Message-ID: <a38653565ad81ced7480f810bbe02918c5ee6cbf.camel@cybertec.at>
Subject: Re: How to configure client-side TLS ciphers for streaming
 replication?
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: xx Z <xxz030811@gmail.com>
Cc: pgsql-general@lists.postgresql.org
Date: Tue, 26 Aug 2025 22:16:39 +0200
In-Reply-To: <CA+aQVj+bq9iz-zM+s3F9_bDFGA_oZ41T-dHX=f=mMXhAP87K6w@mail.gmail.com>
References: 
	<CA+aQVjKMYngg0AVHVOcj8veB5yqoA=HCTKe-QQ3q-AovHTB0SQ@mail.gmail.com>
	 <743186f112b705eb80ba1d03fc2b41f35356dc5e.camel@cybertec.at>
	 <CA+aQVj+bq9iz-zM+s3F9_bDFGA_oZ41T-dHX=f=mMXhAP87K6w@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/a38653565ad81ced7480f810bbe02918c5ee6cbf.camel%40cybertec.at>
Precedence: bulk

On Tue, 2025-08-26 at 20:34 +0800, xx Z wrote:
> Thanks for your suggestion.
> But I still want to know why we can't set "ssl_ciphers" on the client sid=
e.

I'd say because nobody implemented it, perhaps because nobody felt the need=
.

> This is still considered a security issue in some cases, and PostgreSQL h=
as
> mature capabilities on the master side to implement this functionality.

That sounds to me like some moderately clueful security auditor is looking
for a nit to pick.  If you do streaming replication, and you control the
ciphers on the primary server, what added security benefit do you get by
controlling the ciphers on the standby server (the client) as well?

Yours,
Laurenz Albe