Encrypted Connection TLS Protocols and Ciphers To configure a MySQL account to be usable only over encrypted connections, include a  REQUIRE clause in the  CREATE USER  statement that creates the account, specifying in that clause the encryption characteristics you require. For example, to require an encrypted connection and the use of a valid X.509 certificate, use  REQUIRE X509 : For additional information about the  REQUIRE  clause, see Section 13.7.1.3, “CREATE USER Statement” . To modify existing accounts that have no encryption requirements, use the  ALTER USER  statement. MySQL supports multiple TLS protocols and ciphers, and enables configuring which protocols and ciphers to permit for encrypted connections. It is also possible to determine which protocol and cipher the current session uses. MySQL supports encrypted connections using the TLSv1, TLSv1.1, TLSv1.2, and TLSv1.3 protocols, listed in order from less secure to more secure. The set of protocols actually permitted for connections is subject to multiple factors: Workarounds for this issue include: •Change the system-wide host configuration to permit additional TLS protocols. Consult your operating system documentation for instructions. For example, your system may have an  /etc/ssl/ openssl.cnf  file that contains these lines to restrict TLS protocols to TLSv1.2 or higher: •If MySQL configuration permits TLSv1, TLSv1.1, and TLSv1.2, but your host system configuration permits only connections that use TLSv1.3 or higher, you cannot establish MySQL connections at all, because no protocol permitted by MySQL is permitted by the host system. •Suppose that MySQL configuration permits TLSv1, TLSv1.1, and TLSv1.2, but your host system configuration permits only connections that use TLSv1.2 or higher. In this case, you cannot establish MySQL connections that use TLSv1 or TLSv1.1, even though MySQL is configured to permit them, because the host system does not permit them. •System-wide host configuration. The host system may permit only certain TLS protocols, which means that MySQL connections cannot use nonpermitted protocols even if MySQL itself permits them: •MySQL configuration. Permitted TLS protocols can be configured on both the server side and client side to include only a subset of the supported TLS protocols. The configuration on both sides must include at least one protocol in common or connection attempts cannot negotiate a protocol to use. For details, see Connection TLS Protocol Negotiation. •Supported Connection TLS Protocols •Connection TLS Protocol Configuration •Deprecated TLS Protocols •Connection Cipher Configuration •Connection TLS Protocol Negotiation •Monitoring Current Client Session TLS Protocol and Cipher Supported Connection TLS Protocols 6.3.2 Encrypted Connection TLS Protocols and Ciphers mysqladmin --ssl-mode=VERIFY_IDENTITY CREATE USER ’jeffrey’@’localhost’ REQUIRE X509; 1288