Encrypted Connection TLS Protocols and Ciphers Changing the value to a lower protocol version or  None  makes the system more permissive. This workaround has the disadvantage that permitting lower (less secure) protocols may have adverse security consequences. Support for the TLSv1.3 protocol is available as of MySQL 8.0.16 (as of MySQL 8.0.18 for the Group Replication component). In addition, to use TLSv1.3, both the MySQL server and the client application must be compiled using OpenSSL 1.1.1 or higher. On the server side, the value of the  tls_version  system variable determines which TLS protocols a MySQL server permits for encrypted connections. The  tls_version  value applies to connections from clients, regular source/replica replication connections where this server instance is the source, Group Replication group communication connections, and Group Replication distributed recovery connections where this server instance is the donor. The administrative connection interface is configured similarly, but uses the  admin_tls_version  system variable (see Section 5.1.12.2, “Administrative Connection Management” ). This discussion applies to  admin_tls_version  as well. The  tls_version  value is a list of one or more comma-separated protocol versions from this list (not case-sensitive): TLSv1, TLSv1.1, TLSv1.2, and (if available) TLSV1.3. By default, this variable lists all protocols supported by the SSL library used to compile MySQL. To determine the value of  tls_version at runtime, use this statement: To change the value of  tls_version , set it at server startup. For example, to permit connections that use the TLSv1.1 or TLSv1.2 protocol, but prohibit connections that use the less-secure TLSv1 protocol, use these lines in the server  my.cnf  file: To be even more restrictive and permit only TLSv1.2 connections, set  tls_version  like this: 1289 [mysqld] tls_version=TLSv1.2 [mysqld] tls_version=TLSv1.1,TLSv1.2 mysql>  SHOW GLOBAL VARIABLES LIKE ’tls_version’; Connection TLS Protocol Configuration Note •If you cannot or prefer not to change the host system TLS configuration, change MySQL applications to use higher (more secure) TLS protocols that are permitted by the host system. This may not be possible for older versions of MySQL that support only lower protocol versions. For example, TLSv1 is the only supported protocol prior to MySQL 5.6.46, so attempts to connect to a pre-5.6.46 server fail even if the client is from a newer MySQL version that supports higher protocol versions. In such cases, an upgrade to a version of MySQL that supports additional TLS versions may be required. •The SSL library. If the SSL library does not support a particular protocol, neither does MySQL, and any parts of the following discussion that specify that protocol do not apply. [system_default_sect] MinProtocol = TLSv1.2 +---------------+-----------------------+ | Variable_name | Value | +---------------+-----------------------+ | tls_version | TLSv1,TLSv1.1,TLSv1.2 | +---------------+-----------------------+