For the complete documentation index, see llms.txt. This page is also available as Markdown.

Encryption vs Authentication in Galera Cluster

How encryption and peer authentication differ in MariaDB Galera Cluster, what each wsrep_ssl_mode value guarantees, and why the default SERVER mode is insufficient for compliance regimes that require

TLS provides two related but distinct guarantees:

  • Encryption protects data in transit from eavesdropping.

  • Peer authentication ensures the entity at the other end of the connection is the one you expect.

They are configured independently, and Galera Cluster's default configuration provides only the first.

What Each WSREP TLS Mode Guarantees

The wsrep_ssl_mode system variable determines which guarantees apply to Enterprise Cluster replication traffic:

Goal
Configuration

Encryption only

wsrep_ssl_mode=SERVER (default), plus ssl_cert/ssl_key/ssl_ca

Encryption + peer authentication

wsrep_ssl_mode=SERVER_X509

In SERVER mode a node encrypts replication traffic but accepts any peer that completes the TLS handshake — it does not verify the peer's X.509 certificate. In SERVER_X509 mode every inter-node connection additionally requires a valid, CA-verifiable certificate.

Why the Distinction Matters

Encryption alone defends against a passive eavesdropper, but not against an active attacker who can place a rogue server at a cluster member's address. Without peer authentication a node cannot tell a legitimate member from an impostor presenting an arbitrary certificate. Peer authentication closes that gap by requiring each node to present a certificate that chains to the cluster's trusted CA.

See Also

This page is licensed: CC BY-SA / Gnu FDL

Last updated

Was this helpful?