attachment
0001-Add-server-support-for-DHE-ciphers.patch

Associated Bugs:

• Bugzilla Bug #1234984 - RFE: Add support for DHE cipher suites

In parallel Christian Heimes provided a similar patch which had the backwards compatible changes you referred to. I'm going to start with his patch as a basis but given the two patches are largely the same will credit you both.

You added the DSS ciphers but mod_nss only supports RSA and ECC keys so I dropped those.

I'm in the process of double-checking the cipher definitions, adding test cases, etc. I'll hopefully have a patch upstream soon.

master: 9205812

To test, add +dhe_rsa_aes_128_sha to NSSCipherSuite and restart apache

Run something like:

$ sslscan `hostname`:<port> |grep Accepted |grep DHE
    Accepted  SSLv3  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLSv1  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLS11  128 bits  DHE-RSA-AES128-SHA
    Accepted  TLS12  128 bits  DHE-RSA-AES128-SHA

Your specific output will depend on protocol settings.

The full list of supported ciphers is:

• dhe_rsa_des_sha
• dhe_rsa_3des_sha
• dhe_rsa_aes_128_sha
• dhe_rsa_aes_256_sha
• dhe_rsa_camellia_128_sha
• dhe_rsa_camellia_256_sha
• dhe_rsa_aes_128_sha256
• dhe_rsa_aes_256_sha256
• dhe_rsa_aes_128_gcm_sha_256
• dhe_rsa_aes_256_gcm_sha_384