Diffie–Hellman key exchange (DH)

"Diffie–Hellman key exchange (DH)[nb 1] is a method of securely exchanging cryptographic keys" [1]

"Although Diffie–Hellman key agreement itself is a non-authenticated key-agreement protocol, it provides the basis for a variety of authenticated protocols, and is used to provide forward secrecy in Transport Layer Security's ephemeral modes (referred to as EDH or DHE depending on the cipher suite)." [1]

"Ephemeral key exchanges are based on Diffie-Hellman and use per-session, temporary keys during the initial SSL/TLS handshake. They provide Perfect Forward Secrecy, PFS, which means a compromise of the server's long term signing key does not compromise the confidentiality of past session (see following rule). When the server uses an ephemeral key, the server will sign the temporary key with its long term key (the long term key is the customary key available in its certificate)." [2]

For Apache httpd do the following. First generate DH-parameters to get unique prime numbers. The size should be same as the key length in your server certificate.

# openssl dhparam 2048 -out dhparam2048.pem

Then configure Apache httpd to use them.

SSLOpenSSLConfCmd DHParameters <path to dhparam2048.pem>

Problem with DH: DH relies on that is hard to calculate discrete logarithm [3], this was used in the Logjam attack [4].

Reference:
[1] https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
[2] https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet 
[3] https://en.wikipedia.org/wiki/Discrete_logarithm
[4] https://en.wikipedia.org/wiki/Logjam_(computer_security)