where /path/to/clone_dir  is the path to the named directory on the recipient. 

## Configuring an Encrypted Connection for Cloning 

You can configure an encrypted connection for remote cloning operations to protect data as it is cloned over the network. An encrypted connection is required by default when cloning encrypted data. (see Section 5.6.7.4, “Cloning Encrypted Data” .) 

The instructions that follow describe how to configure the recipient MySQL server instance to use an encrypted connection. It is assumed that the donor MySQL server instance is already configured to use encrypted connections. If not, refer to Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” for server-side configuration instructions. 

To configure the recipient MySQL server instance to use an encrypted connection: 

1. Make the client certificate and key files of the donor MySQL server instance available to the recipient host. Either distribute the files to the recipient host using a secure channel or place them on a mounted partition that is accessible to the recipient host. The client certificate and key files to make available include: 

• ca.pem 

The self-signed certificate authority (CA) file. 

• client-cert.pem 

The client public key certificate file. 

• client-key.pem 

The client private key file. 

2. Configure the following SSL options on the recipient MySQL server instance. 

• clone_ssl_ca 

Specifies the path to the self-signed certificate authority (CA) file. 

• clone_ssl_cert 

Specifies the path to the client public key certificate file. 

• clone_ssl_key 

Specifies the path to the client private key file. 

For example: 

clone_ssl_ca=/ path / to /ca.pem clone_ssl_cert=/ path / to /client-cert.pem clone_ssl_key=/ path / to /client-key.pem 

3. To require that an encrypted connection is used, include the REQUIRE SSL  clause when issuing the CLONE  statement on the recipient. 

mysql> CLONE INSTANCE FROM ’ user ’@’ example.donor.host.com ’: 3306 IDENTIFIED BY ’ password ’ DATA DIRECTORY = ’ /path/to/clone_dir ’ REQUIRE SSL; 

