Use SSLOpenSSLConfCmd to specify DHParameters in Apache 2.4?

[tomsommer]

It seems you can do SSLOpenSSLConfCmd DHParameters "/etc/ssl/certs/dhparam.pem" with Apache 2.4.8+ and OpenSSL 1.0.2+

[tomato42]

why we should do that?
AFAIK, it's just a wrapper around the old API (talking about OpenSSL)

[tomsommer]

It's easier when wanting do a serverwide configuration. Appending to the cert-chain is a pain as it has to be done per-certificate, and also harder if you already have an existing certificate in place.

This more mirrors the nginx way of doing it.

[tomato42]

but then apache since 2.4.7 does select the DH parameters based on the size of the RSA key, so this applies only to the situation when you need to use 1024 bit parameters... which is a niche configuration

[tomsommer]

Fair point. Just wanted to highlight the feature. Good to attach an reason to it.