add dhparam gen command

diff --git a/ssl.conf b/ssl.conf
index c63822bd06a60656569919aab18144b21b8d054d..e9c1a2108ed7accfda7d42304a6e812035df4ac3 100644 (file)
--- a/ssl.conf
+++ b/ssl.conf
@@ -20,6 +20,8 @@ $SERVER["socket"] == ":443" {
 #      ssl.ca-file = "/etc/lighttpd/ssl/chain.pem"
 
        # for DH/DHE ciphers, dhparam should be >= 2048-bit
+       # Generate with:
+       # openssl dhparam -out dh2048.pem -outform PEM -2 2048
 #      ssl.dh-file = "/etc/lighttpd/ssl/dhparam.pem"
        # ECDH/ECDHE ciphers curve strength (see `openssl ecparam -list_curves`)
 #      ssl.ec-curve = "secp384r1"