ssl_ecdh_curve

ssl_ecdh_curve is the PostgreSQL setting that defines the curve to use for ECDH.

Note

Fact — official short description: “Sets the curve to use for ECDH.”

Identity

Type , Valuestring: Upstream pg_settings type
Context , Valuesighup: Takes effect after configuration reload
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / SSL: Upstream classification
Latest boot value , Valueprime256v1: prime256v1

Lifecycle

Fact	Value
First observed	PG9.4
Present in	PG9.4–17
Removed in	PG18
Introduction commit	`3164721462d5` — SSL: Support ECDH key exchange
Commit date	2013-12-07
Discussion	—

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG9.4–17	`prime256v1`	—	prime256v1

How it works

ssl_ecdh_curve sets the curve to use for ECDH. This single-curve control existed through PostgreSQL 17 and was replaced in PostgreSQL 18 by the multi-group ssl_groups setting.

ssl_ecdh_curve is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Do not tune ssl_ecdh_curve on PostgreSQL 18+: migrate reviewed policy to ssl_groups. On older releases, change it only with TLS-library compatibility testing.
OLAP	Use the same reviewed key-exchange policy as OLTP; analytical throughput is not a reason to retain a removed single-curve control.
Small nodes	Keep the supported secure default on PostgreSQL 17 and earlier, then validate the ssl_groups replacement during upgrade.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG17; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG9.4–17 unmodified; OLAP: PG9.4–17 unmodified; CRIT: PG9.4–17 unmodified; TINY: PG9.4–17 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Editing ssl_ecdh_curve without reloading configuration and verifying the effective value and subsequent behavior.
Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.
Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.
Leaving the removed name in PostgreSQL 18 configuration instead of migrating to ssl_groups.

ssl_ciphers · ssl_tls13_ciphers · ssl_min_protocol_version · ssl_max_protocol_version · ssl_prefer_server_ciphers · ssl_groups