Configuring MySQL slave to use SSL

Question

I am trying to set up a MySQL slave to use replication via SSL.

The my.cnf file contains the following:

server-id = 1012

master-host = host
master-port = port
master-user = user
master-password = password

ssl-ca=/etc/mysqld/ssl/ca-cert.pem
ssl-cert=/etc/mysqld/ssl/client-cert.pem
ssl-key=/etc/mysqld/ssl/client-key.pem

Starting the slave fails with SLAVE STATUS showing

Master_SSL_Allowed: No

When I manually set up the slave as follows:

CHANGE MASTER TO
     MASTER_HOST='host',
     MASTER_USER='user',
     MASTER_PASSWORD='secret',
     MASTER_SSL=1;
START SLAVE;

Everything works. Any idea what parameter I need to enter into my.cnf in order to force the slave to use SSL? The obvious choice - "master-ssl=1" did not work.

Answer 1

Older versions of MySQL allow declaring the CHANGE MASTER TO parameters in my.cnf. Newer version may not. In fact, according to the MySQL Documentation concerning setting replication options in my.cnf:

Before MySQL 5.1.17, these options are silently ignored if given unless there is no master.info file. If that file exists, the MySQL server has already previously been configured for replication, so the information in the file is used instead. Because the server gives an existing master.info file precedence over the startup options just described, you might elect not to use startup options for these values at all, and instead to specify the replication parameters associated with them by using the CHANGE MASTER TO statement. See Section 12.5.2.1, “CHANGE MASTER TO Syntax”.

Beginning with MySQL 5.1.17, these options are deprecated and have no effect when mysqld is started. If they are used, an appropriate warning is written to the error log. Instead, you must use CHANGE MASTER TO to set the values corresponding to the deprecated options. These options are removed in MySQL 5.5.

Naturally, running CHANGE MASTER TO generates a master.info file, which includes master_ssl. No harm, no foul. Relying on my.cnf for older versions of mysql results in option being ignored when no master.info exists. They are no longer valid.