> On 26 Jun 2020, at 00:44, Tom Lane <t...@sss.pgh.pa.us> wrote: > My feeling now is that we'd be better off defaulting > ssl_min_protocol_version to something nonempty, just to make this > behavior platform-independent. We certainly can't leave the docs > as they are.
Yeah, given the concensus in this thread and your findings I think we should default to TLSv1.2 as originally proposed. I still think there will be instances of existing connections to old servers that will all of a sudden break, but it's probably true that it's not a common setup. Optimizing for the majority and helping the minority with documentation is IMO the winning move. > Also, I confirm that the failure looks like > > $ psql -h ... -d "dbname=postgres sslmode=require" > psql: error: could not connect to server: SSL error: unsupported protocol > > While that's not *that* awful, if you realize that "protocol" means > TLS version, many people probably won't without a hint. It does not > help any that the message doesn't mention either the offered TLS version > or the version limits being enforced. I'm not sure we can do anything > about the former, but reducing the number of variables affecting the > latter seems like a smart idea. +1 > BTW, the server-side report of the problem looks like > > LOG: could not accept SSL connection: wrong version number I can totally see some thinking that it's the psql version at client side which is referred to and not the TLS protocol version. Perhaps we should add a hint there as well? cheers ./daniel
