diff --git a/config/nginx.newsblur.conf b/config/nginx.newsblur.conf
index a6bac2aba..fbf603614 100644
--- a/config/nginx.newsblur.conf
+++ b/config/nginx.newsblur.conf
@@ -15,11 +15,12 @@ server {
     # ssl                     on;
     ssl_certificate         /srv/newsblur/config/certificates/newsblur.com.crt;
     ssl_certificate_key     /srv/newsblur/config/certificates/newsblur.com.key;
-    ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4";
+    ssl_ciphers "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA";
     ssl_prefer_server_ciphers on;
     ssl_session_cache shared:SSL:10m;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
 
+    ssl_dhparam     /srv/newsblur/config/certificates/dhparams.pem;
     client_max_body_size 4M;
     server_name www.newsblur.com newsblur.com dev.newsblur.com push.newsblur.com *.newsblur.com circularapp.com *.circularapp.com;
     add_header X-nginx-server nginx_none;
diff --git a/dhparams.pem b/dhparams.pem
new file mode 100644
index 000000000..ce95efdda
--- /dev/null
+++ b/dhparams.pem
@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAgtZMuf7JkrXuc0+oNFXHYUgYQHbkEXebOPtYPV/P6svFp6FF9A78
+pejkK+1wGoKnhUUH4Sde2ZiA0B9IEU2jSK6E5pWioq85n8SM00p4AQ86VIpqcBJ9
+rQkzugy99WfEjzEK5hVob0VXhDULKncXOwPmOEbz8KkfYryNrj2XitTOqHOO/39y
+1M4OSIF8rYR6b/8AJKxOHwxCiu7FeL1padQFGH1UKhVCbjG2sY9ym30XFGdZAc6h
+LUTfN9h2QI514L4zC6g/vZdkHxdXGG/DwgVU5CyS4OV5JbOjc/TGMpTMBiXyksmV
+g1LZflJqUsjRF6eb4kIM6vsZjaL7TA/umwIBAg==
+-----END DH PARAMETERS-----
diff --git a/fabfile.py b/fabfile.py
index 040046191..ff47cfba6 100644
--- a/fabfile.py
+++ b/fabfile.py
@@ -776,6 +776,7 @@ def copy_certificates():
     put(os.path.join(env.SECRETS_PATH, 'certificates/newsblur.com.crt'), cert_path)
     put(os.path.join(env.SECRETS_PATH, 'certificates/newsblur.com.key'), cert_path)
     put(os.path.join(env.SECRETS_PATH, 'certificates/comodo/newsblur.com.pem'), cert_path)
+    put(os.path.join(env.SECRETS_PATH, 'certificates/comodo/dhparams.pem'), cert_path)
     run('cat %s/newsblur.com.pem > %s/newsblur.pem' % (cert_path, cert_path))
     run('cat %s/newsblur.com.key >> %s/newsblur.pem' % (cert_path, cert_path))