Improvements for encrypted client connection handling
Details
| Detail name | Value |
|---|---|
| Changelog Number | 11680 |
| Type | New Feature |
| Status | Resolved |
| Fix Versions | Exasol 8.0.0, Exasol 7.1.7 |
| Resolution Date | 2022-03-16 |
New Feature
Exasol 7.1 contained this Feature as a Preview Feature.
It is now activated per default.
Details
Added support for TLS 1.3.
We now allow specifying a list of allowed ciphers. These can be specified with the two new DB-parameters
-tls12CipherList: List of ciphers TLS 1.2 may use. (default: 'HIGH:-SSLv2:-SSLv3:-TLSv1:-eNULL:-aNULL:-3DES:-SHA1')
-tls13CipherList: List of ciphers TLS 1.3 may use. (default: '', allowing all TLS 1.3 ciphers)
The cipher list format is described here: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html.
Changing the cipher list parameters could result in clients not being able to connect to Exasol anymore. Please test all configuration changes carefully.
Fallback
If for whatever reason you have to stick to the previous behavior for encrypted client connections, this can be enabled by using the following DB parameter.
-useLegacyTlsMethod: If true, the legacy TLS method is used. (default: false)
