Horton

Re: Update minimum SSL version

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael@paquier.xyz>, Magnus Hagander <magnus@hagander.net>, Daniel Gustafsson <daniel@yesql.se>, pgsql-hackers <pgsql-hackers@postgresql.org>
Date: 2019-12-02T15:13:26Z
Lists: pgsql-hackers 
Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes:
> On 2019-11-30 04:06, Tom Lane wrote:
>> I think the real question we have to answer is this: are we intent on
>> making people upgrade ancient openssl installations?

> The trade-off is that this makes the defaults better for the vast 
> majority of users and gives users of really old systems a nudge that 
> they are no longer in compliance with industry best practices.  You need 
> manual steps to set up SSL anyway, so this doesn't introduce an entirely 
> new kind of requirement for the latter group of users.

True.  I'm okay with this as long as we adapt the ssl test suite as
per your other reply.

			regards, tom lane

Commits

  1. Fix handling of OpenSSL's SSL_clear_options

  2. Remove configure check for OpenSSL's SSL_get_current_compression()

  3. Update minimum SSL version