mysqladmin --ssl-mode=VERIFY_IDENTITY 

To configure a MySQL account to be usable only over encrypted connections, include a REQUIRE clause in the CREATE USER  statement that creates the account, specifying in that clause the encryption characteristics you require. For example, to require an encrypted connection and the use of a valid X.509 certificate, use REQUIRE X509 : 

CREATE USER ’jeffrey’@’localhost’ REQUIRE X509; 

For additional information about the REQUIRE  clause, see Section 13.7.1.3, “CREATE USER Statement” . 

To modify existing accounts that have no encryption requirements, use the ALTER USER  statement. 

## 6.3.2 Encrypted Connection TLS Protocols and Ciphers 

MySQL supports multiple TLS protocols and ciphers, and enables configuring which protocols and ciphers to permit for encrypted connections. It is also possible to determine which protocol and cipher the current session uses. 

## Supported Connection TLS Protocols 

•Supported Connection TLS Protocols 

•Connection TLS Protocol Configuration 

•Deprecated TLS Protocols 

•Connection Cipher Configuration 

•Connection TLS Protocol Negotiation 

•Monitoring Current Client Session TLS Protocol and Cipher 

MySQL supports encrypted connections using the TLSv1, TLSv1.1, TLSv1.2, and TLSv1.3 protocols, listed in order from less secure to more secure. The set of protocols actually permitted for connections is subject to multiple factors: 

•MySQL configuration. Permitted TLS protocols can be configured on both the server side and client side to include only a subset of the supported TLS protocols. The configuration on both sides must include at least one protocol in common or connection attempts cannot negotiate a protocol to use. For details, see Connection TLS Protocol Negotiation. 

•System-wide host configuration. The host system may permit only certain TLS protocols, which means that MySQL connections cannot use nonpermitted protocols even if MySQL itself permits them: 

•Suppose that MySQL configuration permits TLSv1, TLSv1.1, and TLSv1.2, but your host system configuration permits only connections that use TLSv1.2 or higher. In this case, you cannot establish MySQL connections that use TLSv1 or TLSv1.1, even though MySQL is configured to permit them, because the host system does not permit them. 

•If MySQL configuration permits TLSv1, TLSv1.1, and TLSv1.2, but your host system configuration permits only connections that use TLSv1.3 or higher, you cannot establish MySQL connections at all, because no protocol permitted by MySQL is permitted by the host system. 

Workarounds for this issue include: 

•Change the system-wide host configuration to permit additional TLS protocols. Consult your operating system documentation for instructions. For example, your system may have an /etc/ssl/ openssl.cnf  file that contains these lines to restrict TLS protocols to TLSv1.2 or higher: 

