TLS

A database on the same machine as the server needs no encryption, and a connection without TLS settings does not use it. A database on another machine should be reached through TLS, so that passwords and data never cross the network in plain text.

Requiring TLS

ssl turns TLS on. Once on, the connection never runs without it, and fails when the server answers without TLS, rather than falling back to plain text. Any other TLS setting turns it on too.

hostname = db.example.com
username = game
password = ${MYSQL_PASSWORD}
database = game
ssl = true

MySQL_GetConnectionTLS gives the version and cipher in use, as TLSv1.3 TLS_AES_256_GCM_SHA384.

Verifying the server

Encryption alone does not prove the server is the right one. One of these does:

Setting	Verifies
ssl_verify	The certificate of the server and its name, against the authorities of ssl_ca or ssl_capath.
ssl_fingerprint	That the certificate of the server has this SHA1 to SHA512 fingerprint, in hexadecimal with or without colons.

A fingerprint suits a certificate signed by no authority, such as the one MariaDB makes for itself. It is read from the server with:

openssl s_client -connect db.example.com:3306 -starttls mysql < NUL | openssl x509 -noout -fingerprint -sha256

On localhost, 127.0.0.1 and ::1 the name of the server is not checked, and the authority only when ssl_ca or ssl_capath is given.

All the settings

Setting	Meaning
ssl	Require TLS.
ssl_verify	Verify the certificate and the name of the server.
ssl_ca	File of the certificate authorities.
ssl_capath	Folder of the certificate authorities.
ssl_crl	File of revoked certificates.
ssl_crlpath	Folder of revoked certificates.
ssl_fingerprint	Fingerprint the certificate of the server must have.
ssl_cert	Certificate of the client, for a server that asks for one.
ssl_key	Key of the certificate of the client.
ssl_cipher	Ciphers allowed.
tls_version	Versions allowed, as TLSv1.2,TLSv1.3.

The names of the R41 mysql.ini, as ssl_enable and ssl_ca_file, are read too. See Configuration.