doc: fix description of TLS dhparam option

The dhparam option is not required for perfect forward secrecy in general. It is only required for non-ECDHE secrecy, but ECDHE-based secrecy is generally preferred anyway. PR-URL: #46949 Reviewed-By: Luigi Pinca <[email protected]> Reviewed-By: Filip Skokan <[email protected]>
nodejs · Mar 14, 2023 · 5fdd3f4 · 5fdd3f4
1 parent ba5ff15
commit 5fdd3f4
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/doc/api/tls.md b/doc/api/tls.md
@@ -1880,12 +1880,13 @@ changes:
     client certificate.
   * `crl` {string|string\[]|Buffer|Buffer\[]} PEM formatted CRLs (Certificate
     Revocation Lists).
-  * `dhparam` {string|Buffer} Diffie-Hellman parameters, required for
+  * `dhparam` {string|Buffer} Diffie-Hellman parameters, required for non-ECDHE
     [perfect forward secrecy][]. Use `openssl dhparam` to create the parameters.
     The key length must be greater than or equal to 1024 bits or else an error
     will be thrown. Although 1024 bits is permissible, use 2048 bits or larger
     for stronger security. If omitted or invalid, the parameters are silently
-    discarded and DHE ciphers will not be available.
+    discarded and DHE ciphers will not be available. [ECDHE][]-based [perfect
+    forward secrecy][] will still be available.
   * `ecdhCurve` {string} A string describing a named curve or a colon separated
     list of curve NIDs or names, for example `P-521:P-384:P-256`, to use for
     ECDH key agreement. Set to `auto` to select the