(shameless plug here) Galera doesn't come out of the box with a secure SST option. SST, or state snapshot transfer, is how it bootstraps a new/failed node to

(shameless plug here) Galera doesn't come out of the box with a secure SST option. SST, or state snapshot transfer, is how it bootstraps a new/failed node to get it close enough to continue with regular Galera replication. If you're running on a public cloud, you might care about secured SST communication. I wrote a drop-in secure rsync SST option, based on socat, that uses SSL encryption to seamlessly secure that traffic. Not perfect by any means, but it works without any futzing around. https://github.com/tobz/galera-secure-rsync https://github.com/tobz/galera-secure-rsync