-> MASTER_SSL=1; Or from MySQL 8.0.23: mysql> CHANGE REPLICATION SOURCE TO -> SOURCE_HOST=’source_hostname’, -> SOURCE_USER=’repl’, -> SOURCE_PASSWORD=’ password ’, -> SOURCE_SSL=1; 

Setting SOURCE_SSL=1  | MASTER_SSL=1  for a replication connection and then setting no further SOURCE_SSL_ xxx  | MASTER_SSL_ xxx  options corresponds to setting --ssl-mode=REQUIRED for the client, as described in Command Options for Encrypted Connections. With SOURCE_SSL=1 | MASTER_SSL=1 , the connection attempt only succeeds if an encrypted connection can be established. A replication connection does not fall back to an unencrypted connection, so there is no setting corresponding to the --ssl-mode=PREFERRED  setting for replication. If SOURCE_SSL=0  | MASTER_SSL=0  is set, this corresponds to --ssl-mode=DISABLED . 

•To name the replica’s certificate and SSL private key files using the CHANGE REPLICATION SOURCE TO  | CHANGE MASTER TO  statement, if you did not do this in the replica’s my.cnf  file, add the appropriate SOURCE_SSL_ xxx  | MASTER_SSL_ xxx  options: 

-> MASTER_SSL_CA = ’ca_file_name’, -> MASTER_SSL_CAPATH = ’ca_directory_name’, -> MASTER_SSL_CERT = ’cert_file_name’, -> MASTER_SSL_KEY = ’key_file_name’, 

These options correspond to the --ssl- xxx  options with the same names, as described in Command Options for Encrypted Connections. For these options to take effect, MASTER_SSL=1 must also be set. For a replication connection, specifying a value for either of  MASTER_SSL_CA  or MASTER_SSL_CAPATH , or specifying these options in the replica’s my.cnf  file, corresponds to setting --ssl-mode=VERIFY_CA . The connection attempt only succeeds if a valid matching Certificate Authority (CA) certificate is found using the specified information. 

•To activate host name identity verification, add the MASTER_SSL_VERIFY_SERVER_CERT  option: 

-> MASTER_SSL_VERIFY_SERVER_CERT=1, 

This option corresponds to the --ssl-verify-server-cert  option, which was deprecated from MySQL 5.7 and removed in MySQL 8.0. For a replication connection, specifying MASTER_SSL_VERIFY_SERVER_CERT=1  corresponds to setting --ssl-mode=VERIFY_IDENTITY , as described in Command Options for Encrypted Connections. For this option to take effect, MASTER_SSL=1  must also be set. Host name identity verification does not work with self-signed certificates. 

•To activate certificate revocation list (CRL) checks, add the MASTER_SSL_CRL  or MASTER_SSL_CRLPATH  option: 

-> MASTER_SSL_CRL = ’crl_file_name’, -> MASTER_SSL_CRLPATH = ’crl_directory_name’, 

These options correspond to the --ssl- xxx  options with the same names, as described in Command Options for Encrypted Connections. If they are not specified, no CRL checking takes place. 

•To specify lists of ciphers, ciphersuites, and encryption protocols permitted by the replica for the replication connection, use the MASTER_SSL_CIPHER , MASTER_TLS_VERSION , and MASTER_TLS_CIPHERSUITES  options: 

-> MASTER_SSL_CIPHER = ’cipher_list’, -> MASTER_TLS_VERSION = ’protocol_list’, 

