ssl_renegotiation_limit

ssl_renegotiation_limit — Set the amount of traffic to send and receive before renegotiating the encryption keys. Observed in PG9.0–9.4; its last measured boot default is 0 B in PG9.4, with user context. It was removed in PG9.5.

Note

Fact — official short description: “Set the amount of traffic to send and receive before renegotiating the encryption keys.”

Identity

Type , Valueinteger: Upstream pg_settings type
Context , Valueuser: Settable by an ordinary user
Unit , ValuekB: Raw unit
Range , Value0 – 2147483647: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / Security and Authentication: Upstream classification
Latest boot value , Value0: 0 B

Lifecycle

Fact	Value
First observed	PG9.0 (research boundary)
Present in	PG9.0–9.4
Removed in	PG9.5
Introduction commit	Not asserted: predates the PG9.0 research boundary
Commit date	—
Discussion	—

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG9.0–9.4	`0`	`kB`	0 B

How it works

PostgreSQL describes ssl_renegotiation_limit as follows: “Set the amount of traffic to send and receive before renegotiating the encryption keys.” It can be changed per session, which makes plan or behavior comparisons possible without changing every workload. The atlas measures it in PG9.0–9.4; boot_val is the compiled or initialized baseline, not proof of a running cluster’s effective setting.

This setting initiated TLS key renegotiation after a traffic threshold. PostgreSQL removed it in 9.5 as protocol/library behavior and security guidance moved away from renegotiation; modern TLS policy should use supported protocol versions, ciphers, certificates, and ordinary connection rotation.

Read it together with ssl_min_protocol_version, ssl_max_protocol_version, ssl_ciphers, ssl. Check SHOW and pg_settings on the target server, verify the source and pending_restart fields, and compare workload, logs, and resource metrics before and after any change.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Do not add this retired name to a current OLTP configuration. Translate its intent to the documented successor, test the migration under connection and write concurrency, and remove stale automation that still emits it.
OLAP	For an upgrade or analytical estate, inventory every generated configuration before cutover. Map the old control to its successor and compare plans, throughput, WAL, or logging behavior rather than assuming the old numeric value is portable.
Small nodes	Delete the obsolete override after recording why it existed. On a small node, prefer the successor’s default until measurements justify a new value; an unknown startup parameter can otherwise stop the server.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG9.4; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG9.0–9.4 unmodified; OLAP: PG9.0–9.4 unmodified; CRIT: PG9.0–9.4 unmodified; TINY: PG9.0–9.4 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Treating the measured boot_val for ssl_renegotiation_limit as proof of the effective value on an initialized or managed cluster.
Applying a change as though it were immediate while pg_settings reports user context.
Changing this setting in isolation without checking the linked limits, observability, and rollback path.
Copying the removed name into a modern postgresql.conf instead of migrating to its documented successor.

ssl_min_protocol_version · ssl_max_protocol_version · ssl_ciphers · ssl