diff --git a/src/shrpx_ssl.cc b/src/shrpx_ssl.cc index d1952acb..a53c6493 100644 --- a/src/shrpx_ssl.cc +++ b/src/shrpx_ssl.cc @@ -269,9 +269,12 @@ SSL_CTX* create_ssl_context(const char *private_key_file, #ifndef OPENSSL_NO_EC -#if OPENSSL_VERSION_NUMBER >= 0x10002000L - SSL_CTX_set_ecdh_auto(ssl_ctx, 1); -#else // OPENSSL_VERSION_NUBMER < 0x10002000L + // Disabled SSL_CTX_set_ecdh_auto, because computational cost of + // chosen curve is much higher than P-256. + +// #if OPENSSL_VERSION_NUMBER >= 0x10002000L +// SSL_CTX_set_ecdh_auto(ssl_ctx, 1); +// #else // OPENSSL_VERSION_NUBMER < 0x10002000L // Use P-256, which is sufficiently secure at the time of this // writing. auto ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1); @@ -282,7 +285,7 @@ SSL_CTX* create_ssl_context(const char *private_key_file, } SSL_CTX_set_tmp_ecdh(ssl_ctx, ecdh); EC_KEY_free(ecdh); -#endif // OPENSSL_VERSION_NUBMER < 0x10002000L +// #endif // OPENSSL_VERSION_NUBMER < 0x10002000L #endif // OPENSSL_NO_EC