MIME-Version: 1.0
From: xx Z <xxz030811@gmail.com>
Date: Tue, 26 Aug 2025 15:27:40 +0800
Message-ID: <CA+aQVj+i6c=6h3SHMVYwkdVZpyNUm5OnZOz=TnjLXxNpHKj75w@mail.gmail.com>
Subject: Feature request: A method to configure client-side TLS ciphers for
 streaming replication
To: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="0000000000002e7ea9063d3f9c1c"
Archived-At: <https://www.postgresql.org/message-id/CA%2BaQVj%2Bi6c%3D6h3SHMVYwkdVZpyNUm5OnZOz%3DTnjLXxNpHKj75w%40mail.gmail.com>
Precedence: bulk

--0000000000002e7ea9063d3f9c1c
Content-Type: text/plain; charset="UTF-8"

Hello PostgreSQL community,

I have a question regarding the configuration of streaming replication.

When setting up streaming replication over TLS, I've noticed that while the
primary server can restrict its supported encryption algorithms using the
ssl_ciphers parameter, there doesn't seem to be a corresponding method for
the standby (client) side of the replication connection. The standby
appears to use all the default ciphers supported by the system's OpenSSL
library.

For security compliance, we need to restrict the ciphers used by the
client. Is there a way to configure the list of supported TLS ciphers on
the standby for the replication connection?

If this functionality does not currently exist, I would like to request it
as a new feature. It would be very helpful to have a connection parameter
in primary_conninfo to specify the client-side cipher list.

Postgresql version: 15.2

Thank you for your time and consideration.

Best regards,

Yunfei Zhou

--0000000000002e7ea9063d3f9c1c
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello PostgreSQL community,<div dir=3D"auto"><br></div><div dir=3D"auto">I =
have a question regarding the configuration of streaming replication.</div>=
<div dir=3D"auto"><br></div><div dir=3D"auto">When setting up streaming rep=
lication over TLS, I&#39;ve noticed that while the primary server can restr=
ict its supported encryption algorithms using the ssl_ciphers parameter, th=
ere doesn&#39;t seem to be a corresponding method for the standby (client) =
side of the replication connection. The standby appears to use all the defa=
ult ciphers supported by the system&#39;s OpenSSL library.</div><div dir=3D=
"auto"><br></div><div dir=3D"auto">For security compliance, we need to rest=
rict the ciphers used by the client. Is there a way to configure the list o=
f supported TLS ciphers on the standby for the replication connection?</div=
><div dir=3D"auto"><br></div><div dir=3D"auto">If this functionality does n=
ot currently exist, I would like to request it as a new feature. It would b=
e very helpful to have a connection parameter in primary_conninfo to specif=
y the client-side cipher list.</div><div dir=3D"auto"><br></div><div dir=3D=
"auto">Postgresql version: 15.2</div><div dir=3D"auto"><br></div><div dir=
=3D"auto">Thank you for your time and consideration.</div><div dir=3D"auto"=
><br></div><div dir=3D"auto">Best regards,</div><div dir=3D"auto"><br></div=
><div dir=3D"auto">Yunfei Zhou</div>

--0000000000002e7ea9063d3f9c1c--