# How do you get pt-heartbeat to connect to a slave who has require\_secure\_transport enabled?

**URL:** <https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888>\
**Category:** Percona Toolkit\
**Created:** [August 11, 2020, 3:54pm UTC](https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888 "2020-08-11T15:54:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![grosenthal](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@grosenthal](https://forums.percona.com/u/grosenthal)\
**Post date:** [August 11, 2020, 3:54pm UTC](https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888/1 "2020-08-11T15:54:23Z")

</div>

I do not see any ssl options listed in the pt-heartbeat --help.&nbsp; Please advise as i’m unable to get it to connect to my slaves.

---

<div class="post-metadata">

**Author:** ![carlos.salguero](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/carlos.salguero/32/20_2.png) [@carlos.salguero](https://forums.percona.com/u/carlos.salguero)\
**Post date:** [August 11, 2020, 4:04pm UTC](https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888/2 "2020-08-11T16:04:02Z")

</div>

Hello,&nbsp;Please check [[PT-191] add ssl options to DSN - Percona JIRA](https://jira.percona.com/browse/PT-191). It has info about using SSL with Toolkit.  
Regards

---

<div class="post-metadata">

**Author:** ![grosenthal](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@grosenthal](https://forums.percona.com/u/grosenthal)\
**Post date:** [August 18, 2020, 10:27am UTC](https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888/3 "2020-08-18T10:27:05Z")

</div>

Thanks.&nbsp; I have tried 6 ways to sunday to ge this to work but seeing unauthroized user hung up in connection control plugin on the slave and seeing ssl connection error on the master.&nbsp; See below  
  
bash$&nbsp; pt-heartbeat F=/var/lib/mysql/my1.cnf -D test --master-server-id 1 --checkDBI connect(‘test;mysql\_read\_default\_file=/var/lib/mysql/my1.cnf;mysql\_read\_default\_group=client’,‘’,…) failed: SSL connection error: error:00000001:lib(0):func(0):reason(1) at /bin/pt-heartbeat line 2908.  
  
my1.cnf looks like this[client]user=myuserpassword=mypasshost=xx.xx.xx.xxport=3306ssl-mode=REQUIRED  
  
Any suggestions?

---

<div class="post-metadata">

**Author:** ![Hook\_Bot](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/hook_bot/32/4411_2.png) [@Hook\_Bot](https://forums.percona.com/u/Hook_Bot)\
**Post date:** [September 4, 2021, 6:08pm UTC](https://forums.percona.com/t/how-do-you-get-pt-heartbeat-to-connect-to-a-slave-who-has-require-secure-transport-enabled/7888/4 "2021-09-04T18:08:56Z")

</div>

@grosenthal For now, here is a work-around:

bash$ pt-heartbeat -A=‘;mysql\_ssl=1;mysql\_optional=1’

As shown in [PT-191](https://jira.percona.com/browse/PT-191) referenced by @carlos.salguero .

And if you want to be extra super secure, you can still add “ssl-cert=” into your my1.cnf to ensure it actually matches with the MySQL server you are connecting with.

But you can also delete the my1.cnf and don’t even bother with the “F=” commandline option. Just know that without this “F=” option, pt-heartbeat will connect to _any_ MySQL server with _any_ SSL Certificate and _ **no verification** _ matching, which may or may not be acceptable for your situation.