diff options
| -rw-r--r-- | src/backend/libpq/be-secure.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index c6573b40e7b..b620ee73a10 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -935,6 +935,14 @@ initialize_SSL(void) SSL_CTX_set_tmp_dh_callback(SSL_context, tmp_dh_cb); SSL_CTX_set_options(SSL_context, SSL_OP_SINGLE_DH_USE | SSL_OP_NO_SSLv2); + /* disallow SSL session tickets */ +#ifdef SSL_OP_NO_TICKET /* added in openssl 0.9.8f */ + SSL_CTX_set_options(SSL_context, SSL_OP_NO_TICKET); +#endif + + /* disallow SSL session caching, too */ + SSL_CTX_set_session_cache_mode(SSL_context, SSL_SESS_CACHE_OFF); + /* set up the allowed cipher list */ if (SSL_CTX_set_cipher_list(SSL_context, SSLCipherSuites) != 1) elog(FATAL, "could not set the cipher list (no valid ciphers available)"); |