Enabling TLS in PXC without Downtime

A step-by-step procedure explains how to enable TLS encryption for inter-node replication traffic in Percona XtraDB Cluster (PXC) without taking the entire cluster offline. The approach relies on Galera's socket.dynamic provider option, which lets a node accept both encrypted and plaintext connections during a transition. The rollout requires two rolling restarts across a 3-node cluster: the first enables TLS while still allowing plaintext, and the second enforces TLS-only connections. The post also covers certificate placement, SST behavior, verification via wsrep_provider_options queries and tcpdump, and the reverse procedure for disabling TLS.

Source: https://www.percona.com/blog/enabling-tls-in-pxc-without-downtime. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.