# wsrep IST/SST : how to enable xbstream with encryption?

**URL:** <https://forums.percona.com/t/wsrep-ist-sst-how-to-enable-xbstream-with-encryption/2781>\
**Category:** Percona XtraDB Cluster 5.x\
**Created:** [June 30, 2013, 7:51am UTC](https://forums.percona.com/t/wsrep-ist-sst-how-to-enable-xbstream-with-encryption/2781 "2013-06-30T07:51:50Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![joepmeloen12](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@joepmeloen12](https://forums.percona.com/u/joepmeloen12)\
**Post date:** [June 30, 2013, 7:51am UTC](https://forums.percona.com/t/wsrep-ist-sst-how-to-enable-xbstream-with-encryption/2781/1 "2013-06-30T07:51:50Z")

</div>

We hacked SSL encryption into wsrep\_sst\_xtrabackup due to its lack of encryption natively. After upgrading today, we’ve noticed support for xbstream. However our cluster (after upgrading) doesn’t use xbstream automatically hence we’re back where we started: unencrypted IST/SST traffic. On a WAN cluster that’s not a good thing. Anybody can point me in the right direction on how to force Percona to use xbstream (more important, encryption) instead of tar?

---

<div class="post-metadata">

**Author:** ![Raghavendra\_Prabhu](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/raghavendra_prabhu/32/16891_2.png) [@Raghavendra\_Prabhu](https://forums.percona.com/u/Raghavendra_Prabhu)\
**Post date:** [July 4, 2013, 6:19am UTC](https://forums.percona.com/t/wsrep-ist-sst-how-to-enable-xbstream-with-encryption/2781/2 "2013-07-04T06:19:32Z")

</div>

Encryption can be enabled in SST by adding PXB encryption options to my.cnf under [xtrabackup]. There is currently a bug with PXB encryption - [URL=“[https://bugs.launchpad.net/percona-xtrabackup/+bug/1190610](https://bugs.launchpad.net/percona-xtrabackup/+bug/1190610)”][https://bugs.launchpad.net/percona-x...p/+bug/1190610[/URL]](https://bugs.launchpad.net/percona-x...p/+bug/1190610%5B/URL%5D) - after that is fixed, you can use it with PXC unchanged. In the development version of wsrep\_sst\_xtrabackup I have added openssl based encryption (which is independent on PXB). Take a look at [https://bazaar.launchpad.net/~percon](https://bazaar.launchpad.net/~percon)…\_xtrabackup.sh for details.

Edit: The linked script is incorrect. Here is the right one [url][https://bazaar.launchpad.net/~raghavendra-prabhu/percona-xtradb-cluster/pxc-1193215/view/head:/Percona-Server/scripts/wsrep\_sst\_xtrabackup.sh[/url]](https://bazaar.launchpad.net/~raghavendra-prabhu/percona-xtradb-cluster/pxc-1193215/view/head:/Percona-Server/scripts/wsrep_sst_xtrabackup.sh%5B/url%5D)