That's exactly what I did, except you should use ffdhe3072 as a minimum, which is the one I linked to. Can also be found over here: Security/Archive/Server Side TLS 4.0 - MozillaWiki Just updated 123.09beta01 with a new tools/switch-nginx-ciphers.sh...