From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Michael Paquier <michael@paquier.xyz>,
        Magnus Hagander <magnus@hagander.net>,
        Daniel Gustafsson <daniel@yesql.se>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: Update minimum SSL version
In-reply-to: 
 <CA+TgmobM7j=+NN+juu9=urfw0-Bt22QvDdxaPW8O-KK5yegADQ@mail.gmail.com>
References: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
 <224FD25C-BA10-44FA-95AA-F97C35FB3BB0@yesql.se>
 <CABUevEy4meLCVnrTbjU9zoJvRoWUjvmdmUUkaoAqKYkk0MWHYA@mail.gmail.com>
 <20191129125727.GN2505@paquier.xyz> <13786.1575041447@sss.pgh.pa.us>
 <20191130024345.GD99291@paquier.xyz>
 <CA+TgmobM7j=+NN+juu9=urfw0-Bt22QvDdxaPW8O-KK5yegADQ@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Mon, 02 Dec 2019 10:31:40 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <928.1575304768.1@sss.pgh.pa.us>
Date: Mon, 02 Dec 2019 11:39:28 -0500
Message-ID: <929.1575304768@sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> ... However, it would be worth putting in some
> effort to make sure that we give a good error message if this happens.

That's an excellent point, but it looks like we're pretty good
already.  I tried the patch with openssl 0.9.8x, and got this
failure at server start:

FATAL:  ssl_min_protocol_version setting TLSv1.2 not supported by this build

Maybe it'd be worth extending that to show the max supported
version, with some rats-nest of #ifdefs, but I'm not sure if
it's worth the trouble.

			regards, tom lane