9.2 Ensure 'SOURCE_SSL_VERIFY_SERVER_CERT' is Set to 'YES' or '1'

Information

In the MySQL REPLICA (SLAVE is deprecated as of 8.0.22) context the setting SOURCE_SSL_VERIFY_SERVER_CERT (MASTER_SSL_VERIFY_SERVER_CERT is deprecated as of 8.0.22) indicates whether the REPLICA should verify the SOURCE's certificate. This configuration item may be set to Yes or No, and unless SSL has been enabled on the REPLICA, the value will be ignored.

Rationale:

When SSL is in use certificate verification is important to authenticate the party to which a connection is being made. In this case, the REPLICA (client) should verify the SOURCE's (server's) certificate to authenticate the SOURCE prior to continuing the connection.

Impact:

When using CHANGE REPLICATION SOURCE TO, (CHANGE MASTER is deprecated as of 8.0.23) be aware of the following:

REPLICA processes need to be stopped prior to executing CHANGE SOURCE TO

Use of CHANGE REPLICATION SOURCE TO starts new relay logs without keeping the old ones unless explicitly told to keep them

When CHANGE REPLICATION SOURCE TO is invoked, some information is dumped to the error log (previous values for SOURCE_HOST, SOURCE_PORT, SOURCE_LOG_FILE, and SOURCE_LOG_POS)

Invoking CHANGE REPLICATION SOURCE TO will implicitly commit any ongoing transactions in the session where the CHANGE REPLICATION SOURCE was run, but not all ongoing transactions on the database.

Solution

To remediate this setting, you must use the CHANGE SOURCE TO command.
From 8.0.23:

STOP REPLICA; -- required if replication was already running
CHANGE REPLICATION SOURCE TO SOURCE_SSL_VERIFY_SERVER_CERT=1;
START REPLICA; -- required if you want to restart replication

Prior to 8.0.23:

STOP SLAVE; -- required if replication was already running
CHANGE MASTER TO MASTER_SSL_VERIFY_SERVER_CERT=1;
START SLAVE; -- required if you want to restart replication

See Also

https://workbench.cisecurity.org/benchmarks/15112

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7

Plugin: MySQLDB

Control ID: bf64b32c51b607dbfa68a304526245cbcc3076e078f2061c6c83cdf864141c1a