instance method
OpenSSL::SSL::SSLContext#tmp_dh=
ctx.tmp_dh = pkey
ext/openssl/ossl_ssl.c
View on GitHub ↗
static VALUE
ossl_sslctx_set_tmp_dh(VALUE self, VALUE arg)
{
SSL_CTX *ctx;
EVP_PKEY *pkey;
rb_check_frozen(self);
GetSSLCTX(self, ctx);
pkey = GetPKeyPtr(arg);
if (EVP_PKEY_base_id(pkey) != EVP_PKEY_DH)
rb_raise(eSSLError, "invalid pkey type %s (expected DH)",
OBJ_nid2sn(EVP_PKEY_base_id(pkey)));
#ifdef HAVE_SSL_CTX_SET0_TMP_DH_PKEY
if (!SSL_CTX_set0_tmp_dh_pkey(ctx, pkey))
ossl_raise(eSSLError, "SSL_CTX_set0_tmp_dh_pkey");
EVP_PKEY_up_ref(pkey);
#else
if (!SSL_CTX_set_tmp_dh(ctx, EVP_PKEY_get0_DH(pkey)))
ossl_raise(eSSLError, "SSL_CTX_set_tmp_dh");
#endif
// Turn off the "auto" DH parameters set by ossl_sslctx_s_alloc()
SSL_CTX_set_dh_auto(ctx, 0);
return arg;
}
Sets DH parameters used for ephemeral DH key exchange. This is relevant for servers only.
pkey is an instance of OpenSSL::PKey::DH. Note that key components contained in the key object, if any, are ignored. The server will always generate a new key pair for each handshake.
Added in version 3.0. See also the man page SSL_CTX_set0_tmp_dh_pkey(3).
Example:
Example
ctx = OpenSSL::SSL::SSLContext.new ctx.tmp_dh = OpenSSL::DH.generate(2048) svr = OpenSSL::SSL::SSLServer.new(tcp_svr, ctx) Thread.new { svr.accept }