Modified the config file sample and the README.SSL to reflect the

changes in the previous commit.

README.SSL.md

@@ -24,7 +24,10 @@ the changes to the check_nrpe client.
 Running `./configure` will now create a 2048-bit DH key instead
 of the old 512-bit key. The most current versions of openSSL will
 still not allow it. In my testing, openSSL 1.0.1e allowed DH keys
-of 512 bits, and 1.0.1k would not allow 2048 bit keys.
+of 512 bits, and 1.0.1k would not allow 2048 bit keys. In addition
+we now call `SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE)` so a
+new key is generated on each connection, based on the 2048-bit
+key generated.
 
 The NRPE configuration file has added new SSL/TLS options. The
 defaults currently will allow old check_nrpe clients to continue to
@@ -87,12 +90,6 @@ This can be especially helpful during client migration, so you can
 tell which clients have certificates, what SSL/TLS version is being
 used, and which ciphers are being used.
 
-The `ssl_adh_key` directive is **DEPRECATED**, even though it's new. It
-should be used (if at all) during client migration. This will allow
-you to change the ADH key without having to recompile the NRPE
-daemon. It can either contain the path to a key file, or it can
-contain a base-64 encoded key. See the examples in the nrpe.cfg file.
-
 
 ------------------------------------------------
 ####CHANGES IN THE CURRENT VERSION OF CHECK_NRPE

sample-config/nrpe.cfg.in

@@ -243,17 +243,6 @@ connection_timeout=300
 
 #ssl_logging=0
 
-# SSL ADH KEY
-# Set this option to use a different Diffie-Hellman key. The argument is either
-# a path to a file containing the key, or a base-64 encoded key. The key from the
-# file or the base-64 decoded key must be a 512, 1024, 2048 or 4096-bit binary
-# key. Recent versions of openSSL require 2048 or 4096 bit keys or it will refuse
-# to use DH. This directive is DEPRECATED and will be removed in a new version.
-# The sample in the second example is a 512-bit key. DO NOT USE THE SAMPLE KEY!
-
-#ssl_adh_key=@sharedstatedir@/ssl/nrpe_adh.key
-#ssl_adh_key=B64:MEYCQQDGl8SHFLW//3CY9H6R3ZnbB68UAHv59aGwatTT0KHrfono/StMIcPtqSsjjioWWugxt91tECG+GTMgBADLiXZTAgEC  DON'T USE THIS ONE!
-
 
 
 # INCLUDE CONFIG FILE