mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-01-30 19:00:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Doc: add v10 release notes entries for the DH parameter changes.

Browse Source
This commit is contained in:
Heikki Linnakangas 2017-07-31 22:47:07 +03:00
parent c0a15e07cd
commit 4427b515e6
1 changed files with 37 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
doc/src/sgml/release-10.sgml
View File

@ -408,6 +408,43 @@
<listitem>
<!--
2017-07-31 [c0a15e07c] Always use 2048 bit DH parameters for OpenSSL ephemeral
-->
<para>
Add configuration option <xref linkend="guc-ssl-dh-params-file"> to
specify filename for custom OpenSSL DH parameters (Heikki Linnakangas)
</para>
<para>
This replaces the hardcoded, undocumented <filename>dh1024.pem</>
filename. Note that <filename>dh1024.pem</> is no longer used by default;
you must set the option to use custom DH parameters.
</para>
</listitem>
<listitem>
<!--
2017-07-31 [c0a15e07c] Always use 2048 bit DH parameters for OpenSSL ephemeral
-->
<para>
Increase the size of DH parameters used for OpenSSL ephemeral DH ciphers
to 2048 bits (Heikki Linnakangas)
</para>
<para>
The size of the compiled-in DH parameters has been increased from 1024
to 2048 bits, making DH key exchange more resistent to a brute-force
attack. However, some old SSL implementations, notably some revisions of
Java Runtime Environment version 6, will not accept DH parameters longer
than 1024 bits, and will not be able to connect over SSL. As a
work-around, you can use custom 1024-bit DH parameters, instead of the
compiled-in defaults. See <xref linkend="guc-ssl-dh-params-file"> for
information on using custom DH parameters.
</para>
</listitem>
<listitem>
<!--
2017-02-13 [7ada2d31f] Remove contrib/tsearch2.
-->
<para>