# Proxsql Front-end connection

**URL:** <https://forums.percona.com/t/proxsql-front-end-connection/16891>\
**Category:** ProxySQL\
**Created:** [August 4, 2022, 10:54am UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891 "2022-08-04T10:54:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![preethi\_subbu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/preethi_subbu/32/3204_2.png) [@preethi\_subbu](https://forums.percona.com/u/preethi_subbu)\
**Post date:** [August 4, 2022, 10:54am UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/1 "2022-08-04T10:54:55Z")

</div>

Hi, I am new to proxysql. Could anyone share the documentation for changing cipher in proxysql front-end connections ?

By Default DHE-RSA-AES256-SHA cipher used. I would like to enable TLSV1.2 cipher.

Any leads would be really helpful.  
Thanks ahead!

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [August 4, 2022, 11:21am UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/2 "2022-08-04T11:21:27Z")

</div>

Hello, you should read this blog series [SSL Encryption at ProxySQL Part 1 - ProxySQL](https://proxysql.com/blog/ssl-at-proxysql-part1/)

---

<div class="post-metadata">

**Author:** ![preethi\_subbu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/preethi_subbu/32/3204_2.png) [@preethi\_subbu](https://forums.percona.com/u/preethi_subbu)\
**Post date:** [August 4, 2022, 11:26am UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/3 "2022-08-04T11:26:09Z")

</div>

Thanks for the prompt response. I have checked this doc where cipher for back-end connections are mentioned.  
I would like to enable SSL for front-end connections with TLSV1.2 ciphers.

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [August 4, 2022, 11:55am UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/4 "2022-08-04T11:55:53Z")

</div>

I am assuming you tried changing:

```auto
ssl_p2s_cipher

```

I am not sure if you can use different cyphers for frontend and backend connections if that’s the question

---

<div class="post-metadata">

**Author:** ![preethi\_subbu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/preethi_subbu/32/3204_2.png) [@preethi\_subbu](https://forums.percona.com/u/preethi_subbu)\
**Post date:** [August 4, 2022, 12:22pm UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/5 "2022-08-04T12:22:31Z")

</div>

I need to enable SSL only for front-end connections. Sharing the configuration for better clarity.

```nohighlight
+----------------------+-------------------------------+
| variable_name | variable_value |
+----------------------+-------------------------------+
| mysql-ssl_p2s_cipher | ECDHE-ECDSA-AES256-GCM-SHA384 |
+----------------------+-------------------------------+
1 row in set (0.00 sec)

```

Used the below command to confirm the cipher used.

````auto
mysql/bin/mysql -uadmin -p -P6032 -h127.0.0.1 -e '\s' | grep -P 'SSL|Connection'
Connection id: 1441
SSL: Cipher in use is DHE-RSA-AES256-SHA
Connection: 127.0.0.1 via TCP/IP```

From this I could see only default cipher is used in front-end connections. Could anyone share the configuration to change the cipher.
````

---

<div class="post-metadata">

**Author:** ![Ivan\_Groenewold](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/ivan_groenewold/32/6299_2.png) [@Ivan\_Groenewold](https://forums.percona.com/u/Ivan_Groenewold)\
**Post date:** [August 4, 2022, 12:59pm UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/6 "2022-08-04T12:59:40Z")

</div>

Ok, try adding this to the mysql client:

```auto
--ssl --ssl-cipher=ECDHE-ECDSA-AES256-GCM-SHA384

```

---

<div class="post-metadata">

**Author:** ![preethi\_subbu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/preethi_subbu/32/3204_2.png) [@preethi\_subbu](https://forums.percona.com/u/preethi_subbu)\
**Post date:** [August 4, 2022, 1:10pm UTC](https://forums.percona.com/t/proxsql-front-end-connection/16891/7 "2022-08-04T13:10:51Z")

</div>

Getting `SSL connection error: Failed to set ciphers to use` when ECDHE-ECDSA-AES256-GCM-SHA384 cipher is mentioned.

Able to connect only with default cipher.

Should I check the cert creation ?