MIME-Version: 1.0
References: <CA+aQVj+i6c=6h3SHMVYwkdVZpyNUm5OnZOz=TnjLXxNpHKj75w@mail.gmail.com>
 <CANzqJaBirEU9ZNZdSSPKRW7Hm9LrXCYOcH62=bppzOr6-AvGVg@mail.gmail.com>
In-Reply-To: <CANzqJaBirEU9ZNZdSSPKRW7Hm9LrXCYOcH62=bppzOr6-AvGVg@mail.gmail.com>
From: xx Z <xxz030811@gmail.com>
Date: Tue, 26 Aug 2025 21:09:36 +0800
Message-ID: <CA+aQVjJQgZ3Daq4eftH-8mA3e9Nbp2p3n_GEf+WhWVWPatbKSA@mail.gmail.com>
Subject: Re: Feature request: A method to configure client-side TLS ciphers
 for streaming replication
To: Ron Johnson <ronljohnsonjr@gmail.com>
Cc: "pgsql-generallists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000fba35e063d4462e0"
Archived-At: <https://www.postgresql.org/message-id/CA%2BaQVjJQgZ3Daq4eftH-8mA3e9Nbp2p3n_GEf%2BWhWVWPatbKSA%40mail.gmail.com>
Precedence: bulk

--000000000000fba35e063d4462e0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello,
Thank you for the reply and for the advice about our PostgreSQL version. We
will plan to update it.
To clarify what I meant by "standby (client)": In a streaming replication
setup, the standby server connects to the primary server to receive data.
In this specific network connection, the standby acts as the client, and
the primary acts as the server. My question is about restrict thr lists of
supported TLS ciphers on the standby (the client side of the connection).
Regarding my original question, does the latest version of PostgreSQL
provide a way to configure the client-side TLS cipher list for the
replication connection? If not, are there any discussions or plans to add
this feature in the future?
Thank you for your help.
Best regards,
Yunfei Zhou

Ron Johnson <ronljohnsonjr@gmail.com>=E4=BA=8E2025=E5=B9=B48=E6=9C=8826=E6=
=97=A5 =E5=91=A8=E4=BA=8C21:00=E5=86=99=E9=81=93=EF=BC=9A

> On Tue, Aug 26, 2025 at 3:28=E2=80=AFAM xx Z <xxz030811@gmail.com> wrote:
>
>> Hello PostgreSQL community,
>>
>> I have a question regarding the configuration of streaming replication.
>>
>> When setting up streaming replication over TLS, I've noticed that while
>> the primary server can restrict its supported encryption algorithms usin=
g
>> the ssl_ciphers parameter, there doesn't seem to be a corresponding meth=
od
>> for the standby (client) side of the replication connection. The standby
>> appears to use all the default ciphers supported by the system's OpenSSL
>> library.
>>
>
> What is a "standby (client)"?
>
> Postgresql version: 15.2
>>
>
> That's missing 12 sets (three years) of bug fixes.  When using RPM or .de=
b
> packages, updating takes only a few minutes.
>
> --
> Death to <Redacted>, and butter sauce.
> Don't boil me, I'm still alive.
> <Redacted> lobster!
>

--000000000000fba35e063d4462e0
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto">Hello,</div><div dir=3D"auto">Thank you for the reply and=
 for the advice about our PostgreSQL version. We will plan to update it.</d=
iv><div dir=3D"auto">To clarify what I meant by &quot;standby (client)&quot=
;: In a streaming replication setup, the standby server connects to the pri=
mary server to receive data. In this specific network connection, the stand=
by acts as the client, and the primary acts as the server. My question is a=
bout restrict thr lists of supported TLS ciphers=C2=A0on the standby (the c=
lient side of the connection).</div><div dir=3D"auto">Regarding my original=
 question, does the latest version of PostgreSQL provide a way to configure=
 the client-side TLS cipher list for the replication connection? If not, ar=
e there any discussions or plans to add this feature in the future?</div><d=
iv dir=3D"auto">Thank you for your help.</div><div dir=3D"auto">Best regard=
s,</div><div dir=3D"auto">Yunfei Zhou</div><div><br><div class=3D"gmail_quo=
te gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">Ron Johnson=
 &lt;<a href=3D"mailto:ronljohnsonjr@gmail.com">ronljohnsonjr@gmail.com</a>=
&gt;=E4=BA=8E2025=E5=B9=B48=E6=9C=8826=E6=97=A5 =E5=91=A8=E4=BA=8C21:00=E5=
=86=99=E9=81=93=EF=BC=9A<br></div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;=
padding-left:1ex;border-left-color:rgb(204,204,204)"><div dir=3D"ltr"><div =
dir=3D"ltr">On Tue, Aug 26, 2025 at 3:28=E2=80=AFAM xx Z &lt;<a href=3D"mai=
lto:xxz030811@gmail.com" target=3D"_blank">xxz030811@gmail.com</a>&gt; wrot=
e:</div><div class=3D"gmail_quote"><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;=
padding-left:1ex;border-left-color:rgb(204,204,204)">Hello PostgreSQL commu=
nity,<div dir=3D"auto"><br></div><div dir=3D"auto">I have a question regard=
ing the configuration of streaming replication.</div><div dir=3D"auto"><br>=
</div><div dir=3D"auto">When setting up streaming replication over TLS, I&#=
39;ve noticed that while the primary server can restrict its supported encr=
yption algorithms using the ssl_ciphers parameter, there doesn&#39;t seem t=
o be a corresponding method for the standby (client) side of the replicatio=
n connection. The standby appears to use all the default ciphers supported =
by the system&#39;s OpenSSL library.</div></blockquote><div><br></div><div>=
What is=C2=A0a &quot;standby (client)&quot;?</div><div><br></div><blockquot=
e class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left-width=
:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204=
,204)"><div dir=3D"auto">Postgresql version: 15.2</div></blockquote><div><b=
r></div><div>That&#39;s missing 12 sets=C2=A0(three years)=C2=A0of bug fixe=
s.=C2=A0 When=C2=A0using RPM or .deb packages, updating takes only a few mi=
nutes.</div></div></div><div dir=3D"ltr"><div class=3D"gmail_quote"><div><b=
r></div></div><span class=3D"gmail_signature_prefix">-- </span><br><div dir=
=3D"ltr" class=3D"gmail_signature"><div dir=3D"ltr">Death to &lt;Redacted&g=
t;, and butter sauce.<div>Don&#39;t boil me, I&#39;m still alive.<br><div><=
div>&lt;Redacted&gt; lobster!</div></div></div></div></div></div>
</blockquote></div></div>

--000000000000fba35e063d4462e0--