Hi Evan, Thank you for the patch. I was reviewing this as part of the commitfest for v20.
I agree with the premise, and it's easy to demonstrate. With OpenSSL 3.6.2, "openssl list -tls-groups" reports MLKEM512, MLKEM768 and MLKEM1024, none of which are Diffie-Hellman so the old short_desc is simply inaccurate for a growing set of valid values. v2 patch no longer applies to master. The config.sgml change is already upstream (55136e378c6 on master, backpatched as a5112c9b62d on REL_18_STABLE branch), and the be-secure-openssl.c prototype change has drifted because init_host_context() gained a hasWarned argument in 9e526a14d7c. "git apply --3way" absorbs both and leaves exactly the intended +14/-14 across five files, so a straight rebase with the docs change dropped is all that's needed. On the remaining rename: - SSLNamedGroups is consistent with existing style; we already have SSLCipherList for ssl_ciphers and SSLCipherSuites for ssl_tls13_ciphers, so mirroring the GUC name exactly isn't the convention. - Keeping "ssl_ecdh_curve" in map_old_guc_names() is correct. A grep of the patched tree leaves only that entry and the "versions before 18.0" note in config.sgml, which are both deliberate. I built the rebased patch with --with-openssl (OpenSSL 3.6.2) with no warnings, and "postgres --describe-config" shows the new description. One minor point in the already-committed docs, "Specifies the named group to use for TLS key exchange" is singular while a following sentence says multiple groups can be specified. Overall the patch looks in a good shape. Regards, Surya Poondla
