This article may help explain how: http://vincent.bernat.im/en/blog/2011-ssl-perfect-forward-se...