Thanks for the excellent description of the vuln!
You mention Apache not being vulnerbale. I just looked through the Nginx code, and it doesn&#x27;t seem to be vulnerable either because Igor Sysoev enabled SSL_OP_SINGLE_DH_USE back in 2008.
<a href="https:&#x2F;&#x2F;github.com&#x2F;nginx&#x2F;nginx&#x2F;blob&#x2F;master&#x2F;src&#x2F;event&#x2F;ngx_event_openssl.c#L250" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nginx&#x2F;nginx&#x2F;blob&#x2F;master&#x2F;src&#x2F;event&#x2F;ngx_eve...</a>