diff --git a/gpdb-doc/dita/ref_guide/config_params/guc-list.xml b/gpdb-doc/dita/ref_guide/config_params/guc-list.xml index 59e204cad1845b9b93f171933f3da4981711b471..4e37cfda9cb1c4ecb44c505e51cf9092ce6dd2d8 100644 --- a/gpdb-doc/dita/ref_guide/config_params/guc-list.xml +++ b/gpdb-doc/dita/ref_guide/config_params/guc-list.xml @@ -8410,8 +8410,16 @@ ssl_ciphers -

Specifies a list of SSL ciphers that are allowed to be used on secure connections. See the - openssl manual page for a list of supported ciphers.

+

Specifies a list of SSL ciphers that are allowed to be used on secure connections. + ssl_ciphers + overrides any ciphers string specified in /etc/openssl.cnf. The + default value ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH enables all ciphers except + for ADH, LOW, EXP, and MD5 ciphers, and prioritizes ciphers by their strength.

+ With TLS 1.2 some ciphers in MEDIUM and HIGH strength still use NULL encryption (no + encryption for transport), which the default ssl_ciphers string allows. To + bypass NULL ciphers with TLS 1.2 use a string such as + TLSv1.2:!eNULL:!aNULL. +

See the openssl manual page for a list of supported ciphers.

@@ -8427,7 +8435,7 @@ string - ALL + ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH master

system

restart

 diff --git a/gpdb-doc/dita/security-guide/topics/Authenticate.xml b/gpdb-doc/dita/security-guide/topics/Authenticate.xml index b1264b161f7f95e0de5bc82ff1db76449f1ad15b..4db07b50e92fc6339c054ceaaa3042c15b54bb6a 100644 --- a/gpdb-doc/dita/security-guide/topics/Authenticate.xml +++ b/gpdb-doc/dita/security-guide/topics/Authenticate.xml @@ -532,7 +532,15 @@ Hostssl testdb all 192.168.0.0/16 cert map=gpuser
  • ssl_renegotiation_limit integer. Specifies the data limit before key renegotiation.
  • ssl_ciphers - string. Lists SSL ciphers that are allowed.
    • + string. Configures the list SSL ciphers that are allowed. + ssl_ciphers + overrides any ciphers string specified in /etc/openssl.cnf. + The default value ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH enables all + ciphers except for ADH, LOW, EXP, and MD5 ciphers, and prioritizes ciphers by their + strength.With TLS 1.2 some ciphers in MEDIUM and HIGH strength still use NULL + encryption (no encryption for transport), which the default + ssl_ciphers string allows. To bypass NULL ciphers with TLS 1.2 + use a string such as TLSv1.2:!eNULL:!aNULL.

    The following SSL server files can be found in the Master Data Directory: