# Enforce TLS for replication

**URL:** <https://forums.percona.com/t/enforce-tls-for-replication/18139>\
**Category:** Percona XtraDB Cluster 5.x\
**Created:** [October 21, 2022, 6:46pm UTC](https://forums.percona.com/t/enforce-tls-for-replication/18139 "2022-10-21T18:46:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ultrapain](https://avatars.discourse-cdn.com/v4/letter/u/c77e96/32.png) [@ultrapain](https://forums.percona.com/u/ultrapain)\
**Post date:** [October 21, 2022, 6:46pm UTC](https://forums.percona.com/t/enforce-tls-for-replication/18139/1 "2022-10-21T18:46:44Z")

</div>

I have been referencing the following document to try and enforce TLSv1.2 (minimum) for replication, to no avail:

> **[galera-documentation.pdf](https://galeracluster.com/library/galera-documentation.pdf)**

I have the following in the [mysqld] block of my.cnf:  
wsrep\_provider\_options=“socket.ssl\_cert=/path/to/our/ident/cert;socket.ssl\_key=/path/to/our/ssl/key;socket.ssl\_ca=/path/to/our/trust/store;ssl\_cipher=tlsv1.2;socket.ssl=yes”

Yet I’m still able to connect to the port using TLS 1.0. I’ve been combing through documentation for 6 hours and that’s the best I could come up with. Any help would be greatly appreciated. Thanks!

---

<div class="post-metadata">

**Author:** ![CTutte](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ctutte/32/1341_2.png) [@CTutte](https://forums.percona.com/u/CTutte)\
**Post date:** [October 21, 2022, 7:17pm UTC](https://forums.percona.com/t/enforce-tls-for-replication/18139/2 "2022-10-21T19:17:49Z")

</div>

Hi ultrapain,

> Yet I’m still able to connect to the port using TLS 1.0. I’ve been combing through documentation for 6 hours and that’s the best I could come up with.

What do you mean by “I am still able to connect to the port using TLS 1.0”? The connections you (client) make to MySQL are different than the internal communication happening among the nodes.

For client connections use “tls\_version” parameter [https://dev.mysql.com/doc/refman/5.7/en/encrypted-connection-protocols-ciphers.html](https://dev.mysql.com/doc/refman/5.7/en/encrypted-connection-protocols-ciphers.html) and enforce a newer than 1.0 version

Regards

---

<div class="post-metadata">

**Author:** ![ultrapain](https://avatars.discourse-cdn.com/v4/letter/u/c77e96/32.png) [@ultrapain](https://forums.percona.com/u/ultrapain)\
**Post date:** [October 24, 2022, 2:28pm UTC](https://forums.percona.com/t/enforce-tls-for-replication/18139/3 "2022-10-24T14:28:19Z")

</div>

To test TLS enforcement on wsrep, I am doing the following:  
openssl s\_client -connect localhost:4567 -tls1

This attempts to make a connection to my server on port 4567 (the replication port) using tlsv1, which is accepted. Hope this helps to clarify my issue.

Thanks!