# Issue joining bootstrapped cluster

**URL:** <https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764>\
**Category:** Percona XtraDB Cluster\
**Tags:** percona\
**Created:** [November 20, 2025, 9:19pm UTC](https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764 "2025-11-20T21:19:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stsirag](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@stsirag](https://forums.percona.com/u/stsirag)\
**Post date:** [November 20, 2025, 9:19pm UTC](https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764/1 "2025-11-20T21:19:32Z")

</div>

I’m following the docs [Configure-nodes](https://docs.percona.com/percona-xtradb-cluster/8.4/configure-nodes.html) and [Add-nodes](https://docs.percona.com/percona-xtradb-cluster/8.4/add-node.html) to configure Percona 8.4 Mysql cluster

I’ve bootstrapped the first node and started mysql on the 2nd node after generating and copying the cert, and configuring the mysqld.cnf file as described (Ubuntu 24.04).

Slight modification: I’ve mounted a 2nd drive for the mysql data, and it’s in /mnt/data rather than the normal mysql directory.

Mysql fails to start on 2nd node.

In the /var/log/mysql/error.log, I get a bunch of this:

2025-11-18T22:24:03.119873Z 0 [Note] [MY-000000] [Galera] Failed to establish connection: invalid padding: certificate signature failure  
2025-11-18T22:24:03.617122Z 0 [Note] [MY-000000] [Galera] Failed to establish connection: Connection refused

I’ve tested with and without the firewalls, I’ve double/triple checked that the certs are the same in /etc/ on all 3 nodes, with mysql:mysql ownership and permissions as advised.

Certs inside the /mnt/data directory are NOT the same, but the instructions don’t say anything about that.

---

<div class="post-metadata">

**Author:** ![przemek](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/przemek/32/3_2.png) [@przemek](https://forums.percona.com/u/przemek)\
**Post date:** [November 20, 2025, 10:28pm UTC](https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764/2 "2025-11-20T22:28:19Z")

</div>

By default, the server is looking for SSL certificates and keys first in the datadir:

> **[MySQL :: MySQL 8.4 Reference Manual :: 8.3.1 Configuring MySQL to Use...](https://dev.mysql.com/doc/refman/8.4/en/using-encrypted-connections.html#using-encrypted-connections-server-side-startup-configuration)**

You need to make sure the relevant ssl-key, ssl-cert, ssl-ca, etc variables are pointing to the correct directory.

The PXC documentation explicitly states that the same certs should be on all cluster members:

> **[Percona XtraDB Cluster - Encrypt PXC traffic](https://docs.percona.com/percona-xtradb-cluster/8.4/encrypt-traffic.html#recommended-certificate-storage)**
>
> Percona XtraDB Cluster processes two distinct types of traffic and applies encryption to ensure secure data exchanges across all connections.

Moreover, as custom directories are used, check the AppArmor configuration to see if they are allowed for the mysql user in Ubuntu.

---

<div class="post-metadata">

**Author:** ![stsirag](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@stsirag](https://forums.percona.com/u/stsirag)\
**Post date:** [November 20, 2025, 10:46pm UTC](https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764/3 "2025-11-20T22:46:02Z")

</div>

I did try putting the cluster certs in a specific dir (/etc/mysql/clustercerts), and specified the full paths in both the wsrep\_provider\_options statement and [sst] section, but from the “passing config” line in the error log, it appears that the full path was not provided to Galera. (see highlighted in screenshot). Does that mean it’s still looking in the data directory?

And if so, should I replace the same files in the data directory? I was cautious to do so as there are other certs in there as well I didn’t want to screw up.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/percona1/original/3X/5/8/58030e6d77c3c1cccf31bb078fda4233a996dadb.jpeg)

---

<div class="post-metadata">

**Author:** ![matthewb](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/matthewb/32/34_2.png) [@matthewb](https://forums.percona.com/u/matthewb)\
**Post date:** [November 21, 2025, 3:46pm UTC](https://forums.percona.com/t/issue-joining-bootstrapped-cluster/39764/4 "2025-11-21T15:46:53Z")

</div>

This is the configuration you need, it is the same configuration we use in our XtraDB Cluster training classes.

```auto
[mysqld]
pxc_encrypt_cluster_traffic=ON
ssl-ca=/etc/ssl/mysql/ca.pem
ssl-cert=/etc/ssl/mysql/server-cert.pem
ssl-key=/etc/ssl/mysql/server-key.pem

```