Command Options for Connecting to the Server To specify the encryption ciphers for the server, set the  ssl_cipher  system variable. The path name of the file containing certificate revocation lists in PEM format. If neither  --ssl-crl  nor  --ssl-crlpath  is given, no CRL checks are performed, even if the CA path contains certificate revocation lists. To specify the revocation-list file for the server, set the  ssl_crl  system variable. The path name of the directory that contains certificate revocation-list files in PEM format. If neither  --ssl-crl  nor  --ssl-crlpath  is given, no CRL checks are performed, even if the CA path contains certificate revocation lists. To specify the revocation-list directory for the server, set the  ssl_crlpath  system variable. Controls whether to enable FIPS mode on the client side. The  --ssl-fips-mode  option differs from other  --ssl- xxx  options in that it is not used to establish encrypted connections, but rather to affect which cryptographic operations to permit. See Section 6.8, “FIPS Support” . These  --ssl-fips-mode  values are permissible: • OFF : Disable FIPS mode. • ON : Enable FIPS mode. • STRICT : Enable “strict”  FIPS mode. • --ssl-key= file_name If the OpenSSL FIPS Object Module is not available, the only permissible value for  --ssl-fips-mode  is  OFF . In this case, setting  --ssl-fips-mode  to  ON  or STRICT  causes the client to produce a warning at startup and to operate in non- FIPS mode. To specify the FIPS mode for the server, set the  ssl_fips_mode  system variable. The path name of the client SSL private key file in PEM format. For better security, use a certificate with an RSA key size of at least 2048 bits. If the key file is protected by a passphrase, the client program prompts the user for the passphrase. The password must be given interactively; it cannot be stored in a file. If the passphrase is incorrect, the program continues as if it could not read the key. To specify the server SSL private key file, set the  ssl_key  system variable. 361 Note • --ssl-fips-mode={OFF|ON|STRICT} • --ssl-crlpath= dir_name • --ssl-crl= file_name