MySQL transaction and replication between two datacenters

Question

I'm using a master MySQL in an east coast data center and want to setup a replication server on a west coast data center. The app server on the west coast may at times need to write to the master.

Since the data centers can't setup a private link between them using the internal interfaces, I have to use a public interface. Does MySQL use any encryption when sending data over the public network? How can I secure or increase security between the two sites?

Let's assume site-to-site VPN is a last resort option.

Answer 1

You can setup replication using SSL.

With an unencrypted connection between the MySQL client and the server, someone with access to the network could watch all your traffic and look at the data being sent or received, or even change the data while it is in transit between client and server.

When you must move information over a network in a secure fashion, an unencrypted connection is unacceptable. Encryption is the way to make any kind of data unreadable. Encryption algorithms must include security elements to resist many kinds of known attacks such as changing the order of encrypted messages or replaying data twice.

MySQL supports secure (encrypted) connections between clients and the server using the Secure Sockets Layer (SSL) protocol. SSL uses encryption algorithms to ensure that data received over a public network can be trusted. It has mechanisms to detect any data change, loss, or replay. SSL also incorporates algorithms that provide identity verification using the X509 standard.

Source: https://dev.mysql.com/doc/refman/5.6/en/ssl-connections.html