content_image/673619.jpg
to start the server with encrypted connections disabled on the main interface, then reconfigure TLS and execute ALTER INSTANCE RELOAD TLS  to enable encrypted connections at runtime. 

## Client-Side Configuration for Encrypted Connections 

For a complete list of client options related to establishment of encrypted connections, see Command Options for Encrypted Connections. 

By default, MySQL client programs attempt to establish an encrypted connection if the server supports encrypted connections, with further control available through the --ssl-mode  option: 

•In the absence of an --ssl-mode  option, clients attempt to connect using encryption, falling back to an unencrypted connection if an encrypted connection cannot be established. This is also the behavior with an explicit --ssl-mode=PREFFERED  option. 

•With --ssl-mode=REQUIRED , clients require an encrypted connection and fail if one cannot be established. 

•With --ssl-mode=DISABLED , clients use an unencrypted connection. 

•With --ssl-mode=VERIFY_CA  or --ssl-mode=VERIFY_IDENTITY , clients require an encrypted connection, and also perform verification against the server CA certificate and (with VERIFY_IDENTITY ) against the server host name in its certificate. 

Attempts to establish an unencrypted connection fail if the require_secure_transport  system variable is enabled on the server side to cause the server to require encrypted connections. See Configuring Encrypted Connections as Mandatory. 

The following options on the client side identify the certificate and key files clients use when establishing encrypted connections to the server. They are similar to the ssl_ca , ssl_cert , and ssl_key  system variables used on the server side, but --ssl-cert  and --ssl-key  identify the client public and private key: 

• --ssl-ca : The path name of the Certificate Authority (CA) certificate file. This option, if used, must specify the same certificate used by the server. ( --ssl-capath  is similar but specifies the path name of a directory of CA certificate files.) 

• --ssl-cert : The path name of the client public key certificate file. 

• --ssl-key : The path name of the client private key file. 

For additional security relative to that provided by the default encryption, clients can supply a CA certificate matching the one used by the server and enable host name identity verification. In this way, the server and client place their trust in the same CA certificate and the client verifies that the host to which it connected is the one intended: 

•To specify the CA certificate, use --ssl-ca  (or --ssl-capath ), and specify --ssl- mode=VERIFY_CA . 

•To enable host name identity verification as well, use --ssl-mode=VERIFY_IDENTITY  rather than -- ssl-mode=VERIFY_CA . 

<img src='content_image/673619.jpg'>

Note 

Host name identity verification with VERIFY_IDENTITY  does not work with self- signed certificates that are created automatically by the server or manually using mysql_ssl_rsa_setup  (see Section 6.3.3.1, “Creating SSL and RSA Certificates 

