On 5/13/26 11:08 AM, Dmitry Dolgov wrote:
> The new version should address this problem, and includes documentation fix from Cary.
Hi Dmitry,
I like having some way to check the negotiated group akin to
ssl_cipher(), though I am less sure about the utility of displaying
groups that weren't negotiated (as noted upthread).
Assuming we still want to keep those details, I feel the naming could be
a bit clearer. "supported_groups" makes sense in the context of the
handshake, but having the server tell a client a value is "supported"
feels like its saying something about itself rather than the client.
Maybe "client_supported" is more informative?
Regardless, if RSA key exchange is used, SSL_get_negotiated_group is
supposed to return NID_undef. Things will error (Openssl 3.5 example):
postgres=# ALTER SYSTEM SET ssl_ciphers='TLS_RSA_WITH_AES_128_CBC_SHA256';
(...)
PGSSLMAXPROTOCOLVERSION=TLSv1.2 psql "host=localhost dbname=postgres
user=evsi sslmode=require"
(...)
postgres=# SELECT ssl_group_info();
2026-08-29 20:58:41.172 UTC [60034] ERROR: unknown OpenSSL group at
position 0
2026-08-29 20:58:41.172 UTC [60034] STATEMENT: SELECT ssl_group_info();
I feel that listing the (lack of) a negotiated group is the right thing
to do in this case.
Evan
