From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
To: pramod kg <pramod11287@gmail.com>
To: pgsql-admin@postgresql.org
Subject: Re: PostgreSQL SSL params
Date: Mon, 14 Jun 2021 09:53:08 +0200
Message-ID: <487d3054-08c3-1215-b39e-c1d32ec06bde@enterprisedb.com> (raw)
In-Reply-To: <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
References: <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
On 13.06.21 16:20, pramod kg wrote:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> Still, the security team complains that weak ciphers are accepted at
> server side (They have run some security tests).
Try to get a list of specific ciphers that they object to. Then you can
use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.
> Security team
> suggesting to use ssl_dh_params_file.
>
> As per my understanding, DH is a key exchange protocol (read in some
> forum). DH is used to securely generate a common key between two
> parties, other algorithms are used for encryption itself. So I
> believe that dhparam does not help in resolving weak cipher issues. Need
> some insight on this.
I think you are correct on this.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: peter.eisentraut@enterprisedb.com, pramod11287@gmail.com
Subject: Re: PostgreSQL SSL params
In-Reply-To: <487d3054-08c3-1215-b39e-c1d32ec06bde@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox