postgres.git / summary / log / commit / refs
commit edfc08652ae35de37c886ba0e9382d72eb2042dd
Author: Peter Eisentraut <peter@eisentraut.org>
Date: Thu Jul 23 15:13:00 2020 +0000
First released in: 14.0, 9.5.23, 9.6.19, 10.14, 11.9, 12.4, 13.0
doc: Document that ssl_ciphers does not affect TLS 1.3
TLS 1.3 uses a different way of specifying ciphers and a different
OpenSSL API. PostgreSQL currently does not support setting those
ciphers. For now, just document this. In the future, support for
this might be added somehow.
Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
doc/src/sgml/config.sgml | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 081809997ac..d0350dffd3e 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1056,11 +1056,14 @@ include_dir 'conf.d'
</term>
<listitem>
<para>
- Specifies a list of <acronym>SSL</> cipher suites that are allowed to be
- used on secure connections. See
- the <citerefentry><refentrytitle>ciphers</></citerefentry> manual page
- in the <application>OpenSSL</> package for the syntax of this setting
- and a list of supported values. The default value is
+ Specifies a list of <acronym>SSL</> cipher suites that are
+ allowed to be used by SSL connections. See the
+ <citerefentry><refentrytitle>ciphers</></citerefentry>
+ manual page in the <application>OpenSSL</> package for the
+ syntax of this setting and a list of supported values. Only
+ connections using TLS version 1.2 and lower are affected. There is
+ currently no setting that controls the cipher choices used by TLS
+ version 1.3 connections. The default value is
<literal>HIGH:MEDIUM:+3DES:!aNULL</>. It is usually reasonable,
unless you have specific security requirements. This parameter can only
be set at server start.
[parent: 47adb24882b2]