Encrypting Binary Log Files and Relay Log Files The protocols, ciphers, and ciphersuites that you can specify in these lists depend on the SSL library used to compile MySQL. For information about the formats, the permitted values, and the defaults if you do not specify the options, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . In MySQL 8.0.16 through 8.0.18, MySQL supports TLSv1.3, but the MASTER_TLS_CIPHERSUITES  option is not available. In these releases, if TLSv1.3 is used for connections between a source and replica, the source must permit the use of at least one TLSv1.3 ciphersuite that is enabled by default. From MySQL 8.0.19, you can use the option to specify any selection of ciphersuites, including only non-default ciphersuites if you want. You can use the  SHOW REPLICA | SLAVE STATUS  statement to confirm that an encrypted connection was established successfully. If you have an existing replication user account on the source, you can add  REQUIRE SSL  to it with this statement: mysql>  ALTER USER ’repl’@’%.example.com’ REQUIRE SSL; From MySQL 8.0.14, binary log files and relay log files can be encrypted, helping to protect these files and the potentially sensitive data contained in them from being misused by outside attackers, and also from 3617 17.3.2 Encrypting Binary Log Files and Relay Log Files Note ->  MASTER_TLS_CIPHERSUITES = ’ciphersuite_list’, •The  MASTER_SSL_CIPHER  option specifies a colon-separated list of one or more ciphers permitted by the replica for the replication connection. •The  MASTER_TLS_VERSION  option specifies a comma-separated list of the TLS encryption protocols permitted by the replica for the replication connection, in a format like that for the  tls_version server system variable. The connection procedure negotiates the use of the highest TLS version that both the source and the replica permit. To be able to connect, the replica must have at least one TLS version in common with the source. •The  MASTER_TLS_CIPHERSUITES  option (available from MySQL 8.0.19) specifies a colon-separated list of one or more ciphersuites that are permitted by the replica for the replication connection if TLSv1.3 is used for the connection. If this option is set to  NULL  when TLSv1.3 is used (which is the default if you do not set the option), the ciphersuites that are enabled by default are allowed. If you set the option to an empty string, no cipher suites are allowed, and TLSv1.3 is therefore not used. •After the source information has been updated, start the replication process on the replica: •Requiring encrypted connections on the replica does not ensure that the source requires encrypted connections from replicas. If you want to ensure that the source only accepts replicas that connect using encrypted connections, create a replication user account on the source using the  REQUIRE SSL  option, then grant that user the  REPLICATION SLAVE  privilege. For example: mysql>  CREATE USER ’repl’@’%.example.com’ IDENTIFIED BY ’ password ’ ->  REQUIRE SSL; mysql>  GRANT REPLICATION SLAVE ON *.* ->  TO ’repl’@’%.example.com’; mysql>  START SLAVE; Or from MySQL 8.0.22: mysql>  START REPLICA;