From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Subject: Re: Replication & TLS encryption - how?
Date: Fri, 09 Apr 2021 19:55:26 +0200
Message-ID: <933348165a7555c5a0a7c78a0234e3395e8efea8.camel@cybertec.at> (raw)
In-Reply-To: <0918fe8c-05a7-f381-2346-4857cc3479e9@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
<54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
<1596782.1617813374@sss.pgh.pa.us>
<7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
<d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
<a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
<84304703ff2131cb3302eaf12b31a235b25a76a6.camel@cybertec.at>
<9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>
<749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at>
<0918fe8c-05a7-f381-2346-4857cc3479e9@yahoo.co.uk>
On Fri, 2021-04-09 at 16:43 +0100, lejeczek wrote:
> > > I get what you were saying but I also wondered - when I
> > > showed my "primary_conninfo" & pg_hba: why does replication
> > > appear to work without the bits you mention and what is the
> > > significance of 'clientcert=1' in all this.
> >
> > Replication works just fine when unencrypted.
> >
> > "clientcert=1" (in versions before v12) means that the server will
> > reject a client connection unless it sends a client certificate that is
> > signed by an authority that the server recognizes.
>
> And by 'recognizes' we would mean the one from 'ssl_ca_file'
> which, if true then I still have to wonder why my pgSQLs
> were not happy.
> My first guess and first question at the same time would be
> - could be because how my certs were crafted?
> Beyond "regular" certs params, or something "extra" in other
> words, I requested my certs to have 'Extended Key Usage'
> Thus my certs have both: TLS Web Server Authentication, TLS
> Web Client Authentication which I thought is a 'must' since
> pgSQL in replication/clusters is both server and the
> client.(no? )
This seems to be an SSL question unrelated to PostgreSQL.
Perhaps you can use SSL tools like "openssl s_client" and
"openssl s_server" to debug this.
> > > Does that confirm healthy & encrypted replication?
> >
> > Compare with the lines in "pg_stat_replication". If the entry with "ssl" = true
> > (pid 78705) has the same PID as the entry in "pg_stat_replication", then that
> > connection is encrypted, yes.
>
> I think those match, but what is that 'Record 3' (which has
> no match in 'pg_stat_replication', I can guess but I rather
> ask) , master-supplier with two standbays is my setup.
> -[ RECORD 1 ]-+-----------------------
> pid | 108394
> ssl | t
> version | TLSv1.3
> cipher | TLS_AES_256_GCM_SHA384
> bits | 256
> compression | f
> client_dn |How should I know?
> client_serial |
> issuer_dn |
> -[ RECORD 2 ]-+-----------------------
> pid | 108395
> ssl | t
> version | TLSv1.3
> cipher | TLS_AES_256_GCM_SHA384
> bits | 256
> compression | f
> client_dn |
> client_serial |
> issuer_dn |
> -[ RECORD 3 ]-+-----------------------
> pid | 111811
> ssl | f
> version |
> cipher |
> bits |
> compression |
> client_dn |
> client_serial |
> issuer_dn |
It might well be your own local connection on which you are
running the query...
Yours,
Laurenz Albe
--
Cybertec | https://www.cybertec-postgresql.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, peljasz@yahoo.co.uk
Subject: Re: Replication & TLS encryption - how?
In-Reply-To: <933348165a7555c5a0a7c78a0234e3395e8efea8.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox