setup ECDHE to allow Perfect Forward Secrecy, using the p256 NIST prime curve
@@ -1474,6 +1474,7 @@ set_ssl(struct shttpd_ctx *ctx, const char *pem)
char *ssl_disabled_protocols = wsmand_options_get_ssl_disabled_protocols();
char *ssl_cipher_list = wsmand_options_get_ssl_cipher_list();
int retval = FALSE;
+ EC_KEY* key;
/* Load SSL library dynamically */
if ((lib = dlopen(SSL_LIB, RTLD_LAZY)) == NULL) {
@@ -1499,6 +1500,13 @@ set_ssl(struct shttpd_ctx *ctx, const char *pem)
else
retval = TRUE;
+ /* This enables ECDH Perfect Forward secrecy. Currently with just the most generic p256 prime curve */
+ key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+ if (key != NULL) {
+ SSL_CTX_set_tmp_ecdh(CTX, key);
+ EC_KEY_free(key);
+ }
+
while (ssl_disabled_protocols) {
struct ctx_opts_t {
char *name;
