From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Update minimum SSL version
Date: Fri, 29 Nov 2019 08:36:00 +0100
Message-ID: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com> (raw)
I propose to change the default of ssl_min_protocol_version to TLSv1.2
(from TLSv1, which means 1.0). Older versions would still be supported,
just not by default.
The reason is that TLS 1.0 and 1.1 are either already discouraged or
deprecated or will be by the time PostgreSQL 13 comes out. So this move
would be in the direction of "secure by default". Specifically, PCI DSS
disallows the use of TLS 1.0 and discourages 1.1 [0], and browser
vendors are set to disable 1.0 and 1.1 in their products sometime soon [1].
Using TLS 1.2 requires OpenSSL 1.0.1, released in 2012. I find this to
be satisfied in CentOS 6 and Debian jessie (oldoldstable), for example.
More details also in my recent blog post [2].
[0]:
https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls
[1]:
https://arstechnica.com/gadgets/2018/10/browser-vendors-unite-to-end-support-for-20-year-old-tls-1-0...
[2]:
https://www.2ndquadrant.com/en/blog/setting-ssl-tls-protocol-versions-with-postgresql-12/
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
From e5d71a3048a8eb17d68ef34caac05ce0bc0b156e Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <peter@eisentraut.org>
Date: Fri, 29 Nov 2019 08:08:03 +0100
Subject: [PATCH] Update minimum SSL version
Change default of ssl_min_protocol_version to TLSv1.2 (from TLSv1,
which means 1.0). Older versions are still supported, just not by
default.
TLS 1.0 is widely deprecated, and TLS 1.1 only slightly less so. All
OpenSSL versions that support TLS 1.1 also support TLS 1.2, so there
would be very little reason to, say, set the default to TLS 1.1
instead on grounds of better compatibility.
---
doc/src/sgml/config.sgml | 6 ++----
src/backend/utils/misc/guc.c | 2 +-
src/backend/utils/misc/postgresql.conf.sample | 2 +-
3 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgmlindex d4d1fe45cc..901744958c 100644--- a/doc/src/sgml/config.sgml+++ b/doc/src/sgml/config.sgml@@ -1365,10 +1365,8 @@ <title>SSL</title>
</para>
<para>
- The default is <literal>TLSv1</literal>, mainly to support older- versions of the <productname>OpenSSL</productname> library. You might- want to set this to a higher value if all software components can- support the newer protocol versions.+ The default is <literal>TLSv1.2</literal>, which satisfies industry+ best practices as of this writing.
</para>
</listitem>
</varlistentry>
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.cindex ba4edde71a..adb277d8f2 100644--- a/src/backend/utils/misc/guc.c+++ b/src/backend/utils/misc/guc.c@@ -4573,7 +4573,7 @@ static struct config_enum ConfigureNamesEnum[] =
GUC_SUPERUSER_ONLY
},
&ssl_min_protocol_version,
- PG_TLS1_VERSION,+ PG_TLS1_2_VERSION,
ssl_protocol_versions_info + 1, /* don't allow PG_TLS_ANY */
NULL, NULL, NULL
},
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sampleindex 46a06ffacd..9541879c1f 100644--- a/src/backend/utils/misc/postgresql.conf.sample+++ b/src/backend/utils/misc/postgresql.conf.sample@@ -105,7 +105,7 @@
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
-#ssl_min_protocol_version = 'TLSv1'+#ssl_min_protocol_version = 'TLSv1.2'
#ssl_max_protocol_version = ''
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
--
2.24.0
Attachments:
[text/plain] 0001-Update-minimum-SSL-version.patch (2.5K, ../b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com/2-0001-Update-minimum-SSL-version.patch)
download | inline diff:
From e5d71a3048a8eb17d68ef34caac05ce0bc0b156e Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <peter@eisentraut.org>
Date: Fri, 29 Nov 2019 08:08:03 +0100
Subject: [PATCH] Update minimum SSL version
Change default of ssl_min_protocol_version to TLSv1.2 (from TLSv1,
which means 1.0). Older versions are still supported, just not by
default.
TLS 1.0 is widely deprecated, and TLS 1.1 only slightly less so. All
OpenSSL versions that support TLS 1.1 also support TLS 1.2, so there
would be very little reason to, say, set the default to TLS 1.1
instead on grounds of better compatibility.
---
doc/src/sgml/config.sgml | 6 ++----
src/backend/utils/misc/guc.c | 2 +-
src/backend/utils/misc/postgresql.conf.sample | 2 +-
3 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgmlindex d4d1fe45cc..901744958c 100644--- a/doc/src/sgml/config.sgml+++ b/doc/src/sgml/config.sgml@@ -1365,10 +1365,8 @@ <title>SSL</title>
</para>
<para>
- The default is <literal>TLSv1</literal>, mainly to support older- versions of the <productname>OpenSSL</productname> library. You might- want to set this to a higher value if all software components can- support the newer protocol versions.+ The default is <literal>TLSv1.2</literal>, which satisfies industry+ best practices as of this writing.
</para>
</listitem>
</varlistentry>
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.cindex ba4edde71a..adb277d8f2 100644--- a/src/backend/utils/misc/guc.c+++ b/src/backend/utils/misc/guc.c@@ -4573,7 +4573,7 @@ static struct config_enum ConfigureNamesEnum[] =
GUC_SUPERUSER_ONLY
},
&ssl_min_protocol_version,
- PG_TLS1_VERSION,+ PG_TLS1_2_VERSION,
ssl_protocol_versions_info + 1, /* don't allow PG_TLS_ANY */
NULL, NULL, NULL
},
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sampleindex 46a06ffacd..9541879c1f 100644--- a/src/backend/utils/misc/postgresql.conf.sample+++ b/src/backend/utils/misc/postgresql.conf.sample@@ -105,7 +105,7 @@
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
#ssl_prefer_server_ciphers = on
#ssl_ecdh_curve = 'prime256v1'
-#ssl_min_protocol_version = 'TLSv1'+#ssl_min_protocol_version = 'TLSv1.2'
#ssl_max_protocol_version = ''
#ssl_dh_params_file = ''
#ssl_passphrase_command = ''
--
2.24.0
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: peter.eisentraut@2ndquadrant.com
Subject: Re: Update minimum SSL version
In-Reply-To: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox