CentOS 7

This seems to be a regression (at least from my perspective) from the fix for MDEV-14612.

Is there any status update available on this?

Do you have any suggested change to my configuration, or need any additional information from me?

pioto,

If you set wsrep_sst_receive_address or wsrep_node_address on the joiner to the hostname used as the commonName in the joiner's certificate, then do you still see the issue?

http://galeracluster.com/documentation-webpages/mysqlwsrepoptions.html#wsrep-sst-receive-address

http://galeracluster.com/documentation-webpages/mysqlwsrepoptions.html#wsrep-node-address

Do we want to disable certificate verification for socat?:

http://www.dest-unreach.org/socat/doc/socat.html#OPTION_OPENSSL_VERIFY

Or should we revert MDEV-14612?

It looks like certificate verification is also disabled when encrypt=3 is set:

https://github.com/MariaDB/server/blob/312de43f40e221096b5565f6f4999eaadae09ef4/scripts/wsrep_sst_mariabackup.sh#L238

MariaDB doesn't really have any documentation about this encryption mode, but Percona notes this in their documentation for XtraBackup SSTs:

Set encrypt=3 to perform SST encryption based on SSL for just the key and certificate files as implemented in Galera.

It does not provide certificate validation. In order to work correctly, paths to the key and certificate files need to be specified as well, for example:

https://www.percona.com/doc/percona-xtradb-cluster/5.6/manual/xtrabackup_sst.html#encrypt

pioto,

If you want to try out encrypt=3, I added some details to the MariaDB documentation:

https://mariadb.com/kb/en/library/mariabackup-sst-method/#tls-using-openssl-encryption-with-galera-compatible-certificates-and-keys

Changing the wsrep_node_address setting from using the node's IP address to the node's FQDN seems to work here, though I can't say for sure if that's the "best" fix.

My configuration was already using encrypt=3 for sst.