Setting Up Replication to Use Encrypted Connections 17.3.1 Setting Up Replication to Use Encrypted Connections To use an encrypted connection for the transfer of the binary log required during replication, both the source and the replica servers must support encrypted network connections. If either server does not support encrypted connections (because it has not been compiled or configured for them), replication through an encrypted connection is not possible. Setting up encrypted connections for replication is similar to doing so for client/server connections. You must obtain (or create) a suitable security certificate that you can use on the source, and a similar certificate (from the same certificate authority) on each replica. You must also obtain suitable key files. For more information on setting up a server and client for encrypted connections, see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” . To enable encrypted connections on the source, you must create or obtain suitable certificate and key files, and then add the following configuration parameters to the source’s configuration within the  [mysqld] section of the source’s  my.cnf  file, changing the file names as necessary: [mysqld] ssl_ca=cacert.pem ssl_cert=server-cert.pem ssl_key=server-key.pem The paths to the files may be relative or absolute; we recommend that you always use complete paths for this purpose. The configuration parameters are as follows: • ssl_ca : The path name of the Certificate Authority (CA) certificate file. ( ssl_capath  is similar but specifies the path name of a directory of CA certificate files.) • ssl_cert : The path name of the server public key certificate file. This certificate can be sent to the client and authenticated against the CA certificate that it has. • ssl_key : The path name of the server private key file. To enable encrypted connections on the replica, use the  CHANGE REPLICATION SOURCE TO  statement (from MySQL 8.0.23) or  CHANGE MASTER TO  statement (before MySQL 8.0.23). You can either name the replica’s certificate and SSL private key files required for the encrypted connection in the  [client] section of the replica’s  my.cnf  file, or you can explicitly specify that information using the  CHANGE REPLICATION SOURCE TO  |  CHANGE MASTER TO  statement. •To name the replica’s certificate and key files using an option file, add the following lines to the [client]  section of the replica’s  my.cnf  file, changing the file names as necessary: [client] ssl-ca=cacert.pem ssl-cert=client-cert.pem ssl-key=client-key.pem mysql>  CHANGE MASTER TO ->  MASTER_HOST=’source_hostname’, ->  MASTER_USER=’repl’, ->  MASTER_PASSWORD=’ password ’, •Restart the replica server, using the  --skip-slave-start  option, or from MySQL 8.0.24, the skip_slave_start  system variable, to prevent the replica from connecting to the source. Use  CHANGE REPLICATION SOURCE TO  |  CHANGE MASTER TO  to specify the source configuration, and add the MASTER_SSL  option to connect using encryption: 3615