Connection Management For general information about configuring connection-encryption support, see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections” , and Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . That discussion is written for the main connection interface, but the parameter names are similar for the administrative connection interface. Use that discussion together with the following remarks, which provide information specific to the administrative interface. TLS configuration for the administrative interface follows these rules: It is also possible to disable encrypted connections on the administrative interface without specifying --admin-ssl  in negated form. Set the  admin_tls_version  system variable to the empty value to indicate that no TLS versions are supported. For example, these lines in the server  my.cnf  file disable encrypted connections on the administrative interface: [mysqld] admin_tls_version=’’ Examples: [mysqld] admin_address=127.0.0.1 As a result, the administrative interface supports encrypted connections (because encryption is supported by default when the administrative interface is enabled), and uses the main interface TLS context. When clients connect to the administrative interface, they should use the same certificate and key files as for ordinary connections on the main interface. For example (enter the command on a single line): 986 [mysqld] admin_address=127.0.0.1 admin_ssl_ca=admin-ca.pem admin_ssl_cert=admin-server-cert.pem admin_ssl_key=admin-server-key.pem mysql --protocol=TCP --port=33062 --ssl-ca=ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem •If  --admin-ssl  is enabled (the default), the administrative interface supports encrypted connections. For connections on the interface, the applicable TLS context depends on whether any nondefault administrative TLS parameter is configured: •If all administrative TLS parameters have their default values, the administrative interface uses the same TLS context as the main interface. •If any administrative TLS parameter has a nondefault value, the administrative interface uses the TLS context defined by its own parameters. (This is the case if any  admin_tls_ xxx  or  admin_ssl_ xxx system variable is set to a value different from its default.) If a valid TLS context cannot be created from those parameters, the administrative interface falls back to the main interface TLS context. •If  --admin-ssl  is disabled (for example, by specifying  --admin-ssl=OFF , encrypted connections to the administrative interface are disabled. This is true even if administrative TLS parameters have nondefault values because disabling  --admin-ssl  takes precedence. •This configuration in the server  my.cnf  file enables the administrative interface, but does not set any of the TLS parameters specific to that interface: •This server configuration enables the administrative interface and sets the TLS certificate and key file parameters specific to that interface: