Making it possible to define parameters for Diffie–Hellman key exchange.

Motivation:

Improving security of SSL transactions that use DHE-based ciphers. For
instance, it should be possible to change key size.

Modifications:

Adding a new native operation on OpenSSL that makes it possible to add
to an SSL context a file that defines DH parameters.

Result:

One can now create his/her dhparam key file using the following command
line:
openssl dhparam -rand - 2048 > /etc/ssl/certs/dhparam.pem
For parameters to be taken int o account, in Java, one should then call:
SSLContext.setTmpDH(sslContext.context(), "/etc/ssl/certs/dhparam.pem")
Making it possible to have access to the chose session protocol (e.g. … TLSv1.2 or SSLv3)

Motivation:

It is possible to check what is the chosen cipher for an SSL session,
which is properly reported in netty using the OpenSSL implementation for
SSLSession. However, protocol is reported as unknown. If using the JDK
implementation, it is correctly reported such as as SSLv3.

Knowing the session protocol can help in managing security properly,
e.g. for accepting SSLv3 or TLSv1 in some parts of an application for
compatibility, and allowing only TLSv1.1 or TLSv1.2 for more secured
parts, such as user authentication.

Modifications:

Just adding a new native operation to SSL to quary protocol of an
existing session thanks to its id.

Result:

It will be possible to implement getProtocol for the
OpenSslEngine.getSession().getProtocol() so that it has same behavior as
JDK implementation.