> I believe that pre7-3 SSL clients will work in 7.3.1, or am I wrong?

In 7.3 the SSL protocol switched from SSLv2 to TLSv1. If the server
method is switched to SSLv23_method it will be backwords compatable with
pre-7.3 clients without sacrificing the added security of TLSv1 for
newer stuff. There's been a lot of other changes to the SSL code between
7.2 and 7.3, but I've tested this out and haven't found any problems.
I've included a patch to src/backend/libpq/be-secure.c if you're
interested.

        --Nate

--- be-secure.c 13 Dec 2002 18:06:44 -0000 1.3
+++ be-secure.c 18 Dec 2002 04:16:19 -0000
@@ -587,7 +587,7 @@
        {
                SSL_library_init();
                SSL_load_error_strings();
-               SSL_context = SSL_CTX_new(TLSv1_method());
+               SSL_context = SSL_CTX_new(SSLv23_method());
                if (!SSL_context)
                {
                        postmaster_error("failed to create SSL
                        context: %s",

Tue, 17 Dec 2002 22:18:38 -0600 (CST)
Nathan Mueller <nmueller@cs.wisc.edu>
Re: 7.3.1 stamped

I am confused.  How can we switch back to SSLv23_method and still be
compatible with TLSv1_method.  Does SSLv23_method support both?

The SSL author didn't like SSLv23_method (especially SSLv2) and I am not
confident to question his decision.  We will just have to break backward
compatibility with pre-7.3 clients.  No one else has mentioned it as a
problem, and in fact most have probably already upgraded to 7.3, so we
should be OK.

---------------------------------------------------------------------------

Nathan Mueller wrote:
> > I believe that pre7-3 SSL clients will work in 7.3.1, or am I wrong?
> 
> In 7.3 the SSL protocol switched from SSLv2 to TLSv1. If the server
> method is switched to SSLv23_method it will be backwords compatable with
> pre-7.3 clients without sacrificing the added security of TLSv1 for
> newer stuff. There's been a lot of other changes to the SSL code between
> 7.2 and 7.3, but I've tested this out and haven't found any problems.
> I've included a patch to src/backend/libpq/be-secure.c if you're
> interested.
> 
>         --Nate
> 
> --- be-secure.c 13 Dec 2002 18:06:44 -0000 1.3
> +++ be-secure.c 18 Dec 2002 04:16:19 -0000
> @@ -587,7 +587,7 @@
>         {
>                 SSL_library_init();
>                 SSL_load_error_strings();
> -               SSL_context = SSL_CTX_new(TLSv1_method());
> +               SSL_context = SSL_CTX_new(SSLv23_method());
>                 if (!SSL_context)
>                 {
>                         postmaster_error("failed to create SSL
>                         context: %s",
> 

-- 
  Bruce Momjian                        |  http://candle.pha.pa.us
  pgman@candle.pha.pa.us               |  (610) 359-1001
  +  If your life is a hard drive,     |  13 Roberts Road
  +  Christ can be your backup.        |  Newtown Square, Pennsylvania 19073

Tue, 17 Dec 2002 23:22:04 -0500 (EST)
Bruce Momjian <pgman@candle.pha.pa.us>
Re: 7.3.1 stamped