# ssl_ecdh_curve

> ssl_ecdh_curve is the PostgreSQL setting that defines the curve to use for ECDH.
---

> [!NOTE]
> **Fact — official short description:** “Sets the curve to use for ECDH.”

## Identity {#identity}

| Field | Value | Meaning |
| --- | --- | --- |
| Type | `string` | Upstream pg_settings type |
| Context | `sighup` | Takes effect after configuration reload |
| Unit | — | Raw unit |
| Range | — | Raw limits in the last observed version |
| Enum values | — | — for non-enum types |
| Category | Connections and Authentication / SSL | Upstream classification |
| Latest boot value | `prime256v1` | prime256v1 |
{.fields meta="-"}

## Lifecycle {#lifecycle}

| Fact | Value |
| --- | --- |
| First observed | PG9.4 |
| Present in | PG9.4–17 |
| Removed in | PG18 |
| Introduction commit | [`3164721462d5`](https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=3164721462d547fa2d15e2a2f07eb086a3590fd5) — SSL: Support ECDH key exchange |
| Commit date | 2013-12-07 |
| Discussion | — |

## Default history {#default-history}

| Versions | Raw `boot_val` | Unit | Human value |
| --- | --- | --- | --- |
| PG9.4–17 | `prime256v1` | — | prime256v1 |
{.full-width caption="Measured PG9.0–19 Beta 3 boot defaults"}

## How it works {#mechanism}

ssl_ecdh_curve sets the curve to use for ECDH. This single-curve control existed through PostgreSQL 17 and was replaced in PostgreSQL 18 by the multi-group ssl_groups setting.

ssl_ecdh_curve is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

## Tuning advice {#tuning-advice}

> [!TIP]
> **Advice.** These are workload-specific starting points and must be validated with measurements.

| Workload | Guidance |
| --- | --- |
| OLTP | Do not tune ssl_ecdh_curve on PostgreSQL 18+: migrate reviewed policy to ssl_groups. On older releases, change it only with TLS-library compatibility testing. |
| OLAP | Use the same reviewed key-exchange policy as OLTP; analytical throughput is not a reason to retain a removed single-curve control. |
| Small nodes | Keep the supported secure default on PostgreSQL 17 and earlier, then validate the ssl_groups replacement during upgrade. |
{.full-width}

## Pigsty {#pigsty}

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG17; this does not assert current Pigsty support for that historical or beta release.

| Template | Effective value | Versus upstream boot | Source expression |
| --- | --- | --- | --- |
| OLTP | Unmodified | — | — |
| OLAP | Unmodified | — | — |
| CRIT | Unmodified | — | — |
| TINY | Unmodified | — | — |
{.full-width}

> [!CAUTION]
> **Advice — pending human review.** Fact from the current Pigsty template projection: OLTP: PG9.4–17 unmodified; OLAP: PG9.4–17 unmodified; CRIT: PG9.4–17 unmodified; TINY: PG9.4–17 unmodified. No Pigsty-specific rationale is inferred from an absent override.

## Common pitfalls {#common-pitfalls}

- Editing ssl_ecdh_curve without reloading configuration and verifying the effective value and subsequent behavior.
- Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.
- Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.
- Leaving the removed name in PostgreSQL 18 configuration instead of migrating to ssl_groups.

## Related parameters {#related-parameters}

[`ssl_ciphers`](/parameters/ssl-ciphers/) · [`ssl_tls13_ciphers`](/parameters/ssl-tls13-ciphers/) · [`ssl_min_protocol_version`](/parameters/ssl-min-protocol-version/) · [`ssl_max_protocol_version`](/parameters/ssl-max-protocol-version/) · [`ssl_prefer_server_ciphers`](/parameters/ssl-prefer-server-ciphers/) · [`ssl_groups`](/parameters/ssl-groups/)

## References {#references}

- [PostgreSQL 17 — ssl_ecdh_curve](https://www.postgresql.org/docs/17/runtime-config-connection.html#GUC-SSL-ECDH-CURVE)
- [Machine-readable GUC export](/data/guc.jsonl)