<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="replication-encrypted-connections">
      </a>
      19.3.1 Setting Up Replication to Use Encrypted Connections
     </h3>
    </div>
   </div>
  </div>
  <p>
   To use an encrypted connection for the transfer of the binary log
      required during replication, both the source and the replica
      servers must support encrypted network connections. If either
      server does not support encrypted connections (because it has not
      been compiled or configured for them), replication through an
      encrypted connection is not possible.
  </p>
  <p>
   Setting up encrypted connections for replication is similar to
      doing so for client/server connections. You must obtain (or
      create) a suitable security certificate that you can use on the
      source, and a similar certificate (from the same certificate
      authority) on each replica. You must also obtain suitable key
      files.
  </p>
  <p>
   For more information on setting up a server and client for
      encrypted connections, see
   <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
    Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
   </a>
   .
  </p>
  <p>
   To enable encrypted connections on the source, you must create or
      obtain suitable certificate and key files, and then add the
      following configuration parameters to the
   <code class="literal">
    [mysqld]
   </code>
   section of the source
   <code class="filename">
    my.cnf
   </code>
   file, changing the file names as
      necessary:
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa67142327"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">ssl_ca</span><span class="token attr-value"><span class="token punctuation">=</span>cacert.pem</span>
<span class="token constant">ssl_cert</span><span class="token attr-value"><span class="token punctuation">=</span>server-cert.pem</span>
<span class="token constant">ssl_key</span><span class="token attr-value"><span class="token punctuation">=</span>server-key.pem</span></code></pre>
  </div>
  <p>
   The paths to the files may be relative or absolute; we recommend
      that you always use complete paths for this purpose.
  </p>
  <p>
   The configuration parameters are as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="link" href="server-system-variables.html#sysvar_ssl_ca">
       <code class="literal">
        ssl_ca
       </code>
      </a>
      : The path name of the
          Certificate Authority (CA) certificate file.
          (
      <a class="link" href="server-system-variables.html#sysvar_ssl_capath">
       <code class="literal">
        ssl_capath
       </code>
      </a>
      is similar but
          specifies the path name of a directory of CA certificate
          files.)
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="server-system-variables.html#sysvar_ssl_cert">
       <code class="literal">
        ssl_cert
       </code>
      </a>
      : The path name of
          the server public key certificate file. This certificate can
          be sent to the client and authenticated against the CA
          certificate that it has.
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="link" href="server-system-variables.html#sysvar_ssl_key">
       <code class="literal">
        ssl_key
       </code>
      </a>
      : The path name of the
          server private key file.
     </p>
    </li>
   </ul>
  </div>
  <p>
   To enable encrypted connections on the replica, use the
   <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
    <code class="literal">
     CHANGE REPLICATION SOURCE TO
    </code>
   </a>
   statement.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      To name the replica's certificate and SSL private key
          files using
      <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
       <code class="literal">
        CHANGE REPLICATION SOURCE
          TO
       </code>
      </a>
      , add the appropriate
      <code class="literal">
       SOURCE_SSL_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      options, like this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa98331123"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CA</span> <span class="token operator">=</span> <span class="token string">'ca_file_name'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CAPATH</span> <span class="token operator">=</span> <span class="token string">'ca_directory_name'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CERT</span> <span class="token operator">=</span> <span class="token string">'cert_file_name'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_KEY</span> <span class="token operator">=</span> <span class="token string">'key_file_name'</span><span class="token punctuation">,</span></code></pre>
     </div>
     <p>
      These options correspond to the
      <code class="option">
       --ssl-
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      options
          with the same names, as described in
      <a class="xref" href="connection-options.html#encrypted-connection-options" title="Command Options for Encrypted Connections">
       Command Options for Encrypted Connections
      </a>
      . For these
          options to take effect,
      <code class="literal">
       SOURCE_SSL=1
      </code>
      must
          also be set. For a replication connection, specifying a value
          for either of
      <code class="literal">
       SOURCE_SSL_CA
      </code>
      or
      <code class="literal">
       SOURCE_SSL_CAPATH
      </code>
      corresponds to setting
      <code class="option">
       --ssl-mode=VERIFY_CA
      </code>
      . The connection attempt
          succeeds only if a valid matching Certificate Authority (CA)
          certificate is found using the specified information.
     </p>
    </li>
    <li class="listitem">
     <p>
      To activate host name identity verification, add the
      <code class="literal">
       SOURCE_SSL_VERIFY_SERVER_CERT
      </code>
      option, like
          this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa71568071"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_VERIFY_SERVER_CERT</span><span class="token operator">=</span><span class="token number">1</span><span class="token punctuation">,</span></code></pre>
     </div>
     <p>
      For a replication connection, specifying
      <code class="literal">
       SOURCE_SSL_VERIFY_SERVER_CERT=1
      </code>
      corresponds
          to setting
      <code class="option">
       --ssl-mode=VERIFY_IDENTITY
      </code>
      , as
          described in
      <a class="xref" href="connection-options.html#encrypted-connection-options" title="Command Options for Encrypted Connections">
       Command Options for Encrypted Connections
      </a>
      .
          For this option to take effect,
      <code class="literal">
       SOURCE_SSL=1
      </code>
      must also be set. Host name
          identity verification does not work with self-signed
          certificates.
     </p>
    </li>
    <li class="listitem">
     <p>
      To activate certificate revocation list (CRL) checks, add the
      <code class="literal">
       SOURCE_SSL_CRL
      </code>
      or
      <code class="literal">
       SOURCE_SSL_CRLPATH
      </code>
      option, as shown here:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa2573113"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CRL</span> <span class="token operator">=</span> <span class="token string">'crl_file_name'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CRLPATH</span> <span class="token operator">=</span> <span class="token string">'crl_directory_name'</span><span class="token punctuation">,</span></code></pre>
     </div>
     <p>
      These options correspond to the
      <code class="option">
       --ssl-
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      options
          with the same names, as described in
      <a class="xref" href="connection-options.html#encrypted-connection-options" title="Command Options for Encrypted Connections">
       Command Options for Encrypted Connections
      </a>
      . If they are
          not specified, no CRL checking takes place.
     </p>
    </li>
    <li class="listitem">
     <p>
      To specify lists of ciphers, ciphersuites, and encryption
          protocols permitted by the replica for the replication
          connection, use the
      <code class="literal">
       SOURCE_SSL_CIPHER
      </code>
      ,
      <code class="literal">
       SOURCE_TLS_VERSION
      </code>
      , and
      <code class="literal">
       SOURCE_TLS_CIPHERSUITES
      </code>
      options, like this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa90286653"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_SSL_CIPHER</span> <span class="token operator">=</span> <span class="token string">'cipher_list'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_TLS_VERSION</span> <span class="token operator">=</span> <span class="token string">'protocol_list'</span><span class="token punctuation">,</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">SOURCE_TLS_CIPHERSUITES</span> <span class="token operator">=</span> <span class="token string">'ciphersuite_list'</span><span class="token punctuation">,</span></code></pre>
     </div>
     <div class="itemizedlist">
      <ul class="itemizedlist" style="list-style-type: circle; ">
       <li class="listitem">
        <p>
         The
         <code class="literal">
          SOURCE_SSL_CIPHER
         </code>
         option specifies
              a colon-separated list of one or more ciphers permitted by
              the replica for the replication connection.
        </p>
       </li>
       <li class="listitem">
        <p>
         The
         <code class="literal">
          SOURCE_TLS_VERSION
         </code>
         option specifies
              a comma-separated list of the TLS encryption protocols
              permitted by the replica for the replication connection,
              in a format like that for the
         <a class="link" href="server-system-variables.html#sysvar_tls_version">
          <code class="literal">
           tls_version
          </code>
         </a>
         server system
              variable. The connection procedure negotiates the use of
              the highest TLS version that both the source and the
              replica permit. To be able to connect, the replica must
              have at least one TLS version in common with the source.
        </p>
       </li>
       <li class="listitem">
        <p>
         The
         <code class="literal">
          SOURCE_TLS_CIPHERSUITES
         </code>
         option
              specifies a colon-separated list of one or more
              ciphersuites that are permitted by the replica for the
              replication connection if TLSv1.3 is used for the
              connection. If this option is set to
         <code class="literal">
          NULL
         </code>
         when TLSv1.3 is used (which is the
              default if you do not set the option), the ciphersuites
              that are enabled by default are allowed. If you set the
              option to an empty string, no cipher suites are allowed,
              and TLSv1.3 is therefore not used.
        </p>
       </li>
      </ul>
     </div>
     <p>
      The protocols, ciphers, and ciphersuites that you can specify
          in these lists depend on the SSL library used to compile
          MySQL. For information about the formats, the permitted
          values, and the defaults if you do not specify the options,
          see
      <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
       Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
      </a>
      .
     </p>
     <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
      <div class="admon-title">
       Note
      </div>
      <p>
       You can use the
       <code class="literal">
        SOURCE_TLS_CIPHERSUITES
       </code>
       option to specify any selection of ciphersuites, including
            only non-default ciphersuites if you want.
      </p>
     </div>
    </li>
    <li class="listitem">
     <p>
      After the source information has been updated, start the
          replication process on the replica, like this:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa60707337"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">START</span> <span class="token keyword">REPLICA</span><span class="token punctuation">;</span></code></pre>
     </div>
     <p>
      You can use the
      <a class="link" href="show-replica-status.html" title="15.7.7.35 SHOW REPLICA STATUS Statement">
       <code class="literal">
        SHOW REPLICA
          STATUS
       </code>
      </a>
      statement to confirm that an encrypted
          connection was established successfully.
     </p>
    </li>
    <li class="listitem">
     <p>
      Requiring encrypted connections on the replica does not ensure
          that the source requires encrypted connections from replicas.
          If you want to ensure that the source only accepts replicas
          that connect using encrypted connections, create a replication
          user account on the source using the
      <code class="literal">
       REQUIRE
          SSL
      </code>
      option, then grant that user the
      <a class="link" href="privileges-provided.html#priv_replication-slave">
       <code class="literal">
        REPLICATION SLAVE
       </code>
      </a>
      privilege.
          For example:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa13922875"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">CREATE</span> <span class="token keyword">USER</span> <span class="token string">'repl'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">IDENTIFIED</span> <span class="token keyword">BY</span> <span class="token string">'<em class="replaceable">password</em>'</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span>
<span class="token prompt">mysql&gt;</span> <span class="token keyword">GRANT</span> <span class="token keyword">REPLICATION</span> <span class="token keyword">SLAVE</span> <span class="token keyword">ON</span> <span class="token operator">*</span><span class="token punctuation">.</span><span class="token operator">*</span>
<span class="token prompt">    -&gt;</span> <span class="token keyword">TO</span> <span class="token string">'repl'</span>@<span class="token string">'%.example.com'</span><span class="token punctuation">;</span></code></pre>
     </div>
     <p>
      If you have an existing replication user account on the
          source, you can add
      <code class="literal">
       REQUIRE SSL
      </code>
      to it with
          this statement:
     </p>
     <div class="copytoclipboard-wrapper">
      <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa64691426"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">ALTER</span> <span class="token keyword">USER</span> <span class="token string">'repl'</span>@<span class="token string">'%.example.com'</span> <span class="token keyword">REQUIRE</span> <span class="token keyword">SSL</span><span class="token punctuation">;</span></code></pre>
     </div>
    </li>
   </ul>
  </div>
 </div>
 <br/>
</div>
