1
Diagnostic step 1
Disable aggressive TLS renegotiation on the load balancer; prefer long-lived TLS sessions with session tickets or TLS1.3 PSK resumption.
FULL AI ANALYSIS
PostgreSQL primary WAL sender CPU spikes and replication lag after enabling frequent TLS renegotiation on streaming replication
Generated Oct 12, 2026, 10:57:59 PM
Analysis summary
TLS renegotiation forces repeated full handshakes which are CPU-expensive, especially on servers performing crypto for each walsender. PostgreSQL's walsender uses blocking SSL operations and is not optimized for frequent full handshake churn; constant teardown/reconnect also disrupts the streaming replication pipeline, causing lag. Session resumption (TLS session tickets or TLS 1.3 PSK) can avoid full handshakes, but must be supported and correctly configured by the load balancer and server. Offloading TLS or allowing long-lived TLS sessions reduces CPU cost and stabilizes streaming.
Possible causes
Load balancer configured to force full TLS renegotiation frequently, preventing session resumption and causing crypto CPU surge.
95%Walsender processes are single-threaded per connection and block on handshake crypto, so many renegotiations saturate CPU cores.
90%Intermediate device or policy forcing connection close instead of renegotiation, causing repeated new handshakes.
85%OpenSSL or libpq configuration not enabling or supporting TLS session resumption/tickets for resumed handshakes.
30%Suggested fixes
2
Diagnostic step 2
Enable and verify TLS session resumption (session tickets) on both PostgreSQL server OpenSSL configuration and the load balancer. Test that a resumed session avoids a full handshake.
3
Diagnostic step 3
If load balancer cannot support session resumption, consider TLS offload to a dedicated proxy with proper resumption support or use a TCP passthrough and terminate TLS on the database hosts with lower churn.
4
Diagnostic step 4
Monitor walsender CPU and replication lag while gradually increasing allowed session lifetime; collect OpenSSL timers and replication metrics to validate improvement.
5
Diagnostic step 5
If workload cannot avoid renegotiation, provision additional CPU capacity for primary or distribute replication across multiple standby hosts; escalate to infra/network team for load balancer config change.