SSLLabs-Grade-A-NGINX-Config You can create a dhparam.pem with the following command: openssl dhparam -out dhparam.pem 4096