Message-ID: <933348165a7555c5a0a7c78a0234e3395e8efea8.camel@cybertec.at>
Subject: Re: Replication & TLS encryption - how?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Date: Fri, 09 Apr 2021 19:55:26 +0200
In-Reply-To: <0918fe8c-05a7-f381-2346-4857cc3479e9@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
	 <54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
	 <1596782.1617813374@sss.pgh.pa.us>
	 <7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
	 <d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
	 <a217cf80-b5be-443f-f3df-445ee7b88b37@yahoo.co.uk>
	 <84304703ff2131cb3302eaf12b31a235b25a76a6.camel@cybertec.at>
	 <9d29a3c7-80de-4408-9197-e5ce1dd54a8e@yahoo.co.uk>
	 <749e43831c8fd197fa06560746c9ff4d474ac2dd.camel@cybertec.at>
	 <0918fe8c-05a7-f381-2346-4857cc3479e9@yahoo.co.uk>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/933348165a7555c5a0a7c78a0234e3395e8efea8.camel%40cybertec.at>
Precedence: bulk

On Fri, 2021-04-09 at 16:43 +0100, lejeczek wrote:
> > > I get what you were saying but I also wondered - when I
> > > showed my "primary_conninfo" & pg_hba: why does replication
> > > appear to work without the bits you mention and what is the
> > > significance of 'clientcert=1' in all this.
> >
> > Replication works just fine when unencrypted.
> > 
> > "clientcert=1" (in versions before v12) means that the server will
> > reject a client connection unless it sends a client certificate that is
> > signed by an authority that the server recognizes.
>
> And by 'recognizes' we would mean the one from 'ssl_ca_file' 
> which, if true then I still have to wonder why my pgSQLs 
> were not happy.
> My first guess and first question at the same time would be 
> - could be because how my certs were crafted?
> Beyond "regular" certs params, or something "extra" in other 
> words, I requested my certs to have 'Extended Key Usage'
> Thus my certs have both: TLS Web Server Authentication, TLS 
> Web Client Authentication which I thought is a 'must' since 
> pgSQL in replication/clusters is both server and the 
> client.(no? )

This seems to be an SSL question unrelated to PostgreSQL.

Perhaps you can use SSL tools like "openssl s_client" and
"openssl s_server" to debug this.


> > > Does that confirm healthy & encrypted replication?
> >
> > Compare with the lines in "pg_stat_replication".  If the entry with "ssl" = true
> > (pid 78705) has the same PID as the entry in "pg_stat_replication", then that
> > connection is encrypted, yes.
>
> I think those match, but what is that 'Record 3' (which has 
> no match in 'pg_stat_replication', I can guess but I rather 
> ask) , master-supplier with two standbays is my setup.
> -[ RECORD 1 ]-+-----------------------
> pid           | 108394
> ssl           | t
> version       | TLSv1.3
> cipher        | TLS_AES_256_GCM_SHA384
> bits          | 256
> compression   | f
> client_dn     |How should I know?
> client_serial |
> issuer_dn     |
> -[ RECORD 2 ]-+-----------------------
> pid           | 108395
> ssl           | t
> version       | TLSv1.3
> cipher        | TLS_AES_256_GCM_SHA384
> bits          | 256
> compression   | f
> client_dn     |
> client_serial |
> issuer_dn     |
> -[ RECORD 3 ]-+-----------------------
> pid           | 111811
> ssl           | f
> version       |
> cipher        |
> bits          |
> compression   |
> client_dn     |
> client_serial |
> issuer_dn     |

It might well be your own local connection on which you are
running the query...

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com