Message-ID: <d7c701fd45117f1281f7342be412c5297610755f.camel@cybertec.at>
Subject: Re: Replication & TLS encryption - how?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: lejeczek <peljasz@yahoo.co.uk>
Cc: pgsql-admin@postgresql.org
Date: Thu, 08 Apr 2021 04:59:07 +0200
In-Reply-To: <7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
References: <54a5bf2b-0504-02c0-e5a2-ab24173abcdb.ref@yahoo.co.uk>
	 <54a5bf2b-0504-02c0-e5a2-ab24173abcdb@yahoo.co.uk>
	 <1596782.1617813374@sss.pgh.pa.us>
	 <7e89a9be-e788-23fc-6b1b-2ee67586d452@yahoo.co.uk>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5 (3.36.5-2.fc32) 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/d7c701fd45117f1281f7342be412c5297610755f.camel%40cybertec.at>
Precedence: bulk

On Wed, 2021-04-07 at 21:12 +0100, lejeczek wrote:
> On 07/04/2021 17:36, Tom Lane wrote:
> > lejeczek <peljasz@yahoo.co.uk> writes:
> > > A novice here thus please go easy on me as I ask this - I
> > > see docs/howtos all over the place be those either talk of
> > > encryption or replication. I failed to find one which blend
> > > these two concepts together - sure it's possible to pgSQL
> > > replication encrypted, right?
> > Replication connections work exactly like normal sessions for
> > this purpose.  Just make sure you set any required parameters
> > in the standby's connection string.
> > 
> > 			regards, tom lane
> > 
> > 
> Thanks. Would you know how '|clientcert=1' fits into the 
> equation?
> With it present in pg_hba.conf pgSQL was not happy saying:
> 
> FATAL:  connection requires a valid client certificate.

Then include "sslcert" in "primary_conninfo".

You can use all the libpq connection parameters:
https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS

Yours,
Laurenz Albe
-- 
Cybertec | https://www.cybertec-postgresql.com