# Example with TLS

**URL:** <https://forums.percona.com/t/example-with-tls/12703>\
**Category:** Percona Operator for MySQL\
**Created:** [October 24, 2021, 2:25pm UTC](https://forums.percona.com/t/example-with-tls/12703 "2021-10-24T14:25:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sergey\_Stepanenko](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_stepanenko/32/3192_2.png) [@Sergey\_Stepanenko](https://forums.percona.com/u/Sergey_Stepanenko)\
**Post date:** [October 24, 2021, 2:25pm UTC](https://forums.percona.com/t/example-with-tls/12703/1 "2021-10-24T14:25:35Z")

</div>

Hi all!  
Please share example with external TLS use.  
I use setup with haproxy, how i can set TLS for this case.  
I not found tips for this.

---

<div class="post-metadata">

**Author:** ![Sergey\_Stepanenko](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/sergey_stepanenko/32/3192_2.png) [@Sergey\_Stepanenko](https://forums.percona.com/u/Sergey_Stepanenko)\
**Post date:** [October 25, 2021, 12:18pm UTC](https://forums.percona.com/t/example-with-tls/12703/2 "2021-10-25T12:18:49Z")

</div>

Hi again!  
I was resolved my problem.  
In case when HAproxy as loadbalancer, we use only sslInternal.  
Haproxy in tcp mode and tls do with mysqld.

I miss with checking cert, when use

```auto
openssl s_client -connect IP_POD_PXC:3306

```

For check need use

```auto
openssl s_client -starttls mysql -connect IP_POD_PXC:3306

```

Also when we want use cert-manager and letencrypt issuer, you may get - “unable get local issuer certificate” in pxc pods and slave pod restarting always (not connect to master).  
This was resolved by modify secret (i not find other solution).  
New secret have:  
ca.crt: chain ROOT\_CA+INTER\_CA  
tls.crt: CERT  
tls.key: KEY

Original secret have only:  
tls.crt: chain ROOT\_CA+INTER\_CA+CERT  
tls.key: KEY

Maybe who can known how resolve this problem different?

PS  
Sorry for my english.