ssl_dh_params_file

Definition PG 18 manual

Specifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers. The default is empty, in which case compiled-in default DH parameters used. Using custom DH parameters reduces the exposure if an attacker manages to crack the well-known compiled-in DH parameters. You can create your own DH parameters file with the command openssl dhparam -out dhparams.pem 2048.

This parameter can only be set in the postgresql.conf file or on the server command line.

How it works

ssl_dh_params_file identifies the location of the SSL DH parameters file. An empty string means use compiled-in default parameters. An empty value uses PostgreSQL's compiled-in DH parameters; the file matters only for cipher suites that perform finite-field Diffie-Hellman exchange.

ssl_dh_params_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_dh_params_file without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Changing ssl_dh_params_file globally without a rollback plan and a client or operational compatibility test.

Workload guidance

OLAP: Analytical throughput is not a reason to weaken DH parameters. Prefer the same reviewed key-exchange policy and measure only after client compatibility is proven.

OLTP: Use a custom ssl_dh_params_file only when finite-field ephemeral-DH cipher suites are intentionally supported and the parameters are generated by an approved current process. Test OpenSSL acceptance and reload before rollout.

SMALL: Leave the file empty to use PostgreSQL's compiled-in parameters unless policy requires a managed custom set; generating or loading custom parameters does not improve capacity.