ssl_ca：证书颁发机构（CA）证书文件的路径名。（ssl_capath 类似，但它指定的是 CA 证书文件所在目录的路径名。）ssl_ca: The path name of the Certificate Authority (CA) certificate file. (ssl_capath is similar but specifies the path name of a directory of CA certificate files.)

ssl_cert：服务器公钥证书文件的路径名。该证书可以发送给客户端，并可以根据客户端所持有的 CA 证书进行验证。ssl_cert: The path name of the server public key certificate file. This certificate can be sent to the client and authenticated against the CA certificate that it has.

ssl_key：服务器私钥文件的路径名。ssl_key: The path name of the server private key file.

要使用 CHANGE REPLICATION SOURCE TO 为副本的证书和 SSL 私钥文件命名，请添加相应的 SOURCE_SSL_xxx 选项，如下所示：To name the replica's certificate and SSL private key files using CHANGE REPLICATION SOURCE TO, add the appropriate SOURCE_SSL_xxx options, like this:

    -> SOURCE_SSL_CA = 'ca_file_name',
    -> SOURCE_SSL_CAPATH = 'ca_directory_name',
    -> SOURCE_SSL_CERT = 'cert_file_name',
    -> SOURCE_SSL_KEY = 'key_file_name',

这些选项对应于具有相同名称的 --ssl-xxx 选项，如 加密连接的命令选项 中所述。要使这些选项生效，必须同时设置 SOURCE_SSL=1。对于复制连接，为 SOURCE_SSL_CA 或 SOURCE_SSL_CAPATH 指定值相当于设置 --ssl-mode=VERIFY_CA。只有在使用指定信息找到有效匹配的证书颁发机构 (CA) 证书时，连接尝试才会成功。These options correspond to the --ssl-xxx options with the same names, as described in Command Options for Encrypted Connections. For these options to take effect, SOURCE_SSL=1 must also be set. For a replication connection, specifying a value for either of SOURCE_SSL_CA or SOURCE_SSL_CAPATH corresponds to setting --ssl-mode=VERIFY_CA. The connection attempt succeeds only if a valid matching Certificate Authority (CA) certificate is found using the specified information.

要启用主机名身份验证，请添加 SOURCE_SSL_VERIFY_SERVER_CERT 选项，如下所示：To activate host name identity verification, add the SOURCE_SSL_VERIFY_SERVER_CERT option, like this:

    -> SOURCE_SSL_VERIFY_SERVER_CERT=1,

对于复制连接，指定 SOURCE_SSL_VERIFY_SERVER_CERT=1 相当于设置 --ssl-mode=VERIFY_IDENTITY，如 加密连接的命令选项 中所述。要使此选项生效，还必须设置 SOURCE_SSL=1。主机名身份验证不适用于自签名证书。For a replication connection, specifying SOURCE_SSL_VERIFY_SERVER_CERT=1 corresponds to setting --ssl-mode=VERIFY_IDENTITY, as described in Command Options for Encrypted Connections. For this option to take effect, SOURCE_SSL=1 must also be set. Host name identity verification does not work with self-signed certificates.

要启用证书撤销列表 (CRL) 检查，请添加 SOURCE_SSL_CRL 或 SOURCE_SSL_CRLPATH 选项，如下所示：To activate certificate revocation list (CRL) checks, add the SOURCE_SSL_CRL or SOURCE_SSL_CRLPATH option, as shown here:

    -> SOURCE_SSL_CRL = 'crl_file_name',
    -> SOURCE_SSL_CRLPATH = 'crl_directory_name',

这些选项对应于具有相同名称的 --ssl-xxx 选项，如 加密连接的命令选项 中所述。如果未指定这些选项，将不会进行 CRL 检查。These options correspond to the --ssl-xxx options with the same names, as described in Command Options for Encrypted Connections. If they are not specified, no CRL checking takes place.

要为副本指定复制连接允许的密码、密码套件和加密协议列表，请使用 SOURCE_SSL_CIPHER、SOURCE_TLS_VERSION 和 SOURCE_TLS_CIPHERSUITES 选项，如下所示：To specify lists of ciphers, ciphersuites, and encryption protocols permitted by the replica for the replication connection, use the SOURCE_SSL_CIPHER, SOURCE_TLS_VERSION, and SOURCE_TLS_CIPHERSUITES options, like this:

    -> SOURCE_SSL_CIPHER = 'cipher_list',
    -> SOURCE_TLS_VERSION = 'protocol_list',
    -> SOURCE_TLS_CIPHERSUITES = 'ciphersuite_list',

您可以在这些列表中指定的协议、密码和密码套件取决于用于编译 MySQL 的 SSL 库。有关格式、允许的值以及如果未指定选项时的默认值的信息，请参见 第 8.3.2 节，“加密连接 TLS 协议和密码”。The protocols, ciphers, and ciphersuites that you can specify in these lists depend on the SSL library used to compile MySQL. For information about the formats, the permitted values, and the defaults if you do not specify the options, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

在源信息更新后，在从属服务器上启动复制过程，如下所示：After the source information has been updated, start the replication process on the replica, like this:

mysql> START REPLICA;

您可以使用 SHOW REPLICA STATUS 语句来确认是否成功建立了加密连接。You can use the SHOW REPLICA STATUS statement to confirm that an encrypted connection was established successfully.

在副本上要求加密连接，并不确保源端要求副本使用加密连接。如果您想确保源端仅接受通过加密连接连接的副本，请在源端使用 REQUIRE SSL 选项创建一个复制用户账户，然后授予该用户 REPLICATION SLAVE 权限。例如：Requiring encrypted connections on the replica does not ensure that the source requires encrypted connections from replicas. If you want to ensure that the source only accepts replicas that connect using encrypted connections, create a replication user account on the source using the REQUIRE SSL option, then grant that user the REPLICATION SLAVE privilege. For example:

mysql> CREATE USER 'repl'@'%.example.com' IDENTIFIED BY 'password'
    -> REQUIRE SSL;
mysql> GRANT REPLICATION SLAVE ON *.*
    -> TO 'repl'@'%.example.com';

如果您在源端已有现有的复制用户账户，可以使用以下语句向其添加 REQUIRE SSL：If you have an existing replication user account on the source, you can add REQUIRE SSL to it with this statement:

mysql> ALTER USER 'repl'@'%.example.com' REQUIRE SSL;