Setting Up Replication to Use Encrypted Connections ->  MASTER_SSL=1; Or from MySQL 8.0.23: mysql>  CHANGE REPLICATION SOURCE TO ->  SOURCE_HOST=’source_hostname’, ->  SOURCE_USER=’repl’, ->  SOURCE_PASSWORD=’ password ’, ->  SOURCE_SSL=1; Setting  SOURCE_SSL=1  |  MASTER_SSL=1  for a replication connection and then setting no further SOURCE_SSL_ xxx  |  MASTER_SSL_ xxx  options corresponds to setting  --ssl-mode=REQUIRED for the client, as described in Command Options for Encrypted Connections. With  SOURCE_SSL=1 |  MASTER_SSL=1 , the connection attempt only succeeds if an encrypted connection can be established. A replication connection does not fall back to an unencrypted connection, so there is no setting corresponding to the  --ssl-mode=PREFERRED  setting for replication. If  SOURCE_SSL=0  | MASTER_SSL=0  is set, this corresponds to  --ssl-mode=DISABLED . •To name the replica’s certificate and SSL private key files using the  CHANGE REPLICATION SOURCE TO  |  CHANGE MASTER TO  statement, if you did not do this in the replica’s  my.cnf  file, add the appropriate  SOURCE_SSL_ xxx  |  MASTER_SSL_ xxx  options: ->  MASTER_SSL_CA = ’ca_file_name’, ->  MASTER_SSL_CAPATH = ’ca_directory_name’, ->  MASTER_SSL_CERT = ’cert_file_name’, ->  MASTER_SSL_KEY = ’key_file_name’, These options correspond to the  --ssl- xxx  options with the same names, as described in Command Options for Encrypted Connections. For these options to take effect,  MASTER_SSL=1 must also be set. For a replication connection, specifying a value for either of   MASTER_SSL_CA  or MASTER_SSL_CAPATH , or specifying these options in the replica’s  my.cnf  file, corresponds to setting --ssl-mode=VERIFY_CA . The connection attempt only succeeds if a valid matching Certificate Authority (CA) certificate is found using the specified information. •To activate host name identity verification, add the  MASTER_SSL_VERIFY_SERVER_CERT  option: ->  MASTER_SSL_VERIFY_SERVER_CERT=1, This option corresponds to the  --ssl-verify-server-cert  option, which was deprecated from MySQL 5.7 and removed in MySQL 8.0. For a replication connection, specifying MASTER_SSL_VERIFY_SERVER_CERT=1  corresponds to setting  --ssl-mode=VERIFY_IDENTITY , as described in Command Options for Encrypted Connections. For this option to take effect, MASTER_SSL=1  must also be set. Host name identity verification does not work with self-signed certificates. •To activate certificate revocation list (CRL) checks, add the  MASTER_SSL_CRL  or MASTER_SSL_CRLPATH  option: These options correspond to the  --ssl- xxx  options with the same names, as described in Command Options for Encrypted Connections. If they are not specified, no CRL checking takes place. ->  MASTER_SSL_CRL = ’crl_file_name’, ->  MASTER_SSL_CRLPATH = ’crl_directory_name’, ->  MASTER_SSL_CIPHER = ’cipher_list’, ->  MASTER_TLS_VERSION = ’protocol_list’, •To specify lists of ciphers, ciphersuites, and encryption protocols permitted by the replica for the replication connection, use the  MASTER_SSL_CIPHER ,  MASTER_TLS_VERSION , and MASTER_TLS_CIPHERSUITES  options: 3616