From ef3267523d1ecf53bb6d4ffbeb6a0ae1af84ed47 Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Sat, 7 Dec 2013 08:04:27 -0500 Subject: SSL: Add configuration option to prefer server cipher order By default, OpenSSL (and SSL/TLS in general) lets the client cipher order take priority. This is OK for browsers where the ciphers were tuned, but few PostgreSQL client libraries make the cipher order configurable. So it makes sense to have the cipher order in postgresql.conf take priority over client defaults. This patch adds the setting "ssl_prefer_server_ciphers" that can be turned on so that server cipher order is preferred. Per discussion, this now defaults to on. From: Marko Kreen Reviewed-by: Adrian Klaver --- doc/src/sgml/config.sgml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) (limited to 'doc/src') diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 932ee17b095..1946bb083d9 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -886,6 +886,27 @@ include 'filename' + + ssl_prefer_server_ciphers (bool) + + ssl_prefer_server_ciphers configuration parameter + + + + Specifies whether to use the server's SSL cipher preferences, rather + than the client's. The default is true. + + + + Older PostgreSQL versions do not have this setting and always use the + client's preferences. This setting is mainly for backward + compatibility with those versions. Using the server's preferences is + usually better because it is more likely that the server is appropriately + configured. + + + + password_encryption (boolean) -- cgit v1.2.3