How to generate legacy DH parameters using OpenSSL
Diffie-Hellman parameter files belong to older TLS configurations that still enable finite-field DHE ciphers. Modern TLS deployments normally negotiate ECDHE groups without a custom dhparam.pem file, but an inherited web server, appliance, or policy profile may still require one before it accepts DHE handshakes.
OpenSSL still ships dhparam for compatibility, while current command documentation points parameter generation toward genpkey and inspection toward pkeyparam. Using a named FFDHE group such as ffdhe2048 avoids waiting for a new safe-prime search and writes the same BEGIN DH PARAMETERS PEM block expected by many legacy service directives.
Treat the file as compatibility material, not as a way to harden modern TLS by itself. Keep service cipher policy focused on ECDHE unless a legacy DHE requirement is explicit, and validate both the parameter file and the final server handshake before using it in production.
Steps to generate legacy DH parameters with OpenSSL:
- Generate a named FFDHE parameter file.
$ openssl genpkey -genparam -algorithm DH -pkeyopt group:ffdhe2048 -out dhparam.pem
The command writes a PEM file that starts with -----BEGIN DH PARAMETERS-----. Use ffdhe3072 or ffdhe4096 only when the receiving service and performance budget require a larger finite-field group.
Use openssl dhparam 2048 only when a policy explicitly requires freshly generated safe primes. It can take a long time and does not improve modern ECDHE handshakes.
- Check that OpenSSL accepts the parameter file.
$ openssl pkeyparam -in dhparam.pem -check -noout Parameters are valid
Parameters are valid confirms that pkeyparam can parse and validate the PEM file before a service tries to load it.
- Inspect the group and size recorded in the file.
$ openssl pkeyparam -in dhparam.pem -text -noout DH Parameters: (2048 bit) GROUP: ffdhe2048
The group line should match the -pkeyopt group:… value used during generation.
- Confirm compatibility with the legacy dhparam command.
$ openssl dhparam -check -in dhparam.pem -noout DH parameters appear to be ok.
Use the generated file only in service configuration that explicitly asks for DH parameters, then run that service's syntax test and a real DHE handshake check.