CREATE USER ’jeffrey’@’localhost’ REQUIRE SSL; 

Clients attempt to establish a secure connection by default. For accounts that have REQUIRE SSL , the connection attempt fails if a secure connection cannot be established. 

• X509 

For all accounts named by the statement, requires that clients present a valid certificate, but the exact certificate, issuer, and subject do not matter. The only requirement is that it should be possible to verify its signature with one of the CA certificates. Use of X.509 certificates always implies encryption, so the SSL  option is unnecessary in this case. 

CREATE USER ’jeffrey’@’localhost’ REQUIRE X509; 

For accounts with REQUIRE X509 , clients must specify the --ssl-key  and --ssl-cert  options to connect. (It is recommended but not required that --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) This is true for ISSUER  and SUBJECT  as well because those REQUIRE  options imply the requirements of X509 . 

• ISSUER ’ issuer ’ 

For all accounts named by the statement, requires that clients present a valid X.509 certificate issued by CA ’ issuer ’ . If a client presents a certificate that is valid but has a different issuer, the server rejects the connection. Use of X.509 certificates always implies encryption, so the SSL  option is unnecessary in this case. 

CREATE USER ’jeffrey’@’localhost’ REQUIRE ISSUER ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL/CN=CA/emailAddress=ca@example.com’; 

Because ISSUER  implies the requirements of X509 , clients must specify the --ssl-key  and --ssl- cert  options to connect. (It is recommended but not required that --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) 

• SUBJECT ’ subject ’ 

For all accounts named by the statement, requires that clients present a valid X.509 certificate containing the subject subject . If a client presents a certificate that is valid but has a different subject, the server rejects the connection. Use of X.509 certificates always implies encryption, so the SSL  option is unnecessary in this case. 

CREATE USER ’jeffrey’@’localhost’ REQUIRE SUBJECT ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL demo client certificate/ CN=client/emailAddress=client@example.com’; 

MySQL does a simple string comparison of the ’ subject ’  value to the value in the certificate, so lettercase and component ordering must be given exactly as present in the certificate. 

Because SUBJECT  implies the requirements of X509 , clients must specify the --ssl-key  and --ssl- cert  options to connect. (It is recommended but not required that --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) 

• CIPHER ’ cipher ’ 

For all accounts named by the statement, requires a specific cipher method for encrypting connections. This option is needed to ensure that ciphers and key lengths of sufficient strength are used. Encryption can be weak if old algorithms using short encryption keys are used. 

