On 01/12/2021 16:35, Viktor Dukhovni wrote:
I've reworked the DH support in Postfix for OpenSSL 3.x compatibility, without use of any deprecated interfaces. I now prefer/recommend the use "auto" DH parameter selection:
As do I. Going back to my comment earlier in this thread:> SSL_set0_tmp_dh_pkey(). Although you might be able to just remove it completely. These functions set the DH parameters to a specific set of values. Mostly you can instead just use the default built-in ones.
Matt
