Message-ID: <743186f112b705eb80ba1d03fc2b41f35356dc5e.camel@cybertec.at>
Subject: Re: How to configure client-side TLS ciphers for streaming
 replication?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: xx Z <xxz030811@gmail.com>, pgsql-general@lists.postgresql.org
Date: Tue, 26 Aug 2025 14:16:58 +0200
In-Reply-To: <CA+aQVjKMYngg0AVHVOcj8veB5yqoA=HCTKe-QQ3q-AovHTB0SQ@mail.gmail.com>
References: 
	<CA+aQVjKMYngg0AVHVOcj8veB5yqoA=HCTKe-QQ3q-AovHTB0SQ@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/743186f112b705eb80ba1d03fc2b41f35356dc5e.camel%40cybertec.at>
Precedence: bulk

On Tue, 2025-08-26 at 19:48 +0800, xx Z wrote:
> Is there a way for a streaming replication standby (client) to restrict i=
ts list
> of supported TLS ciphers, similar to how the ssl_ciphers parameter works =
on the
> primary server?
> We need this for security compliance but can't find an equivalent setting=
 for
> the client-side connection in primary_conninfo.

I don't think that there is a way to do that on the client side.
But the streaming replication primary is surely under your control, so it s=
hould
be sufficient to set "ssl_siphers" there.

Yours,
Laurenz Albe