On 8/26/26 2:24 PM, Clemens Lang via stunnel-users wrote:
For now, if you want to keep FFDHE enabled and/or not opt-out of crypto-policies with your stunnel config, I’d recommend following this instruction from the stunnel manpage:
Alternatively, it is possible to specify static DH parameters in the certificate file, which disables generating temporary DH parameters:
openssl dhparam 2048 >> stunnel.pem
Instead of generating a new set of parameters using `openssl dhparam`, I would recommend grabbing a PEM-encoded copy of the RFC 7919 ones from
https://github.com/internetstandards/dhe_groups/ tree/26f703fe44e0b4b03840e3dc7eaacf8257f7a184
Thanks Clemens! (Sorry about the slow response.)
Could you share which RHEL version you’re using? It looks like 9 or 10 based on the OpenSSL version, but both ship the same, so it’s impossible to tell from your provided output.
I'm on Fedora 44. openssl-3.5.7-2.fc44.x86_64 stunnel-5.80-1.fc44.x86_64 -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================