diff --git a/nginx/files/_ssl_secure.conf b/nginx/files/_ssl_secure.conf
index 0ae8811..ca24272 100644
--- a/nginx/files/_ssl_secure.conf
+++ b/nginx/files/_ssl_secure.conf
@@ -3,3 +3,4 @@
 ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK;
 ssl_prefer_server_ciphers on;
 ssl_ecdh_curve secp521r1;
+ssl_dhparam /etc/ssl/dhparams.pem;
diff --git a/nginx/server.sls b/nginx/server.sls
index 72d2e2c..7be9fb0 100644
--- a/nginx/server.sls
+++ b/nginx/server.sls
@@ -39,4 +39,13 @@
   - require:
     - pkg: nginx_packages
 
+generate_dhparams:
+  cmd.run:
+  - name: openssl dhparam -out /etc/ssl/dhparams.pem 2048
+  - creates: /etc/ssl/dhparams.pem
+  - require:
+    - pkg: nginx_packages
+  - watch_in:
+    - service: nginx_service
+
 {%- endif %}