From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Magnus Hagander <magnus@hagander.net>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
In-reply-to: <F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
 <4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
 <CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
 <DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
 <2305871.1593125045@sss.pgh.pa.us>
 <F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Fri, 26 Jun 2020 14:33:04 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2339795.1593177583.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 26 Jun 2020 09:19:43 -0400
Message-ID: <2339796.1593177583@sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
>> On 26 Jun 2020, at 00:44, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> BTW, the server-side report of the problem looks like
>> LOG:  could not accept SSL connection: wrong version number

> I can totally see some thinking that it's the psql version at client sid=
e which
> is referred to and not the TLS protocol version.  Perhaps we should add =
a hint
> there as well?

Not sure.  We can't fix it in the case we're mainly concerned about,
namely an out-of-support server version.  At the same time, it's certainly
true that "version number" is way too under-specified in this context.
Maybe improving this against the day that TLSv2 exists would be smart.

			regards, tom lane