> For the complete documentation index, see [llms.txt](https://mariadb.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mariadb.com/docs/galera-cluster/galera-security/encryption-vs-authentication-in-galera-cluster.md).

# Encryption vs Authentication in Galera Cluster

TLS provides two related but distinct guarantees:

* **Encryption** protects data in transit from eavesdropping.
* **Peer authentication** ensures the entity at the other end of the connection is the one you expect.

They are configured independently, and Galera Cluster's default configuration provides only the first.

## What Each WSREP TLS Mode Guarantees

The [wsrep\_ssl\_mode](/docs/galera-cluster/reference/wsrep-variable-details/wsrep_ssl_mode.md) system variable determines which guarantees apply to Enterprise Cluster replication traffic:

| Goal                             | Configuration                                                         |
| -------------------------------- | --------------------------------------------------------------------- |
| Encryption only                  | `wsrep_ssl_mode=SERVER` (default), plus `ssl_cert`/`ssl_key`/`ssl_ca` |
| Encryption + peer authentication | `wsrep_ssl_mode=SERVER_X509`                                          |

In `SERVER` mode a node encrypts replication traffic but accepts any peer that completes the TLS handshake — it does not verify the peer's X.509 certificate. In `SERVER_X509` mode every inter-node connection additionally requires a valid, CA-verifiable certificate.

{% hint style="warning" %}
If compliance requires mutual authentication of endpoints — as PCI DSS, SOC 2, ISO 27001, and most internal audit programs interpret "strong cryptography" — the default `SERVER` mode is insufficient. Use `SERVER_X509`.
{% endhint %}

## Why the Distinction Matters

Encryption alone defends against a passive eavesdropper, but not against an active attacker who can place a rogue server at a cluster member's address. Without peer authentication a node cannot tell a legitimate member from an impostor presenting an arbitrary certificate. Peer authentication closes that gap by requiring each node to present a certificate that chains to the cluster's trusted CA.

## See Also

* [wsrep\_ssl\_mode](/docs/galera-cluster/reference/wsrep-variable-details/wsrep_ssl_mode.md)
* [Securing Communications in Galera Cluster](/docs/galera-cluster/galera-security/securing-communications-in-galera-cluster.md)
* [Migrating to Verified TLS in Galera Cluster](/docs/galera-cluster/galera-security/migrating-to-verified-tls-in-galera-cluster.md)

<sub>*This page is licensed: CC BY-SA / Gnu FDL*</sub>