Account Management Statements To specify SSL/TLS-related options for a MySQL account, use a  REQUIRE  clause that specifies one or more  tls_option  values. Order of  REQUIRE  options does not matter, but no option can be specified twice. The  AND  keyword is optional between  REQUIRE  options. ALTER USER  permits these  tls_option  values: Indicates that all accounts named by the statement have no SSL or X.509 requirements. Unencrypted connections are permitted if the user name and password are valid. Encrypted connections can be used, at the client’s option, if the client has the proper certificate and key files. Clients attempt to establish a secure connection by default. For clients that have  REQUIRE NONE , the connection attempt falls back to an unencrypted connection if a secure connection cannot be established. To require an encrypted connection, a client need specify only the  --ssl- mode=REQUIRED  option; the connection attempt fails if a secure connection cannot be established. Tells the server to permit only encrypted connections for all accounts named by the statement. Clients attempt to establish a secure connection by default. For accounts that have  REQUIRE SSL , the connection attempt fails if a secure connection cannot be established. For all accounts named by the statement, requires that clients present a valid certificate, but the exact certificate, issuer, and subject do not matter. The only requirement is that it should be possible to verify its signature with one of the CA certificates. Use of X.509 certificates always implies encryption, so the SSL  option is unnecessary in this case. For accounts with  REQUIRE X509 , clients must specify the  --ssl-key  and  --ssl-cert  options to connect. (It is recommended but not required that  --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) This is true for  ISSUER  and  SUBJECT  as well because those  REQUIRE  options imply the requirements of  X509 . For all accounts named by the statement, requires that clients present a valid X.509 certificate issued by CA  ’ issuer ’ . If a client presents a certificate that is valid but has a different issuer, the server rejects the connection. Use of X.509 certificates always implies encryption, so the  SSL  option is unnecessary in this case. Because  ISSUER  implies the requirements of  X509 , clients must specify the  --ssl-key  and  --ssl- cert  options to connect. (It is recommended but not required that  --ssl-ca  also be specified so that the public certificate provided by the server can be verified.) 2844 ALTER USER ’jeffrey’@’localhost’ REQUIRE ISSUER ’/C=SE/ST=Stockholm/L=Stockholm/ O=MySQL/CN=CA/emailAddress=ca@example.com’; • ISSUER ’ issuer ’ ALTER USER ’jeffrey’@’localhost’ REQUIRE X509; ALTER USER ’jeffrey’@’localhost’ REQUIRE SSL; ALTER USER ’jeffrey’@’localhost’ REQUIRE NONE; • NONE • SSL • X509