Securing Group Communication Connections with Secure Socket Layer (SSL) separate. If you need to configure different allowlists to meet your security requirements, ensure that there is sufficient overlap between the allowlists in the replication group to maximize the possibility of servers being able to reconnect in the absence of their original seed member. For host names, name resolution takes place only when a connection request is made by another server. A host name that cannot be resolved is not considered for allowlist validation, and a warning message is written to the error log. Forward-confirmed reverse DNS (FCrDNS) verification is carried out for resolved host names. Host names are inherently less secure than IP addresses in an allowlist. FCrDNS verification provides a good level of protection, but can be compromised by certain types of attack. Specify host names in your allowlist only when strictly necessary, and ensure that all components used for name resolution, such as DNS servers, are maintained under your control. You can also implement name resolution locally using the hosts file, to avoid the use of external components. Secure sockets can be used for group communication connections between members of a group. The Group Replication system variable  group_replication_ssl_mode  is used to activate the use of SSL for group communication connections and specify the security mode for the connections. The default setting means that SSL is not used. The option has the following possible values: The remainder of the configuration for Group Replication’s group communication connections is taken from the server’s SSL configuration. For more information on the options for configuring the server SSL, see Command Options for Encrypted Connections. The server SSL options that are applied to Group Replication’s group communication connections are as follows: Table 18.3 SSL Options Table 18.2 group_replication_ssl_mode configuration values Server Configuration Description ssl_key The path name of the SSL private key file in PEM format. On the client side, this is the client private key. On the server side, this is the server private key. Value Description DISABLED Establish an unencrypted connection (the default). REQUIRED Establish a secure connection if the server supports secure connections. VERIFY_CA Like REQUIRED, but additionally verify the server TLS certificate against the configured Certificate Authority (CA) certificates. VERIFY_IDENTITY Like VERIFY_CA, but additionally verify that the server certificate matches the host to which the connection is attempted. 3767 18.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL) Warning