Do I need to periodically change the ssl_dhparam parameters in Nginx?

Question

Nginx

Do I need to periodically generate a new dhparams file for the ssl_dhparam directive for Nginx in order for PFS to work? I don’t understand the mechanism of how this all works, but for some reason it seems that if there is already some kind of thing that is generated, and completely independent of anything else (as opposed to the same certificates, HPKP keys, etc.) - it need to change sometimes. Or not?

Answer 1

No need. These DH parameters are not secret, unlike keys. For the protocol, the main thing is that you set them so that they are not "vulnerable" (generated by leaky software). Well, they are generated for a long time, so it is difficult (and pointless) to generate them with each use.