Securing Distributed Recovery Connections members already permit the use of a suitable lower TLS protocol version, or if you configure them to do so. In that situation, OpenSSL uses a lower TLS protocol version for the connections from each member to the joining member. Each member’s connections to other existing members continue to use the highest available protocol that both members support. From MySQL 8.0.16, you can change the  tls_version  system variable at runtime to alter the list of permitted TLS protocol versions for the server. Note that for Group Replication, the  ALTER INSTANCE RELOAD TLS  statement, which reconfigures the server’s TLS context from the current values of the system variables that define the context, does not change the TLS context for Group Replication’s group communication connection while Group Replication is running. To apply the reconfiguration to these connections, you must execute  STOP GROUP_REPLICATION  followed by  START GROUP_REPLICATION to restart Group Replication on the member or members where you changed the  tls_version  system variable. Similarly, if you want to make all members of a group change to using a higher or lower TLS protocol version, you must carry out a rolling restart of Group Replication on the members after changing the list of permitted TLS protocol versions, so that OpenSSL negotiates the use of the higher TLS protocol version when the rolling restart is completed. For instructions to change the list of permitted TLS protocol versions at runtime, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers”  and Server- Side Runtime Configuration and Monitoring for Encrypted Connections. The following example shows a section from a  my.cnf  file that configures SSL on a server, and activates SSL for Group Replication group communication connections: The  ALTER INSTANCE RELOAD TLS  statement, which reconfigures the server’s TLS context from the current values of the system variables that define the context, does not change the TLS context for Group Replication’s group communication connections while Group Replication is running. To apply the reconfiguration to these connections, you must execute  STOP GROUP_REPLICATION  followed by START GROUP_REPLICATION  to restart Group Replication. Connections made between a joining member and an existing member for distributed recovery are not covered by the options described above. These connections use Group Replication’s dedicated distributed recovery SSL options, which are described in Section 18.6.3.2, “Secure Socket Layer (SSL) Connections for Distributed Recovery” . When a member joins the group, distributed recovery is carried out using a combination of a remote cloning operation, if available and appropriate, and an asynchronous replication connection. For a full description of distributed recovery, see Section 18.5.3, “Distributed Recovery” . The connection that an existing member offers to a joining member for distributed recovery is not the same connection that is used by Group Replication for communication between online members of the group. Up to MySQL 8.0.20, group members offer their standard SQL client connection to joining members for distributed recovery, as specified by MySQL Server’s  hostname  and  port  system variables. From 3769 18.6.3 Securing Distributed Recovery Connections Important [mysqld] ssl_ca = "cacert.pem" ssl_capath = "/.../ca_directory" ssl_cert = "server-cert.pem" ssl_cipher = "DHE-RSA-AEs256-SHA" ssl_crl = "crl-server-revoked.crl" ssl_crlpath = "/.../crl_directory" ssl_key = "server-key.pem" group_replication_ssl_mode= REQUIRED