</para>

<para>

The default is <literal>TLSv1</literal>, mainly to support older

versions of the <productname>OpenSSL</productname> library. You might

want to set this to a higher value if all software components can

support the newer protocol versions.

The default is <literal>TLSv1.2</literal>, which satisfies industry

best practices as of this writing.

</para>

</listitem>

</varlistentry>

},

&ssl_min_protocol_version,

PG_TLS1_VERSION,

PG_TLS1_2_VERSION,

ssl_protocol_versions_info+1,/* don't allow PG_TLS_ANY */

NULL,NULL,NULL

},

#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers

#ssl_prefer_server_ciphers = on

#ssl_ecdh_curve = 'prime256v1'

#ssl_min_protocol_version = 'TLSv1'

#ssl_min_protocol_version = 'TLSv1.2'

#ssl_max_protocol_version = ''

#ssl_dh_params_file = ''

#ssl_passphrase_command = ''

print$conf"listen_addresses='$serverhost'\n";

print$conf"log_statement=all\n";

print$conf"ssl_min_protocol_version='TLSv1'\n";

print$conf"include 'sslconfig.conf'\n";