SQL MASTER_SSL_VERIFY_SERVER_CERT

What is MASTER_SSL_VERIFY_SERVER_CERT in MySQL replication?

Toggles whether a MySQL replica validates the master server’s SSL certificate during replication connection setup.

Welcome to the Galaxy, Guardian!
You'll be receiving a confirmation email

Follow us on twitter :)

Oops! Something went wrong while submitting the form.

Compatible dialects for SQL MASTER_SSL_VERIFY_SERVER_CERT: Supported: MySQL 5.1 – 5.7 (deprecated after 5.7.10). Not supported: PostgreSQL, SQL Server, Oracle, SQLite, MariaDB 10.5+ (use MASTER_SSL or connection options instead).

SQL MASTER_SSL_VERIFY_SERVER_CERT Full Explanation

MASTER_SSL_VERIFY_SERVER_CERT is an option of the CHANGE MASTER TO statement used in MySQL replication. When set to 1 (ON), the replica validates the server certificate presented by the master against the certificate authority (CA) file defined in MASTER_SSL_CA. A value of 0 (OFF) disables that verification, allowing the connection even if the certificate is self-signed or untrusted. Enabling verification hardens security by preventing man-in-the-middle attacks. The option was introduced in MySQL 5.1 and deprecated in MySQL 5.7.11 when MASTER_SSL_MODE replaced it. It was removed in MySQL 8.0; use MASTER_SSL_MODE='VERIFY_IDENTITY' instead. The setting is stored in the replication metadata repositories (mysql.slave_master_info and relay log index) and persists across restarts until explicitly changed.Important caveats:- Requires SSL to be enabled (MASTER_SSL=1 or MASTER_SSL_MODE not equal to DISABLED).- The replica must have access to a valid CA certificate file.- If verification fails, START SLAVE (START REPLICA) aborts with an SSL error.

SQL MASTER_SSL_VERIFY_SERVER_CERT Syntax

CHANGE MASTER TO
  MASTER_HOST = 'primary.example.com',
  MASTER_USER = 'replica',
  MASTER_PASSWORD = 's3cret',
  MASTER_SSL = 1,
  MASTER_SSL_CA = '/etc/mysql/ca.pem',
  MASTER_SSL_VERIFY_SERVER_CERT = 1;

SQL MASTER_SSL_VERIFY_SERVER_CERT Parameters

MASTER_SSL_VERIFY_SERVER_CERT - integer (0 or 1)
0 - Do not verify the master’s SSL certificate.
1 - Verify the master’s SSL certificate.

Example Queries Using SQL MASTER_SSL_VERIFY_SERVER_CERT

-- Enable certificate verification on an existing replica
STOP SLAVE;
CHANGE MASTER TO MASTER_SSL_VERIFY_SERVER_CERT = 1;
START SLAVE;

-- Disable verification (not recommended)
STOP SLAVE;
CHANGE MASTER TO MASTER_SSL_VERIFY_SERVER_CERT = 0;
START SLAVE;

Expected Output Using SQL MASTER_SSL_VERIFY_SERVER_CERT

CHANGE MASTER TO updates the replica’s connection metadata
START SLAVE then attempts to connect
If verification succeeds, replication starts; otherwise, it stops with an SSL verification error

Use Cases with SQL MASTER_SSL_VERIFY_SERVER_CERT

Enforcing strict SSL security between geographically separated master and replica.
Meeting compliance requirements (PCI-DSS, HIPAA) that mandate certificate validation.
Protecting replication traffic over untrusted networks such as the public internet.

Common Mistakes with SQL MASTER_SSL_VERIFY_SERVER_CERT

Forgetting to supply MASTER_SSL_CA, causing the connection to fail.
Enabling verification while using a self-signed master certificate not present in the CA file.
Assuming the option still exists in MySQL 8.0 (use MASTER_SSL_MODE instead).

First Introduced In

MySQL 5.1

Frequently Asked Questions

What happens if I enable MASTER_SSL_VERIFY_SERVER_CERT without providing MASTER_SSL_CA?

Replication will not start. The replica needs a CA file to verify the certificate. Without it, START SLAVE returns an SSL validation error.

How do I migrate from MASTER_SSL_VERIFY_SERVER_CERT to MySQL 8.0?

Upgrade the replica, then use CHANGE MASTER TO MASTER_SSL_MODE='VERIFY_IDENTITY', and remove any reference to MASTER_SSL_VERIFY_SERVER_CERT.

Does MASTER_SSL_VERIFY_SERVER_CERT affect performance?

The additional certificate check adds negligible overhead compared to the network round-trip, so performance impact is minimal.

Can I set MASTER_SSL_VERIFY_SERVER_CERT per connection?

No. The setting is stored in the replica’s replication metadata and applies to all future connections until changed with another CHANGE MASTER TO statement.