ssl_ca: The path name of the Certificate Authority (CA) certificate file. (ssl_capath is similar but specifies the path name of a directory of CA certificate files.)

ssl_cert: The path name of the server public key certificate file. This certificate can be sent to the client and authenticated against the CA certificate that it has.

ssl_key: The path name of the server private key file.

To name the replica's certificate and key files using an option file, add the following lines to the [client] section of the replica's my.cnf file, changing the file names as necessary:

[client]
ssl-ca=cacert.pem
ssl-cert=client-cert.pem
ssl-key=client-key.pem

Restart the replica server, using the --skip-slave-start option, or from MySQL 8.0.24, the skip_slave_start system variable, to prevent the replica from connecting to the source. Use CHANGE REPLICATION SOURCE TO | CHANGE MASTER TO to specify the source configuration, and add the MASTER_SSL option to connect using encryption:

mysql> CHANGE MASTER TO
    -> MASTER_HOST='source_hostname',
    -> MASTER_USER='repl',
    -> MASTER_PASSWORD='password',
    -> MASTER_SSL=1;

Or from MySQL 8.0.23:
mysql> CHANGE REPLICATION SOURCE TO
    -> SOURCE_HOST='source_hostname',
    -> SOURCE_USER='repl',
    -> SOURCE_PASSWORD='password',
    -> SOURCE_SSL=1;

Setting SOURCE_SSL=1 | MASTER_SSL=1 for a replication connection and then setting no further SOURCE_SSL_xxx | MASTER_SSL_xxx options corresponds to setting --ssl-mode=REQUIRED for the client, as described in Command Options for Encrypted Connections. With SOURCE_SSL=1 | MASTER_SSL=1, the connection attempt only succeeds if an encrypted connection can be established. A replication connection does not fall back to an unencrypted connection, so there is no setting corresponding to the --ssl-mode=PREFERRED setting for replication. If SOURCE_SSL=0 | MASTER_SSL=0 is set, this corresponds to --ssl-mode=DISABLED.

To name the replica's certificate and SSL private key files using the CHANGE REPLICATION SOURCE TO | CHANGE MASTER TO statement, if you did not do this in the replica's my.cnf file, add the appropriate SOURCE_SSL_xxx | MASTER_SSL_xxx options:

    -> MASTER_SSL_CA = 'ca_file_name',
    -> MASTER_SSL_CAPATH = 'ca_directory_name',
    -> MASTER_SSL_CERT = 'cert_file_name',
    -> MASTER_SSL_KEY = 'key_file_name',

These options correspond to the --ssl-xxx options with the same names, as described in Command Options for Encrypted Connections. For these options to take effect, MASTER_SSL=1 must also be set. For a replication connection, specifying a value for either of MASTER_SSL_CA or MASTER_SSL_CAPATH, or specifying these options in the replica's my.cnf file, corresponds to setting --ssl-mode=VERIFY_CA. The connection attempt only succeeds if a valid matching Certificate Authority (CA) certificate is found using the specified information.

To activate host name identity verification, add the MASTER_SSL_VERIFY_SERVER_CERT option:

    -> MASTER_SSL_VERIFY_SERVER_CERT=1,

This option corresponds to the --ssl-verify-server-cert option, which was deprecated from MySQL 5.7 and removed in MySQL 8.0. For a replication connection, specifying MASTER_SSL_VERIFY_SERVER_CERT=1 corresponds to setting --ssl-mode=VERIFY_IDENTITY, as described in Command Options for Encrypted Connections. For this option to take effect, MASTER_SSL=1 must also be set. Host name identity verification does not work with self-signed certificates.

To activate certificate revocation list (CRL) checks, add the MASTER_SSL_CRL or MASTER_SSL_CRLPATH option:

    -> MASTER_SSL_CRL = 'crl_file_name',
    -> MASTER_SSL_CRLPATH = 'crl_directory_name',

These options correspond to the --ssl-xxx options with the same names, as described in Command Options for Encrypted Connections. If they are not specified, no CRL checking takes place.

To specify lists of ciphers, ciphersuites, and encryption protocols permitted by the replica for the replication connection, use the MASTER_SSL_CIPHER, MASTER_TLS_VERSION, and MASTER_TLS_CIPHERSUITES options:

    -> MASTER_SSL_CIPHER = 'cipher_list',
    -> MASTER_TLS_VERSION = 'protocol_list',
    -> MASTER_TLS_CIPHERSUITES = 'ciphersuite_list',

The protocols, ciphers, and ciphersuites that you can specify in these lists depend on the SSL library used to compile MySQL. For information about the formats, the permitted values, and the defaults if you do not specify the options, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

After the source information has been updated, start the replication process on the replica:

mysql> START SLAVE;
Or from MySQL 8.0.22:
mysql> START REPLICA;

You can use the SHOW REPLICA | SLAVE STATUS statement to confirm that an encrypted connection was established successfully.

Requiring encrypted connections on the replica does not ensure that the source requires encrypted connections from replicas. If you want to ensure that the source only accepts replicas that connect using encrypted connections, create a replication user account on the source using the REQUIRE SSL option, then grant that user the REPLICATION SLAVE privilege. For example:

mysql> CREATE USER 'repl'@'%.example.com' IDENTIFIED BY 'password'
    -> REQUIRE SSL;
mysql> GRANT REPLICATION SLAVE ON *.*
    -> TO 'repl'@'%.example.com';

If you have an existing replication user account on the source, you can add REQUIRE SSL to it with this statement:

mysql> ALTER USER 'repl'@'%.example.com' REQUIRE SSL;