MIME-Version: 1.0
References: <CA+aQVj+i6c=6h3SHMVYwkdVZpyNUm5OnZOz=TnjLXxNpHKj75w@mail.gmail.com>
In-Reply-To: <CA+aQVj+i6c=6h3SHMVYwkdVZpyNUm5OnZOz=TnjLXxNpHKj75w@mail.gmail.com>
From: Ron Johnson <ronljohnsonjr@gmail.com>
Date: Tue, 26 Aug 2025 08:59:39 -0400
Message-ID: <CANzqJaBirEU9ZNZdSSPKRW7Hm9LrXCYOcH62=bppzOr6-AvGVg@mail.gmail.com>
Subject: Re: Feature request: A method to configure client-side TLS ciphers
 for streaming replication
To: "pgsql-generallists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000621b21063d443f44"
Archived-At: <https://www.postgresql.org/message-id/CANzqJaBirEU9ZNZdSSPKRW7Hm9LrXCYOcH62%3DbppzOr6-AvGVg%40mail.gmail.com>
Precedence: bulk

--000000000000621b21063d443f44
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Aug 26, 2025 at 3:28=E2=80=AFAM xx Z <xxz030811@gmail.com> wrote:

> Hello PostgreSQL community,
>
> I have a question regarding the configuration of streaming replication.
>
> When setting up streaming replication over TLS, I've noticed that while
> the primary server can restrict its supported encryption algorithms using
> the ssl_ciphers parameter, there doesn't seem to be a corresponding metho=
d
> for the standby (client) side of the replication connection. The standby
> appears to use all the default ciphers supported by the system's OpenSSL
> library.
>

What is a "standby (client)"?

Postgresql version: 15.2
>

That's missing 12 sets (three years) of bug fixes.  When using RPM or .deb
packages, updating takes only a few minutes.

--=20
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

--000000000000621b21063d443f44
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Tue, Aug 26, 2025 at 3:28=E2=80=AFAM x=
x Z &lt;<a href=3D"mailto:xxz030811@gmail.com">xxz030811@gmail.com</a>&gt; =
wrote:</div><div class=3D"gmail_quote gmail_quote_container"><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid=
 rgb(204,204,204);padding-left:1ex">Hello PostgreSQL community,<div dir=3D"=
auto"><br></div><div dir=3D"auto">I have a question regarding the configura=
tion of streaming replication.</div><div dir=3D"auto"><br></div><div dir=3D=
"auto">When setting up streaming replication over TLS, I&#39;ve noticed tha=
t while the primary server can restrict its supported encryption algorithms=
 using the ssl_ciphers parameter, there doesn&#39;t seem to be a correspond=
ing method for the standby (client) side of the replication connection. The=
 standby appears to use all the default ciphers supported by the system&#39=
;s OpenSSL library.</div></blockquote><div><br></div><div>What is=C2=A0a &q=
uot;standby (client)&quot;?</div><div><br></div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex"><div dir=3D"auto">Postgresql version: 15.2</div></bl=
ockquote><div><br></div><div>That&#39;s missing 12 sets=C2=A0(three years)=
=C2=A0of bug fixes.=C2=A0 When=C2=A0using RPM or .deb packages, updating ta=
kes only a few minutes.</div><div><br></div></div><span class=3D"gmail_sign=
ature_prefix">-- </span><br><div dir=3D"ltr" class=3D"gmail_signature"><div=
 dir=3D"ltr">Death to &lt;Redacted&gt;, and butter sauce.<div>Don&#39;t boi=
l me, I&#39;m still alive.<br><div><div>&lt;Redacted&gt; lobster!</div></di=
v></div></div></div></div>

--000000000000621b21063d443f44--