You can't. It hard codes 1024 bit parameters, which is highly annoying. There's a patch to allow user-specified DH parameters but it hasn't been merged: http

You can't. It hard codes 1024 bit parameters, which is highly annoying. There's a patch to allow user-specified DH parameters but it hasn't been merged: https://issues.apache.org/bugzilla/show_bug.cgi?id=49559 https://issues.apache.org/bugzilla/show_bug.cgi?id=49559 I would just go with elliptic curve Diffie Hellman (which unfortunately requires Apache 2.4) and then disable the non-EC Diffie Hellman ciphers if you're concerned about using 1024 bit DH. FWIW, nginx is a lot more flexible in configuring the cryptography.