# Changing the SST auth mechanism from plaintext to SSL encryption without downtime

**URL:** <https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019>\
**Category:** Percona XtraDB Cluster 8.x\
**Tags:** mysql, percona\
**Created:** [October 19, 2023, 3:55am UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019 "2023-10-19T03:55:11Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![irwanseptian](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/irwanseptian/32/12983_2.png) [@irwanseptian](https://forums.percona.com/u/irwanseptian)\
**Post date:** [October 19, 2023, 3:55am UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019/1 "2023-10-19T03:55:11Z")

</div>

Hi all,

I want to upgrade my 5.7 to 8.0 and for now the sst auth on the 5.7 nodes using plaintext authentication (wsrep\_sst\_auth) but maybe for the initial step i will disable the `pxc-encrypt-cluster-traffic` and i will enable it again later when the node already uses version 8.0.

So is that possible to changing the SST auth mechanism from plaintext to SSL without downtime? Is there any way to do that?

thankyou.

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 19, 2023, 1:01pm UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019/2 "2023-10-19T13:01:31Z")

</div>

> [@irwanseptian](#):
>
> wsrep\_sst\_auth

This option no longer exists in PXC 8. You should remove it from your config _before_ upgrading to 8. SST authentication is handled automatically by the wsrep\_sst process. A new, temporary user, is automatically created for the duration of the SST.

---

<div class="post-metadata">

**Author:** ![irwanseptian](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/irwanseptian/32/12983_2.png) [@irwanseptian](https://forums.percona.com/u/irwanseptian)\
**Post date:** [October 19, 2023, 3:41pm UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019/3 "2023-10-19T15:41:47Z")

</div>

ah yeah i’m actually aware of that, so let say i already used pxc 8 without ssl encryption. So, it is possible if i enable the encryption later without downtime?

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [October 19, 2023, 3:56pm UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019/4 "2023-10-19T15:56:47Z")

</div>

If you want to enable node-to-node SSL encryption (internal galera traffic), you will have to restart the cluster.

SST will be encrypted always because that process is external and has nothing to do with node-node communications.

---

<div class="post-metadata">

**Author:** ![irwanseptian](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/irwanseptian/32/12983_2.png) [@irwanseptian](https://forums.percona.com/u/irwanseptian)\
**Post date:** [October 20, 2023, 3:31am UTC](https://forums.percona.com/t/changing-the-sst-auth-mechanism-from-plaintext-to-ssl-encryption-without-downtime/26019/5 "2023-10-20T03:31:59Z")

</div>

ah i see, thanks for the answer. Really appreciate that.