ssl_dh_params_file

ssl_dh_params_file is the PostgreSQL setting that identifies the location of the SSL DH parameters file.

Note

Fact — official short description: “Location of the SSL DH parameters file.”

Identity

Type , Valuestring: Upstream pg_settings type
Context , Valuesighup: Takes effect after configuration reload
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / SSL: Upstream classification
Latest boot value , Value"": empty string

Lifecycle

Fact	Value
First observed	PG10
Present in	PG10–19 Beta 3
Removed in	No
Introduction commit	`c0a15e07cd71` — Always use 2048 bit DH parameters for OpenSSL ephemeral DH ciphers.
Commit date	2017-07-31
Discussion	thread 1

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG10–19 Beta 3	`""`	—	empty string

How it works

ssl_dh_params_file identifies the location of the SSL DH parameters file. An empty string means use compiled-in default parameters. An empty value uses PostgreSQL’s compiled-in DH parameters; the file matters only for cipher suites that perform finite-field Diffie-Hellman exchange.

ssl_dh_params_file is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Use a custom ssl_dh_params_file only when finite-field ephemeral-DH cipher suites are intentionally supported and the parameters are generated by an approved current process. Test OpenSSL acceptance and reload before rollout.
OLAP	Analytical throughput is not a reason to weaken DH parameters. Prefer the same reviewed key-exchange policy and measure only after client compatibility is proven.
Small nodes	Leave the file empty to use PostgreSQL’s compiled-in parameters unless policy requires a managed custom set; generating or loading custom parameters does not improve capacity.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG10–19 Beta 3 unmodified; OLAP: PG10–19 Beta 3 unmodified; CRIT: PG10–19 Beta 3 unmodified; TINY: PG10–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Editing ssl_dh_params_file without reloading configuration and verifying the effective value and subsequent behavior.
Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.
Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.
Changing ssl_dh_params_file globally without a rollback plan and a client or operational compatibility test.

ssl_ciphers · ssl_tls13_ciphers · ssl_min_protocol_version · ssl_max_protocol_version · ssl_prefer_server_ciphers · ssl_groups