Oracle Cloud Infrastructure Documentation

Applying the Updated Default Configuration for the TLS Version

Apply the latest TLS version to a database system that uses a default configuration by applying the updated default.

Note

Don't use a configuration that has Inactive status, or that has a ssl_max_protocol_version value of TLSv1.2.

For database systems that use custom configurations, see Applying an Updated Custom Configuration for the TLS Version.

Before You Begin

Note

Changing ssl_max_protocol_version requires a database system restart. The updated setting takes effect after the restart, and later connections negotiate TLS using the new protocol range. Existing database connections close during the restart.

Before you edit a configuration's TLS version or otherwise change the permitted protocol range, verify that all clients, drivers, proxies, and other network components support the intended TLS versions. For conceptual information about TLS, servers, and clients, see TLS, Servers, and Clients.

    1. Note the name and compartment of the latest active default configuration that uses TLSv1.3.
      1. On the Configurations list page, limit the list to those of Active status and Default configuration type (active default configurations). If you need help finding the list page or the configuration, see Listing OCI Database with PostgreSQL Configurations.
      2. Select the latest active default configuration.
      3. On the configuration's details page, select System variables (Read only).
      4. Confirm that the value for ssl_max_protocol_version is TLSv1.3.
    2. On the Database systems list page, select the database system that you want to update. If you need help finding the list page or the configuration, see Listing OCI Database with PostgreSQL Database Systems.
    3. On the database system's details page, next to Configuration, select Edit.
    4. On the Edit parameter list panel, select the configuration you identified in step 1.
    5. Select Update.
    1. Identify the latest active default configuration: Use the oci psql default-configuration-collection list-default-configurations command and required parameters. 
      oci psql default-configuration-collection list-default-configurations --compartment-id <compartment_ocid> [OPTIONS]
    2. Confirm that the configuration ssl_max_protocol_version is set to TLSv1.3 by retrieving its values: Use the oci psql default-configuration get command and required parameters. 
      oci psql default-configuration get --configuration-id <configuration_ocid> [OPTIONS]
    3. Apply the selected configuration to the database system: Use the oci psql db-system update command and required parameters. 
      oci psql db-system update --db-system-id <db_system_ocid> [OPTIONS]
    For a complete list of parameters and values for CLI commands, see the CLI Command Reference.
    1. Identify the latest active default configuration: Run ListDefaultConfigurations.
      This configuration has ssl_max_protocol_version set to TLSv1.3.
    2. Apply the selected configuration to the database system: Run UpdateDbSystem.