可以在组成员之间的组通信连接中使用安全套接字。Secure sockets can be used for group communication connections between members of a group.

组复制系统变量 group_replication_ssl_mode 用于激活组通信连接的 SSL 使用，并指定连接的安全模式。此值应在所有组成员中保持一致；如果不同，一些成员可能无法加入组。默认设置表示不使用 SSL。此变量具有以下可能的值：The Group Replication system variable group_replication_ssl_mode is used to activate the use of SSL for group communication connections and specify the security mode for the connections. This value should be the same on all group members; if it differs, some members may not be able to join the group. The default setting means that SSL is not used. This variable has the following possible values:

如果使用 SSL，则配置安全连接的方式取决于用于组通信的 XCom 或 MySQL 通信栈。If SSL is used, the means for configuring the secure connection depends on whether the XCom or the MySQL communication stack is used for group communication.

使用 XCom 通信栈（group_replication_communication_stack=XCOM）时： Group Replication 组通信连接的其余配置取自服务器的 SSL 配置。有关配置服务器 SSL 的选项的更多信息，请参见 加密连接的命令选项。应用到 Group Replication 组通信连接的服务器 SSL 选项如下：When using the XCom communication stack (group_replication_communication_stack=XCOM):  The remainder of the configuration for Group Replication's group communication connections is taken from the server's SSL configuration. For more information on the options for configuring the server SSL, see Command Options for Encrypted Connections. The server SSL options that are applied to Group Replication's group communication connections are as follows:

在复制组中，OpenSSL 会协商使用所有成员都支持的最高 TLS 协议。一个配置为仅使用 TLSv1.3（tls_version=TLSv1.3）的新加入成员，无法加入任何现有成员不支持 TLSv1.3 的复制组，因为在这种情况下，组成员使用的是较低的 TLS 协议版本。要让该成员加入组，必须将其配置为也允许使用现有组成员支持的较低 TLS 协议版本。相反，如果一个新加入成员不支持 TLSv1.3，但现有组成员都支持该版本并在相互连接时使用该版本，如果现有组成员已允许使用适当的较低 TLS 协议版本，或者你配置它们允许使用，则该成员仍可加入。在这种情况下，OpenSSL 会对从每个成员到新加入成员的连接使用较低的 TLS 协议版本。每个成员与其他现有成员的连接仍然使用双方支持的最高可用协议。In a replication group, OpenSSL negotiates the use of the highest TLS protocol that is supported by all members. A joining member that is configured to use only TLSv1.3 (tls_version=TLSv1.3) cannot join a replication group where any existing member does not support TLSv1.3, because the group members in that case are using a lower TLS protocol version. To join the member to the group, you must configure the joining member to also permit the use of lower TLS protocol versions supported by the existing group members. Conversely, if a joining member does not support TLSv1.3, but the existing group members all do and are using that version for connections to each other, the member can join if the existing group members already permit the use of a suitable lower TLS protocol version, or if you configure them to do so. In that situation, OpenSSL uses a lower TLS protocol version for the connections from each member to the joining member. Each member's connections to other existing members continue to use the highest available protocol that both members support.

您可以在运行时更改 tls_version 系统变量，以更改服务器允许的 TLS 协议版本列表。对于组复制，ALTER INSTANCE RELOAD TLS 语句会根据定义上下文的系统变量的当前值重新配置服务器的 TLS 上下文，但在组复制运行时，它不会更改组复制组通信连接的 TLS 上下文。要将重新配置应用到这些连接，您必须执行 STOP GROUP_REPLICATION，然后执行 START GROUP_REPLICATION，以在更改了 tls_version 系统变量的成员上重新启动组复制。同样，如果您希望组的所有成员都切换到使用更高或更低的 TLS 协议版本，则在更改允许的 TLS 协议版本列表后，必须对成员执行滚动重启组复制，以便在滚动重启完成后，OpenSSL 可以协商使用更高的 TLS 协议版本。有关在运行时更改允许的 TLS 协议版本列表的说明，请参见 第 8.3.2 节，“加密连接 TLS 协议和密码” 和 加密连接的服务器端运行时配置和监控。You can change the tls_version system variable at runtime to alter the list of permitted TLS protocol versions for the server. For Group Replication, the ALTER INSTANCE RELOAD TLS statement, which reconfigures the server's TLS context from the current values of the system variables that define the context, does not change the TLS context for Group Replication's group communication connection while Group Replication is running. To apply the reconfiguration to these connections, you must execute STOP GROUP_REPLICATION followed by START GROUP_REPLICATION to restart Group Replication on the member or members where you changed the tls_version system variable. Similarly, if you want to make all members of a group change to using a higher or lower TLS protocol version, you must carry out a rolling restart of Group Replication on the members after changing the list of permitted TLS protocol versions, so that OpenSSL negotiates the use of the higher TLS protocol version when the rolling restart is completed. For instructions to change the list of permitted TLS protocol versions at runtime, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers” and Server-Side Runtime Configuration and Monitoring for Encrypted Connections.

下面的示例显示了一个 my.cnf 文件的部分内容，该文件在服务器上配置了 SSL，并为 Group Replication 组通信连接启用了 SSL：The following example shows a section from a my.cnf file that configures SSL on a server, and activates SSL for Group Replication group communication connections:

[mysqld]
ssl_ca = "cacert.pem"
ssl_capath = "/.../ca_directory"
ssl_cert = "server-cert.pem"
ssl_cipher = "DHE-RSA-AEs256-SHA"
ssl_crl = "crl-server-revoked.crl"
ssl_crlpath = "/.../crl_directory"
ssl_key = "server-key.pem"
group_replication_ssl_mode= REQUIRED

为分布式恢复而在新加入的成员与现有成员之间建立的连接不包括在上述描述的选项中。这些连接使用组复制的专用分布式恢复 SSL 选项，详见第 20.6.3.2 节，“分布式恢复的安全套接层（SSL）连接”。Connections made between a joining member and an existing member for distributed recovery are not covered by the options described above. These connections use Group Replication's dedicated distributed recovery SSL options, which are described in Section 20.6.3.2, “Secure Socket Layer (SSL) Connections for Distributed Recovery”.

当使用 MySQL 通信栈（group_replication_communication_stack=MYSQL）时： 组的分布式恢复的安全设置将应用于组成员之间的常规通信。有关如何配置安全设置，请参见 第 20.6.3 节，“保护分布式恢复连接”。When using the MySQL communication stack (group_replication_communication_stack=MYSQL):  The security settings for distributed recovery of the group are applied to the normal communications between group members. See Section 20.6.3, “Securing Distributed Recovery Connections” on how to configure the security settings.