content_image/780655.jpg
• tls_version , tls_ciphersuites : Which encryption protocols and ciphersuites the server permits for encrypted connections; see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . For example, you can configure tls_version  to prevent clients from using less-secure protocols. 

If the server cannot create a valid TLS context from the system variables for server-side encrypted- connection control, the server executes without support for encrypted connections. 

## Server-Side Runtime Configuration and Monitoring for Encrypted Connections 

Prior to MySQL 8.0.16, the tls_ xxx  and ssl_ xxx  system variables that configure encrypted-connection support can be set only at server startup. These system variables therefore determine the TLS context the server uses for all new connections. 

As of MySQL 8.0.16, the tls_ xxx  and ssl_ xxx  system variables are dynamic and can be set at runtime, not just at startup. If changed with SET GLOBAL , the new values apply only until server restart. If changed with SET PERSIST , the new values also carry over to subsequent server restarts. See Section 13.7.6.1, “SET Syntax for Variable Assignment” . However, runtime changes to these variables do not immediately affect the TLS context for new connections, as explained later in this section. 

Along with the change in MySQL 8.0.16 that enables runtime changes to the TLS context-related system variables, the server enables runtime updates to the actual TLS context used for new connections. This capability may be useful, for example, to avoid restarting a MySQL server that has been running so long that its SSL certificate has expired. 

To create the initial TLS context, the server uses the values that the context-related system variables have at startup. To expose the context values, the server also initializes a set of corresponding status variables. The following table shows the system variables that define the TLS context and the corresponding status variables that expose the currently active context values. 

<img src='content_image/780655.jpg'>

As of MySQL 8.0.21, those active TLS context values are also exposed as properties in the Performance Schema tls_channel_status  table, along with the properties for any other active TLS contexts. 

To reconfigure the TLS context at runtime, use this procedure: 

1. Set each TLS context-related system variable that should be changed to its new value. 

2. Execute ALTER INSTANCE RELOAD TLS . This statement reconfigures the active TLS context from the current values of the TLS context-related system variables. It also sets the context-related status variables to reflect the new active context values. The statement requires the CONNECTION_ADMIN privilege. 

