--- contrib/mod_tls.c
+++ contrib/mod_tls.c
@@ -461,7 +461,7 @@ static tls_sess_cache_t *tls_sess_cache
 static SSL *ctrl_ssl = NULL;
 static SSL_CTX *ssl_ctx = NULL;
 static X509_STORE *tls_crl_store = NULL;
-static DH *tls_tmp_dh = NULL;
+static array_header *tls_tmp_dhs = NULL;
 static RSA *tls_tmp_rsa = NULL;
 
 /* SSL/TLS support functions */
@@ -1952,58 +1952,60 @@ static int tls_ctrl_renegotiate_cb(CALLB
 #endif
 
 static DH *tls_dh_cb(SSL *ssl, int is_export, int keylength) {
-  FILE *fp = NULL;
-
-  if (tls_tmp_dh) {
-    return tls_tmp_dh;
-  }
+  DH *dh = NULL;
 
-  if (tls_dhparam_file) {
-    fp = fopen(tls_dhparam_file, "r");
-    if (fp) {
-      tls_tmp_dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
-      fclose(fp);
+  if (tls_tmp_dhs != NULL &&
+      tls_tmp_dhs->nelts > 0) {
+    register unsigned int i;
+    DH **dhs;
 
-      if (tls_tmp_dh) {
-        return tls_tmp_dh;
+    dhs = tls_tmp_dhs->elts;
+    for (i = 0; i < tls_tmp_dhs->nelts; i++) {
+      /* Note: the keylength argument is in BITS, but DH_size() returns
+       * the number of BYTES.
+       */
+      if (DH_size(dhs[i]) == (keylength / 8)) {
+        return dhs[i];
       }
-
-    } else {
-      pr_log_debug(DEBUG3, MOD_TLS_VERSION
-        ": unable to open TLSDHParamFile '%s': %s", tls_dhparam_file,
-          strerror(errno));
     }
   }
 
   switch (keylength) {
     case 512:
-      tls_tmp_dh = get_dh512();
+      dh = get_dh512();
       break;
 
     case 768:
-      tls_tmp_dh = get_dh768();
+      dh = get_dh768();
       break;
 
      case 1024:
-       tls_tmp_dh = get_dh1024();
+       dh = get_dh1024();
        break;
 
      case 1536:
-       tls_tmp_dh = get_dh1536();
+       dh = get_dh1536();
        break;
 
      case 2048:
-       tls_tmp_dh = get_dh2048();
+       dh = get_dh2048();
        break;
 
      default:
        tls_log("unsupported DH key length %d requested, returning 1024 bits",
          keylength);
-       tls_tmp_dh = get_dh1024();
+       dh = get_dh1024();
        break;
   }
 
-  return tls_tmp_dh;
+  /* Add this DH to the list, so that it can be freed properly later. */
+  if (tls_tmp_dhs == NULL) {
+    tls_tmp_dhs = make_array(session.pool, 1, sizeof(DH *));
+  }
+
+  *((DH **) push_array(tls_tmp_dhs)) = dh;
+
+  return dh;
 }
 
 /* Post 0.9.7a, RSA blinding is turned on by default, so there is no need to
@@ -3018,9 +3020,16 @@ static void tls_cleanup(int flags) {
     ssl_ctx = NULL;
   }
 
-  if (tls_tmp_dh) {
-    DH_free(tls_tmp_dh);
-    tls_tmp_dh = NULL;
+  if (tls_tmp_dhs) {
+    register unsigned int i;
+    DH **dhs;
+
+    dhs = tls_tmp_dhs->elts;
+    for (i = 0; i < tls_tmp_dhs->nelts; i++) {
+      DH_free(dhs[i]);
+    }
+
+    tls_tmp_dhs = NULL;
   }
 
   if (tls_tmp_rsa) {
@@ -7320,6 +7329,38 @@ static int tls_sess_init(void) {
   tls_crl_path = get_param_ptr(main_server->conf, "TLSCARevocationPath", FALSE);
 
   tls_dhparam_file = get_param_ptr(main_server->conf, "TLSDHParamFile", FALSE);
+  if (tls_dhparam_file != NULL) {
+    FILE *fp;
+    int xerrno;
+
+    /* Load the DH params from the file. */
+    PRIVS_ROOT
+    fp = fopen(tls_dhparam_file, "r");
+    xerrno = errno;
+    PRIVS_RELINQUISH
+
+    if (fp != NULL) {
+      DH *dh;
+
+      dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
+      if (dh != NULL) {
+        tls_tmp_dhs = make_array(session.pool, 1, sizeof(DH *));
+      }
+
+      while (dh != NULL) {
+        pr_signals_handle();
+        *((DH **) push_array(tls_tmp_dhs)) = dh;
+        dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
+      }
+
+      fclose(fp);
+
+    } else {
+      pr_log_debug(DEBUG3, MOD_TLS_VERSION
+        ": unable to open TLSDHParamFile '%s': %s", tls_dhparam_file,
+          strerror(xerrno));
+    }
+  }
 
   tls_dsa_cert_file = get_param_ptr(main_server->conf, "TLSDSACertificateFile",
     FALSE);