> get a new certificate without it? The certificate isn't what control PFS, it's the allowed (and preferred) cipher suites. You can enable PFS without changin

> get a new certificate without it? The certificate isn't what control PFS, it's the allowed (and preferred) cipher suites. You can enable PFS without changing your cert.