Secure Socket Layer (SSL)
| pgpool-II 4.0.11 Documentation | |||
|---|---|---|---|
| Prev | Up | Chapter 5. Server Configuration | Next |
5.13.1. SSL Settings
- ssl ( boolean )
-
When set to on, Pgpool-II enables the SSL for both the frontend and backend communications. Default is off.
Note: ssl_key and ssl_cert must also be configured in order for SSL to work with frontend connections.
Note: For SSL to work Pgpool-II must be build with OpenSSL support. See Section 3.4 for details on building the Pgpool-II .
This parameter can only be set at server start.
- ssl_key ( string )
-
Specifies the path to the private key file to be used for incoming frontend connections. There is no default value for this option, and if left unset SSL will be disabled for incoming frontend connections.
This parameter can only be set at server start.
- ssl_cert ( string )
-
Specifies the path to the public x509 certificate file to be used for the incoming frontend connections. There is no default value for this option, and if left unset SSL will be disabled for incoming frontend connections.
This parameter can only be set at server start.
- ssl_ca_cert ( string )
-
Specifies the path to a PEM format CA certificate files, which can be used to verify the backend server certificates. This is analogous to the -CApath option of the OpenSSL verify(1) command.
This parameter can only be set at server start.
- ssl_ca_cert_dir ( string )
-
Specifies the path to a directory containing PEM format CA certificate files, which can be used to verify the backend server certificates. This is analogous to the -CApath option of the OpenSSL verify(1) command.
The default value for this option is unset, which means no verification takes place. Verification will still happen if this option is not set but a value is provided for ssl_ca_cert .
This parameter can only be set at server start.
- ssl_ciphers ( string )
-
Specifies a list of SSL cipher suites that are allowed to be used by SSL connections. See the ciphers manual page in the OpenSSL package for the syntax of this setting and a list of supported values. Only connections using TLS version 1.2 and lower are affected. There is currently no setting that controls the cipher choices used by TLS version 1.3 connections. The default value is HIGH:MEDIUM:+3DES:!aNULL , which is same as PostgreSQL . See PostgreSQL manual to know why the value is chosen.
This parameter can only be set at server start.
- ssl_prefer_server_ciphers ( boolean )
-
Specifies whether to use the server's SSL cipher preferences, rather than the client's. The default value is false.
This parameter can only be set at server start.
5.13.2. Generating SSL certificates
Certificate handling is outside the scope of this document. The Secure TCP/IP Connections with SSL page at postgresql.org has pointers with sample commands for how to generate self-signed certificates.