Ffdhe2048

[dragoangel]

Contribution Guidelines

• I've read the contribution guidelines and wholeheartedly agree them

What does this PR include?

Short Description

Use precompiled FFDHE key from ssl-config.mozilla.org/ffdhe2048.txt as of recomendations of RFC7919

Affected Containers

• acme
• postfix
• dovecot

Did you run tests?

Nope

What did you tested?

What were the final results? (Awaited, got)

Have better security for old crypto

[accolon]

Many government agencies [1] recommend to phase out FFDHE-2048 and use larger group sizes, i.e. FFDHE-3072 and above. I would recommend to do this for mailcow as well during this change.

[1] E.g. the German BSI (Table 1.2) and the Dutch NCSC (Table 10).

[dragoangel]

Many government agencies [1] recommend to phase out FFDHE-2048 and use larger group sizes, i.e. FFDHE-3072 and above. I would recommend to do this for mailcow as well during this change.

[1] E.g. the German BSI (Table 1.2) and the Dutch NCSC (Table 10).

Question in backwards compatibility first, so no, I intentionally put 2K, it works by everything, more over no new algos using it, so it's really bad to do