From: Tom Lane <tgl@sss.pgh.pa.us>
To: pramod kg <pramod11287@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: PostgreSQL SSL params
Date: Sun, 13 Jun 2021 11:04:35 -0400
Message-ID: <50173.1623596675@sss.pgh.pa.us> (raw)
In-Reply-To: <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
References: <CAHkcXnx4vZvYcYYkNFiZ3MXgNJq=Jw+iT_LnT0+H==8ri6AJ4g@mail.gmail.com>
pramod kg <pramod11287@gmail.com> writes:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> Still, the security team complains that weak ciphers are accepted at server
> side (They have run some security tests).
The default setting of that is
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
Perhaps the problem is your ill-advised removal of the !aNULL part.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, pramod11287@gmail.com
Subject: Re: PostgreSQL SSL params
In-Reply-To: <50173.1623596675@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox