From the SSL_CTX_new man page:

"SSLv23_method(void), SSLv23_server_method(void), SSLv23_client_method(void)

 A TLS/SSL connection established with these methods will understand the SSLv2,
 SSLv3, and TLSv1 protocol. A client will send out SSLv2 client hello messages
 and will indicate that it also understands SSLv3 and TLSv1. A server will
 understand SSLv2, SSLv3, and TLSv1 client hello messages. This is the best
 choice when compatibility is a concern."

This will maintain backwards compatibility for those us that don't use
TLS connections ...

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index ccb434cdd06ec6d0bcc2aa103fb1ce342cc89a99..a501df64d5456622150818ccb28fb40c2df6b31c 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.19 2002/12/14 18:39:14 momjian Exp $
+ *   $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.20 2002/12/18 13:15:12 pgsql Exp $
  *
  *   Since the server static private key ($DataDir/server.key)
  *   will normally be stored unencrypted so that the database
@@ -587,7 +587,7 @@ initialize_SSL(void)
    {
        SSL_library_init();
        SSL_load_error_strings();
-       SSL_context = SSL_CTX_new(TLSv1_method());
+       SSL_context = SSL_CTX_new(SSLv23_method());
        if (!SSL_context)
        {
            postmaster_error("failed to create SSL context: %s",

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index b0cec2608a58121a7a074d98cdd0c6878061c2ea..6f613aec0697b7deb61a0482158d2becbdb1bfdd 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.17 2002/12/12 22:42:39 momjian Exp $
+ *   $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.18 2002/12/18 13:15:15 pgsql Exp $
  *
  * NOTES
  *   The client *requires* a valid server certificate.  Since
@@ -714,7 +714,7 @@ initialize_SSL(PGconn *conn)
    {
        SSL_library_init();
        SSL_load_error_strings();
-       SSL_context = SSL_CTX_new(TLSv1_method());
+       SSL_context = SSL_CTX_new(SSLv23_method());
        if (!SSL_context)
        {
            printfPQExpBuffer(&conn->errorMessage,