<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="group-replication-secure-socket-layer-support-ssl">
      </a>
      20.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL)
     </h3>
    </div>
   </div>
  </div>
  <a class="indexterm" name="idm46045132540192">
  </a>
  <a class="indexterm" name="idm46045132538688">
  </a>
  <p>
   Secure sockets can be used for group communication connections
      between members of a group.
  </p>
  <p>
   The Group Replication system variable
   <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
    <code class="literal">
     group_replication_ssl_mode
    </code>
   </a>
   is
      used to activate the use of SSL for group communication
      connections and specify the security mode for the connections. The
      default setting means that SSL is not used. The option has the
      following possible values:
  </p>
  <div class="table">
   <a name="idm46045132534800">
   </a>
   <p class="title">
    <b>
     Table 20.1 group_replication_ssl_mode configuration values
    </b>
   </p>
   <div class="table-contents">
    <table summary="Lists the possible values for group_replication_ssl_mode and describes their effect on how replication group members connect to each other.">
     <colgroup>
      <col style="width: 35%"/>
      <col style="width: 65%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Value
       </th>
       <th>
        <p>
         Description
        </p>
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        <code class="literal">
         DISABLED
        </code>
       </td>
       <td>
        <p>
         Establish an unencrypted connection (the default).
        </p>
       </td>
      </tr>
      <tr>
       <td>
        <code class="literal">
         REQUIRED
        </code>
       </td>
       <td>
        <p>
         Establish a secure connection if the server supports
              secure connections.
        </p>
       </td>
      </tr>
      <tr>
       <td>
        <code class="literal">
         VERIFY_CA
        </code>
       </td>
       <td>
        <p>
         Like
         <code class="literal">
          REQUIRED
         </code>
         , but additionally verify
              the server TLS certificate against the configured
              Certificate Authority (CA) certificates.
        </p>
       </td>
      </tr>
      <tr>
       <td>
        <code class="literal">
         VERIFY_IDENTITY
        </code>
       </td>
       <td>
        <p>
         Like
         <code class="literal">
          VERIFY_CA
         </code>
         , but additionally verify
              that the server certificate matches the host to which the
              connection is attempted.
        </p>
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <p>
   If SSL is used, the means for configuring the secure connection
      depends on whether the XCom or the MySQL communication stack is
      used for group communication.
  </p>
  <p>
   <b>
    When using the XCom communication stack
        (
    <code class="literal">
     group_replication_communication_stack=XCOM
    </code>
    ):
   </b>
   The remainder of the configuration for Group Replication's group
        communication connections is taken from the server's SSL
        configuration. For more information on the options for
        configuring the server SSL, see
   <a class="xref" href="connection-options.html#encrypted-connection-options" title="Command Options for Encrypted Connections">
    Command Options for Encrypted Connections
   </a>
   . The server SSL
        options that are applied to Group Replication's group
        communication connections are as follows:
  </p>
  <div class="table">
   <a name="idm46045132512560">
   </a>
   <p class="title">
    <b>
     Table 20.2 SSL Options
    </b>
   </p>
   <div class="table-contents">
    <table summary="Lists the server configuration options for SSL and describes their effect on the configuration of the Group Replication plugin for SSL.">
     <colgroup>
      <col style="width: 35%"/>
      <col style="width: 65%"/>
     </colgroup>
     <thead>
      <tr>
       <th>
        Server Configuration
       </th>
       <th>
        Description
       </th>
      </tr>
     </thead>
     <tbody>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_key">
         <code class="literal">
          ssl_key
         </code>
        </a>
       </td>
       <td>
        The path name of the SSL private key file in PEM format. On the client
            side, this is the client private key. On the server side,
            this is the server private key.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_cert">
         <code class="literal">
          ssl_cert
         </code>
        </a>
       </td>
       <td>
        The path name of the SSL public key certificate file in PEM format. On
            the client side, this is the client public key certificate.
            On the server side, this is the server public key
            certificate.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_ca">
         <code class="literal">
          ssl_ca
         </code>
        </a>
       </td>
       <td>
        The path name of the Certificate Authority (CA) certificate file in PEM
            format.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_capath">
         <code class="literal">
          ssl_capath
         </code>
        </a>
       </td>
       <td>
        The path name of the directory that contains trusted SSL certificate
            authority (CA) certificate files in PEM format.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_crl">
         <code class="literal">
          ssl_crl
         </code>
        </a>
       </td>
       <td>
        The path name of the file containing certificate revocation lists in PEM
            format.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_crlpath">
         <code class="literal">
          ssl_crlpath
         </code>
        </a>
       </td>
       <td>
        The path name of the directory that contains certificate revocation list
            files in PEM format.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
         <code class="literal">
          ssl_cipher
         </code>
        </a>
       </td>
       <td>
        A list of permissible ciphers for encrypted connections.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_tls_version">
         <code class="literal">
          tls_version
         </code>
        </a>
       </td>
       <td>
        A list of the TLS protocols the server permits for encrypted
            connections.
       </td>
      </tr>
      <tr>
       <td>
        <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
         <code class="literal">
          tls_ciphersuites
         </code>
        </a>
       </td>
       <td>
        Which TLSv1.3 ciphersuites the server permits for encrypted connections.
       </td>
      </tr>
     </tbody>
    </table>
   </div>
  </div>
  <br class="table-break"/>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Support for the TLSv1 and TLSv1.1 connection protocols was
            removed in MySQL 8.0. MySQL clients, including Group
            Replication server instances acting as clients, do not
            return warnings to the user if a deprecated TLS protocol
            version is used. See
       <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-deprecated-protocols" title="Removal of Support for the TLSv1 and TLSv1.1 Protocols">
        Removal of Support for the TLSv1 and TLSv1.1 Protocols
       </a>
       for more information.
      </p>
     </li>
     <li class="listitem">
      <p>
       MySQL 8.4 supports the TLSv1.3 protocol,
            provided that the MySQL Server was compiled using OpenSSL
            1.1.1. The server checks the version of OpenSSL at startup;
            if it is lower than 1.1.1, TLSv1.3 is removed from the
            default values for all server system variables relating to
            TLS versions, including
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_version">
        <code class="literal">
         group_replication_recovery_tls_version
        </code>
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       MySQL 8.4 Group Replication supports TLSv1.3.
      </p>
     </li>
     <li class="listitem">
      <p>
       Use
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_version">
        <code class="literal">
         group_replication_recovery_tls_version
        </code>
       </a>
       and
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_ciphersuites">
        <code class="literal">
         group_replication_recovery_tls_ciphersuites
        </code>
       </a>
       to configure client support for any selection of
            ciphersuites, including only non-default ciphersuites if
            desired.
      </p>
     </li>
     <li class="listitem">
      <p>
       In the list of TLS protocols specified in the
       <a class="link" href="server-system-variables.html#sysvar_tls_version">
        <code class="literal">
         tls_version
        </code>
       </a>
       system
            variable, ensure the specified versions are contiguous (for
            example,
       <code class="literal">
        TLSv1.2,TLSv1.3
       </code>
       ). If there are
            any gaps in the list of protocols (for example, if you
            specified
       <code class="literal">
        TLSv1,TLSv1.2
       </code>
       , omitting TLS
            1.1) Group Replication might be unable to make group
            communication connections.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <p>
   In a replication group, OpenSSL negotiates the use of the highest
      TLS protocol that is supported by all members. A joining member
      that is configured to use only TLSv1.3
      (
   <a class="link" href="server-system-variables.html#sysvar_tls_version">
    <code class="literal">
     tls_version=TLSv1.3
    </code>
   </a>
   ) cannot join
      a replication group where any existing member does not support
      TLSv1.3, because the group members in that case are using a lower
      TLS protocol version. To join the member to the group, you must
      configure the joining member to also permit the use of lower TLS
      protocol versions supported by the existing group members.
      Conversely, if a joining member does not support TLSv1.3, but the
      existing group members all do and are using that version for
      connections to each other, the member can join if the existing
      group members already permit the use of a suitable lower TLS
      protocol version, or if you configure them to do so. In that
      situation, OpenSSL uses a lower TLS protocol version for the
      connections from each member to the joining member. Each member's
      connections to other existing members continue to use the highest
      available protocol that both members support.
  </p>
  <p>
   You can change the
   <a class="link" href="server-system-variables.html#sysvar_tls_version">
    <code class="literal">
     tls_version
    </code>
   </a>
   system variable at runtime to alter the list of permitted TLS
      protocol versions for the server. For Group Replication, the
   <a class="link" href="alter-instance.html#alter-instance-reload-tls">
    <code class="literal">
     ALTER INSTANCE RELOAD TLS
    </code>
   </a>
   statement, which reconfigures the server's TLS context from the
      current values of the system variables that define the context,
      does not change the TLS context for Group Replication's group
      communication connection while Group Replication is running. To
      apply the reconfiguration to these connections, you must execute
   <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
    <code class="literal">
     STOP GROUP_REPLICATION
    </code>
   </a>
   followed by
   <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
    <code class="literal">
     START GROUP_REPLICATION
    </code>
   </a>
   to restart
      Group Replication on the member or members where you changed the
   <a class="link" href="server-system-variables.html#sysvar_tls_version">
    <code class="literal">
     tls_version
    </code>
   </a>
   system variable.
      Similarly, if you want to make all members of a group change to
      using a higher or lower TLS protocol version, you must carry out a
      rolling restart of Group Replication on the members after changing
      the list of permitted TLS protocol versions, so that OpenSSL
      negotiates the use of the higher TLS protocol version when the
      rolling restart is completed. For instructions to change the list
      of permitted TLS protocol versions at runtime, see
   <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
    Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
   </a>
   and
   <a class="xref" href="using-encrypted-connections.html#using-encrypted-connections-server-side-runtime-configuration" title="Server-Side Runtime Configuration and Monitoring for Encrypted Connections">
    Server-Side Runtime Configuration and Monitoring for Encrypted
        Connections
   </a>
   .
  </p>
  <p>
   The following example shows a section from a
   <code class="literal">
    my.cnf
   </code>
   file that configures SSL on a server,
      and activates SSL for Group Replication group communication
      connections:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa23222456"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">ssl_ca</span> <span class="token attr-value"><span class="token punctuation">=</span> "cacert.pem"</span>
<span class="token constant">ssl_capath</span> <span class="token attr-value"><span class="token punctuation">=</span> "/.../ca_directory"</span>
<span class="token constant">ssl_cert</span> <span class="token attr-value"><span class="token punctuation">=</span> "server-cert.pem"</span>
<span class="token constant">ssl_cipher</span> <span class="token attr-value"><span class="token punctuation">=</span> "DHE-RSA-AEs256-SHA"</span>
<span class="token constant">ssl_crl</span> <span class="token attr-value"><span class="token punctuation">=</span> "crl-server-revoked.crl"</span>
<span class="token constant">ssl_crlpath</span> <span class="token attr-value"><span class="token punctuation">=</span> "/.../crl_directory"</span>
<span class="token constant">ssl_key</span> <span class="token attr-value"><span class="token punctuation">=</span> "server-key.pem"</span>
<span class="token constant">group_replication_ssl_mode</span><span class="token attr-value"><span class="token punctuation">=</span> REQUIRED</span></code></pre>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    The
    <a class="link" href="alter-instance.html#alter-instance-reload-tls">
     <code class="literal">
      ALTER INSTANCE RELOAD TLS
     </code>
    </a>
    statement, which reconfigures the server's TLS context from the
        current values of the system variables that define the context,
        does not change the TLS context for Group Replication's group
        communication connections while Group Replication is running. To
        apply the reconfiguration to these connections, you must execute
    <a class="link" href="stop-group-replication.html" title="15.4.3.2 STOP GROUP_REPLICATION Statement">
     <code class="literal">
      STOP GROUP_REPLICATION
     </code>
    </a>
    followed
        by
    <a class="link" href="start-group-replication.html" title="15.4.3.1 START GROUP_REPLICATION Statement">
     <code class="literal">
      START GROUP_REPLICATION
     </code>
    </a>
    to
        restart Group Replication.
   </p>
  </div>
  <p>
   Connections made between a joining member and an existing member
      for distributed recovery are not covered by the options described
      above. These connections use Group Replication's dedicated
      distributed recovery SSL options, which are described in
   <a class="xref" href="group-replication-configuring-ssl-for-recovery.html" title="20.6.3.2 Secure Socket Layer (SSL) Connections for Distributed Recovery">
    Section 20.6.3.2, “Secure Socket Layer (SSL) Connections for Distributed Recovery”
   </a>
   .
  </p>
  <p>
   <b>
    When using the MySQL communication stack
        (group_replication_communication_stack=MYSQL):
   </b>
   The security settings for distributed recovery of the group are
        applied to the normal communications between group members. See
   <a class="xref" href="group-replication-distributed-recovery-securing.html" title="20.6.3 Securing Distributed Recovery Connections">
    Section 20.6.3, “Securing Distributed Recovery Connections”
   </a>
   on how to configure the security settings.
  </p>
 </div>
 <br/>
</div>
