> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/galera-cluster/galera-security/cluster-tls-state-inspection.md).

# Cluster TLS State Inspection

{% hint style="info" %}
The `information_schema.wsrep_connections` view is available in MariaDB Enterprise Server from version 11.8.3-1.
{% endhint %}

Operators and auditors often need to answer "which certificate is each node presenting, and over what cipher" without scraping logs. The `wsrep_connections` view exposes per-connection TLS state.

## information\_schema.wsrep\_connections

The `wsrep_connections` plugin provides one row per Galera connection:

| Column                | Description                                                       |
| --------------------- | ----------------------------------------------------------------- |
| `connection_id`       | Connection identifier.                                            |
| `connection_scheme`   | Connection scheme / transport.                                    |
| `local_address`       | Local endpoint address.                                           |
| `remote_address`      | Remote peer address.                                              |
| `cipher`              | Negotiated TLS cipher (empty if the connection is not encrypted). |
| `certificate_subject` | Subject of the peer certificate.                                  |
| `certificate_issuer`  | Issuer of the peer certificate.                                   |
| `certificate_version` | Version of the peer certificate.                                  |

```sql
SELECT remote_address, cipher, certificate_subject, certificate_issuer
FROM information_schema.wsrep_connections;
```

A connection with an empty `cipher` is not using TLS. Comparing `certificate_issuer` across rows helps confirm every peer chains to the expected cluster CA.

## See Also

* [Encryption vs Authentication in Galera Cluster](/docs/galera-cluster/galera-security/encryption-vs-authentication-in-galera-cluster.md)
* [Securing Communications in Galera Cluster](/docs/galera-cluster/galera-security/securing-communications-in-galera-cluster.md)

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>