Securing Group Communication Connections with Secure Socket Layer (SSL) Server Configuration Description ssl_cert The path name of the SSL public key certificate file in PEM format. On the client side, this is the client public key certificate. On the server side, this is the server public key certificate. ssl_ca The path name of the Certificate Authority (CA) certificate file in PEM format. ssl_capath The path name of the directory that contains trusted SSL certificate authority (CA) certificate files in PEM format. ssl_crl The path name of the file containing certificate revocation lists in PEM format. ssl_crlpath The path name of the directory that contains certificate revocation list files in PEM format. ssl_cipher A list of permissible ciphers for encrypted connections. tls_version A list of the TLS protocols the server permits for encrypted connections. tls_ciphersuites Which TLSv1.3 ciphersuites the server permits for encrypted connections. Important •Support for the TLSv1.3 protocol is available in MySQL Server as of MySQL 8.0.16, provided that MySQL was compiled using OpenSSL 1.1.1 or higher. Group Replication supports TLSv1.3 from MySQL 8.0.18. In MySQL 8.0.16 and MySQL 8.0.17, if the server supports TLSv1.3, the protocol is not supported in the group communication engine and cannot be used by Group Replication. •In the list of TLS protocols specified in the  tls_version  system variable, ensure the specified versions are contiguous (for example, TLSv1,TLSv1.1,TLSv1.2 ). If there are any gaps in the list of protocols (for example, if you specified  TLSv1,TLSv1.2 , omitting TLS 1.1) Group Replication might be unable to make group communication connections. •In MySQL 8.0.18, TLSv1.3 can be used in Group Replication for the distributed recovery connection, but the  group_replication_recovery_tls_version and  group_replication_recovery_tls_ciphersuites  system variables are not available. The donor servers must therefore permit the use of at least one TLSv1.3 ciphersuite that is enabled by default, as listed in Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . From MySQL 8.0.19, you can use the options to configure client support for any selection of ciphersuites, including only non-default ciphersuites if you want. In a replication group, OpenSSL negotiates the use of the highest TLS protocol that is supported by all members. A joining member that is configured to use only TLSv1.3 ( tls_version=TLSv1.3 ) cannot join a replication group where any existing member does not support TLSv1.3, because the group members in that case are using a lower TLS protocol version. To join the member to the group, you must configure the joining member to also permit the use of lower TLS protocol versions supported by the existing group members. Conversely, if a joining member does not support TLSv1.3, but the existing group members all do and are using that version for connections to each other, the member can join if the existing group 3768