> On 26 Jun 2020, at 00:44, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> My feeling now is that we'd be better off defaulting
> ssl_min_protocol_version to something nonempty, just to make this
> behavior platform-independent. We certainly can't leave the docs
> as they are.
Yeah, given the concensus in this thread and your findings I think we should
default to TLSv1.2 as originally proposed.
I still think there will be instances of existing connections to old servers
that will all of a sudden break, but it's probably true that it's not a common
setup. Optimizing for the majority and helping the minority with documentation
is IMO the winning move.
> Also, I confirm that the failure looks like
>
> $ psql -h ... -d "dbname=postgres sslmode=require"
> psql: error: could not connect to server: SSL error: unsupported protocol
>
> While that's not *that* awful, if you realize that "protocol" means
> TLS version, many people probably won't without a hint. It does not
> help any that the message doesn't mention either the offered TLS version
> or the version limits being enforced. I'm not sure we can do anything
> about the former, but reducing the number of variables affecting the
> latter seems like a smart idea.
+1
> BTW, the server-side report of the problem looks like
>
> LOG: could not accept SSL connection: wrong version number
I can totally see some thinking that it's the psql version at client side which
is referred to and not the TLS protocol version. Perhaps we should add a hint
there as well?
cheers ./daniel