Parameter · Connections and Authentication / SSL
ssl_min_protocol_version
Sets the minimum SSL/TLS protocol version to use.
- Default:
TLSv1.2 - Type: enum
- Values: TLSv1 · TLSv1.1 · TLSv1.2 · TLSv1.3
- Applies: Reload
In plain words
The oldest TLS protocol version the server accepts. The default TLSv1.2 rejects the outdated TLS 1.0 and 1.1. Raising it to TLSv1.3 is a common hardening step if all clients support it.
For DBAs and operators
SSLv2/SSLv3 are never allowed. The default has been TLSv1.2 since PostgreSQL 13 (it was TLSv1 before). OpenSSL builds that lack a version raise an error when it is chosen. With OpenSSL 3.x, lowering the minimum below TLSv1.2 is not enough on its own: OpenSSL's default security level still refuses TLS 1.0/1.1 unless ssl_ciphers also contains @SECLEVEL=0 (tested with OpenSSL 3.0). A client that only speaks an older version fails with a server log entry like could not accept SSL connection: unsupported protocol; on the client side libpq has the matching ssl_min_protocol_version connection option.
Old JDBC drivers on Java 7, legacy ODBC and some appliances may only do TLS 1.0/1.1; check pg_stat_ssl.version across sessions before raising the minimum:
SELECT version, count(*) FROM pg_stat_ssl WHERE ssl GROUP BY 1;Reload is enough; existing sessions are not affected.
How to change it
Change in postgresql.conf or ALTER SYSTEM, then run SELECT pg_reload_conf().