> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/galera-cluster/galera-security.md).

# Galera Security

- [Securing Communications in Galera Cluster](https://mariadb.com/docs/galera-cluster/galera-security/securing-communications-in-galera-cluster.md): Encrypt MariaDB Galera Cluster replication and SST traffic with TLS by configuring socket.ssl\_cert, socket.ssl\_key, and socket.ssl\_ca alongside server-side TLS system variables.
- [MariaDB Enterprise Cluster Security](https://mariadb.com/docs/galera-cluster/galera-security/mariadb-enterprise-cluster-security.md): Security extensions in MariaDB Enterprise Cluster powered by Galera: WSREP and SST TLS modes, cluster-name verification, X.509 certificate expiration warnings, and online TLS rollout.
- [Encryption vs Authentication in Galera Cluster](https://mariadb.com/docs/galera-cluster/galera-security/encryption-vs-authentication-in-galera-cluster.md): How encryption and peer authentication differ in MariaDB Galera Cluster, what each wsrep\_ssl\_mode value guarantees, and why the default SERVER mode is insufficient for compliance regimes that require
- [Choosing a Certificate Authority for Galera Cluster](https://mariadb.com/docs/galera-cluster/galera-security/choosing-a-certificate-authority-for-galera-cluster.md): How to choose a Certificate Authority for MariaDB Galera Cluster inter-node TLS: dedicate a CA, keep certificates short-lived, and set EKUs correctly.
- [Migrating to Verified TLS in Galera Cluster](https://mariadb.com/docs/galera-cluster/galera-security/migrating-to-verified-tls-in-galera-cluster.md): Procedure to migrate an existing MariaDB Galera Cluster from wsrep\_ssl\_mode=SERVER (encryption only) to SERVER\_X509 (encryption plus X.509 verification) with a node-by-node rolling restart.
- [Reloading TLS Certificates Without Downtime](https://mariadb.com/docs/galera-cluster/galera-security/reloading-tls-certificates-without-downtime.md): Reload MariaDB Galera Cluster TLS certificates without restarting a node using FLUSH SSL or socket.ssl\_reload, including the atomic file-replacement procedure.
- [Routine Certificate Rotation](https://mariadb.com/docs/galera-cluster/galera-security/routine-certificate-rotation.md): Rotate MariaDB Galera Cluster node certificates before expiry with no downtime, using hot reload and a validity-overlap window.
- [Cluster CA Rotation](https://mariadb.com/docs/galera-cluster/galera-security/cluster-ca-rotation.md): Migrate a MariaDB Galera Cluster to a new Certificate Authority without downtime using a dual-trust bundle, then retire the old CA.
- [Responding to a Key or Certificate Compromise](https://mariadb.com/docs/galera-cluster/galera-security/responding-to-a-key-or-certificate-compromise.md): Respond to a compromised MariaDB Galera Cluster node key or certificate by revoking via CRL or reissuing from a new CA, applied online with hot reload.
- [Connection Allowlist](https://mariadb.com/docs/galera-cluster/galera-security/connection-allowlist.md): Restrict which IP addresses may join a MariaDB Galera Cluster using the wsrep\_allowlist system variable or the mysql.wsrep\_allowlist table.
- [Cluster TLS State Inspection](https://mariadb.com/docs/galera-cluster/galera-security/cluster-tls-state-inspection.md): Inspect per-connection TLS state across a MariaDB cluster via the information\_schema.wsrep\_connections view (cipher, certificate subject, issuer, and version per connection).