Encrypted Connection TLS Protocols and Ciphers |  MASTER_SSL_CIPHER  option for the  CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or  CHANGE MASTER TO  statement (before MySQL 8.0.23). See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections” . For encrypted connections that use TLSv1.3, OpenSSL 1.1.1 and higher supports the following ciphersuites, the first three of which are enabled by default: To configure the permitted TLSv1.3 ciphersuites explicitly, set the following parameters. In each case, the configuration value is a list of zero or more colon-separated ciphersuite names. Ciphersuite support is available as of MySQL 8.0.16, but requires that both the MySQL server and the client application be compiled using OpenSSL 1.1.1 or higher. In MySQL 8.0.16 through 8.0.18, the group_replication_recovery_tls_ciphersuites  system variable and the  SOURCE_TLS_CIPHERSUITES  |  MASTER_TLS_CIPHERSUITES  option for the CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or  CHANGE MASTER TO  statement (before MySQL 8.0.23) are not available. In these releases, if TLSv1.3 is used for source/replica replication connections, or in Group Replication for distributed recovery (supported from MySQL 8.0.18), the replication source 1292 •On the server side, use the  tls_ciphersuites  system variable. If this variable is not set, its default value is  NULL , which means that the server permits the default set of ciphersuites. If the variable is set to the empty string, no ciphersuites are enabled and encrypted connections cannot be established. •On the client side, use the  --tls-ciphersuites  option. If this option is not set, the client permits the default set of ciphersuites. If the option is set to the empty string, no ciphersuites are enabled and encrypted connections cannot be established. •For regular source/replica replication connections, where this server instance is the source, use the  tls_ciphersuites  system variable. Where this server instance is the replica, use the SOURCE_TLS_CIPHERSUITES  |  MASTER_TLS_CIPHERSUITES  option for the  CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or  CHANGE MASTER TO  statement (before MySQL 8.0.23). See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections” . •For a Group Replication group member, for Group Replication group communication connections and also for Group Replication distributed recovery connections where this server instance is the donor, use the  tls_ciphersuites  system variable. For Group Replication distributed recovery connections where this server instance is the joining member, use the group_replication_recovery_tls_ciphersuites  system variable. See Section 18.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)” . •For a Group Replication group member, for Group Replication group communication connections and also for Group Replication distributed recovery connections where this server instance is the donor, set the  ssl_cipher  system variable. For Group Replication distributed recovery connections where this server instance is the joining member, use the  group_replication_recovery_ssl_cipher  system variable. See Section 18.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)” . TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 TLS_AES_128_CCM_SHA256 TLS_AES_128_CCM_8_SHA256 Note