pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedUpdate to reflect that TLS1 and TLSv1.1 are now deprecated
4+ messages / 3 participants
[nested] [flat]
* Update to reflect that TLS1 and TLSv1.1 are now deprecated
@ 2021-03-24 09:49 Daniel Gustafsson <daniel@yesql.se>
2021-03-24 12:55 ` Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated Jonathan S. Katz <jkatz@postgresql.org>
2021-03-24 20:07 ` Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated Peter Eisentraut <peter.eisentraut@enterprisedb.com>
0 siblings, 2 replies; 4+ messages in thread
From: Daniel Gustafsson @ 2021-03-24 09:49 UTC (permalink / raw)
To: Pg Docs <pgsql-docs@lists.postgresql.org>
The recently published RFC 8996 deprecates the use of TLSv1 and TLSv1.1, the
attached rewords where we say our default of 1.2 is industry best practice with
a link to the authoritative source.
--
Daniel Gustafsson https://vmware.com/
Attachments:
rfc_8996.diff (application/octet-stream, 1.3K) download
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 1f0e0fc1fb..12a9e28018 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1433,7 +1433,10 @@ include_dir 'conf.d'
<para>
The default is <literal>TLSv1.2</literal>, which satisfies industry
- best practices as of this writing.
+ best practices as of
+ <ulink url="https://tools.ietf.org/html/rfc8996">RFC 8996</ulink>
+ which deprecates <literal>TLSv1</literal> and
+ <literal>TLSv1.1</literal>.
</para>
</listitem>
</varlistentry>
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index be674fbaa9..d701421ca2 100644
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -1811,7 +1811,10 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
version of <productname>OpenSSL</productname> used, older versions
not supporting the most modern protocol versions. If not specified,
the default is <literal>TLSv1.2</literal>, which satisfies industry
- best practices as of this writing.
+ best practices as of
+ <ulink url="https://tools.ietf.org/html/rfc8996">RFC 8996</ulink>
+ which deprecates <literal>TLSv1</literal> and
+ <literal>TLSv1.1</literal>.
</para>
</listitem>
</varlistentry>
* Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated
2021-03-24 09:49 Update to reflect that TLS1 and TLSv1.1 are now deprecated Daniel Gustafsson <daniel@yesql.se>
@ 2021-03-24 12:55 ` Jonathan S. Katz <jkatz@postgresql.org>
1 sibling, 0 replies; 4+ messages in thread
From: Jonathan S. Katz @ 2021-03-24 12:55 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; Pg Docs <pgsql-docs@lists.postgresql.org>
On 3/24/21 5:49 AM, Daniel Gustafsson wrote:
> The recently published RFC 8996 deprecates the use of TLSv1 and TLSv1.1, the
> attached rewords where we say our default of 1.2 is industry best practice with
> a link to the authoritative source.
I would s/as of/stated in/ and add a comma after RFC 8996, but otherwise
+1 from me.
Jonathan
Attachments:
OpenPGP_signature (application/pgp-signature, 839B) download
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated
2021-03-24 09:49 Update to reflect that TLS1 and TLSv1.1 are now deprecated Daniel Gustafsson <daniel@yesql.se>
@ 2021-03-24 20:07 ` Peter Eisentraut <peter.eisentraut@enterprisedb.com>
2021-03-24 20:57 ` Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated Daniel Gustafsson <daniel@yesql.se>
1 sibling, 1 reply; 4+ messages in thread
From: Peter Eisentraut @ 2021-03-24 20:07 UTC (permalink / raw)
To: Daniel Gustafsson <daniel@yesql.se>; Pg Docs <pgsql-docs@lists.postgresql.org>
On 24.03.21 10:49, Daniel Gustafsson wrote:
> The recently published RFC 8996 deprecates the use of TLSv1 and TLSv1.1, the
> attached rewords where we say our default of 1.2 is industry best practice with
> a link to the authoritative source.
The "industry best practices" the original text refers to are things
like PCI-DSS and various announcements by browser vendors. Those best
practices have already been around for long before RFC 8996. I think
this patch is mangling the two concepts of what is best practice and
what is officially deprecated, and since when each of them applies.
If we want to throw RFC 8996 into the mix, we could drop the reference
to best practices and just write something like
"The default is TLSv1.2. Note that all older versions are deprecated as
of this writing (see RFC 8996)."
However, now that I read this, it's not clear from this who is doing the
deprecating. Someone could wonder, does this mean PostgreSQL will drop
support for it?
Maybe the old wording is best and more timeless, and if someone wants to
question it they can do their own research.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated
2021-03-24 09:49 Update to reflect that TLS1 and TLSv1.1 are now deprecated Daniel Gustafsson <daniel@yesql.se>
2021-03-24 20:07 ` Re: Update to reflect that TLS1 and TLSv1.1 are now deprecated Peter Eisentraut <peter.eisentraut@enterprisedb.com>
@ 2021-03-24 20:57 ` Daniel Gustafsson <daniel@yesql.se>
0 siblings, 0 replies; 4+ messages in thread
From: Daniel Gustafsson @ 2021-03-24 20:57 UTC (permalink / raw)
To: Peter Eisentraut <peter.eisentraut@enterprisedb.com>; +Cc: Pg Docs <pgsql-docs@lists.postgresql.org>
> On 24 Mar 2021, at 21:07, Peter Eisentraut <peter.eisentraut@enterprisedb.com> wrote:
>
> On 24.03.21 10:49, Daniel Gustafsson wrote:
>> The recently published RFC 8996 deprecates the use of TLSv1 and TLSv1.1, the
>> attached rewords where we say our default of 1.2 is industry best practice with
>> a link to the authoritative source.
>
> The "industry best practices" the original text refers to are things like PCI-DSS and various announcements by browser vendors. Those best practices have already been around for long before RFC 8996. I think this patch is mangling the two concepts of what is best practice and what is officially deprecated, and since when each of them applies.
Well, since the publishing of RFC 8996 as a BCP document the industry best
practice is to not allow TLSv1.0 or TLSv1.1 at all, so claiming 1.2 as the
default with others available being best practice is concept mangling to some
extent as well.
> However, now that I read this, it's not clear from this who is doing the deprecating. Someone could wonder, does this mean PostgreSQL will drop support for it?
OpenSSL and/or distributions are likely to beat us to it, so users may find
their servers unreachable after upgrading OpenSSL because of the protocol no
longer being available. Maybe it's the below wording which should reflect that
all versions of OpenSSL will restrict the available protocols, either because
of age or RFC 8996?
"Older versions of the OpenSSL library do not support all values; an
error will be raised if an unsupported setting is chosen."
--
Daniel Gustafsson https://vmware.com/
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2021-03-24 20:57 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-03-24 09:49 Update to reflect that TLS1 and TLSv1.1 are now deprecated Daniel Gustafsson <daniel@yesql.se>
2021-03-24 12:55 ` Jonathan S. Katz <jkatz@postgresql.org>
2021-03-24 20:07 ` Peter Eisentraut <peter.eisentraut@enterprisedb.com>
2021-03-24 20:57 ` Daniel Gustafsson <daniel@yesql.se>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox