site from being trusted if DH isn't available?
- blumentopf 15y agoIt's an openssl configuration option, so it does affect performance for Apache with mod_ssl. It's not specific to nginx. If you do not allow DH ciphers, you'll probably just lose users who deliberately configure their software to use only strong ciphers. What you can do is put DH ciphers at the end of the list. That way, weaker ciphers are preferred but you're still supporting strong ciphers.