How to master <-> slaves communicate? Encrypted?

Most likely it is not. ISPConfig slaves connect to the master via mysql, and mysql is not encrypted by default (possibly depending on the config your OS uses, but certainly under debian it's all plain text, though the mysql account password itself is sent encrypted).

If you have any other services that talk between the master and slave you'd have to examine their config separately. Eg. say you had postfix/mail running on both, if you have a certificate setup on both sides, then likely mail in both directions will be sent over a TLS connection (your log entries will indicate that). DNS between the two is probably unencrypted. SSH will be encrypted. FTP may or may not be, it depends if you have a certificate setup and what the ftp client supports. There's probably not much http/imap/pop traffic across servers like that, though it is possible.

 

On a semi-related note, I plan to post a mini-howto to use letsencrypt certificate for mysql - but I'm still letting letsencrypt 'settle in', making sure all certificate rotation happens correctly and services restarted correctly, which is still work in progress, though has had some good discussion lately, and changes in ispconfig code that sound promising.

 

As Jesse explained, the connection that ISPConfig makes is a standard MySQL connect from slave to master. One way to secure it might be to build a VPN between the nodes and let MySQL connect trough the private network.

 

I'm not sure if we will be able to have it for 3.2, might be that this feature has to be moved to 3.3 in October.

 

There are no problems, it is just not finished yet. We'll announce releases on our blog, on twitter and facebook, so you can see there when it is released.