Update minimum SSL version - Mailing list pgsql-hackers

I propose to change the default of ssl_min_protocol_version to TLSv1.2 
(from TLSv1, which means 1.0).  Older versions would still be supported, 
just not by default.

The reason is that TLS 1.0 and 1.1 are either already discouraged or 
deprecated or will be by the time PostgreSQL 13 comes out.  So this move 
would be in the direction of "secure by default".  Specifically, PCI DSS 
disallows the use of TLS 1.0 and discourages 1.1 [0], and browser 
vendors are set to disable 1.0 and 1.1 in their products sometime soon [1].

Using TLS 1.2 requires OpenSSL 1.0.1, released in 2012.  I find this to 
be satisfied in CentOS 6 and Debian jessie (oldoldstable), for example.

More details also in my recent blog post [2].


[0]: 
https://blog.pcisecuritystandards.org/are-you-ready-for-30-june-2018-sayin-goodbye-to-ssl-early-tls
[1]: 
https://arstechnica.com/gadgets/2018/10/browser-vendors-unite-to-end-support-for-20-year-old-tls-1-0/
[2]: 
https://www.2ndquadrant.com/en/blog/setting-ssl-tls-protocol-versions-with-postgresql-12/

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services