diff --git a/roles/xmpp_server/molecule/default/prepare.yml b/roles/xmpp_server/molecule/default/prepare.yml
index 3c589d551c745240b03738ba3c3525366b53447b..becb853f2c2ada341780491839fb785e492a6ab6 100644
--- a/roles/xmpp_server/molecule/default/prepare.yml
+++ b/roles/xmpp_server/molecule/default/prepare.yml
@@ -18,6 +18,11 @@
         update_cache: true
       changed_when: false
 
+    - name: Install tools for testing
+      apt:
+        name: gnutls-bin
+        state: present
+
 - hosts: stretch
   become: true
   tasks:
diff --git a/roles/xmpp_server/molecule/default/tests/test_default.py b/roles/xmpp_server/molecule/default/tests/test_default.py
index ddb8e6ebd0efcdc6c9aaea31626438e1fd6c8d2f..103e9f252b6dd64b8db67b9199aadbb725158987 100644
--- a/roles/xmpp_server/molecule/default/tests/test_default.py
+++ b/roles/xmpp_server/molecule/default/tests/test_default.py
@@ -123,6 +123,28 @@ def test_firewall_configuration_file(host):
         assert config.group == 'root'
         assert config.mode == 0o640
 
+
+def test_xmpp_server_dh_parameters_file(host):
+    """
+    Tests if the Diffie-Helman parameter file has been generated
+    correctly.
+    """
+
+    fqdn = host.run('hostname -f').stdout.strip()
+    dhparam_file_path = '/etc/ssl/private/%s_xmpp.dh.pem' % fqdn
+
+    with host.sudo():
+        dhparam_file = host.file(dhparam_file_path)
+        assert dhparam_file.is_file
+        assert dhparam_file.user == 'root'
+        assert dhparam_file.group == 'prosody'
+        assert dhparam_file.mode == 0o640
+
+        dhparam_info = host.run("openssl dhparam -noout -text -in %s", dhparam_file_path)
+
+        assert "DH Parameters: (2048 bit)" in dhparam_info.stdout
+
+
 # @TODO: Tests which were not implemented due to lack of out-of-box tools:
 #
 # - Proxy capability.
diff --git a/roles/xmpp_server/molecule/default/tests/test_mandatory.py b/roles/xmpp_server/molecule/default/tests/test_mandatory.py
index 6557d53c49a613cb460a05418502dcac1e3b0563..e498261e66fbeef0fa8cb26ca4ff0cff6e43d78d 100644
--- a/roles/xmpp_server/molecule/default/tests/test_mandatory.py
+++ b/roles/xmpp_server/molecule/default/tests/test_mandatory.py
@@ -81,3 +81,24 @@ def test_correct_prosody_package_installed(host):
     """
 
     assert host.package('prosody-0.10').is_installed
+
+
+def test_xmpp_server_uses_correct_dh_parameters(host):
+    """
+    Tests if the HTTP server uses the generated Diffie-Helman parameter.
+    """
+
+    fqdn = host.run('hostname -f').stdout.strip()
+
+    with host.sudo():
+        expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
+
+    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
+                          "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain1")
+
+    output = connection.stdout
+    begin_marker = "-----BEGIN DH PARAMETERS-----"
+    end_marker = "-----END DH PARAMETERS-----"
+    used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
+
+    assert used_dhparam == expected_dhparam
diff --git a/roles/xmpp_server/molecule/default/tests/test_optional.py b/roles/xmpp_server/molecule/default/tests/test_optional.py
index abfd7c6d423c58d3f7cb4f454cb6992c6d76a401..c7aaed13a2887e3f751f59ef17aa31aa3aa6199b 100644
--- a/roles/xmpp_server/molecule/default/tests/test_optional.py
+++ b/roles/xmpp_server/molecule/default/tests/test_optional.py
@@ -87,3 +87,24 @@ def test_correct_prosody_package_installed(host):
     """
 
     assert host.package('prosody-0.9').is_installed
+
+
+def test_xmpp_server_uses_correct_dh_parameters(host):
+    """
+    Tests if the HTTP server uses the generated Diffie-Helman parameter.
+    """
+
+    fqdn = host.run('hostname -f').stdout.strip()
+
+    with host.sudo():
+        expected_dhparam = host.file('/etc/ssl/private/%s_xmpp.dh.pem' % fqdn).content_string.rstrip()
+
+    connection = host.run("gnutls-cli --no-ca-verification --starttls-proto=xmpp --port 5222 "
+                          "--priority 'NONE:+VERS-TLS1.2:+CTYPE-X509:+COMP-NULL:+SIGN-RSA-SHA384:+DHE-RSA:+SHA384:+AEAD:+AES-256-GCM' --verbose domain2")
+
+    output = connection.stdout
+    begin_marker = "-----BEGIN DH PARAMETERS-----"
+    end_marker = "-----END DH PARAMETERS-----"
+    used_dhparam = output[output.find(begin_marker):output.find(end_marker) + len(end_marker)]
+
+    assert used_dhparam == expected_dhparam
diff --git a/roles/xmpp_server/tasks/main.yml b/roles/xmpp_server/tasks/main.yml
index d53bc30f3cd9ed8c3e492881a8da5673eb77a3b1..dcedd1dfe4f1a831d832aaf1e6883cc2e78130a7 100644
--- a/roles/xmpp_server/tasks/main.yml
+++ b/roles/xmpp_server/tasks/main.yml
@@ -57,6 +57,16 @@
   notify:
     - Restart Prosody
 
+- name: Generate the XMPP server Diffie-Helman parameter
+  openssl_dhparam:
+    owner: root
+    group: prosody
+    mode: 0640
+    path: "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem"
+    size: 2048
+  notify:
+    - Restart Prosody
+
 - name: Deploy configuration file for checking certificate validity via cron
   copy:
     content: "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem"
diff --git a/roles/xmpp_server/templates/prosody.cfg.lua.j2 b/roles/xmpp_server/templates/prosody.cfg.lua.j2
index d36bffae94817418b03be034d53adb0d7502611e..676a16940e14233fb72256a3914aa5fdcd6d673c 100644
--- a/roles/xmpp_server/templates/prosody.cfg.lua.j2
+++ b/roles/xmpp_server/templates/prosody.cfg.lua.j2
@@ -44,6 +44,7 @@ allow_registration = false;
 ssl = {
   key = "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.key";
   certificate = "/etc/ssl/certs/{{ ansible_fqdn }}_xmpp.pem";
+  dhparam = "/etc/ssl/private/{{ ansible_fqdn }}_xmpp.dh.pem";
 }
 
 -- Ports on which to have direct TLS/SSL.