content_image/670429.jpg
• --ssl-mode= mode 

This option specifies the desired security state of the connection to the server. These mode values are permissible, in order of increasing strictness: 

• DISABLED : Establish an unencrypted connection. 

• PREFERRED : Establish an encrypted connection if the server supports encrypted connections, falling back to an unencrypted connection if an encrypted connection cannot be established. This is the default if --ssl-mode  is not specified. 

Connections over Unix socket files are not encrypted with a mode of PREFERRED . To enforce encryption for Unix socket-file connections, use a mode of REQUIRED  or stricter. (However, socket- file transport is secure by default, so encrypting a socket-file connection makes it no more secure and increases CPU load.) 

• REQUIRED : Establish an encrypted connection if the server supports encrypted connections. The connection attempt fails if an encrypted connection cannot be established. 

• VERIFY_CA : Like REQUIRED , but additionally verify the server Certificate Authority (CA) certificate against the configured CA certificates. The connection attempt fails if no valid matching CA certificates are found. 

• VERIFY_IDENTITY : Like VERIFY_CA , but additionally perform host name identity verification by checking the host name the client uses for connecting to the server against the identity in the certificate that the server sends to the client: 

•As of MySQL 8.0.12, if the client uses OpenSSL 1.0.2 or higher, the client checks whether the host name that it uses for connecting matches either the Subject Alternative Name value or the Common Name value in the server certificate. Host name identity verification also works with certificates that specify the Common Name using wildcards. 

•Otherwise, the client checks whether the host name that it uses for connecting matches the Common Name value in the server certificate. 

The connection fails if there is a mismatch. For encrypted connections, this option helps prevent man- in-the-middle attacks. 

<img src='content_image/670429.jpg'>

## Note 

Host name identity verification with VERIFY_IDENTITY  does not work with self-signed certificates that are created automatically by the server or manually using mysql_ssl_rsa_setup  (see Section 6.3.3.1, “Creating SSL and RSA 

