diff --git a/sslsplit.1 b/sslsplit.1 index 72f89f8..58a9338 100644 --- a/sslsplit.1 +++ b/sslsplit.1 @@ -112,10 +112,10 @@ NAT ENGINES for a list of NAT engines currently supported by SSLsplit. .B \-g \fIpemfile\fP Use Diffie-Hellman group parameters from \fIpemfile\fP for Ephemereal Diffie-Hellman (EDH/DHE) cipher suites. If \fB-g\fP is not given, SSLsplit -first tries to load DH parameters from the key files given by \fB-K\fP and -\fB-k\fP. If no DH parameters are found in the key files, built-in 512 or 1024 -bit group parameters are automatically used iff a non-RSA private key is given -with \fB-K\fP. +first tries to load DH parameters from the PEM files given by \fB-K\fP, +\fB-k\fP or \fB-c\fP. If no DH parameters are found in the key files, built-in +512 or 1024 bit group parameters are automatically used iff a non-RSA private +key is given with \fB-K\fP. This is because DSA/DSS private keys can by themselves only be used for signing and thus require DH to exchange an SSL/TLS session key. If \fB-g\fP is given, the parameters from the given \fIpemfile\fP will always