diff options
| -rw-r--r-- | doc/src/sgml/config.sgml | 6 | ||||
| -rw-r--r-- | src/backend/utils/misc/guc.c | 2 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 2 | ||||
| -rw-r--r-- | src/test/ssl/t/SSLServer.pm | 4 |
4 files changed, 8 insertions, 6 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 4ec13f3311c..53ac14490a1 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1365,10 +1365,8 @@ include_dir 'conf.d' </para> <para> - The default is <literal>TLSv1</literal>, mainly to support older - versions of the <productname>OpenSSL</productname> library. You might - want to set this to a higher value if all software components can - support the newer protocol versions. + The default is <literal>TLSv1.2</literal>, which satisfies industry + best practices as of this writing. </para> </listitem> </varlistentry> diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 5fccc9683ee..ba74bf9f7dc 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -4573,7 +4573,7 @@ static struct config_enum ConfigureNamesEnum[] = GUC_SUPERUSER_ONLY }, &ssl_min_protocol_version, - PG_TLS1_VERSION, + PG_TLS1_2_VERSION, ssl_protocol_versions_info + 1, /* don't allow PG_TLS_ANY */ NULL, NULL, NULL }, diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 46a06ffacd4..9541879c1fa 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -105,7 +105,7 @@ #ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers #ssl_prefer_server_ciphers = on #ssl_ecdh_curve = 'prime256v1' -#ssl_min_protocol_version = 'TLSv1' +#ssl_min_protocol_version = 'TLSv1.2' #ssl_max_protocol_version = '' #ssl_dh_params_file = '' #ssl_passphrase_command = '' diff --git a/src/test/ssl/t/SSLServer.pm b/src/test/ssl/t/SSLServer.pm index 005955a2ff7..26b5964f4fe 100644 --- a/src/test/ssl/t/SSLServer.pm +++ b/src/test/ssl/t/SSLServer.pm @@ -132,6 +132,10 @@ sub configure_test_server_for_ssl print $conf "listen_addresses='$serverhost'\n"; print $conf "log_statement=all\n"; + # Accept even old TLS versions so that builds with older OpenSSL + # can run the test suite. + print $conf "ssl_min_protocol_version='TLSv1'\n"; + # enable SSL and set up server key print $conf "include 'sslconfig.conf'\n"; |