Configuring MySQL to Use Encrypted Connections • tls_version ,  tls_ciphersuites : Which encryption protocols and ciphersuites the server permits for encrypted connections; see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . For example, you can configure  tls_version  to prevent clients from using less-secure protocols. If the server cannot create a valid TLS context from the system variables for server-side encrypted- connection control, the server executes without support for encrypted connections. Server-Side Runtime Configuration and Monitoring for Encrypted Connections Prior to MySQL 8.0.16, the  tls_ xxx  and  ssl_ xxx  system variables that configure encrypted-connection support can be set only at server startup. These system variables therefore determine the TLS context the server uses for all new connections. As of MySQL 8.0.16, the  tls_ xxx  and  ssl_ xxx  system variables are dynamic and can be set at runtime, not just at startup. If changed with  SET GLOBAL , the new values apply only until server restart. If changed with  SET PERSIST , the new values also carry over to subsequent server restarts. See Section 13.7.6.1, “SET Syntax for Variable Assignment” . However, runtime changes to these variables do not immediately affect the TLS context for new connections, as explained later in this section. Along with the change in MySQL 8.0.16 that enables runtime changes to the TLS context-related system variables, the server enables runtime updates to the actual TLS context used for new connections. This capability may be useful, for example, to avoid restarting a MySQL server that has been running so long that its SSL certificate has expired. To create the initial TLS context, the server uses the values that the context-related system variables have at startup. To expose the context values, the server also initializes a set of corresponding status variables. The following table shows the system variables that define the TLS context and the corresponding status variables that expose the currently active context values. Table 6.11 System and Status Variables for Server Main Connection Interface TLS Context System Variable Name Corresponding Status Variable Name ssl_ca Current_tls_ca ssl_capath Current_tls_capath ssl_cert Current_tls_cert ssl_cipher Current_tls_cipher ssl_crl Current_tls_crl ssl_crlpath Current_tls_crlpath ssl_key Current_tls_key tls_ciphersuites Current_tls_ciphersuites tls_version Current_tls_version As of MySQL 8.0.21, those active TLS context values are also exposed as properties in the Performance Schema  tls_channel_status  table, along with the properties for any other active TLS contexts. To reconfigure the TLS context at runtime, use this procedure: 1. Set each TLS context-related system variable that should be changed to its new value. 2. Execute  ALTER INSTANCE RELOAD TLS . This statement reconfigures the active TLS context from the current values of the TLS context-related system variables. It also sets the context-related status variables to reflect the new active context values. The statement requires the  CONNECTION_ADMIN privilege. 1283