Parameter · Connections and Authentication / SSL
ssl_max_protocol_version
Sets the maximum SSL/TLS protocol version to use.
- Default:
— - Type: enum
- Values: · TLSv1 · TLSv1.1 · TLSv1.2 · TLSv1.3
- Applies: Reload
In plain words
The newest TLS version the server will use. Empty (the default) means no limit, which is what you want. Setting a maximum is mainly for testing or working around a broken client.
For DBAs and operators
Valid values are those of ssl_min_protocol_version plus the empty string. Capping at TLSv1.2 is sometimes used temporarily when a middlebox or old library mishandles TLS 1.3, or to test that clients still work with TLS 1.2. Leaving a cap in place means missing TLS 1.3's faster handshake and stronger defaults. If max is lower than min, the SSL configuration cannot be loaded: at startup with ssl = on the server fails with FATAL: could not set SSL protocol version range (DETAIL: "ssl_min_protocol_version" cannot be higher than "ssl_max_protocol_version"); on reload the old SSL settings stay in use. Reload is enough to change it.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().