database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Add settings to control SSL/TLS protocol version

Browse Source 
For example:

    ssl_min_protocol_version = 'TLSv1.1'
    ssl_max_protocol_version = 'TLSv1.2'

Reviewed-by: Steve Singer <steve@ssinger.info>
Discussion: https://www.postgresql.org/message-id/flat/1822da87-b862-041a-9fc2-d0310c3da173@2ndquadrant.com
This commit is contained in:
Peter Eisentraut
2018-11-20 21:49:01 +01:00
parent 2d9140ed26
commit e73e67c719
6 changed files with 214 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
doc/src/sgml/config.sgml
View File

@ -1291,6 +1291,50 @@ include_dir 'conf.d'
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-min-protocol-version" xreflabel="ssl_min_protocol_version">
<term><varname>ssl_min_protocol_version</varname> (<type>enum</type>)
<indexterm>
<primary><varname>ssl_min_protocol_version</varname> configuration parameter</primary>
</indexterm>
</term>
<listitem>
<para>
Sets the minimum SSL/TLS protocol version to use. Valid values are
currently: <literal>TLSv1</literal>, <literal>TLSv1.1</literal>,
<literal>TLSv1.2</literal>, <literal>TLSv1.3</literal>. Older
versions of the <productname>OpenSSL</productname> library do not
support all values; an error will be raised if an unsupported setting
is chosen. Protocol versions before TLS 1.0, namely SSL version 2 and
3, are always disabled.
</para>
<para>
The default is <literal>TLSv1</literal>, mainly to support older
versions of the <productname>OpenSSL</productname> library. You might
want to set this to a higher value if all software components can
support the newer protocol versions.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-max-protocol-version" xreflabel="ssl_max_protocol_version">
<term><varname>ssl_max_protocol_version</varname> (<type>enum</type>)
<indexterm>
<primary><varname>ssl_max_protocol_version</varname> configuration parameter</primary>
</indexterm>
</term>
<listitem>
<para>
Sets the maximum SSL/TLS protocol version to use. Valid values are as
for <xref linkend="guc-ssl-min-protocol-version"/>, with addition of
an empty string, which allows any protocol version. The default is to
allow any version. Setting the maximum protocol version is mainly
useful for testing or if some component has issues working with a
newer protocol.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-dh-params-file" xreflabel="ssl_dh_params_file">
<term><varname>ssl_dh_params_file</varname> (<type>string</type>)
<indexterm>