| From: | Peter Eisentraut <peter(dot)eisentraut(at)enterprisedb(dot)com> |
|---|---|
| To: | pramod kg <pramod11287(at)gmail(dot)com>, pgsql-admin(at)postgresql(dot)org |
| Subject: | Re: PostgreSQL SSL params |
| Date: | 2021-06-14 07:53:08 |
| Message-ID: | 487d3054-08c3-1215-b39e-c1d32ec06bde@enterprisedb.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-admin |
On 13.06.21 16:20, pramod kg wrote:
> I have enabled ssl on my PG servers and have set ssl_cipher to "HIGH".
> Still, the security team complains that weak ciphers are accepted at
> server side (They have run some security tests).
Try to get a list of specific ciphers that they object to. Then you can
use "openssl ciphers" and SSL_CTX_set_cipher_list(3) to tune your settings.
> Security team
> suggesting to use ssl_dh_params_file.
>
> As per my understanding, DH is a key exchange protocol (read in some
> forum). DH is used to securely generate a common key between two
> parties, other algorithms are used for encryption itself. So I
> believe that dhparam does not help in resolving weak cipher issues. Need
> some insight on this.
I think you are correct on this.
| From | Date | Subject | |
|---|---|---|---|
| Next Message | pramod kg | 2021-06-14 08:47:41 | Re: PostgreSQL SSL params |
| Previous Message | Tom Lane | 2021-06-14 06:00:44 | Re: pg_restore can't re-mat mat view that uses a function which depends on another mat view |