Rechercher dans le manuel MySQL

18.5.2 Group Replication Secure Socket Layer (SSL) Support

Contents

Group communication connections and distributed recovery connections can be secured using SSL. The following sections explain how to configure connections.

Configuring SSL for Group Communication

Secure sockets can be used for group communication connections between members of a group. The Group Replication system variable group_replication_ssl_mode is used to activate the use of SSL for group communication connections and specify the security mode for the connections. The default setting means that SSL is not used. The option has the following possible values:

Table 18.2 group_replication_ssl_mode configuration values

Value

Description

DISABLED

Establish an unencrypted connection (the default).

REQUIRED

Establish a secure connection if the server supports secure connections.

VERIFY_CA

Like REQUIRED, but additionally verify the server TLS certificate against the configured Certificate Authority (CA) certificates.

VERIFY_IDENTITY

Like VERIFY_CA, but additionally verify that the server certificate matches the host to which the connection is attempted.


The remainder of the configuration for Group Replication's group communication connections is taken from the server's SSL configuration. For more information on the options for configuring the server SSL, see Command Options for Encrypted Connections. The server SSL options that are applied to Group Replication's group communication connections are as follows:

Table 18.3 SSL Options

Server Configuration

Description

ssl_key

The path name of the SSL private key file in PEM format. On the client side, this is the client private key. On the server side, this is the server private key.

ssl_cert

The path name of the SSL public key certificate file in PEM format. On the client side, this is the client public key certificate. On the server side, this is the server public key certificate.

ssl_ca

The path name of the Certificate Authority (CA) certificate file in PEM format.

ssl_capath

The path name of the directory that contains trusted SSL certificate authority (CA) certificate files in PEM format.

ssl_crl

The path name of the file containing certificate revocation lists in PEM format.

ssl_crlpath

The path name of the directory that contains certificate revocation list files in PEM format.

ssl_cipher

The list of permissible ciphers for connection encryption.

tls_version

For client programs, a list of the TLS protocols the client permits for encrypted connections.


Important

In the list of TLS protocols specified in the tls_version system variable, ensure the specified versions are contiguous (for example, TLSv1,TLSv1.1,TLSv1.2,TLSv1.3). If there are any gaps in the list of protocols (for example, if you specified TLSv1.1,TLSv1.3, omitting TLS 1.2) Group Replication might be unable to make group communication connections.

The following example shows a section from a my.cnf file that configures SSL on a server, and activates SSL for Group Replication group communication connections: 

[mysqld]
ssl_ca = "cacert.pem"
ssl_capath = "/.../ca_directory"
ssl_cert = "server-cert.pem"
ssl_cipher = "DHE-RSA-AEs256-SHA"
ssl_crl = "crl-server-revoked.crl"
ssl_crlpath = "/.../crl_directory"
ssl_key = "server-key.pem"
group_replication_ssl_mode= REQUIRED
Important

The ALTER INSTANCE RELOAD TLS statement, which reconfigures the server's SSL context from the current values of the system variables that define the context, does not change the SSL context for Group Replication's group communication connections while Group Replication is running. To apply the reconfiguration to these connections, you must issue STOP GROUP_REPLICATION followed by START GROUP_REPLICATION to restart Group Replication.

Contents Haut

Configuring SSL for Distributed Recovery

When a member joins the group, distributed recovery is carried out using a combination of a remote cloning operation, if available and appropriate, and an asynchronous replication connection. Both methods of state transfer require a replication user that has been set up for distributed recovery, as described in Section 18.2.1.3, “User Credentials”. A replication user that requires an SSL connection must be created before the server joining the group (the joining member) connects to the donor. Typically, this is set up at the time you are provisioning a server to join the group.

To create a replication user for distributed recovery that requires an SSL connection, issue these statements:

  1. donor> SET SQL_LOG_BIN=0;
  2. donor> CREATE USER 'rec_ssl_user'@'%' REQUIRE SSL;
  3. donor> GRANT replication slave ON *.* TO 'rec_ssl_user'@'%';
  4. donor> GRANT BACKUP_ADMIN ON *.* TO 'rec_ssl_user'@'%';
  5. donor> SET SQL_LOG_BIN=1;

Assuming that all servers already in the group have a replication user set up to use SSL, you configure joining members to use those credentials when connecting to the donor by configuring the Group Replication recovery channel to use the credentials, as follows:

  1. new_member> CHANGE MASTER TO MASTER_USER="rec_ssl_user" FOR CHANNEL "group_replication_recovery";

To configure secure distributed recovery connections, use Group Replication's dedicated distributed recovery SSL options. These options correspond to the server SSL options that are used for group communication connections, but they are only applied for distributed recovery connections. By default, distributed recovery connections do not use SSL, even if you activated SSL for group communication connections, and the server SSL options are not applied for distributed recovery connections. You must configure these connections separately.

If a remote cloning operation is used as part of distributed recovery, Group Replication automatically configures the clone plugin's SSL options to match your settings for the distributed recovery SSL options. (For details of how the clone plugin uses SSL, see Configuring a Secure Connection for Cloning.)

The distributed recovery SSL options are as follows:

For example, issuing the following statements enables the use of SSL for distributed recovery connections, and identifies the paths to the certificate authority (CA) file, the public key certificate file, and the private key file that must be used for those connections:

  1. new_member> SET GLOBAL group_replication_recovery_use_ssl=1;
  2. new_member> SET GLOBAL group_replication_recovery_ssl_ca= '.../cacert.pem';
  3. new_member> SET GLOBAL group_replication_recovery_ssl_cert= '.../client-cert.pem';
  4. new_member> SET GLOBAL group_replication_recovery_ssl_key= '.../client-key.pem';

Find a PHP function

Document created the 26/06/2006, last modified the 26/10/2018
Source of the printed document:https://www.gaudry.be/en/mysql-rf-group-replication-secure-socket-layer-support-ssl.html

The infobrol is a personal site whose content is my sole responsibility. The text is available under CreativeCommons license (BY-NC-SA). More info on the terms of use and the author.

References

  1. View the html document Language of the document:en Manuel MySQL : https://dev.mysql.com/

These references and links indicate documents consulted during the writing of this page, or which may provide additional information, but the authors of these sources can not be held responsible for the content of this page.
The author This site is solely responsible for the way in which the various concepts, and the freedoms that are taken with the reference works, are presented here. Remember that you must cross multiple source information to reduce the risk of errors.

Contents Haut