The following bug has been logged on the website:
Bug reference: 16815
Logged by: - -
Email address: frank.buettner@mdc-berlin.de
PostgreSQL version: 13.1
Operating system: CentOS8
Description:
The openssl version that comes with CentOS8 will support both curves.
And using the curves with the apache for example will work, so it is not an
OS related problem.
SSLOpenSSLConfCmd Groups "X448:X25519:secp521r1:secp384r1" will work.
But try the same curves on postgresql 13 will fail.
ssl_ecdh_curve = 'X448' or
ssl_ecdh_curve = 'X25519'
will fail with:
FATAL: ECDH: could not create key
using the lower X it fails with:
FATAL: ECDH: unrecognized curve name: x25519
Only the NIST ones like secp521r1 will work.
It looks like the curves with the upper X are known, but not correct
initialized.