ssl_ecdh_curve

Definition PG 17 manual

Specifies the name of the curve to use in ECDH key exchange. It needs to be supported by all clients that connect. It does not need to be the same curve used by the server's Elliptic Curve key. This parameter can only be set in the postgresql.conf file or on the server command line. The default is prime256v1.

OpenSSL names for the most common curves are: prime256v1 (NIST P-256), secp384r1 (NIST P-384), secp521r1 (NIST P-521). The full list of available curves can be shown with the command openssl ecparam -list_curves. Not all of them are usable in TLS though.

How it works

ssl_ecdh_curve sets the curve to use for ECDH. This single-curve control existed through PostgreSQL 17 and was replaced in PostgreSQL 18 by the multi-group ssl_groups setting.

ssl_ecdh_curve is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_ecdh_curve without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Leaving the removed name in PostgreSQL 18 configuration instead of migrating to ssl_groups.

Workload guidance

OLAP: Use the same reviewed key-exchange policy as OLTP; analytical throughput is not a reason to retain a removed single-curve control.

OLTP: Do not tune ssl_ecdh_curve on PostgreSQL 18+: migrate reviewed policy to ssl_groups. On older releases, change it only with TLS-library compatibility testing.

SMALL: Keep the supported secure default on PostgreSQL 17 and earlier, then validate the ssl_groups replacement during upgrade.