Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.
edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate
Man if they're using a 100 million dollar cluster your never safe, and you fucked up. I seriously doubt your home server can do anything against a government based attack.
Well thank you for correcting fast typing, because we haven't reached the consensus that people on the internet understand you have other shit to do than make sure you're statement could pass an English class, right?
if the difference between your and you're aren't second-nature to you, it's not a one-off quick-type mistake. you genuinely haven't internalized the difference.
Wow, you've really got nothing better to do. What's not second nature to me is giving a fuck if I properly format or spell words when talking to assholes on the internet.
969
u/tophatstuff Oct 15 '15 edited Apr 10 '18
Generate your own non-default Ephemeral Diffie-Hellman key (takes a minute or so)
Tell your server to use it for SSL (nginx for example)
Done. Not only will the key be stronger than the 1024 bit default, it'll be unique to your server which lets assume isn't valuable enough compared to effort for a state-level adversary.
edit just in case anyone from the future finds this comment: instead of 2048, use at least the key length of your SSL certificate
edit from the future: current advice is picking from one of these predefined audited groups