Oracle 5.0 Reference Manual page 1516

Setting up replication using an SSL connection is similar to setting up a server and client using SSL.
You must obtain (or create) a suitable security certificate that you can use on the master, and a similar
certificate (from the same certificate authority) on each slave.
For more information on setting up a server and client for SSL connectivity, see
"Configuring MySQL for
To enable SSL on the master you must create or obtain suitable certificates, and then add the following
configuration options to the master's configuration within the
file:
my.cnf
[mysqld]
ssl-ca=cacert.pem
ssl-cert=server-cert.pem
ssl-key=server-key.pem
The paths to the certificates may be relative or absolute; we recommend that you always use complete
paths for this purpose.
The options are as follows:
• identifies the Certificate Authority (CA) certificate.
ssl-ca
• identifies the server public key. This can be sent to the client and authenticated against
ssl-cert
the CA certificate that it has.
• identifies the server private key.
ssl-key
On the slave, you have two options available for setting the SSL information. You can either add the
slave certificates to the
SSL information using the
• To add the slave certificates using an option file, add the following lines to the
the slave's file:
my.cnf
[client]
ssl-ca=cacert.pem
ssl-cert=client-cert.pem
ssl-key=client-key.pem
Restart the slave server, using the
connecting to the master. Use
option to enable SSL connectivity:
MASTER_SSL
mysql> CHANGE MASTER TO
-> MASTER_HOST='master_hostname',
-> MASTER_USER='replicate',
-> MASTER_PASSWORD='password',
-> MASTER_SSL=1;
• To specify the SSL certificate options using the
options:
mysql> CHANGE MASTER TO
-> MASTER_HOST='master_hostname',
-> MASTER_USER='replicate',
-> MASTER_PASSWORD='password',
-> MASTER_SSL=1,
-> MASTER_SSL_CA = 'ca_file_name',
-> MASTER_SSL_CAPATH = 'ca_directory_name',
-> MASTER_SSL_CERT = 'cert_file_name',
-> MASTER_SSL_KEY = 'key_file_name';
After the master information has been updated, start the slave replication process:
mysql> START SLAVE;
Setting Up Replication Using SSL
SSL".
section of the slave's
[client]
CHANGE MASTER TO
--skip-slave-start
CHANGE MASTER TO
1496
[mysqld]
file, or you can explicitly specify the
my.cnf
statement:
[1462] option to prevent the slave from
to specify the master configuration, using the
CHANGE MASTER TO
Section 6.3.6.2,
section of the master's
section of
[client]
statement, append the SSL