Received: from localhost (unknown [200.46.204.183]) by mail.postgresql.org (Postfix) with ESMTP id DB083632582 for ; Thu, 22 Jan 2009 14:27:53 -0400 (AST) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 61083-05 for ; Thu, 22 Jan 2009 14:27:50 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from locust.cns.vt.edu (locust.cns.vt.edu [198.82.169.14]) by mail.postgresql.org (Postfix) with ESMTP id 4920463242D for ; Thu, 22 Jan 2009 14:27:48 -0400 (AST) Received: by locust.cns.vt.edu (Postfix, from userid 986) id 3FFEF118DCA; Thu, 22 Jan 2009 13:27:47 -0500 (EST) Date: Thu, 22 Jan 2009 13:27:47 -0500 From: Ray Stell To: Carol Walter Cc: pgsql-admin@postgresql.org Subject: Re: ssl database connection problems... Message-ID: <20090122182747.GA22330@cns.vt.edu> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.17 (2007-11-01) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=0 tagged_above=0 required=5 tests=none X-Spam-Level: X-Archive-Number: 200901/125 X-Sequence-Number: 31172 On Thu, Jan 22, 2009 at 10:35:22AM -0500, Carol Walter wrote: > I'm still having problems with ssl. My ssl_ciphers line in postgresql.conf > looks as the following: > > ssl_ciphers 'ALL:!ADH:!LOW:@STRENGTH' this parameter was not available in 8.2.x when I tested so what I say here has little basis. 1. no equal sign? 2. isn't this a list of values to choose from so should it be: ssl_ciphers='ALL' ??? 3. the doc does not say what happens if the the guy is commented out: http://www.postgresql.org/docs/8.3/interactive/runtime-config-connection.html#GUC-SSL-CIPHERS I wonder what the default is? 4. the doc: http://www.postgresql.org/docs/8.3/interactive/ssl-tcp.html says: "a list of ciphers can be specified" which makes it sound optional, but again, I'm without clue. > Do you have any ideas for me to try to solve this problem? Well, I think when I did it with 8.2 it was by trial and error in a test environment. I just kept changing stuff and kept a matrix of where I had been. There is a finite number of things to change. It might be good to make a list of possible variable/values. I've not done that, but it might be good for us to try to construct a howto.