<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h4 class="title">
      <a name="group-replication-configuring-ssl-for-recovery">
      </a>
      20.6.3.2 Secure Socket Layer (SSL) Connections for Distributed Recovery
     </h4>
    </div>
   </div>
  </div>
  <div class="important" style="margin-left: 0.5in; margin-right: 0.5in;">
   <div class="admon-title">
    Important
   </div>
   <p>
    When using the MySQL communication stack
          (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_communication_stack">
     <code class="literal">
      group_replication_communication_stack=MYSQL
     </code>
    </a>
    )
          AND secure connections between members
          (
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
     <code class="literal">
      group_replication_ssl_mode
     </code>
    </a>
    is not set to
    <code class="literal">
     DISABLED
    </code>
    ), the security
          settings discussed in this section are applied not just to
          distributed recovery connections, but to group communications
          between members in general. See
    <a class="xref" href="group-replication-connection-security.html" title="20.6.1 Communication Stack for Connection Security Management">
     Section 20.6.1, “Communication Stack for Connection Security Management”
    </a>
    .
   </p>
  </div>
  <p>
   Whether the distributed recovery connection is made using the
        standard SQL client connection or a distributed recovery
        endpoint, to configure the connection securely, you can use
        Group Replication's dedicated distributed recovery SSL options.
        These options correspond to the server SSL options that are used
        for group communication connections, but they are only applied
        for distributed recovery connections. By default, distributed
        recovery connections do not use SSL, even if you activated SSL
        for group communication connections, and the server SSL options
        are not applied for distributed recovery connections. You must
        configure these connections separately.
  </p>
  <p>
   If a remote cloning operation is used as part of distributed
        recovery, Group Replication automatically configures the clone
        plugin's SSL options to match your settings for the distributed
        recovery SSL options. (For details of how the clone plugin uses
        SSL, see
   <a class="xref" href="clone-plugin-remote.html#clone-plugin-remote-ssl" title="Configuring an Encrypted Connection for Cloning">
    Configuring an Encrypted Connection for Cloning
   </a>
   .)
  </p>
  <p>
   The distributed recovery SSL options are as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_use_ssl">
       <code class="literal">
        group_replication_recovery_use_ssl
       </code>
      </a>
      :
            Set to
      <code class="literal">
       ON
      </code>
      to make Group Replication use
            SSL for distributed recovery connections, including remote
            cloning operations and state transfer from a donor's
            binary log. If the server you connect to does not use the
            default configuration for this (see
      <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
       Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
      </a>
      ), use the
            other distributed recovery SSL options to determine which
            certificates and cipher suites to use.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_ca">
       <code class="literal">
        group_replication_recovery_ssl_ca
       </code>
      </a>
      :
            The path name of the Certificate Authority (CA) file to use
            for distributed recovery connections. Group Replication
            automatically configures the clone SSL option
      <a class="link" href="clone-plugin-options-variables.html#sysvar_clone_ssl_ca">
       <code class="literal">
        clone_ssl_ca
       </code>
      </a>
      to match this.
     </p>
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_capath">
       <code class="literal">
        group_replication_recovery_ssl_capath
       </code>
      </a>
      :
            The path name of a directory that contains trusted SSL
            certificate authority (CA) certificate files.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_cert">
       <code class="literal">
        group_replication_recovery_ssl_cert
       </code>
      </a>
      :
            The path name of the SSL public key certificate file to use
            for distributed recovery connections. Group Replication
            automatically configures the clone SSL option
      <a class="link" href="clone-plugin-options-variables.html#sysvar_clone_ssl_cert">
       <code class="literal">
        clone_ssl_cert
       </code>
      </a>
      to match
            this.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_key">
       <code class="literal">
        group_replication_recovery_ssl_key
       </code>
      </a>
      :
            The path name of the SSL private key file to use for
            distributed recovery connections. Group Replication
            automatically configures the clone SSL option
      <a class="link" href="clone-plugin-options-variables.html#sysvar_clone_ssl_cert">
       <code class="literal">
        clone_ssl_cert
       </code>
      </a>
      to match
            this.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_verify_server_cert">
       <code class="literal">
        group_replication_recovery_ssl_verify_server_cert
       </code>
      </a>
      :
            Makes the distributed recovery connection check the server's
            Common Name value in the donor sent certificate. Setting
            this option to
      <code class="literal">
       ON
      </code>
      is the equivalent for
            distributed recovery connections of setting
      <code class="literal">
       VERIFY_IDENTITY
      </code>
      for the
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_ssl_mode">
       <code class="literal">
        group_replication_ssl_mode
       </code>
      </a>
      option for group communication connections.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_crl">
       <code class="literal">
        group_replication_recovery_ssl_crl
       </code>
      </a>
      :
            The path name of a file containing certificate revocation
            lists.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_crlpath">
       <code class="literal">
        group_replication_recovery_ssl_crlpath
       </code>
      </a>
      :
            The path name of a directory containing certificate
            revocation lists.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_cipher">
       <code class="literal">
        group_replication_recovery_ssl_cipher
       </code>
      </a>
      :
            A list of permissible ciphers for connection encryption for
            the distributed recovery connection. Specify a list of one
            or more cipher names, separated by colons. For information
            about which encryption ciphers MySQL supports, see
      <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
       Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
      </a>
      .
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_version">
       <code class="literal">
        group_replication_recovery_tls_version
       </code>
      </a>
      :
            A comma-separated list of one or more permitted TLS
            protocols for connection encryption when this server
            instance is the client in the distributed recovery
            connection, that is, the joining member. The default for
            this system variable depends on the TLS protocol versions
            supported in the MySQL Server release. The group members
            involved in each distributed recovery connection as the
            client (joining member) and server (donor) negotiate the
            highest protocol version that they are both set up to
            support.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_ciphersuites">
       <code class="literal">
        group_replication_recovery_tls_ciphersuites
       </code>
      </a>
      :
            A colon-separated list of one or more permitted ciphersuites
            when TLSv1.3 is used for connection encryption for the
            distributed recovery connection, and this server instance is
            the client in the distributed recovery connection, that is,
            the joining member. If this system variable is set to
      <code class="literal">
       NULL
      </code>
      when TLSv1.3 is used (which is the
            default if you do not set the system variable), the
            ciphersuites that are enabled by default are allowed, as
            listed in
      <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
       Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
      </a>
      . If
            this system variable is set to the empty string, no cipher
            suites are allowed, and TLSv1.3 is therefore not used.
     </p>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
