19.3.1 Setting Up Replication to Use Encrypted Connections (original) (raw)

19.3.1 Setting Up Replication to Use Encrypted Connections

To use an encrypted connection for the transfer of the binary log required during replication, both the source and the replica servers must support encrypted network connections. If either server does not support encrypted connections (because it has not been compiled or configured for them), replication through an encrypted connection is not possible.

Setting up encrypted connections for replication is similar to doing so for client/server connections. You must obtain (or create) a suitable security certificate that you can use on the source, and a similar certificate (from the same certificate authority) on each replica. You must also obtain suitable key files.

For more information on setting up a server and client for encrypted connections, seeSection 8.3.1, “Configuring MySQL to Use Encrypted Connections”.

To enable encrypted connections on the source, you must create or obtain suitable certificate and key files, and then add the following configuration parameters to the[mysqld] section of the sourcemy.cnf file, changing the file names as necessary:

[mysqld]
ssl_ca=cacert.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem

The paths to the files may be relative or absolute; we recommend that you always use complete paths for this purpose.

The configuration parameters are as follows:

To enable encrypted connections on the replica, use theCHANGE REPLICATION SOURCE TO statement (MySQL 8.0.23 and later) or CHANGE MASTER TO statement (prior to MySQL 8.0.23).

    -> SOURCE_SSL_CA = 'ca_file_name',  
    -> SOURCE_SSL_CAPATH = 'ca_directory_name',  
    -> SOURCE_SSL_CERT = 'cert_file_name',  
    -> SOURCE_SSL_KEY = 'key_file_name',

These options correspond to the--ssl-_`xxx`_ options with the same names, as described inCommand Options for Encrypted Connections. For these options to take effect, SOURCE_SSL=1 must also be set. For a replication connection, specifying a value for either of SOURCE_SSL_CA orSOURCE_SSL_CAPATH corresponds to setting--ssl-mode=VERIFY_CA. The connection attempt succeeds only if a valid matching Certificate Authority (CA) certificate is found using the specified information.

    -> SOURCE_SSL_VERIFY_SERVER_CERT=1,

This option corresponds to the--ssl-verify-server-cert option, which is deprecated in MySQL 5.7 and removed in MySQL 8.0. For a replication connection, specifyingMASTER_SSL_VERIFY_SERVER_CERT=1 corresponds to setting --ssl-mode=VERIFY_IDENTITY, as described in Command Options for Encrypted Connections. For this option to take effect,SOURCE_SSL=1 must also be set. Host name identity verification does not work with self-signed certificates.

    -> SOURCE_SSL_CRL = 'crl_file_name',  
    -> SOURCE_SSL_CRLPATH = 'crl_directory_name',

These options correspond to the--ssl-_`xxx`_ options with the same names, as described inCommand Options for Encrypted Connections. If they are not specified, no CRL checking takes place.

    -> SOURCE_SSL_CIPHER = 'cipher_list',  
    -> SOURCE_TLS_VERSION = 'protocol_list',  
    -> SOURCE_TLS_CIPHERSUITES = 'ciphersuite_list',  
mysql> START SLAVE;

Beginning with MySQL 8.0.22, START REPLICA is preferred, as shown here: 

mysql> START REPLICA;

You can use the SHOW REPLICA STATUS (prior to MySQL 8.0.22,SHOW SLAVE STATUS) statement to confirm that an encrypted connection was established successfully.

mysql> CREATE USER 'repl'@'%.example.com' IDENTIFIED BY 'password'  
    -> REQUIRE SSL;  
mysql> GRANT REPLICATION SLAVE ON *.*  
    -> TO 'repl'@'%.example.com';

If you have an existing replication user account on the source, you can add REQUIRE SSL to it with this statement: 

mysql> ALTER USER 'repl'@'%.example.com' REQUIRE SSL;