Let OpenSSL auto-select DH parameters by default

From: Peter Eisentraut <peter(at)eisentraut(dot)org>
To: pgsql-hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Let OpenSSL auto-select DH parameters by default
Date: 2026-08-11 13:24:14
Message-ID: 953bceb7-340d-4717-9682-0ebe65c4b57e@eisentraut.org
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

I was curious about the hardcoded FILE_DH2048 in
src/include/libpq/libpq-be.h -- how did it get there, do we ever need to
update it, how do we know, etc. -- and it seems that there is a more
modern approach that allows us to get rid of it.

Previously, if ssl_dh_params_file was not set, the compiled-in default
parameters in FILE_DH2048 were used. Instead, we can call
SSL_CTX_set_dh_auto() and have OpenSSL choose appropriate, well-known,
and appropriately sized parameters. In particular, the size of the
parameters is chosen consistent with the size of the key and
certificate, and so it can automatically grow with new standards and
best practices. This facility was not available at the time FILE_DH2048
was added, but it is now available in all relevant OpenSSL and LibreSSL
versions.

I think this new behavior is preferable (also consistent with
recommendations in the OpenSSL documentation), so I have tweaked the
documentation a bit in that direction.

There was also some not-very-modern text about this in README.SSL,
which I have deleted.

Note that if you use a very small certificate/key size, then this
could mean that the size of the chosen DH parameters could also end up
smaller than the previous hard-coded default. But that could only
happen if you disregarded all current security best practices anyway.

Note a small behavior change: Previously, if loading the DH file
failed during a server reload, the system would then fall back to
using the built-in parameters, instead of failing the reload and
keeping the old SSL context, which is what it would do if some other
aspect of reinitializing SSL would fail. I think this is actually a
bug. I have fixed this here as part of reflowing the relevant function.

Anyway, this is all very complicated and obscure. Reviews are welcome.

Attachment Content-Type Size
0001-Let-OpenSSL-auto-select-DH-parameters-by-default.patch text/plain 9.0 KB

Browse pgsql-hackers by date

  From Date Subject
Next Message Bertrand Drouvot 2026-08-11 13:50:49 Re: pgstat: Flush some statistics within running transactions, take 2
Previous Message Jonathan Gonzalez V. 2026-08-11 13:19:31 Re: [PATCH] Harden recovery/t/051_effective_wal_level against WAL recycling