• --tls-version : The client does not permit encrypted outgoing connections to the server. 

• SOURCE_TLS_VERSION  | MASTER_TLS_VERSION : The replica does not permit encrypted outgoing connections to the source. 

• group_replication_recovery_tls_version : The joining member does not permit encrypted connections to the distributed recovery connection. 

## Deprecated TLS Protocols 

As of MySQL 8.0.26, the TLSv1 and TLSv1.1 connection protocols are deprecated and support for them is subject to removal in a future MySQL version. (For background, refer to the IETF memo Deprecating TLSv1.0 and TLSv1.1.) It is recommended that connections be made using the more-secure TLSv1.2 and TLSv1.3 protocols. TLSv1.3 requires that both the MySQL server and the client application be compiled with OpenSSL 1.1.1 or higher. 

On the server side, this deprecation has the following effects: 

•If the tls_version  or admin_tls_version  system variable is assigned a value containing a deprecated TLS protocol during server startup, the server produces a warning for each deprecated protocol: 

•If the assignment occurs during server startup, the warning appears in the error log. 

•If the assignment occurs at runtime, the warning is added to the result of executing the ALTER INSTANCE RELOAD TLS  statement. 

•If a client successfully connects using a deprecated TLS protocol, the server writes a warning to the error log. 

On the client side, the deprecation has no visible effect. Clients do not issue a warning if configured to permit a deprecated TLS protocol. This includes: 

•Client programs that support a --tls-version  option for specifying TLS protocols for connections to the MySQL server. 

•Statements that enable replicas to specify TLS protocols for connections to the source server. ( CHANGE REPLICATION SOURCE TO  has a SOURCE_TLS_VERSION  option and CHANGE MASTER TO  has a MASTER_TLS_VERSION  option.) 

•The group_replication_recovery_tls_version  system variable that enables joining members to specify TLS protocols for distributed recovery connections. 

## Connection Cipher Configuration 

A default set of ciphers applies to encrypted connections, which can be overridden by explicitly configuring the permitted ciphers. During connection establishment, both sides of a connection must permit some cipher in common or the connection fails. Of the permitted ciphers common to both sides, the SSL library chooses the one supported by the provided certificate that has the highest priority. 

To specify a cipher or ciphers applicable for encrypted connections that use TLS protocols up through TLSv1.2: 

•Set the ssl_cipher  system variable on the server side, and use the --ssl-cipher  option for client programs. 

•For regular source/replica replication connections, where this server instance is the source, set the ssl_cipher  system variable. Where this server instance is the replica, use the SOURCE_SSL_CIPHER 

