Generating DH parameters is as expensive as generating an RSA key pair. It was never too expensive to generate DH parameters for your server, once, or every res

Generating DH parameters is as expensive as generating an RSA key pair. It was never too expensive to generate DH parameters for your server, once, or every restart, or daily. It still is too expensive to generate DH parameters per-connection. If Apache always did what it does now (generate new DH params on service start, of the same size as the RSA key), it would have been secure and not computationally expensive for anyone except embedded platforms that don't run Apache anyway. The client does not care whether the 1024 bit DH prime is common or not, so even if you have to use 1024 bit DH params, make sure they're new and that the NSA can probably crack them.