Hi Percona xtradb users,
I just set up my first Percona xtradb cluster using Ubuntu 24.04.2.
These packages are currently installed:
ii percona-release 1.0-30.generic all Package to install Percona gpg key and APT repos
ii percona-telemetry-agent 1.0.3-4.noble amd64 Percona Telemetry Agent gathers information and metrics from Percona products installed on the host.
ii percona-xtrabackup-84 8.4.0-2-1.noble amd64 Open source backup tool for InnoDB and XtraDB
ii percona-xtrabackup-dbg-84 8.4.0-2-1.noble amd64 Debug symbols for Percona XtraBackup
ii percona-xtradb-cluster 1:8.0.41-32-1.noble amd64 Percona XtraDB Cluster with Galera
ii percona-xtradb-cluster-client 1:8.0.41-32-1.noble amd64 Percona XtraDB Cluster database client binaries
ii percona-xtradb-cluster-common 1:8.0.41-32-1.noble amd64 Percona XtraDB Cluster database common files (e.g. /etc/mysql/my.cnf)
ii percona-xtradb-cluster-server 1:8.0.41-32-1.noble amd64 Percona XtraDB Cluster database server binaries
Here you have the config of the first node.
# Template my.cnf for PXC
# Edit to your requirements.
[client]
socket=/var/run/mysqld/mysqld.sock
[mysqld]
server-id=1
datadir=/var/lib/mysql
socket=/var/run/mysqld/mysqld.sock
log-error=/var/log/mysql/error.log
pid-file=/var/run/mysqld/mysqld.pid
user= mysql
# Binary log expiration period is 604800 seconds, which equals 7 days
binlog_expire_logs_seconds=604800
######## wsrep ###############
# Path to Galera library
wsrep_provider=/usr/lib/galera4/libgalera_smm.so
# Cluster connection URL contains IPs of nodes
#If no IP is found, this implies that a new cluster needs to be created,
#in order to do that you need to bootstrap this node
wsrep_cluster_address=gcomm://192.168.1.10,192.168.1.11,192.168.1.12,
# In order for Galera to work correctly binlog format should be ROW
binlog_format=ROW
# Slave thread to use
wsrep_slave_threads=8
wsrep_log_conflicts
# This changes how InnoDB autoincrement locks are managed and is a requirement for Galera
innodb_autoinc_lock_mode=2
# Node IP address
wsrep_node_address=192.168.1.10
# Cluster name
wsrep_cluster_name=testcluster
[mysqld]
# TLS/SSL Usage
wsrep_provider_options = "socket.ssl_cert=/etc/ssl/galera/cluster_1/node01.domain.tld.crt;socket.ssl_key=/etc/ssl/galera/cluster_1/node01.domain.tld.key;socket.ssl_ca=/etc/ssl/certs/CACRT.pem;ssl_cipher=tlsv1.2"
pxc_encrypt_cluster_traffic=ON
#
[sst]
encrypt=4
ssl-ca=/etc/ssl/certs/CACRT.pem
ssl-cert=/etc/ssl/galera/cluster_1/node01.domain.tld.crt
ssl-key=/etc/ssl/galera/cluster_1/node01.domain.tld.key
#If wsrep_node_name is not specified, then system hostname will be used
wsrep_node_name=node01.domain.tld
#pxc_strict_mode allowed values: DISABLED,PERMISSIVE,ENFORCING,MASTER
pxc_strict_mode=ENFORCING
# SST method
wsrep_sst_method=xtrabackup-v2
The configs of the other two nodes differs in wsrep_node_address, wsrep_node_name, and certname(key|crt).
Bootstrapping the first node can be executed without errors.
As soon as I start node2 to join the cluster, I receive error messages on the donor node
2025-05-06T12:30:25.821752Z 0 [Note] [MY-000000] [Galera] Failed to establish connection: tlsv1 alert decrypt error
And these messages on node2:
2025-05-06T12:30:18.313375Z 0 [Note] [MY-000000] [Galera] Failed to establish connection: invalid padding: certificate signature failure
I used self signed certs on both nodes, signed with the same CA, which is integrated into the local ca store of the os.
Checking the self signed cert show no errors:
openssl verify -verbose -CAfile /etc/ssl/certs/CACRT.pem /etc/ssl/galera/cluster_1/node01.domain.tld.crt
/etc/ssl/galera/cluster_1/node01.domain.tld.crt: OK
The user mysql is able to read the needed cert files.
I also tried adding âsocat_options=openssl-cipher=TLSv1.2,TLSv1.3â and âwsrep_provider_options = ââŠ;ssl_cipher=tlsv1.2ââ to the config with no success.
Performing a SST is posible if I switch off the transport security âpxc_encrypt_cluster_traffic=OFFâ.
Do I have an issue with Percona xtradb cluster under Ubuntu 24, where TLS 1.0, 1.1 and DTLS 1.0 are forcefully disabled Ubuntu 24.04 LTS (Noble Numbat) Release Notes - Release - Ubuntu Community Hub
Or are there some other issues within my installation?
Thx in advance
mrks
