Add ability to override default DH_PARAM_SIZE of 2048

[panteparak]

I would like to add the ability to change the default Diffie-Hellman parameters of 2048 bits through the environment variable. This would allow DH Param to be future proof where the user would be able to pick a desired value such as 3072 or 4096 bits

[JrCs]

@XPLOT1ON what is your use case to need to change the number of bits for DH keys. It's already 2048 and give us a A+ grade on Qualsys SSL Server Test ?

[panteparak]

@JrCs Yes, 2048 does give A+ SSL raitings, but when I generate DH params, I would prefer for a bigger bit size such as 4096. and as mentioned before, if 2048 bit size is cracked (well, not very soon, I hope) a change to the DH param bit size can override the default value as needed.

[buchdag]

@XPLOT1ON > could you change the variable name to DHPARAM_BITS to mimic the one used by nginx-proxy for the same purpose ?

IMO, the input check shouldn't be described in the doc, and naming the variable DHPARAM_BITS has the advantage of being explicit about what should go there.

Speaking of input check openssl dhparam -out dhparam.pem 02048 works just fine, at least on the 0.9.8 I tried it with (and on the latest libressl too). So maybe the regex should just be '^[0-9]*$' to avoid triggering on a valid input.

The example should be with a non default value eg 1024 or 4096.

[JrCs]

Don't force the user to add DH_PARAM_SIZE environment variable. If not set the default must be 2048

[JrCs]

Don't force the user to add DH_PARAM_SIZE environment variable. If not set the default must be 2048

[panteparak]

Isn't ENV DH_PARAM_SIZE would be a default value for docker environment? User can override the bits size via compose or docker run. @JrCs

[JrCs]

I prefer not to depend of the content of the dockerfile.
Closer to the code is better.

[JrCs]

Add something like

: "${DH_PARAM_SIZE:=2048}"

to have a default value for DH_PARAM_SIZE variable

[buchdag]

@XPLOT1ON > let me know if you need help to complete this :)

[panteparak]

@buchdag sure. I've got sidetracked from completing this due to other commitment.

[buchdag]

@JrCs I think this is good to go now, awaiting your approval.