From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
Date: Fri, 26 Jun 2020 09:19:43 -0400
Message-ID: <2339796.1593177583@sss.pgh.pa.us> (raw)
In-Reply-To: <F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
<4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
<CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
<DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
<2305871.1593125045@sss.pgh.pa.us>
<F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
Daniel Gustafsson <daniel@yesql.se> writes:
>> On 26 Jun 2020, at 00:44, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> BTW, the server-side report of the problem looks like
>> LOG: could not accept SSL connection: wrong version number
> I can totally see some thinking that it's the psql version at client side which
> is referred to and not the TLS protocol version. Perhaps we should add a hint
> there as well?
Not sure. We can't fix it in the case we're mainly concerned about,
namely an out-of-support server version. At the same time, it's certainly
true that "version number" is way too under-specified in this context.
Maybe improving this against the day that TLSv2 exists would be smart.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, magnus@hagander.net, peter.eisentraut@2ndquadrant.com
Subject: Re: should libpq also require TLSv1.2 by default?
In-Reply-To: <2339796.1593177583@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox