pg.ddx.io  pgsql-admin@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Subject: Re: Replication & TLS encryption - how?
Date: Fri, 09 Apr 2021 11:09:46 +0200
Message-ID: <749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at> (raw)
In-Reply-To: <9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
	<54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
	<1596782.1617813374@sss.pgh.pa.us>
	<7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
	<d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
	<a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
	<84304703ff2131cb3302eaf12b31a235b25a76a6.camel@cybertec.at>
	<9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>

On Thu, 2021-04-08 at 12:37 +0100, lejeczek wrote:
> I get what you were saying but I also wondered - when I 
> showed my "primary_conninfo" & pg_hba: why does replication 
> appear to work without the bits you mention and what is the 
> significance of 'clientcert=1' in all this.

Replication works just fine when unencrypted.

"clientcert=1" (in versions before v12) means that the server will
reject a client connection unless it sends a client certificate that is
signed by an authority that the server recognizes.

If you omit the option (or set it to 0), the server doesn't care
if the client sends a certificate or not.
Note that by default, PostgreSQL uses SSL only to encrypt the
connection, not to verify the identity of the participants.



view thread (10+ messages)  latest in thread

Message-ID: <749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at>
Permalink:  ../749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at/
Also on:    postgresql.org/message-id/749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-admin@postgresql.org
  Cc: laurenz.albe@cybertec.at, peljasz@yahoo.co.uk
  Subject: Re: Replication & TLS encryption - how?
  In-Reply-To: <749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox