I have set up nginx with SSL. Everything works perfectly, with online tools giving the domain a good score.
Now I am wondering about one particular nginx configuration option; ssl_dhparam. Should I generate and set these parameters? Does it have any influence on security or computational load of SSL?
Yes.
Yes, when enabling Perfect Forward Secrecy. An appropriate ciphersuite must also be configured.
If a future attacker compromises your TLS, with PFS past traffic they intercepted and retained still cannot be decrypted.
Generate a DHE prime no smaller than your SSL certificate RSA private key. Given a 2048 bit private key:
Too little to worry about.
Google I/O 2014 had a good HTTPS Everwhere talk which covered these and related topics in a broad fashion.
Diffie helman is a good algorithm for key exchange but it takes too much time for computation slowing your website down. I recommend using
RC4-SHA
which is weaker than DH but serve its purpose. If it helps, google.com usesRC4-SHA
. You can check out the algorithm for any website using the following:I suggest you check out what kind of key exchange and encryption other websites similar to yours are using and use a suitable algorithm.
Also read out this article on the same topic.