# SSL Replication question

**URL:** <https://forums.percona.com/t/ssl-replication-question/41131>\
**Category:** Percona Distribution for MySQL\
**Created:** [August 3, 2026, 5:20pm UTC](https://forums.percona.com/t/ssl-replication-question/41131 "2026-08-03T17:20:40Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ipcmlr](https://avatars.discourse-cdn.com/v4/letter/i/df705f/32.png) [@ipcmlr](https://forums.percona.com/u/ipcmlr)\
**Post date:** [August 3, 2026, 5:20pm UTC](https://forums.percona.com/t/ssl-replication-question/41131/1 "2026-08-03T17:20:40Z")

</div>

I have replication setup. Copied keys, certs from the source to the replica.

The ssl keys/certs are specified in the mysql config file.

source\_ssl is 1

My replication user is setup and requires ssl.

Replication is working and syncing.

Is this setup complete?

I see on the mysql documentation that i need to also put the ca , server , and key certs. I did not set those up.

Do I need to set those up or the fact that my replication user uses ssl is good enough?

Thanks

---

<div class="post-metadata">

**Author:** ![Wayne\_Leutwyler](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/wayne_leutwyler/32/20829_2.png) [@Wayne\_Leutwyler](https://forums.percona.com/u/Wayne_Leutwyler)\
**Post date:** [August 3, 2026, 5:53pm UTC](https://forums.percona.com/t/ssl-replication-question/41131/2 "2026-08-03T17:53:11Z")

</div>

Your setup is completed for encrypted replication.

If you wanted stronger production security, configure at least:

```auto
STOP REPLICA;

CHANGE REPLICATION SOURCE TO
    SOURCE_SSL = 1,
    SOURCE_SSL_CA = '/path/to/ca.pem';

START REPLICA;

```

You normally do **not** need to configure the replica with the source server’s certificate and private key. The source keeps its own `server-cert.pem` and `server-key.pem`; the replica only needs the trusted CA unless mutual certificate authentication is required.

[replication-encrypted-connections](https://dev.mysql.com/doc/refman/8.4/en/replication-encrypted-connections.html)