Parameter · Connections and Authentication / SSL
ssl_dh_params_file
Location of the SSL DH parameters file. An empty string means use compiled-in default parameters.
- Default:
'' (empty) - Type: string
- Applies: Reload
In plain words
A file with your own Diffie-Hellman parameters, used by some older-style TLS cipher suites (DHE). Empty means PostgreSQL's built-in 2048-bit parameters. Most installations never set it.
For DBAs and operators
Only affects the finite-field DHE-* cipher suites in TLS 1.2 and earlier; elliptic-curve exchange (ECDHE, controlled by ssl_groups) and TLS 1.3 do not use it. Using custom parameters avoids relying on widely shared, precomputed groups. Generate them with openssl dhparam -out dhparams.pem 2048 (or 3072/4096) and point this setting at the file; relative paths are relative to the data directory.
A file that cannot be loaded stops the server at startup, e.g. FATAL: could not open DH parameters file "…": No such file or directory (or could not load DH parameters file: … for an unparsable file); on reload the error is only logged and the built-in parameters are used. With the default ssl_min_protocol_version = TLSv1.2 and modern clients, ECDHE suites are almost always chosen, so this setting matters mainly for compliance scans that flag DH group size.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().