Subject: Re: PostgreSQL SSL params
To: pramod kg <pramod11287@gmail.com>, pgsql-admin@postgresql.org
References: 
 <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Message-ID: <487d3054-08c3-1215-b39e-c1d32ec06bde@enterprisedb.com>
Date: Mon, 14 Jun 2021 09:53:08 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0)
 Gecko/20100101 Thunderbird/78.10.2
MIME-Version: 1.0
In-Reply-To: 
 <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Archived-At: 
 <https://www.postgresql.org/message-id/487d3054-08c3-1215-b39e-c1d32ec06bde%40enterprisedb.com>
Precedence: bulk

On 13.06.21 16:20, pramod kg wrote:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH". 
> Still, the security team complains that weak ciphers are accepted at 
> server side (They have run some security tests).

Try to get a list of specific ciphers that they object to.  Then you can 
use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.

> Security team 
> suggesting to use ssl_dh_params_file.
> 
> As per my understanding, DH is a key exchange protocol (read in some 
> forum). DH is used to securely generate a common key between two 
> parties, other algorithms are used for encryption itself. So I 
> believe that dhparam does not help in resolving weak cipher issues. Need 
> some insight on this.

I think you are correct on this.