I am trying to ensure that the PostgreSQL client's connection to Azure PostgreSQL server (version 10.7) is using TLSv1.2. When I execute psql
command, the connection header shows me protocol TLSv1.2
:
[user ~]# psql -h psql_server.postgres.database.azure.com -p 5432 -U psql_admin_accnt@psql_server -W postgres
Password:
psql (10.7)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.
Yet, when I query pg_stat_ssl
table, I get information, that the current connection is using TLSv1.1
and cipher
information isn't the same either.
postgres=> SELECT * FROM pg_stat_ssl;
pid | ssl | version | cipher | bits | compression | clientdn
--------+-----+---------+----------------------+------+-------------+----------
168648 | t | TLSv1.1 | ECDHE-RSA-AES256-SHA | 256 | f |
(1 row)
Which information is the correct one and I should rely on? Does my psql
connection really uses TLSv1.2
or it is TLSv1.1
as seen from PostgreSQL system tables.
Seems the issue was fixed by Microsoft itself
[user@host ~]$ /usr/pgsql-10/bin/psql "host=psql_server.postgres.database.azure.com port=5432 dbname=dbname user=psql_admin_accnt@psql_server sslmode=require sslrootcert=/path/to/BaltimoreCyberTrustRoot.cer"
Password:
psql (10.11)
SSL connection (protocol: TLSv1.2, cipher: ECDHE-RSA-AES256-GCM-SHA384, bits: 256, compression: off)
Type "help" for help.
dbname=> SELECT * FROM pg_stat_ssl WHERE pid = pg_backend_pid();
pid | ssl | version | cipher | bits | compression | clientdn
--------+-----+---------+-----------------------------+------+-------------+----------
812820 | t | TLSv1.2 | ECDHE-RSA-AES256-GCM-SHA384 | 256 | f |
(1 row)
dbname=> SELECT VERSION();
version
-------------------------------------------------------------
PostgreSQL 10.11, compiled by Visual C++ build 1800, 64-bit
(1 row)
Now, the TLS version is correctly returned.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.