dh now disabled by default but can be enabled w/o opensslextra