{"id":42813,"date":"2026-02-09T07:28:29","date_gmt":"2026-02-09T06:28:29","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=42813"},"modified":"2026-02-09T07:28:31","modified_gmt":"2026-02-09T06:28:31","slug":"commercial-postgresql-distributions-with-tde-2-edb-postgres-extended-server-1-setup","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/commercial-postgresql-distributions-with-tde-2-edb-postgres-extended-server-1-setup\/","title":{"rendered":"Commercial PostgreSQL distributions with TDE (2) EDB Postgres Extended Server (1) Setup"},"content":{"rendered":"\n

We’ve already briefly looked at Fujitsu Enterprise Postgres (here<\/a> and here<\/a>) when it comes to TDE (Transparent Data Encryption) in PostgreSQL. In this and the next post we’ll look at EDB’s distribution<\/a> of PostgreSQL and how TDE can be configured and used in his commercial flavor of PostgreSQL.<\/p>\n\n\n\n

For getting EDB Postgres Extended Server installed you need to create an account<\/a> on the EDB website. Once your account is ready you can request access to the EDB repository here<\/a>. For me (on RHEL 9) this generated a token and the repository setup was just a matter of downloading and executing the repository setup script:<\/p>\n\n\n

\n[postgres@rhel9-postgres-tde sources]$ sudo curl -1sSLf 'https:\/\/downloads.enterprisedb.com\/[TOKEN]\/enterprise\/setup.rpm.sh' | sudo -E bash\nExecuting the  setup script for the 'enterprisedb\/enterprise' repository ...\n\n   OK: Checking for required executable 'curl' ...\n   OK: Checking for required executable 'rpm' ...\n   OK: Detecting your OS distribution and release using system methods ...\n ^^^^: ... Detected\/provided for your OS\/distribution, version and architecture:\n >>>>:\n >>>>: ... distro=rhel  version=9.7  codename=Plow  arch=x86_64  \n >>>>:\n   OK: Importing 'enterprisedb\/enterprise' repository GPG keys into rpm ...\n   OK: Checking for available package manager (DNF\/Microdnf\/YUM\/Zypper) ...\n ^^^^: ... Detected package manager as 'dnf'\n   OK: Checking for dnf dependency 'dnf-plugins-core' ...\n   OK: Checking if upstream install config is OK ...\n   OK: Fetching 'enterprisedb\/enterprise' repository configuration ...\n   OK: Installing 'enterprisedb\/enterprise' repository via dnf ...\nImporting GPG key 0x9F1EF813:\n Userid     : "Cloudsmith Package (enterprisedb\/enterprise) <support@cloudsmith.io>"\n Fingerprint: 31A4 CF09 0B3A E265 F131 58DE E71E B082 9F1E F813\n From       : https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\nImporting GPG key 0x9F1EF813:\n Userid     : "Cloudsmith Package (enterprisedb\/enterprise) <support@cloudsmith.io>"\n Fingerprint: 31A4 CF09 0B3A E265 F131 58DE E71E B082 9F1E F813\n From       : https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\nImporting GPG key 0x9F1EF813:\n Userid     : "Cloudsmith Package (enterprisedb\/enterprise) <support@cloudsmith.io>"\n Fingerprint: 31A4 CF09 0B3A E265 F131 58DE E71E B082 9F1E F813\n From       : https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\n   OK: Updating the dnf cache to fetch the new repository metadata ...\n   OK: The repository has been installed successfully - You're ready to rock!\n<\/pre><\/div>\n\n\n
What this did, is to create a new repository definition for dnf\/yum<\/a>:<\/p>\n\n\n
\n[postgres@rhel9-postgres-tde sources]$ cat \/etc\/yum.repos.d\/enterprisedb-enterprise.repo \n\n# Source: EnterpriseDB\n# Site: https:\/\/cloudsmith.io\n# Repository: EnterpriseDB \/ enterprise\n# Description: A certifiably-awesome private package repository curated by EnterpriseDB, hosted by Cloudsmith.\n\n[enterprisedb-enterprise]\nname=enterprisedb-enterprise\nbaseurl=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/rpm\/el\/9\/$basearch\nrepo_gpgcheck=1\nenabled=1\nskip_if_unavailable=1\ngpgkey=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\ngpgcheck=1\nsslverify=1\nsslcacert=\/etc\/pki\/tls\/certs\/ca-bundle.crt\nmetadata_expire=300\npkg_gpgcheck=1\nautorefresh=1\ntype=rpm-md\n\n[enterprisedb-enterprise-noarch]\nname=enterprisedb-enterprise-noarch\nbaseurl=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/rpm\/el\/9\/noarch\nrepo_gpgcheck=1\nenabled=1\nskip_if_unavailable=1\ngpgkey=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\ngpgcheck=1\nsslverify=1\nsslcacert=\/etc\/pki\/tls\/certs\/ca-bundle.crt\nmetadata_expire=300\npkg_gpgcheck=1\nautorefresh=1\ntype=rpm-md\n\n[enterprisedb-enterprise-source]\nname=enterprisedb-enterprise-source\nbaseurl=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/rpm\/el\/9\/SRPMS\nrepo_gpgcheck=1\nenabled=1\nskip_if_unavailable=1\ngpgkey=https:\/\/downloads.enterprisedb.com\/xxx\/enterprise\/gpg.E71EB0829F1EF813.key\ngpgcheck=1\nsslverify=1\nsslcacert=\/etc\/pki\/tls\/certs\/ca-bundle.crt\nmetadata_expire=300\npkg_gpgcheck=1\nautorefresh=1\ntype=rpm-md\n<\/pre><\/div>\n\n\n
Installing is just a matter of telling dnf what you want to install:<\/p>\n\n\n
\n[postgres@rhel9-postgres-tde ~]$ sudo dnf -y install edb-postgresextended18-server edb-postgresextended18-contrib\n<\/pre><\/div>\n\n\n
Similar to the community packages for Red Hat based distributions<\/a>, the binaries are installed in “\/usr\/edb\/pge18”:<\/p>\n\n\n
\n[postgres@rhel9-postgres-tde ~]$ ls -la \/usr\/edb\/pge18\/\ntotal 16\ndrwxr-xr-x. 6 root root   52 Feb  6 22:05 .\ndrwxr-xr-x. 3 root root   19 Feb  6 22:05 ..\ndrwxr-xr-x. 2 root root 4096 Feb  6 22:05 bin\ndrwxr-xr-x. 3 root root   23 Feb  6 22:05 doc\ndrwxr-xr-x. 3 root root 4096 Feb  6 22:05 lib\ndrwxr-xr-x. 8 root root 4096 Feb  6 22:05 share\n<\/pre><\/div>\n\n\n
Initializing a new cluster, according to the documentation<\/a>, is done with “edb-pge-18-setup” and options to initdb can be given by populating the environment variable “PGSETUP_INITDB_OPTIONS”. As I want my datafiles to be in \/u02\/pgdata I’ll pass that in addition to the encoding which is given in the documentation:<\/p>\n\n\n
\n[postgres@rhel9-postgres-tde ~]$ sudo PGSETUP_INITDB_OPTIONS="-E UTF-8 -D \/u02\/pgdata\/pge18" \/usr\/edb\/pge18\/bin\/edb-pge-18-setup initdb\nInitializing database ... failed, see \/var\/lib\/edb-pge\/18\/initdb.log\n<\/pre><\/div>\n\n\n
… and this fails. Looking at the log file is not obvious what exactly has failed and actually the output looks quite okay:<\/p>\n\n\n
\n[postgres@rhel9-postgres-tde ~]$ cat \/var\/lib\/edb-pge\/18\/initdb.log\nThe files belonging to this database system will be owned by user "postgres".\nThis user must also own the server process.\n\nThe database cluster will be initialized with locale "en_US.UTF-8".\nThe default text search configuration will be set to "english".\n\nData page checksums are enabled.\nTransparent data encryption is disabled.\n\ncreating directory \/u02\/pgdata\/pge18 ... ok\ncreating subdirectories ... ok\nselecting dynamic shared memory implementation ... posix\nselecting default "max_connections" ... 100\nselecting default "shared_buffers" ... 128MB\nselecting default time zone ... Europe\/Berlin\ncreating configuration files ... ok\nrunning bootstrap script ... ok\nperforming post-bootstrap initialization ... ok\nsyncing data to disk ... ok\n\nSuccess. You can now start the database server using:\n\n    \/usr\/edb\/pge18\/bin\/pg_ctl -D \/u02\/pgdata\/pge18 -l logfile start\n<\/pre><\/div>\n\n\n
Looking a bit closer there is this message: “Transparent data encryption is disabled.” which already is a difference to the Fujitsu version of PostgreSQL. And indeed, if you want to use TDE in the EDB version of PostgreSQL, this needs to be enabled when you initialize a new cluster with initdb<\/a>. There is an option to migrate a non-encrypted cluster into an encrypted cluster<\/a>, but this means using pg_upgrade<\/a> for going from left to right.<\/p>\n\n\n\n
As setting up TDE is the topics for the next post, we’ll stop here as this is all what needs to be done for the installation. <\/p>\n\n\n\n
Some final thoughts:<\/p>\n\n\n\n