# Creating openssl certificates for replication

**URL:** <https://forums.percona.com/t/creating-openssl-certificates-for-replication/37372>\
**Category:** Other MySQL® Questions\
**Created:** [March 26, 2025, 3:03pm UTC](https://forums.percona.com/t/creating-openssl-certificates-for-replication/37372 "2025-03-26T15:03:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 26, 2025, 3:03pm UTC](https://forums.percona.com/t/creating-openssl-certificates-for-replication/37372/1 "2025-03-26T15:03:28Z")

</div>

EDIT:  
I might have had typos copy pasting last time.  
I have made the certificates without error today.

Are there instructions/documetation to create ssl certificates for mysql?  
I will use them for mysql replication in a QA environment.

> **[MySQL :: MySQL 8.4 Reference Manual :: 19.3.1 Setting Up Replication to Use...](https://dev.mysql.com/doc/refman/8.0/en/replication-encrypted-connections.html)**

Can I just simply use the certs created automatically in the /var/lib/mysql directory?

I tried using the instructions from the mysql documentation:

> **[MySQL :: MySQL 8.4 Reference Manual :: 8.3.3.2 Creating SSL Certificates and...](https://dev.mysql.com/doc/refman/8.4/en/creating-ssl-files-using-openssl.html#creating-ssl-files-using-openssl-unix-command-line)**

But the resulting certs give me an error when I try to verify them:  
openssl verify -CAfile ca.pem server-cert.pem client-cert.pem  
C = US, L = Default City, O = Default Company Ltd  
error 18 at 0 depth lookup: self signed certificate  
error server-cert.pem: verification failed  
C = US, L = Default City, O = Default Company Ltd  
error 18 at 0 depth lookup: self signed certificate  
error client-cert.pem: verification failed

---

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [March 27, 2025, 4:07pm UTC](https://forums.percona.com/t/creating-openssl-certificates-for-replication/37372/2 "2025-03-27T16:07:04Z")

</div>

errors probably due to typos