# Enabling TLS in PXC without Downtime

DevFeed: [Enabling TLS in PXC without Downtime](<https://devfeed.tech/articles/enabling-tls-in-pxc-without-downtime-14095.md>)

Original publisher: [Read original article](<https://www.percona.com/blog/enabling-tls-in-pxc-without-downtime/>)

Author: Juan Arruti

Published: 2026-09-09T23:32:15Z

Content type: tutorial

Language: en

Sources: [Blog - Percona](<https://devfeed.tech/sources/blog-percona.md>)

Topics: [TLS (Transport Layer Security)](<https://devfeed.tech/topics/tls.md>), [Replication](<https://devfeed.tech/topics/replication.md>), [Security](<https://devfeed.tech/topics/security.md>), [Network](<https://devfeed.tech/topics/network.md>), [openssl](<https://devfeed.tech/topics/openssl.md>)

Tags: [galera](<https://devfeed.tech/tags/galera.md>), [high-availability](<https://devfeed.tech/tags/high-availability.md>), [insight-for-dbas](<https://devfeed.tech/tags/insight-for-dbas.md>), [mysql](<https://devfeed.tech/tags/mysql.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [percona](<https://devfeed.tech/tags/percona.md>), [pxc](<https://devfeed.tech/tags/pxc.md>), [replication](<https://devfeed.tech/tags/replication.md>), [security](<https://devfeed.tech/tags/security.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [tls](<https://devfeed.tech/tags/tls.md>), [tls-handshake](<https://devfeed.tech/tags/tls-handshake.md>), [uncategorized](<https://devfeed.tech/tags/uncategorized.md>), [xtradb-cluster-pxc](<https://devfeed.tech/tags/xtradb-cluster-pxc.md>)

## AI overview

This tutorial explains how to enable TLS for replication traffic in Percona XtraDB Cluster without a full cluster restart. Using Galera's socket.dynamic option, operators can perform two rolling restarts: first allowing encrypted and plaintext connections, then enforcing TLS-only communication.

## Source excerpt

Starting with Percona XtraDB Cluster (PXC) 8.0, replication traffic encryption is enabled by default. That said, it's common to find clusters running without TLS that suddenly need it: a new compliance requirement, an audit finding, a network segment that is no longer considered trusted. PXC has a variable for exactly that case, pxc-encrypt-cluster-traffic, which handles ... Continued The post Enabling TLS in PXC without Downtime appeared first on Percona.