Re: Add ssl_(supported|shared)_groups to sslinfo

On 5/13/26 11:08 AM, Dmitry Dolgov wrote:
> The new version should address this problem, and includes documentation fix from Cary.

Hi Dmitry,

I like having some way to check the negotiated group akin to
ssl_cipher(), though I am less sure about the utility of displaying
groups that weren't negotiated (as noted upthread).

Assuming we still want to keep those details, I feel the naming could be
a bit clearer. "supported_groups" makes sense in the context of the
handshake, but having the server tell a client a value is "supported"
feels like its saying something about itself rather than the client.
Maybe "client_supported" is more informative?

Regardless, if RSA key exchange is used, SSL_get_negotiated_group is
supposed to return NID_undef. Things will error (Openssl 3.5 example):

postgres=# ALTER SYSTEM SET ssl_ciphers='TLS_RSA_WITH_AES_128_CBC_SHA256';
(...)

PGSSLMAXPROTOCOLVERSION=TLSv1.2 psql "host=localhost dbname=postgres
user=evsi sslmode=require"
(...)

postgres=# SELECT ssl_group_info();
2026-08-29 20:58:41.172 UTC [60034] ERROR: unknown OpenSSL group at
position 0
2026-08-29 20:58:41.172 UTC [60034] STATEMENT: SELECT ssl_group_info();

I feel that listing the (lack of) a negotiated group is the right thing
to do in this case.

Evan