{"Entry":{"collection":"guc","key":"ssl_dh_params_file","name":"ssl_dh_params_file","aliases":[],"metadata":{"baseline":false,"boot_human":"Not specified","boot_val":null,"category":"Connections and Authentication / SSL","category_zh":"","changed_in":["11","18"],"changes":[{"documentation_changed":false,"fields":{},"from":"9.6","status":"added","to":"10"},{"documentation_changed":false,"fields":{"category":{"from":"Connections and Authentication / Security and Authentication","to":"Connections and Authentication / SSL"}},"from":"10","status":"changed","to":"11"},{"documentation_changed":false,"fields":{"extra_desc":{"from":null,"to":"An empty string means use compiled-in default parameters."}},"from":"17","status":"changed","to":"18"}],"content_hash":"e1b59a70ec37e6ac63f5920cd5c901ecd079d0e23a4c3eff6ce564fe2c5220ab","context":"","default_changed_in":[],"default_history":[{"from":"10","to":"19","value":"Empty string"}],"derived_content_hash":"bce587784593b317ee8539e4632f237096592cdd0e9fe9265a2c45ed0fa20270","editorial":{"advice":{"olap":"Analytical throughput is not a reason to weaken DH parameters. Prefer the same reviewed key-exchange policy and measure only after client compatibility is proven.","oltp":"Use a custom ssl_dh_params_file only when finite-field ephemeral-DH cipher suites are intentionally supported and the parameters are generated by an approved current process. Test OpenSSL acceptance and reload before rollout.","small":"Leave the file empty to use PostgreSQL's compiled-in parameters unless policy requires a managed custom set; generating or loading custom parameters does not improve capacity."},"mechanism":["ssl_dh_params_file identifies the location of the SSL DH parameters file. An empty string means use compiled-in default parameters. An empty value uses PostgreSQL's compiled-in DH parameters; the file matters only for cipher suites that perform finite-field Diffie-Hellman exchange.","ssl_dh_params_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.","It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy."],"pitfalls":["Editing ssl_dh_params_file without reloading configuration and verifying the effective value and subsequent behavior.","Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.","Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.","Changing ssl_dh_params_file globally without a rollback plan and a client or operational compatibility test."],"references":[{"title":"PostgreSQL 19 Beta 4: ssl_dh_params_file","url":"https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-SSL-DH-PARAMS-FILE"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["ssl_ciphers","ssl_tls13_ciphers","ssl_min_protocol_version","ssl_max_protocol_version","ssl_prefer_server_ciphers","ssl_groups"],"summary":"ssl_dh_params_file is the PostgreSQL setting that identifies the location of the SSL DH parameters file."},"enumvals":[],"first_version":"10","group":"Connections and Authentication","group_slug":"connection","imported_at":"2026-09-27T17:57:32.013271+08:00","intro_commit":{"authored_at":"2017-07-31T22:36:09+03:00","discussion":["https://www.postgresql.org/message-id/CAMxBoUyjOOautVozN6ofzym828aNrDjuCcOTcCquxjwS-L2hGQ@mail.gmail.com"],"hash":"c0a15e07cd718cb6e455e68328f522ac076a0e4b","subject":"Always use 2048 bit DH parameters for OpenSSL ephemeral DH ciphers.","url":"https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=c0a15e07cd718cb6e455e68328f522ac076a0e4b"},"key":"ssl_dh_params_file","last_version":"20","max_val":"","min_val":"","name":"ssl_dh_params_file","position":371,"present_in":["10","11","12","13","14","15","16","17","18","19","20"],"repair_provenance":{"original_source_revision":"english-manuals:7157244762b6552a6ca3ea7180f2a5c23a54c48c074689e5c6b80f684f36ff25","receipt_sha256":"aa92886028b85fe6e7cb853a8d886f40bcbc4ef39eefc7c3919417b292ae45a0","repair":"wiki-repair-20261023"},"short_desc":"Specifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers.","short_desc_zh":"","source_rev":"wiki-repair-20261023:ac742661e1ad7586f2f38ea64188c6fefb10d4cacda2fe9d14afba41aa3f6bbc","unit":"","vartype":"string"}},"Definition":{"Collection":"guc","Key":"ssl_dh_params_file","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"ssl_dh_params_file","SourceRevision":"wiki-repair-20261023:ac742661e1ad7586f2f38ea64188c6fefb10d4cacda2fe9d14afba41aa3f6bbc","Facts":{"boot_val":"","category":"Connections and Authentication / SSL","context":"sighup","description":"Specifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers. The default is empty, in which case compiled-in default DH parameters used. Using custom DH parameters reduces the exposure if an attacker manages to crack the well-known compiled-in DH parameters. You can create your own DH parameters file with the command openssl dhparam -out dhparams.pem 2048. This parameter can only be set in the postgresql.conf file or on the server command line.","description_zh":"指定包含 Diffie-Hellman 参数的文件名，这些参数用于所谓临时 DH 系列的 SSL 密码套件。默认值为空，此时使用编译时内置的默认 DH 参数。如果攻击者破解了众所周知的内置 DH 参数，使用自定义 DH 参数可以降低由此带来的风险。可以用命令 openssl dhparam -out dhparams.pem 2048 创建自己的 DH 参数文件。 这个参数只能在 postgresql.conf 文件中或者服务器命令行上设置。","description_zh_html":"\u003cp\u003e\n        指定包含 Diffie-Hellman 参数的文件名，这些参数用于所谓临时 DH 系列的 SSL 密码套件。默认值为空，此时使用编译时内置的默认 DH 参数。如果攻击者破解了众所周知的内置 DH 参数，使用自定义 DH 参数可以降低由此带来的风险。可以用命令 \u003ccode class=\"command\"\u003eopenssl dhparam -out dhparams.pem 2048\u003c/code\u003e 创建自己的 DH 参数文件。\n       \u003c/p\u003e\u003cp\u003e\n        这个参数只能在 \u003ccode class=\"filename\"\u003epostgresql.conf\u003c/code\u003e 文件中或者服务器命令行上设置。\n       \u003c/p\u003e","doc":{"anchor":"GUC-SSL-DH-PARAMS-FILE","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"},"documented":true,"enumvals":null,"extra_desc":"An empty string means use compiled-in default parameters.","lang":"en","max_val":null,"metadata_version":"18","min_val":null,"name":"ssl_dh_params_file","short_desc":"Location of the SSL DH parameters file.","source":"pg-settings-source-snapshot","translation_provenance":{"inputs":[{"kind":"current-pgdoc-translation","path":"/Users/vonng/pgsty/pgdoc/zh/18/html/runtime-config-connection.html","sha256":"f4e5e4debc927cfa154bbdd71f3bf2eda8130ac3acace1109fe7d45ef2a3456b"}],"kind":"same-version-pgdoc","locale":"zh-Hans","source_revision":"b1b500221dbe5437cfca004d6b04d3f6e422765d","version":"18"},"unit":null,"vartype":"string","zh_from":"same-version-pgdoc"},"ManualEvidence":{"doc":{"anchor":"GUC-SSL-DH-PARAMS-FILE","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"ssl_dh_params_file","SourceDatabase":"center","Version":"18","Locale":"en","Title":"ssl_dh_params_file","Summary":"Specifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers. The default is empty, in which case compiled-in default DH parameters used. Using custom DH parameters reduces the exposure if an attacker manages to crack the well-known compiled-in DH parameters. You can create your own DH parameters file with the command openssl dhparam -out dhparams.pem 2048. This parameter can only be set in the postgresql.conf file or on the server command line.","BodyHTML":"\u003cp\u003eSpecifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers. The default is empty, in which case compiled-in default DH parameters used. Using custom DH parameters reduces the exposure if an attacker manages to crack the well-known compiled-in DH parameters. You can create your own DH parameters file with the command openssl dhparam -out dhparams.pem 2048. This parameter can only be set in the postgresql.conf file or on the server command line.\u003c/p\u003e","SourceRevision":"wiki-repair-20261023:ac742661e1ad7586f2f38ea64188c6fefb10d4cacda2fe9d14afba41aa3f6bbc","ContentHash":"b8171fef966811f9ced16ba3afb313204a18ac7d29c490a1eee9652306cffb0e","Payload":{"description":"Specifies the name of the file containing Diffie-Hellman parameters used for so-called ephemeral DH family of SSL ciphers. The default is empty, in which case compiled-in default DH parameters used. Using custom DH parameters reduces the exposure if an attacker manages to crack the well-known compiled-in DH parameters. You can create your own DH parameters file with the command openssl dhparam -out dhparams.pem 2048. This parameter can only be set in the postgresql.conf file or on the server command line."}},"RequestedLocale":"en","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}