On 8/27/26 12:23 PM, surya poondla wrote:
Thank you for the patch. I was reviewing this as part of the commitfest for
v20.
Thanks for the review!> v2 patch no longer applies to master.
Apologies, forgot to rebase the patch after it was partially committed.
Nonetheless the cfbot seems to have capably rebased the patch already.
One minor point in the already-committed docs, "Specifies the named group
to use for TLS key exchange" is singular while a following sentence says
multiple groups can be specified.
Makes sense. Attached tweaks to "group(s)" across the board.
Evan
From c2bd07b9c441ba7559817f4619aa5a1784ccc034 Mon Sep 17 00:00:00 2001
From: Evan Si <[email protected]>
Date: Mon, 1 Jun 2026 18:13:35 +0000
Subject: [PATCH v3] Clarify that ssl_groups is for any key exchange groups
The current wording seems to suggest that the parameter is only meant for DH.
This introduces minor wording tweaks across comments, short_desc, and the docs
to
reflect that it accepts any group.
---
doc/src/sgml/config.sgml | 2 +-
src/backend/libpq/be-secure-openssl.c | 16 ++++++++--------
src/backend/libpq/be-secure.c | 4 ++--
src/backend/utils/misc/guc_parameters.dat | 4 ++--
src/include/libpq/libpq.h | 2 +-
src/test/ssl/t/SSL/Server.pm | 2 +-
6 files changed, 15 insertions(+), 15 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 0165eb9ec02..a14873ee39d 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1587,7 +1587,7 @@ include_dir 'conf.d'
</term>
<listitem>
<para>
- Specifies the named group to use for <acronym>TLS</acronym> key
+ Specifies the named group(s) to use for <acronym>TLS</acronym> key
exchange. It needs to be supported by all clients that
connect. Multiple groups can be specified by using a colon-separated
list. It does not need to match the key type used by the server
diff --git a/src/backend/libpq/be-secure-openssl.c
b/src/backend/libpq/be-secure-openssl.c
index b7ded8a0250..005ec6d0a7e 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -95,7 +95,7 @@ static int alpn_cb(SSL *ssl,
unsigned int inlen,
void *userdata);
static bool initialize_dh(SSL_CTX *context, bool isServerStart);
-static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
+static bool initialize_groups(SSL_CTX *context, bool isServerStart);
static const char *SSLerrmessageExt(unsigned long ecode, const char
*replacement);
static const char *SSLerrmessage(unsigned long ecode);
static bool init_host_context(HostsLine *host, bool isServerStart, bool
*hasWarned)
@@ -510,10 +510,10 @@ be_tls_init(bool isServerStart)
SSL_CTX_set_options(context, SSL_OP_NO_CLIENT_RENEGOTIATION);
#endif
- /* set up ephemeral DH and ECDH keys */
+ /* set up DH parameters and TLS named groups */
if (!initialize_dh(context, isServerStart))
goto error;
- if (!initialize_ecdh(context, isServerStart))
+ if (!initialize_groups(context, isServerStart))
goto error;
/* set up the allowed cipher list for TLSv1.2 and below */
@@ -2118,14 +2118,14 @@ initialize_dh(SSL_CTX *context, bool isServerStart)
}
/*
- * Set ECDH parameters for generating ephemeral Elliptic Curve DH
- * keys. This is much simpler than the DH parameters, as we just
- * need to provide the name of the curve to OpenSSL.
+ * Set the group(s) to use for TLS key exchange. This is much simpler
+ * than the static DH parameters, as we just need to provide the
+ * colon-separated list of group names to OpenSSL.
*/
static bool
-initialize_ecdh(SSL_CTX *context, bool isServerStart)
+initialize_groups(SSL_CTX *context, bool isServerStart)
{
- if (SSL_CTX_set1_groups_list(context, SSLECDHCurve) != 1)
+ if (SSL_CTX_set1_groups_list(context, SSLNamedGroups) != 1)
{
/*
* OpenSSL 3.3.0 introduced proper error messages for group
parsing
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 86ceea72e64..d69106e6545 100644
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -52,8 +52,8 @@ bool ssl_loaded_verify_locations = false;
char *SSLCipherSuites = NULL;
char *SSLCipherList = NULL;
-/* GUC variable for default ECDH curve. */
-char *SSLECDHCurve;
+/* GUC variable for the named groups to use for TLS key exchange. */
+char *SSLNamedGroups;
/* GUC variable: if false, prefer client ciphers */
bool SSLPreferServerCiphers;
diff --git a/src/backend/utils/misc/guc_parameters.dat
b/src/backend/utils/misc/guc_parameters.dat
index 3c5e16ad1e7..1c074ef5b88 100644
--- a/src/backend/utils/misc/guc_parameters.dat
+++ b/src/backend/utils/misc/guc_parameters.dat
@@ -2811,10 +2811,10 @@
},
{ name => 'ssl_groups', type => 'string', context => 'PGC_SIGHUP', group =>
'CONN_AUTH_SSL',
- short_desc => 'Sets the group(s) to use for Diffie-Hellman key exchange.',
+ short_desc => 'Sets the named group(s) to use for TLS key exchange.',
long_desc => 'Multiple groups can be specified using a colon-separated
list.',
flags => 'GUC_SUPERUSER_ONLY',
- variable => 'SSLECDHCurve',
+ variable => 'SSLNamedGroups',
boot_val => 'DEFAULT_SSL_GROUPS',
},
diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.h
index d15073a0a93..906ac742b83 100644
--- a/src/include/libpq/libpq.h
+++ b/src/include/libpq/libpq.h
@@ -116,7 +116,7 @@ extern PGDLLIMPORT char *ssl_dh_params_file;
extern PGDLLIMPORT bool ssl_sni;
extern PGDLLIMPORT char *SSLCipherSuites;
extern PGDLLIMPORT char *SSLCipherList;
-extern PGDLLIMPORT char *SSLECDHCurve;
+extern PGDLLIMPORT char *SSLNamedGroups;
extern PGDLLIMPORT bool SSLPreferServerCiphers;
#ifdef USE_SSL
extern PGDLLIMPORT bool ssl_loaded_verify_locations;
diff --git a/src/test/ssl/t/SSL/Server.pm b/src/test/ssl/t/SSL/Server.pm
index 4400a432f42..624d36ff7ea 100644
--- a/src/test/ssl/t/SSL/Server.pm
+++ b/src/test/ssl/t/SSL/Server.pm
@@ -322,7 +322,7 @@ sub switch_server_cert
ok(unlink($node->data_dir . '/sslconfig.conf'));
$node->append_conf('sslconfig.conf', 'ssl=on');
$node->append_conf('sslconfig.conf',
$backend->set_server_cert(\%params));
- # use lists of ECDH curves and cipher suites for syntax testing
+ # use lists of TLS groups and cipher suites for syntax testing
$node->append_conf('sslconfig.conf', 'ssl_groups=prime256v1:secp521r1');
$node->append_conf('sslconfig.conf',
'ssl_tls13_ciphers=TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256');
--
2.47.3
