DHE_RSA is a TLS cipher-suite mode that combines ephemeral Diffie-Hellman (DHE) key exchange with RSA-based authentication. The parties use Diffie-Hellman parameters to derive a shared session key; the server uses its RSA certificate key to authenticate the handshake. The RSA key does not itself encrypt the session key.
This distinction matters because DHE can provide forward secrecy: later theft of the server’s RSA private key does not, by itself, reveal previously recorded sessions. Security still depends on sound parameters, correct implementation, and the negotiated TLS version and cipher suite. In real deployments, a server may support DHE_RSA alongside other modes, so defenders should verify which handshake is actually negotiated and keep the TLS library and firmware updated. A flaw affecting a particular DHE_RSA implementation or configuration can put sessions at risk without making every TLS connection vulnerable.