ssl_tls13_ciphers

ssl_tls13_ciphers is the PostgreSQL setting that defines the list of allowed TLSv1.3 cipher suites.

Note

Fact — official short description: “Sets the list of allowed TLSv1.3 cipher suites.”

Identity

Type , Valuestring: Upstream pg_settings type
Context , Valuesighup: Takes effect after configuration reload
Unit , Value—: Raw unit
Range , Value—: Raw limits in the last observed version
Enum values , Value—: — for non-enum types
Category , ValueConnections and Authentication / SSL: Upstream classification
Latest boot value , Value"": empty string

Lifecycle

Fact	Value
First observed	PG18
Present in	PG18–19 Beta 3
Removed in	No
Introduction commit	`45188c2ea239` — Support configuring TLSv1.3 cipher suites
Commit date	2024-10-24
Discussion	thread 1

Default history

Measured PG9.0–19 Beta 3 boot defaults
Versions	Raw `boot_val`	Unit	Human value
PG18–19 Beta 3	`""`	—	empty string

How it works

ssl_tls13_ciphers sets the list of allowed TLSv1.3 cipher suites. An empty string means use the default cipher suites. An empty value delegates TLS 1.3 suite selection to the SSL library default, and the syntax is distinct from ssl_ciphers.

ssl_tls13_ciphers is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Tuning advice

Tip

Advice. These are workload-specific starting points and must be validated with measurements.

Workload	Guidance
OLTP	Treat ssl_tls13_ciphers as transport-security policy rather than a performance knob. Follow the organization’s TLS baseline and test certificate rotation, reload, and every client class.
OLAP	Use the same TLS floor for analytical traffic; benchmark only after correctness because bulk transfer may expose CPU cost but is not a reason to accept obsolete protocols.
Small nodes	Keep ssl_tls13_ciphers simple and secure, using managed certificates and library defaults reviewed for the installed OpenSSL version. Rehearse renewal before expiry.

Pigsty

Values use the fixed 8-vCPU, 32-GiB, 100-GiB SSD fixture and render the current Pigsty templates for PG19 Beta 3; this does not assert current Pigsty support for that historical or beta release.

Template	Effective value	Versus upstream boot	Source expression
OLTP	Unmodified	—	—
OLAP	Unmodified	—	—
CRIT	Unmodified	—	—
TINY	Unmodified	—	—

Caution

Advice — pending human review. Fact from the current Pigsty template projection: OLTP: PG18–19 Beta 3 unmodified; OLAP: PG18–19 Beta 3 unmodified; CRIT: PG18–19 Beta 3 unmodified; TINY: PG18–19 Beta 3 unmodified. No Pigsty-specific rationale is inferred from an absent override.

Common pitfalls

Editing ssl_tls13_ciphers without reloading configuration and verifying the effective value and subsequent behavior.
Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.
Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.
Using ssl_ciphers syntax or names for TLS 1.3 and unintentionally rejecting every intended suite.

ssl_ciphers · ssl_min_protocol_version · ssl_max_protocol_version · ssl_prefer_server_ciphers · ssl_groups