Horton

Re: TLS session tickets disabled?

Jacob Champion <jacob.champion@enterprisedb.com>

View thread View on postgr.es
From: Jacob Champion <jacob.champion@enterprisedb.com>
To: Cameron Vogt <cvogt@automaticcontrols.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>, Daniel Gustafsson <daniel@yesql.se>
Date: 2024-08-15T17:52:32Z
Lists: pgsql-bugs 
On Thu, Aug 15, 2024 at 10:36 AM Cameron Vogt
<cvogt@automaticcontrols.net> wrote:
> I don't know enough about TLS handshakes and session tickets to know where the bug truly lies (PostgreSQL/OpenSSL vs .NET's SslStream).

I'm getting the feeling that this is our bug, and that we should be
using both SSL_OP_NO_TICKET (for TLSv1.2) and SSL_CTX_set_num_tickets
(for TLSv1.3). I don't see any indication in the docs or source that
the latter does anything for 1.2.

(cc'ing Daniel)

--Jacob

Commits

  1. Fix regression in TLS session ticket disabling