Key exchange mechanisms
Key exchange mechanisms
You should only support suites that use ECDHE and DHE (also referred to as EECDH and EDH) for the key exchange. The EC variant is faster and both offer Perfect Forward Secrecy (PFS) which is essential. An example of supporting both ECDHE and DHE with ECDHE preferred.
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384