ssl_prefer_server_ciphers

Definition PG 18 manual

Specifies whether to use the server's SSL cipher preferences, rather than the client's. This parameter can only be set in the postgresql.conf file or on the server command line. The default is on.

PostgreSQL versions before 9.4 do not have this setting and always use the client's preferences. This setting is mainly for backward compatibility with those versions. Using the server's preferences is usually better because it is more likely that the server is appropriately configured.

How it works

ssl_prefer_server_ciphers gives priority to server ciphersuite order. It affects server-versus-client ordering only for TLS 1.2 and older; TLS 1.3 negotiation does not use this switch.

ssl_prefer_server_ciphers is a SIGHUP-context setting: a configuration reload activates the new server value without a restart; subsequent operations that consult it use the refreshed value. Existing TLS sessions are not renegotiated.

It participates in the TLS context used for new handshakes. ssl enables transport, pg_hba.conf decides which connection classes require it, and the certificate, key, CA, revocation, protocol, and cipher settings must form one valid policy.

Operational considerations

Editing ssl_prefer_server_ciphers without reloading configuration and verifying the effective value and subsequent behavior.

Updating only one TLS file or policy knob and leaving an invalid chain, unreadable key, or incompatible protocol set.

Assuming a reload renegotiates existing sessions; TLS policy changes affect new handshakes.

Assuming it controls TLS 1.3 cipher ordering.

Workload guidance

OLAP: Use the same TLS floor for analytical traffic; benchmark only after correctness because bulk transfer may expose CPU cost but is not a reason to accept obsolete protocols.

OLTP: Treat ssl_prefer_server_ciphers as transport-security policy rather than a performance knob. Follow the organization's TLS baseline and test certificate rotation, reload, and every client class.

SMALL: Keep ssl_prefer_server_ciphers simple and secure, using managed certificates and library defaults reviewed for the installed OpenSSL version. Rehearse renewal before expiry.