Configuring MySQL to Use Encrypted Connections and Keys using MySQL” ). Such self-signed certificates do not contain the server name as the Common Name value. Prior to MySQL 8.0.12, host name identity verification also does not work with certificates that specify the Common Name using wildcards because that name is compared verbatim to the server name. MySQL also provides these options for client-side encrypted-connection control: • --ssl-cipher : The list of permissible ciphers for connection encryption. • --ssl-crl : The path name of the file containing certificate revocation lists. ( --ssl-crlpath  is similar but specifies the path name of a directory of certificate revocation-list files.) • --tls-version ,  --tls-ciphersuites : The permitted encryption protocols and ciphersuites; see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . Depending on the encryption requirements of the MySQL account used by a client, the client may be required to specify certain options to connect using encryption to the MySQL server. Suppose that you want to connect using an account that has no special encryption requirements or that was created using a  CREATE USER  statement that included the  REQUIRE SSL  clause. Assuming that the server supports encrypted connections, a client can connect using encryption with no  --ssl-mode  option or with an explicit  --ssl-mode=PREFFERED  option: For an account created with a  REQUIRE SSL  clause, the connection attempt fails if an encrypted connection cannot be established. For an account with no special encryption requirements, the attempt falls back to an unencrypted connection if an encrypted connection cannot be established. To prevent fallback and fail if an encrypted connection cannot be obtained, connect like this: If the account has more stringent security requirements, other options must be specified to establish an encrypted connection: For additional information about the  REQUIRE  clause, see Section 13.7.1.3, “CREATE USER Statement” . To prevent use of encryption and override other  --ssl- xxx  options, invoke the client program with  -- ssl-mode=DISABLED : 1286 mysql --ssl-mode=DISABLED •For accounts created with a  REQUIRE ISSUER  or  REQUIRE SUBJECT  clause, the encryption requirements are the same as for  REQUIRE X509 , but the certificate must match the issue or subject, respectively, specified in the account definition. mysql --ssl-ca=ca.pem --ssl-cert=client-cert.pem --ssl-key=client-key.pem •For accounts created with a  REQUIRE X509  clause, clients must specify at least  --ssl-cert  and  -- ssl-key . In addition,  --ssl-ca  (or  --ssl-capath ) is recommended so that the public certificate provided by the server can be verified. For example (enter the command on a single line): mysql --ssl-mode=PREFERRED mysql --ssl-mode=REQUIRED Or: mysql