Oracle Cloud Infrastructure Documentation

Applying an Updated Custom Configuration for the TLS Version

Apply the latest TLS version to a database system that uses a custom configuration by creating and applying an updated configuration.

Note

Don't use a configuration that has Inactive status, or that has a ssl_max_protocol_version value of TLSv1.2.

For database systems that don't use custom configurations, see Applying the Updated Default Configuration for the TLS Version.

Before You Begin

Note

Changing ssl_max_protocol_version requires a database system restart. The updated setting takes effect after the restart, and later connections negotiate TLS using the new protocol range. Existing database connections close during the restart.

Before you edit a configuration's TLS version or otherwise change the permitted protocol range, verify that all clients, drivers, proxies, and other network components support the intended TLS versions. For conceptual information about TLS, servers, and clients, see TLS, Servers, and Clients.

    1. Create a new custom configuration based on the latest active default configuration that uses TLSv1.3.
      1. On the Configurations list page, limit the list to those of Active status and Default configuration type (active default configurations). If you need help finding the list page or the configuration, see Listing OCI Database with PostgreSQL Configurations.
      2. Select the latest active default configuration.
      3. On the configuration's details page, select System variables (Read only).
      4. Confirm that the value for ssl_max_protocol_version is TLSv1.3.
      5. Select Copy configuration.

        Reapply all required PostgreSQL configuration parameter values. For field descriptions, see Creating an OCI Database with PostgreSQL Configuration.

      6. Save the new configuration.
      7. On the configuration's details page, select System variables (Read only) and confirm that the value for ssl_max_protocol_version is TLSv1.3.
        Note

        To avoid unintended effects on database behavior, review the complete set of parameter changes before applying the configuration.
    2. On the Database systems list page, select the database system that you want to update. If you need help finding the list page or the configuration, see Listing OCI Database with PostgreSQL Database Systems.
    3. On the database system's details page, next to Configuration, select Edit.
    4. On the Edit parameter list panel, select the configuration you created in step 1.
    5. Select Update.
    1. Create a custom configuration with ssl_max_protocol_version set to TLSv1.3 (along with your required PostgreSQL configuration parameter changes): Use the oci psql configuration create command and required parameters. 
      oci psql configuration create --compartment-id <compartment_ocid> [OPTIONS]
    2. Identify the new active custom configuration: Use the oci psql configuration-collection list-configurations command and required parameters. 
      oci psql configuration-collection list-configurations [OPTIONS]
    3. Confirm that the new custom configuration ssl_max_protocol_version is set to TLSv1.3 by retrieving its values: Use the oci psql configuration get command and required parameters. 
      oci psql configuration get --configuration-id <configuration_ocid> [OPTIONS]
    4. Apply the selected configuration to the database system: Use the oci psql db-system update command and required parameters. 
      oci psql db-system update --db-system-id <db_system_ocid> [OPTIONS]
    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.
    1. Create a custom configuration with ssl_max_protocol_version set to TLSv1.3 (along with your required PostgreSQL configuration parameter changes): Run CreateConfiguration.
    2. Verify the new custom configuration and obtain its OCID: Run ListConfigurations.
    3. Apply the selected configuration to the database system: Run UpdateDbSystem.