31

I am generating Diffie-Hellman parameters for the ssl_dhparam directive in the SSL configuration of nginx.

The file dhparam.pem is created with the command openssl dhparam 2048 -check -out dhparam.pem.

Which permissions should I set to this file? Is it safe to share in a git repository or should I keep it private?

Eric Bréchemier
  • 1,435
  • 2
  • 12
  • 8
  • 1
    See [this](http://security.stackexchange.com/questions/38206/can-someone-explain-a-little-better-what-exactly-is-accomplished-by-generation-o). – Richard Smith Jan 22 '16 at 15:47

1 Answers1

24

The dhparam file contains the prime which defines the group for the DH key exchange. It is not a secret, and will be sent in clear during the key exchange, so there is no point in trying to keep it secret.

As for file permissions: nginx needs to read them, and an attacker must not be able to edit them. It may depend on your setup, but setting owner and group to root and permissions to 644 should work.

Dario Seidl
  • 436
  • 5
  • 12