diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2013-12-07 08:04:27 -0500 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2013-12-07 08:13:50 -0500 |
| commit | ef3267523d1ecf53bb6d4ffbeb6a0ae1af84ed47 (patch) | |
| tree | 4d542c256ae38c43a2561b54c1b104683565125a /doc | |
| parent | 8fe3d90d34c26083e9856cb134dfe17a5f6999aa (diff) | |
| download | postgresql-ef3267523d1ecf53bb6d4ffbeb6a0ae1af84ed47.tar.gz | |
SSL: Add configuration option to prefer server cipher order
By default, OpenSSL (and SSL/TLS in general) lets the client cipher
order take priority. This is OK for browsers where the ciphers were
tuned, but few PostgreSQL client libraries make the cipher order
configurable. So it makes sense to have the cipher order in
postgresql.conf take priority over client defaults.
This patch adds the setting "ssl_prefer_server_ciphers" that can be
turned on so that server cipher order is preferred. Per discussion,
this now defaults to on.
From: Marko Kreen <markokr@gmail.com>
Reviewed-by: Adrian Klaver <adrian.klaver@gmail.com>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/src/sgml/config.sgml | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 932ee17b09..1946bb083d 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -886,6 +886,27 @@ include 'filename' </listitem> </varlistentry> + <varlistentry id="guc-ssl-prefer-server-ciphers" xreflabel="ssl_prefer_server_ciphers"> + <term><varname>ssl_prefer_server_ciphers</varname> (<type>bool</type>)</term> + <indexterm> + <primary><varname>ssl_prefer_server_ciphers</> configuration parameter</primary> + </indexterm> + <listitem> + <para> + Specifies whether to use the server's SSL cipher preferences, rather + than the client's. The default is true. + </para> + + <para> + Older PostgreSQL versions do not have this setting and always use the + client's preferences. This setting is mainly for backward + compatibility with those versions. Using the server's preferences is + usually better because it is more likely that the server is appropriately + configured. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-password-encryption" xreflabel="password_encryption"> <term><varname>password_encryption</varname> (<type>boolean</type>)</term> <indexterm> |