TLS: custom DH parameters about icinga2

[Al2Klimov]

Things to consider

bash-3.2$ set -x; for b in 4096 3072 2048 1024 512; do time openssl dhparam -out `mktemp -d`/dhp $b; done
+ for b in 4096 3072 2048 1024 512
++ mktemp -d
+ openssl dhparam -out /var/folders/c2/k37yy5v51qzd5_rfrwd_sd7r0000gn/T/tmp.b5M8ivlD/dhp 4096
Generating DH parameters, 4096 bit long safe prime, generator 2
This is going to take a long time
...............................................................+......................................................................................................................................................................................................................................................................................................................................+..................................................................................................................................+........................................................................................................................................................................................+..............................................................................................................................................................................................................................................................................................................................................+................+......................+..............................................................................................................................................................................................................................................................+............................................................................................................................................................................................................................................................................................................+..........................+......................................................................................................................................................................................................................................+...............................................................................................................................................................+...........................+............................................................................................................................................................................................................................................................................................................................................................................................................................................+..................................................................................................................................................................+...........................................................+...............................................................................................................+...........................................+............................................................................................................+...........................+..................................................................................................................................................................................................................................................................................................................................................................................................................+.............+......................................................+.............................................................+.....................................................................................................+.............................................................................................................+....................................................................+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...............+.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+..............................+...............................................................................................................................................................................+.....................................................................................................................................................................................................................................................................................................................................................................................................+............................................................................................................................................................................................................................................................................................................+...............................................................................................................................................................+................................................................+.......................................................................................+...................................................................................+.....+...................................................................................................................................................+......................................................................................................................................................................................................................................................................................................................................................................................................................................+................................................................................................................................................................................................................................................................................................................................+................................................................................................................................................................................................................................................................................................................................................................................+.......................................................................+...........................................................................................................................................+......................................+........................................+.......................................................................................................................................................................................................+........+.................................................................................................+................................................................................................................................................+............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+..........................+.............+...........................................................................................................................................................................................................................................................................................................................+............................................................................................+...........+..............................................+..........................................................................+.............................................................................................................................................................................................+....................................................................................................+.................................................................................................................................................................................+............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...................................................................................................................................................................................................+..................................................................................+................................................................................................+..............................................................................................................................................................................................................................................................................................................+........................................................................................................................................................................................................+................................................................................................................................................+...............................................................................................................................................................................+...............................................................................................................................+......................................................................................................................+................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...................................................................................................+....................+.................................................................................................................+.......................................................+...............+.....................................................................................................+...........................................................................................................................+.........+.................+..........................................................................................................................+...........................................................+......+.....................................................................................................................................................................................+........................................................................................................................+................................................................................................+...................................................................................................................................................................................................+...........................................+.............................................................................................................................+..+.......................................................................................................+......................................................................+..................................................................................................................................................................................................................................................+..............................................................................................................................................................................................................................................+......................................................+.........................................................................................................................................................................................................................................................................................................................................................................................................+........................+.......+......................................+........................................................................................+............................................+...............................................................................................................+.........................................................................................................+.....................+..........................................................+.............................................................................................................................................................................................................................+.............................................................................................................................................................................................................................................+............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.....................................................................................................................................+.........................................................................................................................................................................................................+.....................................................................................................................................................................................................................................................................................................+.....................................................................+...................................................................................+.........................+............................................................................................................................................................................................................................+.....+................................................................................................................................................................................................................+...................+...........................................................................................................................................................................................................................................................+...........................................................................................................................................................................................................................+......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...............+................................+..............................................................................................................................................................................................................................................................+...................................................................................................................................................................................................................+..................+............................................................................................................................................................................................................................................................................................................+........................................................................................................................................+..............................................................................................................................................................................+.....................................................................+..........................................................................................+...................................................................+.......................................................................................................................+..............................................................................................................................+.............................................................................................................................................................................................................................................................................+.........................+.................................+................................................................................................+..............................+.................................................................................................................................+.......................................................................................+............................................................................................................................................................................................................................................................................................................................+...........................................................................................................+.+...............................................................................................................................................................................................................................................................................+.....................................................................+.....................................................................................................+............................................................................................................................................................................................................................................................................................................................................................................................+..................................................................................................................................................................................................................................................................................................................................................+.........+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...................................................................................................+...........................................................+.....................................+................................................................................................................................+.................................................................................................+..................................................................................................................................................................................................................................................................+..............................................................+..............................................................................................................................................................+.............................................................................................................................................................................................+......................................................................................................................................................................................................................................+....................................+..........................................................................................................................................................................................................................................................................................+..........................................................................................................................................................................+..........................................................................................................................................................................+.................................................+..............................................................................................................................................................................................................................................................................................................................................................................................+................................................................................................................................................................+...........+.........................+.............................................................................................................+...........................................................+..................................................................................................................................................................................................................................................................+...................................................................................................................................................................................................+...............................................................................................................................+...+.....+..........................................................................+...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+..........................+.....+.......................................................................................................................................................................................................................................................................................................................+......................................................................................................................................................................................................................................................................................................+.........................................................................................................+.................................................................................................................................................................+................................................................................................................................................................................................+..............................................................................................................................................................................................................................................................................................................................................................................+...........................................................................................................................+...............................................................................................+....................................................+.................+...................................................................................................................................+..................................................................................................................+......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.......................................................................................................................+.........+................................................................................................................................................................................................................................................................................................................................................................+................................................................................................................................+.......................................................................................................................................................................................................................................................................................................................................+.................+...........+..........................+...................................................................................................................................................................................................................................................................................................+...+................+...................................+.....................................................................+......................................................................................................+.........+....................................................................................................................................................................+.................................................................................................................+................................................................+....................................................................................................................+...................................................+...............................................................................................................................................................................................................................................................................................................................+................................+....................................................+...............+.....................................................................................................................................................................................................................................................................................................+...................................................................................................................................................................................+......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+...............................................................................................................+..................................................................................................................................................................................................................................................................................+...+......................................................................................................................................+............................................................................................+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.................................................................................................................................................................................................................................................+...............................+....................+................+...................................................................+...............................................................+....................................................................................................................................................................................................................................................................................................................+..........................................................................+............................+.......................................................................+.........................+................................................................................................................................................................+.....................................................................................................................................................................................................................................................+........................................................................................................................................................................................................................................................................................................+......................................................................................................................................................................................................................................................................+....+.................................................................+.................................................+..........................................................+...........................................................+.....................................................................+..+.+.............................................................................................................................................................................................................................................................................................................................................................+...............................................+..............................................................................................................................................................................................+......................................+.................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.......................................................................................................................................................................................................................................................................................................+...............................................................................................................................................................................................................................................................................................................................................+....................................................................................................................+..........................................................+..............................................................................................................................................................................................+........................................................................................................+........+.....+................................................................+............+..................................................................................................................................................................................................................................................................................................................................................................................................+..........................+....................................................+...................................................................+.......................................................................................................................................................................................................................................................................................................................................................................................................+.......................................................+.................................................................................................................................................................................................................................................................................+..............................................................................................................................................................................................................+....................................................+..................................................................................................................................................................................................................................................................................................................................+......................................................................................................................................................................................................................................+...................................................................................................................................................................................+........................................................................+.......................................................................................................................................+...................................................+..............................+......................................................+.........................................................................+..............................+..............................+......................................................+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................++*++*++*

real	27m30.612s
user	26m29.741s
sys	0m16.221s
+ for b in 4096 3072 2048 1024 512
++ mktemp -d
+ openssl dhparam -out /var/folders/c2/k37yy5v51qzd5_rfrwd_sd7r0000gn/T/tmp.VZ7cptiF/dhp 3072
Generating DH parameters, 3072 bit long safe prime, generator 2
This is going to take a long time
..............................................+........................................................................................................................................................................................................................................................................................................................+...................................................................................................................................+....................................................................................................................+.+...........................................................................................................................................................................+............+.................................................................................................................................+.............................................+..........................................................................................................................................................................+........................................................+...................................+........................................................................................................................................................................................................................................+............................................................................................................+..................+........................................................................................................................................................................................+.......................................................................................+.......................................................+.........................................................................................................................................+.......................................................................................................................................................................................................+.........+..........+...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+........................................................................................................................+..............................................................+..............................................................................................................................................................................................................................................................................................................+...................+....................................................................................................................................................................................+................................................+.................................................................+............................................................................................+...................+.....................................................................................................................................+................................................................+........................................................+......................................................+.....................................................................................+......................................................................+..............................................................................................................................................................................................................................................................................................................................................................................................+...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+............................+..+.......................................................................................................................................................................................................................................+................................................................................................................................+...............................................+..........................................................................................................................................................................................................+.............................................................................................................................................................................................................................................................................+...........................................................................................................................................................................................................................................................................................................................................................................................+.............................................+...........................................................................................................................................................+.........+.........................................................................................................................................................................+.....................+............................................................................................................................................................................+.................................+..................................................+....................................................................................................+................................................+............................................................................................................................................................................................................................................................................+..............................................................................................................................................................................................+..............................................................................................................................................................................................+.............................................................................................................................................................................................................................................................................................................................................................+.....................................+............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+......................................................................................................................................+..........+....................................................................................................+......................................................................................................................................................................+.+.........................................................................................................................................................................................................................+.........................................................................................................................................................................+.......................................................................................................................................+...............................................................+......................+...................................................................+.........................................+.....................+..............................................+.....................................................+..................................................................................................+.....................................................................................+........................................+............................................................................................................................................................+..............+........................................................................................................................+...................................................................................................................................................+.+.........................................................................................................................................+...........................................................................................................................................................................................................................................+....................................................................................................................+..............................................................................................................................................................................+.............................................+...........................................................................................................................................................................................................................................+......................+.....................................................................................................................+...................................................................................+........+.............................................................................................................................................................................................................................................+...............................................................................................................................................................+...................................+.............................+..........................................................................................................................................................................................................................................................................+...................................................................................................................................................................................................+........................................................................................................................................................................................................+.........................................................+..............................................................................................................................................................................................................................+.................................................................................................+...........................................................................................................................................................................................+...................................................................................................................................................................................................................................................................................+............................................................................................................+.............................................................................................................................................................................................+..........................................................................................................................................................................+..........................................................................................................................................................+....+..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+.....................................................+..................+................................................................................................................................................................................................................+................................................................................................................................................................+.......................................................................+...........................................................................................................................................................................................................+........................+.......................................................................................................................................+..........................................................................................+.....................+....................................................................................+...........................................................................................................+......................................................................................................................................................................+............................................................................................+..............................................................................................................................................................................................................+.....................................................................................................................................................................................................................................................................................................................................+..........................................................+................................................................................................+...................................................................................+...............................................................................................................................+.................................................................................................................................................+....................................................+..................++*++*++*++*

real	4m57.308s
user	4m51.402s
sys	0m2.457s
+ for b in 4096 3072 2048 1024 512
++ mktemp -d
+ openssl dhparam -out /var/folders/c2/k37yy5v51qzd5_rfrwd_sd7r0000gn/T/tmp.oMzosBgi/dhp 2048
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
......................................................................................+...............................................................+.........................................................................................................+.............................................................+.....................................................................................................................................................................................................................................................................+....................................+..................................................................................................................................................................................+................+.......+.................................................................................................................................................+.....................+................................................................................+................................................+.......................................................................................................................................................................................................................................................................................+.........................................................................................................................+....+..................................................................................................+.................................................................+.......................................................................................................................................................................+.....................+.......................................+.....................................................................+......+........................................................................................................................................................................................................................................................+..............................................................................................+...................................................................................................+.......+............................+.............................................................................................................................................................+..........+..............................................................................................................................+........................................................................+....................+.....+..............+...........................................................+................................+......................................................................................................................................................................................................................................................+........+.....................................................................................................+..................................................................+......................................+.....................+..................................................................................................+.........................................................................................+.............................................+..........+...............................................................................................+........................................................+.............................+.............++*++*++*++*

real	0m24.250s
user	0m23.922s
sys	0m0.159s
+ for b in 4096 3072 2048 1024 512
++ mktemp -d
+ openssl dhparam -out /var/folders/c2/k37yy5v51qzd5_rfrwd_sd7r0000gn/T/tmp.ZCFRf7tE/dhp 1024
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
..........................................................................................................+................................+....................................................+.+..................................................................+........................+.......................................................................................+.......................+.............................................................................+....................................................................................+.......................................................................+.................................................................+........+.....+......+..+................................................................+.............................................+...+.........................+..........+..................................+.....................+.........................................+.............................................................+......................................+..........+................+........................................+............................................................................................................................................................+...............................................................+..............................................+.......................................................................+...+..............+..................................+.................................................................+................................................................................................................................................................................................................................................+....................................+................+...............................................................+....+.......................................................................+.........+............................................................+................+.................................................................+.......................+.............+......+.....................................+............+..............................................................................................................+...............................+.....+............+..............................................+............................................+..................+..........+..........+..................................................................................................................................................................................................+................+......+...................................................+...........................+........+........................+............+...........................+.....................+.............................................................................+........................................................+....................................................+.........+.+...........................+.....................+...........+..........................................+...........................+.............................................................+.........................++*++*++*++*++*

real	0m4.871s
user	0m4.715s
sys	0m0.078s
+ for b in 4096 3072 2048 1024 512
++ mktemp -d
+ openssl dhparam -out /var/folders/c2/k37yy5v51qzd5_rfrwd_sd7r0000gn/T/tmp.fQNTVlIw/dhp 512
Generating DH parameters, 512 bit long safe prime, generator 2
This is going to take a long time
........+....+...+....+................+..............................................................+........+...........+..........+..........................+......+..............+.......+..................+..........+..........................+.......++*++*++*++*++*

real	0m0.132s
user	0m0.115s
sys	0m0.010s
bash-3.2$

[Al2Klimov]

Things to also consider

As generating DH parameters is extremely time consuming, an application should not generate the parameters on the fly. DH parameters can be reused, as the actual key is newly generated during the negotiation.

Typically applications should use well known DH parameters that have built-in support in OpenSSL. The macros SSL_CTX_set_dh_auto() and SSL_set_dh_auto() configure OpenSSL to use the default built-in DH parameters for the SSL_CTX and SSL objects respectively. Passing a value of 1 in the onoff parameter switches the feature on, and passing a value of 0 switches it off. The default setting is off.

– https://www.openssl.org/docs/man3.1/man3/SSL_CTX_set_dh_auto.html

[Al2Klimov]

Oh! They even have pre-computed 8k params: https://github.com/openssl/openssl/blob/986c48c4eb26861f25bc68ea252d8f2aad592735/ssl/t1_lib.c#L3370-L3402

[julianbrost]

Typically applications should use well known DH parameters that have built-in support in OpenSSL. The macros SSL_CTX_set_dh_auto() and SSL_set_dh_auto() configure OpenSSL to use the default built-in DH parameters for the SSL_CTX and SSL objects respectively.

Which is exactly what we do right now (at least if the OpenSSL version supports it):

icinga2/lib/base/tlsutility.cpp

Line 112 in 420db15

SSL_CTX_set_dh_auto(sslContext, 1);

Also, keep in mind that, our default cipher string prefers ECDHE over DHE, so whatever we would do wouldn't even affect the majority of connections (if the client supports ECDHE, it will be used):

icinga2/lib/base/tlsutility.hpp

Line 31 in 420db15

const char * const DEFAULT_TLS_CIPHERS = "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256";