Configuring MySQL to Use Encrypted Connections Note From MySQL 8.0.11 to 8.0.17, it was possible to compile MySQL using wolfSSL as an alternative to OpenSSL. As of MySQL 8.0.18, support for wolfSSL is removed and all MySQL builds use OpenSSL. By default, MySQL programs attempt to connect using encryption if the server supports encrypted connections, falling back to an unencrypted connection if an encrypted connection cannot be established. For information about options that affect use of encrypted connections, see Section 6.3.1, “Configuring MySQL to Use Encrypted Connections”  and Command Options for Encrypted Connections. MySQL performs encryption on a per-connection basis, and use of encryption for a given user can be optional or mandatory. This enables you to choose an encrypted or unencrypted connection according to the requirements of individual applications. For information on how to require users to use encrypted connections, see the discussion of the  REQUIRE  clause of the  CREATE USER statement in Section 13.7.1.3, “CREATE USER Statement” . See also the description of the require_secure_transport  system variable at Section 5.1.8, “Server System Variables” Encrypted connections can be used between source and replica servers. See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections” . For information about using encrypted connections from the MySQL C API, see Support for Encrypted Connections. It is also possible to connect using encryption from within an SSH connection to the MySQL server host. For an example, see Section 6.3.4, “Connecting to MySQL Remotely from Windows with SSH” . Several configuration parameters are available to indicate whether to use encrypted connections, and to specify the appropriate certificate and key files. This section provides general guidance about configuring the server and clients for encrypted connections: On the server side, the  --ssl  option specifies that the server permits but does not require encrypted connections. This option is enabled by default, so it need not be specified explicitly. Instructions for creating any required certificate and key files are available in Section 6.3.3, “Creating SSL and RSA Certificates and Keys” . Encrypted connections also can be used in other contexts, as discussed in these additional sections: 1281 Server-Side Startup Configuration for Encrypted Connections 6.3.1 Configuring MySQL to Use Encrypted Connections •Server-Side Startup Configuration for Encrypted Connections •Server-Side Runtime Configuration and Monitoring for Encrypted Connections •Client-Side Configuration for Encrypted Connections •Configuring Encrypted Connections as Mandatory •Between source and replica replication servers. See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections” . •Among Group Replication servers. See Section 18.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)” . •By client programs that are based on the MySQL C API. See Support for Encrypted Connections.