Configuring MySQL to Use Encrypted Connections To require that clients connect using encrypted connections, enable the  require_secure_transport system variable. See Configuring Encrypted Connections as Mandatory. These system variables on the server side specify the certificate and key files the server uses when permitting clients to establish encrypted connections: For example, to enable the server for encrypted connections, start it with these lines in the  my.cnf  file, changing the file names as necessary: To specify in addition that clients are required to use encrypted connections, enable the require_secure_transport  system variable: Each certificate and key system variable names a file in PEM format. Should you need to create the required certificate and key files, see Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . MySQL servers compiled using OpenSSL can generate missing certificate and key files automatically at startup. See Section 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL” . Alternatively, if you have a MySQL source distribution, you can test your setup using the demonstration certificate and key files in its  mysql-test/std_data  directory. The server performs certificate and key file autodiscovery. If no explicit encrypted-connection options are given other than  --ssl  (possibly along with  ssl_cipher ) to configure encrypted connections, the server attempts to enable encrypted-connection support automatically at startup: If the server automatically enables encrypted connection support, it writes a note to the error log. If the server discovers that the CA certificate is self-signed, it writes a warning to the error log. (The certificate is self-signed if created automatically by the server or manually using  mysql_ssl_rsa_setup .) MySQL also provides these system variables for server-side encrypted-connection control: • ssl_cipher : The list of permissible ciphers for connection encryption. • ssl_crl : The path name of the file containing certificate revocation lists. ( ssl_crlpath  is similar but specifies the path name of a directory of certificate revocation-list files.) •If the server does not find valid certificate and key files in the data directory, it continues executing but without support for encrypted connections. •If the server discovers valid certificate and key files named  ca.pem ,  server-cert.pem , and  server- key.pem  in the data directory, it enables support for encrypted connections by clients. (The files need not have been generated automatically; what matters is that they have those names and are valid.) • ssl_ca : The path name of the Certificate Authority (CA) certificate file. ( ssl_capath  is similar but specifies the path name of a directory of CA certificate files.) • ssl_cert : The path name of the server public key certificate file. This certificate can be sent to the client and authenticated against the CA certificate that it has. • ssl_key : The path name of the server private key file. [mysqld] ssl_ca=ca.pem ssl_cert=server-cert.pem ssl_key=server-key.pem [mysqld] ssl_ca=ca.pem ssl_cert=server-cert.pem ssl_key=server-key.pem require_secure_transport=ON 1282