# Cluster Unable to configure SSL **URL:** \ **Category:** Percona XtraDB Cluster 8.x\ **Created:** [February 13, 2023, 7:55am UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048 "2023-02-13T07:55:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AWHarvard](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@AWHarvard](https://forums.percona.com/u/AWHarvard)\ **Post date:** [February 13, 2023, 7:55am UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/1 "2023-02-13T07:55:01Z")
Ho together, I’m quite new to Percona SQL clusters. I’ve configured it using the latest documentation at [https://docs.percona.com/percona-xtradb-cluster/8.0/configure.html](https://docs.percona.com/percona-xtradb-cluster/8.0/configure.html) This is my environment: 3x Debian 11 servers with latest updates Percona 8 from it’s PPA’s (as of the documentation) Joining the newly created cluster fails, when trying to start mysql on node 1 manually it also fails. mysqld --help --verbose | grep ‘log-error’ | tail -1 shows this error: > [ERROR] [MY-000000] [WSREP] ssl-ca, ssl-cert, and ssl-key must all be defined to use encrypted mode traffic. Unable to configure SSL. Must shutdown. > [ERROR] [MY-010119] [Server] Aborting This is the nodes configuration: > [client] > socket=/sql/mysqld.sock > > [mysqld] > server-id=1 > datadir=/sql > socket=/sql/mysqld.sock > log-error=/sql/error.log > pid-file=/sql/mysqld.pid > > ssl-ca=/sql/certs/ca.pem > ssl-cert=/sql/certs/server-cert.pem > ssl-key=/sql/certs/server-key.pem > > binlog\_expire\_logs\_seconds=604800 > > binlog\_format=ROW > wsrep\_provider\_options=“socket.ssl\_key=/sql/certs/server-key.pem;socket.ssl\_cert=/sql/certs/server-cert.pem;socket.ssl\_ca=/sql/certs/ca.pem” > > wsrep\_provider=/usr/lib/galera4/libgalera\_smm.so > wsrep\_cluster\_address=gcomm://192.168.1.10,192.168.1.12,192.168.1.12 > wsrep\_slave\_threads=8 > wsrep\_log\_conflicts > wsrep\_node\_address=192.168.1.10 > wsrep\_cluster\_name=pxc-cluster > wsrep\_node\_name=node-1 > wsrep\_sst\_method=xtrabackup-v2 > > innodb\_autoinc\_lock\_mode=2 > > pxc\_strict\_mode=ENFORCING > > [sst] > encrypt=4 > ssl-key=/sql/server-key.pem > ssl-ca=/sql/ca.pem > ssl-cert=/sql/server-cert.pem Anything i’ve done wrong? Thank you guys! ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [February 13, 2023, 2:24pm UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/2 "2023-02-13T14:24:44Z")
> [@AWHarvard](#): > > ssl-ca=/sql/certs/ca.pem > ssl-cert=/sql/certs/server-cert.pem > ssl-key=/sql/certs/server-key.pem Did you create these? These are not automatically created for you since you have specified a location. MySQL will only create them automatically if you do NOT specify their location. I would do this: remove ALL ssl parameters from node1 my.cnf and then bootstrap node1. This will create the certificates/keys. Then shutdown node1. Copy the certs from /var/lib/mysql to your chosen location and put back the config parameters. Bootstrap mysql1 again. This should start and use the specified certs. Then, copy those certs to node2, configure node2 and start it to join node1. ---
**Author:** ![AWHarvard](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@AWHarvard](https://forums.percona.com/u/AWHarvard)\ **Post date:** [February 14, 2023, 9:30am UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/3 "2023-02-14T09:30:34Z")
Hi, I’ve removed all ssl spectific configs from the file. After bootstarpping node1 again noting changed in the /var/lib/mysql, still the old certificates in place. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [February 14, 2023, 4:46pm UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/4 "2023-02-14T16:46:04Z")
I’m not sure I understood what you said. If you now have SSL certificates in /var/lib/mysql after bootstrapping, stop MySQL, move those certs to /sql/certs/, add the parameters back to my.cnf and bootstrap again. Then copy those certs to node2, edit node2 config and start node2 ---
**Author:** ![AWHarvard](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@AWHarvard](https://forums.percona.com/u/AWHarvard)\ **Post date:** [February 14, 2023, 5:38pm UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/5 "2023-02-14T17:38:14Z")
What I’ve done now: removed all of my ssl config from the configuration file bootstrapped node 1 made sure mysql stopped on node 1 After that I took a look into /var/lib/mysql and there was no .pem file at all in it, nothing generated during the bootstrapping. ---
**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\ **Post date:** [February 14, 2023, 6:39pm UTC](https://forums.percona.com/t/cluster-unable-to-configure-ssl/20048/6 "2023-02-14T18:39:03Z")
Check MySQL’s error log and see why it didn’t generate SSL’s