git.postgresql.org Git - postgresql.git/commitdiff

git projects / postgresql.git / commitdiff

doc: Document that ssl_ciphers does not affect TLS 1.3

author Peter Eisentraut <peter@eisentraut.org>

2020年7月23日 15:13:00 +0000 (17:13 +0200)

committer Peter Eisentraut <peter@eisentraut.org>

2020年7月23日 18:38:45 +0000 (20:38 +0200)

TLS 1.3 uses a different way of specifying ciphers and a different
OpenSSL API. PostgreSQL currently does not support setting those
ciphers. For now, just document this. In the future, support for
this might be added somehow.

Reviewed-by: Jonathan S. Katz <jkatz@postgresql.org>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>

doc/src/sgml/config.sgml patch | blob | blame | history

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml

index 44e830aa083b11a3688ee89cb884f2ffac684ae0..f569aa2015469f18d713f36dbbceb9cb5f5e7111 100644 (file)

--- a/doc/src/sgml/config.sgml

+++ b/doc/src/sgml/config.sgml

@@ -1178,16 +1178,22 @@ include_dir 'conf.d'

</term>

<para>

- Specifies a list of <acronym>SSL</acronym> cipher suites that are allowed to be

- used on secure connections. See

- the <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry> manual page

- in the <application>OpenSSL</application> package for the syntax of this setting

- and a list of supported values.

- This parameter can only be set in the <filename>postgresql.conf</filename>

- file or on the server command line.

- The default value is <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The

- default is usually a reasonable choice unless you have specific

- security requirements.

+ Specifies a list of <acronym>SSL</acronym> cipher suites that are

+ allowed to be used by SSL connections. See the

+ <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>

+ manual page in the <application>OpenSSL</application> package for the

+ syntax of this setting and a list of supported values. Only

+ connections using TLS version 1.2 and lower are affected. There is

+ currently no setting that controls the cipher choices used by TLS

+ version 1.3 connections. The default value is

+ <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The default is usually a

+ reasonable choice unless you have specific security requirements.

+ </para>

+ <para>

+ This parameter can only be set in the

+ <filename>postgresql.conf</filename> file or on the server command

+ line.

</para>

<para>

This is the main PostgreSQL git repository.

RSS Atom