pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedchange TLS version in postgres
3+ messages / 2 participants
[nested] [flat]
* change TLS version in postgres
@ 2021-06-20 21:25 Yambu <hyambu@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Yambu @ 2021-06-20 21:25 UTC (permalink / raw)
To: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Hi
I'm using postgres version 10, may i know how to change the tls version
from 1.0 to a higher version?
regards
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: change TLS version in postgres
@ 2021-06-20 22:24 Tom Lane <tgl@sss.pgh.pa.us>
parent: Yambu <hyambu@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Tom Lane @ 2021-06-20 22:24 UTC (permalink / raw)
To: Yambu <hyambu@gmail.com>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Yambu <hyambu@gmail.com> writes:
> I'm using postgres version 10, may i know how to change the tls version
> from 1.0 to a higher version?
If you have a new enough OpenSSL library, it should automatically
prefer more recent protocol versions.
If what you're concerned about is actively preventing use of lower
protocol versions, the only way to do that within PG itself is the
ssl_min_protocol_version setting, which exists in v12 and later.
However, you ought to be able to achieve the same effect by
adjusting the system-wide OpenSSL configuration: set
MinProtocol=TLSv1.2 in openssl.cnf (wherever that is on your
machine). You might find your distro already did that, btw.
I am not sure, but it might be possible to use a private openssl
config file if you want to only affect Postgres and not other
daemons on the machine. See the OpenSSL documentation.
regards, tom lane
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: change TLS version in postgres
@ 2021-06-21 03:02 Yambu <hyambu@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 3+ messages in thread
From: Yambu @ 2021-06-21 03:02 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Pgsql-admin <pgsql-admin@lists.postgresql.org>
Thank you Tom
On Mon, Jun 21, 2021 at 12:24 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> Yambu <hyambu@gmail.com> writes:
> > I'm using postgres version 10, may i know how to change the tls version
> > from 1.0 to a higher version?
>
> If you have a new enough OpenSSL library, it should automatically
> prefer more recent protocol versions.
>
> If what you're concerned about is actively preventing use of lower
> protocol versions, the only way to do that within PG itself is the
> ssl_min_protocol_version setting, which exists in v12 and later.
> However, you ought to be able to achieve the same effect by
> adjusting the system-wide OpenSSL configuration: set
> MinProtocol=TLSv1.2 in openssl.cnf (wherever that is on your
> machine). You might find your distro already did that, btw.
>
> I am not sure, but it might be possible to use a private openssl
> config file if you want to only affect Postgres and not other
> daemons on the machine. See the OpenSSL documentation.
>
> regards, tom lane
>
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2021-06-21 03:02 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-06-20 21:25 change TLS version in postgres Yambu <hyambu@gmail.com>
2021-06-20 22:24 ` Tom Lane <tgl@sss.pgh.pa.us>
2021-06-21 03:02 ` Yambu <hyambu@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox