Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1iaap4-0005bM-Mg for pgsql-hackers@arkaria.postgresql.org; Fri, 29 Nov 2019 07:36:15 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.89) (envelope-from ) id 1iaap2-0000Jb-Vd for pgsql-hackers@arkaria.postgresql.org; Fri, 29 Nov 2019 07:36:12 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1iaap1-0000JU-Lb for pgsql-hackers@lists.postgresql.org; Fri, 29 Nov 2019 07:36:12 +0000 Received: from wout1-smtp.messagingengine.com ([64.147.123.24]) by magus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1iaaow-00015i-Ht for pgsql-hackers@postgresql.org; Fri, 29 Nov 2019 07:36:11 +0000 Received: from compute7.internal (compute7.nyi.internal [10.202.2.47]) by mailout.west.internal (Postfix) with ESMTP id 24CFA777 for ; Fri, 29 Nov 2019 02:36:03 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute7.internal (MEProxy); Fri, 29 Nov 2019 02:36:03 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=content-type:date:from:message-id :mime-version:subject:to:x-me-proxy:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm1; bh=oyYbrBfKGjaK8l7dC7rlg2Wildpxa OueUbgSeL6JU+g=; b=STdNp6HqzSlnTUAouFLz1VCnlmhaXepIf63y+KtqAiBAb F7tEk9wedBwn5KsTsRHIrnOgVNmkquMu3kqBqUBUbUPyTb3kTaaLMTK45O/eWIlu eaB6YvI3H4JGIIz7Q91cPuPD/CcmiTY91KYDaCK2tbVnzUPQ7kKJUqCIoqRfyg+u /LHCKqcydPlWPOiMb8E1To2bjG2ZAAa8oZcRlEeM+ibBDUykibiLn8UE6n7xxG21 sMDaQooi2CZ4aHlTQVCiyDFnUgP4btnoyzOL/r7RUwAKKaTKDN10gduJXrqOmf3k Nl1J6dKb+3XVeiD0RXiHk7tIz5vjOstdL++B+EyLQ== X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedufedrudeikedguddutdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpqfgfvfdpuffrtefokffrpgfnqfgh necuuegrihhlohhuthemuceftddtnecunecujfgurhephffuvfhokffffgggtgesmhdtre ertdefjeenucfhrhhomheprfgvthgvrhcugfhishgvnhhtrhgruhhtuceophgvthgvrhdr vghishgvnhhtrhgruhhtsedvnhguqhhurggurhgrnhhtrdgtohhmqeenucffohhmrghinh epvdhnughquhgrughrrghnthdrtghomhdpphgtihhsvggtuhhrihhthihsthgrnhgurghr ughsrdhorhhgpdgrrhhsthgvtghhnhhitggrrdgtohhmnecukfhppeelfedrvdegvddrud egjedrjeelnecurfgrrhgrmhepmhgrihhlfhhrohhmpehpvghtvghrrdgvihhsvghnthhr rghuthesvdhnughquhgrughrrghnthdrtghomhenucevlhhushhtvghrufhiiigvpedt X-ME-Proxy: Received: from april.pezone.net (p5df2934f.dip0.t-ipconnect.de [93.242.147.79]) by mail.messagingengine.com (Postfix) with ESMTPA id BEFD480062 for ; Fri, 29 Nov 2019 02:36:01 -0500 (EST) From: Peter Eisentraut Subject: Update minimum SSL version To: pgsql-hackers Organization: 2ndQuadrant Message-ID: Date: Fri, 29 Nov 2019 08:36:00 +0100 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------70A1236AB26265C30F938085" Content-Language: en-US List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk This is a multi-part message in MIME format. --------------70A1236AB26265C30F938085 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit I propose to change the default of ssl_min_protocol_version to TLSv1.2 (from TLSv1, which means 1.0). Older versions would still be supported, just not by default. The reason is that TLS 1.0 and 1.1 are either already discouraged or deprecated or will be by the time PostgreSQL 13 comes out. So this move would be in the direction of "secure by default". Specifically, PCI DSS disallows the use of TLS 1.0 and discourages 1.1 [0], and browser vendors are set to disable 1.0 and 1.1 in their products sometime soon [1]. Using TLS 1.2 requires OpenSSL 1.0.1, released in 2012. I find this to be satisfied in CentOS 6 and Debian jessie (oldoldstable), for example. More details also in my recent blog post [2]. [0]: https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls [1]: https://arstechnica.com/gadgets/2018/10/browser-vendors-unite-to-end-support-for-20-year-old-tls-1-0/ [2]: https://www.2ndquadrant.com/en/blog/setting-ssl-tls-protocol-versions-with-postgresql-12/ -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services --------------70A1236AB26265C30F938085 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="0001-Update-minimum-SSL-version.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-Update-minimum-SSL-version.patch" RnJvbSBlNWQ3MWEzMDQ4YThlYjE3ZDY4ZWYzNGNhYWMwNWNlMGJjMGIxNTZlIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQZXRlciBFaXNlbnRyYXV0IDxwZXRlckBlaXNlbnRy YXV0Lm9yZz4KRGF0ZTogRnJpLCAyOSBOb3YgMjAxOSAwODowODowMyArMDEwMApTdWJqZWN0 OiBbUEFUQ0hdIFVwZGF0ZSBtaW5pbXVtIFNTTCB2ZXJzaW9uCgpDaGFuZ2UgZGVmYXVsdCBv ZiBzc2xfbWluX3Byb3RvY29sX3ZlcnNpb24gdG8gVExTdjEuMiAoZnJvbSBUTFN2MSwKd2hp Y2ggbWVhbnMgMS4wKS4gIE9sZGVyIHZlcnNpb25zIGFyZSBzdGlsbCBzdXBwb3J0ZWQsIGp1 c3Qgbm90IGJ5CmRlZmF1bHQuCgpUTFMgMS4wIGlzIHdpZGVseSBkZXByZWNhdGVkLCBhbmQg VExTIDEuMSBvbmx5IHNsaWdodGx5IGxlc3Mgc28uICBBbGwKT3BlblNTTCB2ZXJzaW9ucyB0 aGF0IHN1cHBvcnQgVExTIDEuMSBhbHNvIHN1cHBvcnQgVExTIDEuMiwgc28gdGhlcmUKd291 bGQgYmUgdmVyeSBsaXR0bGUgcmVhc29uIHRvLCBzYXksIHNldCB0aGUgZGVmYXVsdCB0byBU TFMgMS4xCmluc3RlYWQgb24gZ3JvdW5kcyBvZiBiZXR0ZXIgY29tcGF0aWJpbGl0eS4KLS0t CiBkb2Mvc3JjL3NnbWwvY29uZmlnLnNnbWwgICAgICAgICAgICAgICAgICAgICAgfCA2ICsr LS0tLQogc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9ndWMuYyAgICAgICAgICAgICAgICAgIHwg MiArLQogc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9wb3N0Z3Jlc3FsLmNvbmYuc2FtcGxlIHwg MiArLQogMyBmaWxlcyBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKyksIDYgZGVsZXRpb25zKC0p CgpkaWZmIC0tZ2l0IGEvZG9jL3NyYy9zZ21sL2NvbmZpZy5zZ21sIGIvZG9jL3NyYy9zZ21s L2NvbmZpZy5zZ21sCmluZGV4IGQ0ZDFmZTQ1Y2MuLjkwMTc0NDk1OGMgMTAwNjQ0Ci0tLSBh L2RvYy9zcmMvc2dtbC9jb25maWcuc2dtbAorKysgYi9kb2Mvc3JjL3NnbWwvY29uZmlnLnNn bWwKQEAgLTEzNjUsMTAgKzEzNjUsOCBAQCA8dGl0bGU+U1NMPC90aXRsZT4KICAgICAgICA8 L3BhcmE+CiAKICAgICAgICA8cGFyYT4KLSAgICAgICAgVGhlIGRlZmF1bHQgaXMgPGxpdGVy YWw+VExTdjE8L2xpdGVyYWw+LCBtYWlubHkgdG8gc3VwcG9ydCBvbGRlcgotICAgICAgICB2 ZXJzaW9ucyBvZiB0aGUgPHByb2R1Y3RuYW1lPk9wZW5TU0w8L3Byb2R1Y3RuYW1lPiBsaWJy YXJ5LiAgWW91IG1pZ2h0Ci0gICAgICAgIHdhbnQgdG8gc2V0IHRoaXMgdG8gYSBoaWdoZXIg dmFsdWUgaWYgYWxsIHNvZnR3YXJlIGNvbXBvbmVudHMgY2FuCi0gICAgICAgIHN1cHBvcnQg dGhlIG5ld2VyIHByb3RvY29sIHZlcnNpb25zLgorICAgICAgICBUaGUgZGVmYXVsdCBpcyA8 bGl0ZXJhbD5UTFN2MS4yPC9saXRlcmFsPiwgd2hpY2ggc2F0aXNmaWVzIGluZHVzdHJ5Cisg ICAgICAgIGJlc3QgcHJhY3RpY2VzIGFzIG9mIHRoaXMgd3JpdGluZy4KICAgICAgICA8L3Bh cmE+CiAgICAgICA8L2xpc3RpdGVtPgogICAgICA8L3Zhcmxpc3RlbnRyeT4KZGlmZiAtLWdp dCBhL3NyYy9iYWNrZW5kL3V0aWxzL21pc2MvZ3VjLmMgYi9zcmMvYmFja2VuZC91dGlscy9t aXNjL2d1Yy5jCmluZGV4IGJhNGVkZGU3MWEuLmFkYjI3N2Q4ZjIgMTAwNjQ0Ci0tLSBhL3Ny Yy9iYWNrZW5kL3V0aWxzL21pc2MvZ3VjLmMKKysrIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlz Yy9ndWMuYwpAQCAtNDU3Myw3ICs0NTczLDcgQEAgc3RhdGljIHN0cnVjdCBjb25maWdfZW51 bSBDb25maWd1cmVOYW1lc0VudW1bXSA9CiAJCQlHVUNfU1VQRVJVU0VSX09OTFkKIAkJfSwK IAkJJnNzbF9taW5fcHJvdG9jb2xfdmVyc2lvbiwKLQkJUEdfVExTMV9WRVJTSU9OLAorCQlQ R19UTFMxXzJfVkVSU0lPTiwKIAkJc3NsX3Byb3RvY29sX3ZlcnNpb25zX2luZm8gKyAxLCAv KiBkb24ndCBhbGxvdyBQR19UTFNfQU5ZICovCiAJCU5VTEwsIE5VTEwsIE5VTEwKIAl9LApk aWZmIC0tZ2l0IGEvc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9wb3N0Z3Jlc3FsLmNvbmYuc2Ft cGxlIGIvc3JjL2JhY2tlbmQvdXRpbHMvbWlzYy9wb3N0Z3Jlc3FsLmNvbmYuc2FtcGxlCmlu ZGV4IDQ2YTA2ZmZhY2QuLjk1NDE4NzljMWYgMTAwNjQ0Ci0tLSBhL3NyYy9iYWNrZW5kL3V0 aWxzL21pc2MvcG9zdGdyZXNxbC5jb25mLnNhbXBsZQorKysgYi9zcmMvYmFja2VuZC91dGls cy9taXNjL3Bvc3RncmVzcWwuY29uZi5zYW1wbGUKQEAgLTEwNSw3ICsxMDUsNyBAQAogI3Nz bF9jaXBoZXJzID0gJ0hJR0g6TUVESVVNOiszREVTOiFhTlVMTCcgIyBhbGxvd2VkIFNTTCBj aXBoZXJzCiAjc3NsX3ByZWZlcl9zZXJ2ZXJfY2lwaGVycyA9IG9uCiAjc3NsX2VjZGhfY3Vy dmUgPSAncHJpbWUyNTZ2MScKLSNzc2xfbWluX3Byb3RvY29sX3ZlcnNpb24gPSAnVExTdjEn Cisjc3NsX21pbl9wcm90b2NvbF92ZXJzaW9uID0gJ1RMU3YxLjInCiAjc3NsX21heF9wcm90 b2NvbF92ZXJzaW9uID0gJycKICNzc2xfZGhfcGFyYW1zX2ZpbGUgPSAnJwogI3NzbF9wYXNz cGhyYXNlX2NvbW1hbmQgPSAnJwotLSAKMi4yNC4wCgo= --------------70A1236AB26265C30F938085--