content_image/814140.jpg
As of MySQL 8.0.16, tls_version  can also be changed at runtime. See Server-Side Runtime Configuration and Monitoring for Encrypted Connections. 

<img src='content_image/814140.jpg'>

## Note 

As of MySQL 8.0.26, the TLSv1 and TLSv1.1 connection protocols are deprecated and support for them is subject to removal in a future version of MySQL. See Deprecated TLS Protocols. 

On the client side, the --tls-version  option specifies which TLS protocols a client program permits for connections to the server. The format of the option value is the same as for the tls_version  system variable described previously (a list of one or more comma-separated protocol versions). 

For source/replica replication connections where this server instance is the replica, the SOURCE_TLS_VERSION  | MASTER_TLS_VERSION  option for the CHANGE REPLICATION SOURCE TO statement (from MySQL 8.0.23) or CHANGE MASTER TO  statement (before MySQL 8.0.23) specifies which TLS protocols the replica permits for connections to the source. The format of the option value is the same as for the tls_version  system variable described previously. See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections” . 

The protocols that can be specified for SOURCE_TLS_VERSION  | MASTER_TLS_VERSION  depend on the SSL library. This option is independent of and not affected by the server tls_version  value. For example, a server that acts as a replica can be configured with tls_version  set to TLSv1.3 to permit only incoming connections that use TLSv1.3, but also configured with SOURCE_TLS_VERSION  | MASTER_TLS_VERSION  set to TLSv1.2 to permit only TLSv1.2 for outgoing replica connections to the source. 

For Group Replication distributed recovery connections where this server instance is the joining member that initiates distributed recovery (that is, the client), the group_replication_recovery_tls_version  system variable specifies which protocols are permitted by the client. This option is independent of and not affected by the server tls_version  value, which applies when this server instance is the donor. A Group Replication server generally participates in distributed recovery both as a donor and as a joining member over the course of its group membership, so both these system variables should be set. See Section 18.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)” . 

TLS protocol configuration affects which protocol a given connection uses, as described in Connection TLS Protocol Negotiation. 

Permitted protocols should be chosen such as not to leave “holes”  in the list. For example, these server configuration values do not have holes: 

tls_version=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3 tls_version=TLSv1.1,TLSv1.2,TLSv1.3 tls_version=TLSv1.2,TLSv1.3 tls_version=TLSv1.3 

These values do have holes and should not be used: 

tls_version=TLSv1,TLSv1.2 (TLSv1.1 is missing) tls_version=TLSv1.1,TLSv1.3 (TLSv1.2 is missing) 

The prohibition on holes also applies in other configuration contexts, such as for clients or replicas. 

Unless you intend to disable encrypted connections, the list of permitted protocols should not be empty. If you set a TLS version parameter to the empty string, encrypted connections cannot be established: 

• tls_version : The server does not permit encrypted incoming connections. 

