Message-ID: <749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at>
Subject: Re: Replication & TLS encryption - how?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Date: Fri, 09 Apr 2021 11:09:46 +0200
In-Reply-To: <9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
	 <54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
	 <1596782.1617813374@sss.pgh.pa.us>
	 <7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
	 <d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
	 <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
	 <84304703ff2131cb3302eaf12b31a235b25a76a6.camel@cybertec.at>
	 <9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/749e43831c8fd197fa06560746c9ff4d474ac2dd.camel%40cybertec.at>
Precedence: bulk

On Thu, 2021-04-08 at 12:37 +0100, lejeczek wrote:
> I get what you were saying but I also wondered - when I 
> showed my "primary_conninfo" & pg_hba: why does replication 
> appear to work without the bits you mention and what is the 
> significance of 'clientcert=1' in all this.

Replication works just fine when unencrypted.

"clientcert=1" (in versions before v12) means that the server will
reject a client connection unless it sends a client certificate that is
signed by an authority that the server recognizes.

If you omit the option (or set it to 0), the server doesn't care
if the client sends a certificate or not.
Note that by default, PostgreSQL uses SSL only to encrypt the
connection, not to verify the identity of the participants.