lib-ssl-iostream: Turn on SSL_OP_SINGLE_DH_USE

Improves forward secrecy in case a DH cipher is used.

diff --git a/src/lib-ssl-iostream/iostream-openssl-context.c b/src/lib-ssl-iostream/iostream-openssl-context.c
index befc555b40f9057ef15392f55028a0395f6e6720..7cdc680d8187815f892c254c8dabd4d89bc828ab 100644 (file)
--- a/src/lib-ssl-iostream/iostream-openssl-context.c
+++ b/src/lib-ssl-iostream/iostream-openssl-context.c
@@ -565,6 +565,11 @@ ssl_proxy_ctx_set_crypto_params(SSL_CTX *ssl_ctx,
                EC_KEY_free(ecdh);
        }
 #endif
+#endif
+#ifdef SSL_OP_SINGLE_DH_USE
+       /* Improves forward secrecy with DH parameters, especially if the
+          parameters used aren't strong primes. See OpenSSL manual. */
+       SSL_CTX_set_options(ssl_ctx, SSL_OP_SINGLE_DH_USE);
 #endif
        return 0;
 }