And, with regards to ssl_ctx_set_tmp_dh, yes, that only makes sense for ephemeral DH, because, analogously to the non-ephemeral EC thing described above, you can't just go ahead and pick whatever field you want for an existing DH key; the DH pubkey you have (the `g**x`) is inextricably linked to the (hopefully safe) prime you used when generating it.