Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jnz4K-0001jj-0Y for pgsql-hackers@arkaria.postgresql.org; Wed, 24 Jun 2020 06:39:36 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1jnz4I-0004Tj-S2 for pgsql-hackers@arkaria.postgresql.org; Wed, 24 Jun 2020 06:39:34 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jnz4I-0004Tc-LS for pgsql-hackers@lists.postgresql.org; Wed, 24 Jun 2020 06:39:34 +0000 Received: from wforward3-smtp.messagingengine.com ([64.147.123.22]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jnz4F-0003Km-Nj for pgsql-hackers@postgresql.org; Wed, 24 Jun 2020 06:39:34 +0000 Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailforward.west.internal (Postfix) with ESMTP id 96C545BB for ; Wed, 24 Jun 2020 02:39:28 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Wed, 24 Jun 2020 02:39:28 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm3; bh=Tfaw7x 2+wKmZ4PbeMEgsVCf+5lGT2/zPmaWDbxBz5UM=; b=tG+DvfbsOuV9YdolT8LEAQ 5xcP+pj90/NhTkXtTwPsj4lDE1LLd6ep4iQDJPQAxcIJFSWvJ0lcvbzz0z75horI 3jYSyjo4hM1TDlb96akbmK5AoA4XocIbtfoIhEs6EjLkVqRFoQXveK3xtNZcG6E7 s4rQPneX00fwjPDn3VGOQMywu7fOyCp2bNKfsfThBmUir06nAkCTkbxY0KDa16r+ /KDcxt220wPHHKDixeu9tIk+LEAQRLtil51CrM9eCFQCOinqkdxKnGxKqu1skNFG 97rVP3MazoRL31ItuAmHIMNAI3Rj7iM/Jmq/d2zH9REO2F4KIZz811XS2YP6WzYA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduhedrudekiedguddutdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurhepvffhufhokffffgggtgfgsehtje ertddtfeejnecuhfhrohhmpefrvghtvghrucfgihhsvghnthhrrghuthcuoehpvghtvghr rdgvihhsvghnthhrrghuthesvdhnughquhgrughrrghnthdrtghomheqnecuggftrfgrth htvghrnhepteefvdfgjeeuieevgfffgeejtedtheduieekveffledugedtgeeigeffleev gfdvnecuffhomhgrihhnpedvnhguqhhurggurhgrnhhtrdgtohhmnecukfhppeelfedrvd egfedrudeluddrvdefkeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgr ihhlfhhrohhmpehpvghtvghrrdgvihhsvghnthhrrghuthesvdhnughquhgrughrrghnth drtghomh X-ME-Proxy: Received: from april.pezone.net (p5df3bfee.dip0.t-ipconnect.de [93.243.191.238]) by mail.messagingengine.com (Postfix) with ESMTPA id A5CD93280063 for ; Wed, 24 Jun 2020 02:39:27 -0400 (EDT) To: pgsql-hackers From: Peter Eisentraut Subject: should libpq also require TLSv1.2 by default? Organization: 2ndQuadrant Message-ID: Date: Wed, 24 Jun 2020 08:39:26 +0200 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk In PG13, we raised the server-side default of ssl_min_protocol_version to TLSv1.2. We also added a connection setting named ssl_min_protocol_version to libpq. But AFAICT, the default value of the libpq setting is empty, so any protocol version will be accepted. Is this what we wanted? Should we raise the default in libpq as well? -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services