@@ -103,6 +103,11 @@ User-visible Changes

 - ``--x509-username-field`` will no longer automatically convert fieldnames to

   uppercase. This is deprecated since OpenVPN 2.4, and has now been removed.

+- ``--dh none`` is now the default if ``--dh`` is not specified. Modern TLS

+  implementations will prefer ECDH and other more modern algorithms anyway.

+  And finite field Diffie Hellman is in the proces of being deprecated

+  (see draft-ietf-tls-deprecate-obsolete-kex)

+

 Overview of changes in 2.6

 ==========================

@@ -171,16 +171,22 @@ certificates and keys: https://github.com/OpenVPN/easy-rsa

 --dh file

-  File containing Diffie Hellman parameters in .pem format (required for

-  ``--tls-server`` only).

-

-  Set ``file`` to :code:`none` to disable Diffie Hellman key exchange (and

-  use ECDH only). Note that this requires peers to be using an SSL library

-  that supports ECDH TLS cipher suites (e.g. OpenSSL 1.0.1+, or

-  mbed TLS 2.0+).

-

-  Use ``openssl dhparam -out dh2048.pem 2048`` to generate 2048-bit DH

-  parameters. Diffie Hellman parameters may be considered public.

+  File containing finite field Diffie Hellman parameters in .pem format (used

+  by ``--tls-server`` only).

+

+  Set ``file`` to :code:`none` to disable fine field Diffie Hellman

+  key exchange (and to only use ECDH or newer hybrid key agreement algorithms

+  like X25519MLKEM768 instead).

+  Note that this requires peers to be using an SSL library that supports

+  ECDH TLS cipher suites (e.g. OpenSSL 1.0.1+, or mbed TLS 2.0+). Starting

+  with 2.7.0, this is the same as not specifying ``--dh`` at all.

+

+  Diffie Hellman parameters can be generated using

+  ``openssl dhparam -out dh2048.pem 2048`` but it is recommended to

+  use ``none`` as finite field Diffie Hellman have been replaced

+  by more modern variants like ECDH.

+

+  Diffie Hellman parameters may be considered public.

 --ecdh-curve name

   Specify the curve to use for elliptic curve Diffie Hellman. Available

@@ -3703,8 +3703,6 @@ options_postprocess_mutate(struct options *o, struct env_set *es)

     if (o->tls_server)

     {

-        /* Check that DH file is specified, or explicitly disabled */

-        notnull(o->dh_file, "DH file (--dh)");

         if (streq(o->dh_file, "none"))

         {

             o->dh_file = NULL;