Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3776.700.51.11.2\))
Subject: Re: How to configure client-side TLS ciphers for streaming
 replication?
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <a38653565ad81ced7480f810bbe02918c5ee6cbf.camel@cybertec.at>
Date: Wed, 27 Aug 2025 21:59:18 +0200
Cc: xx Z <xxz030811@gmail.com>,
 pgsql-general@lists.postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <8611DCDB-C0C7-4080-9E34-97E19E4F8CF5@yesql.se>
References: <CA+aQVjKMYngg0AVHVOcj8veB5yqoA=HCTKe-QQ3q-AovHTB0SQ@mail.gmail.com>
 <743186f112b705eb80ba1d03fc2b41f35356dc5e.camel@cybertec.at>
 <CA+aQVj+bq9iz-zM+s3F9_bDFGA_oZ41T-dHX=f=mMXhAP87K6w@mail.gmail.com>
 <a38653565ad81ced7480f810bbe02918c5ee6cbf.camel@cybertec.at>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Archived-At: <https://www.postgresql.org/message-id/8611DCDB-C0C7-4080-9E34-97E19E4F8CF5%40yesql.se>
Precedence: bulk

> On 26 Aug 2025, at 22:16, Laurenz Albe <laurenz.albe@cybertec.at> =
wrote:
>=20
> On Tue, 2025-08-26 at 20:34 +0800, xx Z wrote:
>> Thanks for your suggestion.
>> But I still want to know why we can't set "ssl_ciphers" on the client =
side.
>=20
> I'd say because nobody implemented it, perhaps because nobody felt the =
need.

I think the former is a highly likely suspect here.

>> This is still considered a security issue in some cases, and =
PostgreSQL has
>> mature capabilities on the master side to implement this =
functionality.
>=20
> That sounds to me like some moderately clueful security auditor is =
looking
> for a nit to pick.  If you do streaming replication, and you control =
the
> ciphers on the primary server, what added security benefit do you get =
by
> controlling the ciphers on the standby server (the client) as well?

I would place this above nitpicking, but I also don't have a clear idea =
of an
attack (if I did I'd fix it..).  TLS is riddled with weird cases =
involving
network middleboxes (usually very enterprisy) so insisting on control =
isn't
necessarily a bad thing.

--
Daniel Gustafsson