postgres.git / summary / log / commit / refs

commit    807dbce4b668c92c06b507e44da1c6a177bcbd20
Author:   Peter Eisentraut <peter@eisentraut.org>
Date:     Thu Jul 23 15:13:00 2020 +0000
First released in: 14.0, 9.5.23, 9.6.19, 10.14, 11.9, 12.4, 13.0

    doc: Document that ssl_ciphers does not affect TLS 1.3
    
    TLS 1.3 uses a different way of specifying ciphers and a different
    OpenSSL API.  PostgreSQL currently does not support setting those
    ciphers.  For now, just document this.  In the future, support for
    this might be added somehow.
    
    Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
    Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>


 doc/src/sgml/config.sgml | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 44e830aa083..f569aa20154 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1178,16 +1178,22 @@ include_dir 'conf.d'
       </term>
       <listitem>
        <para>
-        Specifies a list of <acronym>SSL</acronym> cipher suites that are allowed to be
-        used on secure connections.  See
-        the <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry> manual page
-        in the <application>OpenSSL</application> package for the syntax of this setting
-        and a list of supported values.
-        This parameter can only be set in the <filename>postgresql.conf</filename>
-        file or on the server command line.
-        The default value is <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>.  The
-        default is usually a reasonable choice unless you have specific
-        security requirements.
+        Specifies a list of <acronym>SSL</acronym> cipher suites that are
+        allowed to be used by SSL connections.  See the
+        <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>
+        manual page in the <application>OpenSSL</application> package for the
+        syntax of this setting and a list of supported values.  Only
+        connections using TLS version 1.2 and lower are affected.  There is
+        currently no setting that controls the cipher choices used by TLS
+        version 1.3 connections.  The default value is
+        <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>.  The default is usually a
+        reasonable choice unless you have specific security requirements.
+       </para>
+
+       <para>
+        This parameter can only be set in the
+        <filename>postgresql.conf</filename> file or on the server command
+        line.
        </para>
 
        <para>


[parent: 028f0c3a86d0]