Command Options for Connecting to the Server Certificates and Keys using MySQL” ). Such self-signed certificates do not contain the server name as the Common Name value. The  --ssl-mode  option interacts with CA certificate options as follows: To require use of encrypted connections by a MySQL account, use  CREATE USER  to create the account with a  REQUIRE SSL  clause, or use  ALTER USER  for an existing account to add a  REQUIRE SSL clause. This causes connection attempts by clients that use the account to be rejected unless MySQL supports encrypted connections and an encrypted connection can be established. The  REQUIRE  clause permits other encryption-related options, which can be used to enforce security requirements stricter than  REQUIRE SSL . For additional details about which command options may or must be specified by clients that connect using accounts configured using the various  REQUIRE  options, see CREATE USER SSL/TLS Options. This option specifies which ciphersuites the client permits for encrypted connections that use TLSv1.3. The value is a list of zero or more colon-separated ciphersuite names. For example: mysql --tls-ciphersuites=" suite1 : suite2 : suite3 " The ciphersuites that can be named for this option depend on the SSL library used to compile MySQL. If this option is not set, the client permits the default set of ciphersuites. If the option is set to the empty string, no ciphersuites are enabled and encrypted connections cannot be established. For more information, see Section 6.3.2, “Encrypted Connection TLS Protocols and Ciphers” . This option was added in MySQL 8.0.16. To specify which ciphersuites the server permits, set the  tls_ciphersuites  system variable. This option specifies the TLS protocols the client permits for encrypted connections. The value is a list of one or more comma-separated protocol versions. For example: mysql --tls-version="TLSv1.1,TLSv1.2" The protocols that can be named for this option depend on the SSL library used to compile MySQL. Permitted protocols should be chosen such as not to leave “holes”  in the list. For example, these values do not have holes: 363 --tls-version="TLSv1,TLSv1.1,TLSv1.2,TLSv1.3" --tls-version="TLSv1.1,TLSv1.2,TLSv1.3" --tls-version="TLSv1.2,TLSv1.3" • --tls-version= protocol_list • --tls-ciphersuites= ciphersuite_list •An explicit  --ssl-mode  option with a value other than  VERIFY_CA  or  VERIFY_IDENTITY , together with an explicit  --ssl-ca  or  --ssl-capath  option, produces a warning that no verification of the server certificate is performed, despite a CA certificate option being specified. •For  --ssl-mode  values of  VERIFY_CA  or  VERIFY_IDENTITY ,  --ssl-ca  or  --ssl-capath  is also required, to supply a CA certificate that matches the one used by the server. •If  --ssl-mode  is not explicitly set otherwise, use of  --ssl-ca  or  --ssl-capath  implies  --ssl- mode=VERIFY_CA .