{"Entry":{"collection":"guc","key":"ssl_max_protocol_version","name":"ssl_max_protocol_version","aliases":[],"metadata":{"baseline":false,"boot_human":"Not specified","boot_val":null,"category":"Connections and Authentication / SSL","category_zh":"","changed_in":[],"changes":[{"documentation_changed":false,"fields":{},"from":"11","status":"added","to":"12"}],"content_hash":"5e8acd4e07e775ba3e1636304fac6711fc042d16a6f34019827d9bfea2d948d6","context":"","default_changed_in":[],"default_history":[{"from":"12","to":"19","value":"Empty string"}],"editorial":{"advice":{"olap":"Use the same TLS floor for analytical traffic; benchmark only after correctness because bulk transfer may expose CPU cost but is not a reason to accept obsolete protocols.","oltp":"Treat ssl_max_protocol_version as transport-security policy rather than a performance knob. Follow the organization's TLS baseline and test certificate rotation, reload, and every client class.","small":"Keep ssl_max_protocol_version simple and secure, using managed certificates and library defaults reviewed for the installed OpenSSL version. Rehearse renewal before expiry."},"mechanism":["ssl_max_protocol_version sets the maximum SSL/TLS protocol version to use. An empty value imposes no PostgreSQL-specific ceiling beyond the SSL library, while a named version can intentionally block newer protocols for compatibility testing.","ssl_max_protocol_version is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.","It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy."],"pitfalls":["Editing ssl_max_protocol_version without reloading configuration and verifying the effective value and subsequent behavior.","Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.","Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.","Changing ssl_max_protocol_version globally without a rollback plan and a client or operational compatibility test."],"references":[{"title":"PostgreSQL 19 Beta 4: ssl_max_protocol_version","url":"https://www.postgresql.org/docs/19/runtime-config-connection.html#GUC-SSL-MAX-PROTOCOL-VERSION"},{"title":"PostgreSQL 19 release notes","url":"https://www.postgresql.org/docs/19/release-19.html"}],"related":["ssl_ciphers","ssl_tls13_ciphers","ssl_min_protocol_version","ssl_prefer_server_ciphers","ssl_groups"],"summary":"ssl_max_protocol_version is the PostgreSQL setting that defines the maximum SSL/TLS protocol version to use."},"enumvals":[],"first_version":"12","group":"Connections and Authentication","group_slug":"connection","imported_at":"2026-09-27T17:57:32.027927+08:00","intro_commit":{"authored_at":"2018-11-20T21:49:01+01:00","discussion":["https://www.postgresql.org/message-id/flat/1822da87-b862-041a-9fc2-d0310c3da173@2ndquadrant.com"],"hash":"e73e67c719593c1c16139cc6c516d8379f22f182","subject":"Add settings to control SSL/TLS protocol version","url":"https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=e73e67c719593c1c16139cc6c516d8379f22f182"},"key":"ssl_max_protocol_version","last_version":"20","max_val":"","min_val":"","name":"ssl_max_protocol_version","position":376,"present_in":["12","13","14","15","16","17","18","19","20"],"short_desc":"Sets the maximum SSL/TLS protocol version to use.","short_desc_zh":"","source_rev":"english-manuals:5bc8a04e1ccd677abe712f9b4a1d3f3eb60a572ec2fb1e1151ce84ddf90a8887","unit":"","vartype":"enum"}},"Definition":{"Collection":"guc","Key":"ssl_max_protocol_version","SourceDatabase":"center","Version":"18","SourceTable":"guc","SourceKey":"ssl_max_protocol_version","SourceRevision":"english-manuals:5bc8a04e1ccd677abe712f9b4a1d3f3eb60a572ec2fb1e1151ce84ddf90a8887","Facts":{"boot_val":"","category":"Connections and Authentication / SSL","context":"sighup","description":"Sets the maximum SSL/TLS protocol version to use. Valid values are as for ssl_min_protocol_version, with addition of an empty string, which allows any protocol version. The default is to allow any version. Setting the maximum protocol version is mainly useful for testing or if some component has issues working with a newer protocol. This parameter can only be set in the postgresql.conf file or on the server command line.","doc":{"anchor":"GUC-SSL-MAX-PROTOCOL-VERSION","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"},"documented":true,"enumvals":["","TLSv1","TLSv1.1","TLSv1.2","TLSv1.3"],"extra_desc":null,"lang":"en","max_val":null,"metadata_version":"18","min_val":null,"name":"ssl_max_protocol_version","short_desc":"Sets the maximum SSL/TLS protocol version to use.","source":"pg-settings-source-snapshot","unit":null,"vartype":"enum"},"ManualEvidence":{"doc":{"anchor":"GUC-SSL-MAX-PROTOCOL-VERSION","file":"runtime-config-connection.html","lang":"en","sha256":"567ba928f3e4c4783f548dc8a54f1e748f02bbe163924605f2132eb5b0da440d","slug":"18"}},"MeasuredEvidence":{"metadata_version":"18"}},"Text":{"Collection":"guc","Key":"ssl_max_protocol_version","SourceDatabase":"pgweb","Version":"18","Locale":"zh-Hans","Title":"ssl_max_protocol_version","Summary":"","BodyHTML":"\u003cp\u003e设置要使用的最高 SSL/TLS 协议版本。有效值与\u003ca href=\"/docs/18/runtime-config-connection.html#GUC-SSL-MIN-PROTOCOL-VERSION\" rel=\"nofollow\"\u003essl_min_protocol_version\u003c/a\u003e相同，此外还可设为空字符串，表示允许任意协议版本。默认允许任意版本。设置最高协议版本主要用于测试，或处理某些组件无法正常使用较新协议的问题。\u003c/p\u003e\u003cp\u003e此参数只能在 \u003ccode\u003epostgresql.conf\u003c/code\u003e 文件中或服务器命令行上设置。\u003c/p\u003e","SourceRevision":"2026-09-11@29c86d9","ContentHash":"9721163a803c0aefde37f860d9700e1ebc29dd8fdbfd798f19b6d9d241a3e8c7","Payload":{"carried_from":"","carry_reason":"","doc_html":"\u003cp\u003e设置要使用的最高 SSL/TLS 协议版本。有效值与\u003ca href=\"/docs/18/runtime-config-connection.html#GUC-SSL-MIN-PROTOCOL-VERSION\"\u003essl_min_protocol_version\u003c/a\u003e相同，此外还可设为空字符串，表示允许任意协议版本。默认允许任意版本。设置最高协议版本主要用于测试，或处理某些组件无法正常使用较新协议的问题。\u003c/p\u003e\u003cp\u003e此参数只能在 \u003ccode class=\"filename\"\u003epostgresql.conf\u003c/code\u003e 文件中或服务器命令行上设置。\u003c/p\u003e","doc_same_as":""}},"RequestedLocale":"zh-Hans","Fallback":false,"Versions":["12","13","14","15","16","17","18","19","20"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}