Diffie-Hellman parameters generation and achieving PFS with DHE

Last published : Sep 24, 2026
The Diffie-Hellman (DH) key exchange is a way for two parties involved in an SSL transaction to agree upon a shared secret over an insecure channel. These parties have no prior knowledge about each other. This secret can be converted into cryptographic keying material for symmetric key cipher algorithms that require such a key exchange.
This feature is disabled by default. Configured the feature to support ciphers that use DH as the key exchange algorithm.
Note:
Generating 2048-bit DH parameters might take a long time (up to 30 minutes).

Generate DH parameters by using the CLI

At the command prompt, type the following command:
create ssl dhparam <dhFile> [<bits>] [-gen (2 | 5)]
Example:
create ssl dhparam Key-DH-1 512 -gen 2

Generate DH key of more than 2048 bits using the CLI

Starting from release 14.1-25.x, you can create DH keys up to 4096 bits on the following Intel Coleto and Intel Lewisburg-based platforms, and on the platforms where SSL processing is performed only in the software. Earlier the size was restricted to 2048 bits.
  • MPX 5900
  • MPX/SDX 8900
  • MPX/SDX 15000
  • MPX/SDX 15000-50G
  • MPX/SDX 26000
  • MPX/SDX 26000-50S
  • MPX/SDX 26000-100G
  • MPX/SDX 9100
  • MPX/SDX 16000
To create a DH key of more than 2048 bits, use the OpenSSL command from the NetScaler shell prompt.
Note:
For Cavium platforms, the maximum limit is 2048 bits.

Generate DH parameters by using the GUI

Navigate to Traffic Management > SSL and, in the Tools group, select Create Diffie-Hellman (DH) key, and Configure SSL DH Param.
Note:
For information about DH parameters, see Diffie-Hellman parameters.

Achieve perfect forward secrecy with DHE

Generating DH parameters is a CPU-intensive operation. In earlier releases, parameter generation, on a VPX appliance, took a long time because it was done in the software. Parameter generation is optimized by setting the dhKeyExpSizeLimit parameter. You can set this parameter for an SSL virtual server or an SSL profile and then bind the profile to a virtual server.
You can maintain perfect forward secrecy (PFS) on NetScaler MPX appliances by setting the DH count equal to zero. As a result, DH parameters are generated for each transaction (minimum DHcount is 0) on NetScaler MPX appliances. Thee parameters are generated without a significant drop in performance, because the operation is optimized. Earlier, the minimum DH count allowed was 500. That is, you cannot regenerate the key for up to 500 transactions.
Limitation:
On a NetScaler VPX appliance, if you set the DH count to zero, the DH parameters are not regenerated. Therefore, you must set the DH count to 500 to maintain PFS. The DH parameters are regenerated after 500 transactions.

Optimize DH parameters generation by using the CLI

At the command prompt, type commands 1 and 2, or type command 3:
1.  add ssl profile <name> [-sslProfileType ( BackEnd | FrontEnd )] [-dhCount <positive_integer>] [-dh ( ENABLED | DISABLED) -dhFile <string>] [-dhKeyExpSizeLimit ( ENABLED | DISABLED)]
2.  set ssl vserver <vServerName> [-sslProfile <string>]3.  set ssl vserver <vServerName> [-dh ( ENABLED | DISABLED) -dhFile <string>] [-dhCount <positive_integer>] [-dhKeyExpSizeLimit ( ENABLED | DISABLED )]

Optimize DH parameters generation by using the GUI

  1. Navigate to Traffic Management > Load Balancing > Virtual Servers, and open a virtual server.
  2. In the SSL Parameters section, select Enable DH Key Expire Size Limit.