Quick comment in case you weren't already aware of this:
I don't know anything about the specific problems Leif mentioned (but they would be related if the issue was with configuring DHE parameter values), but I have spent some time looking into DHE recently:
There are concerns that the parameter size should now be larger than was historically typical (2048-bit vs 1024-bit). However, there is no mechanism in the protocol to negotiate the DHE parameter size. Furthermore there are clients fairly commonly encountered (e.g. Java JSSE older than very recent releases) that do not accept a 2048-bit DHE parameter from a server, and do not act gracefully as a result. For these reasons it seems that DHE is normally best disabled on the server (the problematic clients do mostly have support for ECDHE so they work with ECDHE if DHE is not a supported server cipher) because the alternatives are either (a) become incompatible with some clients or (b) allow less than best-practice protection from brute-force attacks.
