ssl_renegotiation_limit

Definition PG 9.4 manual

Specifies how much data can flow over an SSL-encrypted connection before renegotiation of the session keys will take place. Renegotiation decreases an attacker's chances of doing cryptanalysis when large amounts of traffic can be examined, but it also carries a large performance penalty. The sum of sent and received traffic is used to check the limit. If this parameter is set to 0, renegotiation is disabled. The default is 0.

How it works

PostgreSQL describes ssl_renegotiation_limit as follows: “Set the amount of traffic to send and receive before renegotiating the encryption keys.” It can be changed per session, which makes plan or behavior comparisons possible without changing every workload. The atlas measures it in PG9.0–9.4; boot_val is the compiled or initialized baseline, not proof of a running cluster's effective setting.

This setting initiated TLS key renegotiation after a traffic threshold. PostgreSQL removed it in 9.5 as protocol/library behavior and security guidance moved away from renegotiation; modern TLS policy should use supported protocol versions, ciphers, certificates, and ordinary connection rotation.

Read it together with ssl_min_protocol_version, ssl_max_protocol_version, ssl_ciphers, ssl. Check SHOW and pg_settings on the target server, verify the source and pending_restart fields, and compare workload, logs, and resource metrics before and after any change.

Operational considerations

Treating the measured boot_val for ssl_renegotiation_limit as proof of the effective value on an initialized or managed cluster.

Applying a change as though it were immediate while pg_settings reports user context.

Changing this setting in isolation without checking the linked limits, observability, and rollback path.

Copying the removed name into a modern postgresql.conf instead of migrating to its documented successor.

Workload guidance

OLAP: For an upgrade or analytical estate, inventory every generated configuration before cutover. Map the old control to its successor and compare plans, throughput, WAL, or logging behavior rather than assuming the old numeric value is portable.

OLTP: Do not add this retired name to a current OLTP configuration. Translate its intent to the documented successor, test the migration under connection and write concurrency, and remove stale automation that still emits it.

SMALL: Delete the obsolete override after recording why it existed. On a small node, prefer the successor's default until measurements justify a new value; an unknown startup parameter can otherwise stop the server.