Unable to Connect to self-managed MYSQL instance: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL

[yuliiakorabelska]

Software versions
MySqlConnector version:
2.1.0

Server type (MySQL, MariaDB, Aurora, etc.) and version:
Version:
5.6.42-log
Server: MySQL Community Server (GPL)

.NET version:
5.0.402

Additional context
Only happens after upgrading from 1.3.11 to 2.1.0. where it worked fine
Describe the bug
Could not connect to MySQL database, getting SSL handshake error. error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol

openssl.cnf MinProtocol and CipherString values

MinProtocol = TLSv1.0
CipherString = DEFAULT@SECLEVEL=1

MySQL cypher suites
SHOW SESSION STATUS LIKE 'Ssl_cipher_list';
| Ssl_cipher_list | DHE-RSA-AES256-SHA:AES256-SHA:DHE-RSA-AES128-SHA:AES128-SHA:AES256-RMD:AES128-RMD:DES-CBC3-RMD:DHE-RSA-AES256-RMD:DHE-RSA-AES128-RMD:DHE-RSA-DES-CBC3-RMD:RC4-SHA:RC4-MD5:DES-CBC3-SHA:DES-CBC-SHA:EDH-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC-SHA |

MySQL Ssl_version
SHOW SESSION STATUS LIKE 'Ssl_version';
| Ssl_version | TLSv1 |
We do specify TLSCipherSuites param in the MySQL connection string that are present here: https://docs.microsoft.com/en-us/dotnet/api/system.net.security.tlsciphersuite?view=net-5.0

Exception

{"Timestamp":"2022-01-20T14:47:04.5068574+00:00","Level":"Warning","MessageTemplate":"Test database failed","Exception":"MySqlConnector.MySqlException (0x80004005): SSL Authentication Error
 ---> System.Security.Authentication.AuthenticationException: Authentication failed, see inner exception.
 ---> Interop+OpenSsl+SslException: SSL Handshake failed with OpenSSL error - SSL_ERROR_SSL.
 ---> Interop+Crypto+OpenSslCryptographicException: error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol
   --- End of inner exception stack trace ---
   at Interop.OpenSsl.DoSslHandshake(SafeSslHandle context, ReadOnlySpan 1 input, Byte[]& sendBuf, Int32& sendCount)
   at System.Net.Security.SslStreamPal.HandshakeInternal(SafeFreeCredentials credential, SafeDeleteSslContext& context, ReadOnlySpan 1 inputBuffer, Byte[]& outputBuffer, SslAuthenticationOptions sslAuthenticationOptions)
   --- End of inner exception stack trace ---
   at System.Net.Security.SslStream.ForceAuthenticationAsync[TIOAdapter](TIOAdapter adapter, Boolean receiveFirst, Byte[] reAuthenticationData, Boolean isApm)
   at System.Net.Security.SslStream.ProcessAuthentication(Boolean isAsync, Boolean isApm, CancellationToken cancellationToken)
   at System.Net.Security.SslStream.AuthenticateAsClient(SslClientAuthenticationOptions sslClientAuthenticationOptions)
   at MySqlConnector.Core.ServerSession.InitSslAsync(ProtocolCapabilities serverCapabilities, ConnectionSettings cs, MySqlConnection connection, SslProtocols sslProtocols, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 1475
   at MySqlConnector.Core.ServerSession.InitSslAsync(ProtocolCapabilities serverCapabilities, ConnectionSettings cs, MySqlConnection connection, SslProtocols sslProtocols, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 1507
   at MySqlConnector.Core.ServerSession.ConnectAsync(ConnectionSettings cs, MySqlConnection connection, Int32 startTickCount, ILoadBalancer loadBalancer, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ServerSession.cs:line 516
   at MySqlConnector.Core.ConnectionPool.ConnectSessionAsync(MySqlConnection connection, String logMessage, Int32 startTickCount, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ConnectionPool.cs:line 422
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, Int32 startTickCount, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ConnectionPool.cs:line 126
   at MySqlConnector.Core.ConnectionPool.GetSessionAsync(MySqlConnection connection, Int32 startTickCount, IOBehavior ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/Core/ConnectionPool.cs:line 126
   at MySqlConnector.MySqlConnection.CreateSessionAsync(ConnectionPool pool, Int32 startTickCount, Nullable 1 ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlConnection.cs:line 938
   at MySqlConnector.MySqlConnection.OpenAsync(Nullable 1 ioBehavior, CancellationToken cancellationToken) in /_/src/MySqlConnector/MySqlConnection.cs:line 445
   at MySqlConnector.MySqlConnection.Open() in /_/src/MySqlConnector/MySqlConnection.cs:line 369

Expected behavior
Works fine if downgrading to 1.3.11

[bgrainger]

What's your full connection string (except Server and Password)?

[yuliiakorabelska]

@bgrainger Port=13306;User ID=root;SSL Mode=Required;Pooling=True;Minimum Pool Size=0;Maximum Pool Size=256;Allow Zero DateTime=True;Connection Timeout=25;GUID Format=None;Allow User Variables=True;Treat Tiny As Boolean=False;Ignore Command Transaction=True;Allow Load Local Infile=True;Pipelining=False;TLS Cipher Suites=TLS_NULL_WITH_NULL_NULL,TLS_RSA_WITH_NULL_MD5,TLS_RSA_WITH_NULL_SHA,TLS_RSA_EXPORT_WITH_RC4_40_MD5,TLS_RSA_WITH_RC4_128_MD5,TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5,TLS_RSA_WITH_IDEA_CBC_SHA,TLS_RSA_EXPORT_WITH_DES40_CBC_SHA,TLS_RSA_WITH_DES_CBC_SHA,TLS_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA,TLS_DH_DSS_WITH_DES_CBC_SHA,TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA,TLS_DH_RSA_WITH_DES_CBC_SHA,TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,TLS_DHE_DSS_WITH_DES_CBC_SHA,TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,TLS_DHE_RSA_WITH_DES_CBC_SHA,TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_DH_anon_EXPORT_WITH_RC4_40_MD5,TLS_DH_anon_WITH_RC4_128_MD5,TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA,TLS_DH_anon_WITH_DES_CBC_SHA,TLS_DH_anon_WITH_3DES_EDE_CBC_SHA,TLS_KRB5_WITH_DES_CBC_SHA,TLS_KRB5_WITH_3DES_EDE_CBC_SHA,TLS_KRB5_WITH_RC4_128_SHA,TLS_KRB5_WITH_IDEA_CBC_SHA,TLS_KRB5_WITH_DES_CBC_MD5,TLS_KRB5_WITH_3DES_EDE_CBC_MD5,TLS_KRB5_WITH_RC4_128_MD5,TLS_KRB5_WITH_IDEA_CBC_MD5,TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA,TLS_KRB5_EXPORT_WITH_RC2_CBC_40_SHA,TLS_KRB5_EXPORT_WITH_RC4_40_SHA,TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5,TLS_KRB5_EXPORT_WITH_RC2_CBC_40_MD5,TLS_KRB5_EXPORT_WITH_RC4_40_MD5,TLS_PSK_WITH_NULL_SHA,TLS_DHE_PSK_WITH_NULL_SHA,TLS_RSA_PSK_WITH_NULL_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DH_DSS_WITH_AES_128_CBC_SHA,TLS_DH_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DH_anon_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DH_DSS_WITH_AES_256_CBC_SHA,TLS_DH_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_DSS_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_DH_anon_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_NULL_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_DH_DSS_WITH_AES_128_CBC_SHA256,TLS_DH_RSA_WITH_AES_128_CBC_SHA256,TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_CAMELLIA_128_CBC_SHA,TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA,TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA,TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA,TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA,TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,TLS_DH_DSS_WITH_AES_256_CBC_SHA256,TLS_DH_RSA_WITH_AES_256_CBC_SHA256,TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,TLS_DH_anon_WITH_AES_128_CBC_SHA256,TLS_DH_anon_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_CAMELLIA_256_CBC_SHA,TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA,TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA,TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA,TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA,TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA,TLS_PSK_WITH_RC4_128_SHA,TLS_PSK_WITH_3DES_EDE_CBC_SHA,TLS_PSK_WITH_AES_128_CBC_SHA,TLS_PSK_WITH_AES_256_CBC_SHA,TLS_DHE_PSK_WITH_RC4_128_SHA,TLS_DHE_PSK_WITH_3DES_EDE_CBC_SHA,TLS_DHE_PSK_WITH_AES_128_CBC_SHA,TLS_DHE_PSK_WITH_AES_256_CBC_SHA,TLS_RSA_PSK_WITH_RC4_128_SHA,TLS_RSA_PSK_WITH_3DES_EDE_CBC_SHA,TLS_RSA_PSK_WITH_AES_128_CBC_SHA,TLS_RSA_PSK_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_SEED_CBC_SHA,TLS_DH_DSS_WITH_SEED_CBC_SHA,TLS_DH_RSA_WITH_SEED_CBC_SHA,TLS_DHE_DSS_WITH_SEED_CBC_SHA,TLS_DHE_RSA_WITH_SEED_CBC_SHA,TLS_DH_anon_WITH_SEED_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,TLS_DH_RSA_WITH_AES_128_GCM_SHA256,TLS_DH_RSA_WITH_AES_256_GCM_SHA384,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,TLS_DH_DSS_WITH_AES_128_GCM_SHA256,TLS_DH_DSS_WITH_AES_256_GCM_SHA384,TLS_DH_anon_WITH_AES_128_GCM_SHA256,TLS_DH_anon_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_GCM_SHA256,TLS_PSK_WITH_AES_256_GCM_SHA384,TLS_DHE_PSK_WITH_AES_128_GCM_SHA256,TLS_DHE_PSK_WITH_AES_256_GCM_SHA384,TLS_RSA_PSK_WITH_AES_128_GCM_SHA256,TLS_RSA_PSK_WITH_AES_256_GCM_SHA384,TLS_PSK_WITH_AES_128_CBC_SHA256,TLS_PSK_WITH_AES_256_CBC_SHA384,TLS_PSK_WITH_NULL_SHA256,TLS_PSK_WITH_NULL_SHA384,TLS_DHE_PSK_WITH_AES_128_CBC_SHA256,TLS_DHE_PSK_WITH_AES_256_CBC_SHA384,TLS_DHE_PSK_WITH_NULL_SHA256,TLS_DHE_PSK_WITH_NULL_SHA384,TLS_RSA_PSK_WITH_AES_128_CBC_SHA256,TLS_RSA_PSK_WITH_AES_256_CBC_SHA384,TLS_RSA_PSK_WITH_NULL_SHA256,TLS_RSA_PSK_WITH_NULL_SHA384,TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA256,TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA256,TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA256,TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256,TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA256,TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA256,TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA256,TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256,TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA256,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_CCM_SHA256,TLS_AES_128_CCM_8_SHA256,TLS_ECDH_ECDSA_WITH_NULL_SHA,TLS_ECDH_ECDSA_WITH_RC4_128_SHA,TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_NULL_SHA,TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDH_RSA_WITH_NULL_SHA,TLS_ECDH_RSA_WITH_RC4_128_SHA,TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_NULL_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDH_anon_WITH_NULL_SHA,TLS_ECDH_anon_WITH_RC4_128_SHA,TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,TLS_ECDH_anon_WITH_AES_128_CBC_SHA,TLS_ECDH_anon_WITH_AES_256_CBC_SHA,TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA,TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA,TLS_SRP_SHA_DSS_WITH_3DES_EDE_CBC_SHA,TLS_SRP_SHA_WITH_AES_128_CBC_SHA,TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA,TLS_SRP_SHA_DSS_WITH_AES_128_CBC_SHA,TLS_SRP_SHA_WITH_AES_256_CBC_SHA,TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA,TLS_SRP_SHA_DSS_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_PSK_WITH_RC4_128_SHA,TLS_ECDHE_PSK_WITH_3DES_EDE_CBC_SHA,TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA,TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA,TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA256,TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384,TLS_ECDHE_PSK_WITH_NULL_SHA,TLS_ECDHE_PSK_WITH_NULL_SHA256,TLS_ECDHE_PSK_WITH_NULL_SHA384,TLS_RSA_WITH_ARIA_128_CBC_SHA256,TLS_RSA_WITH_ARIA_256_CBC_SHA384,TLS_DH_DSS_WITH_ARIA_128_CBC_SHA256,TLS_DH_DSS_WITH_ARIA_256_CBC_SHA384,TLS_DH_RSA_WITH_ARIA_128_CBC_SHA256,TLS_DH_RSA_WITH_ARIA_256_CBC_SHA384,TLS_DHE_DSS_WITH_ARIA_128_CBC_SHA256,TLS_DHE_DSS_WITH_ARIA_256_CBC_SHA384,TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256,TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384,TLS_DH_anon_WITH_ARIA_128_CBC_SHA256,TLS_DH_anon_WITH_ARIA_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384,TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256,TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384,TLS_RSA_WITH_ARIA_128_GCM_SHA256,TLS_RSA_WITH_ARIA_256_GCM_SHA384,TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256,TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384,TLS_DH_RSA_WITH_ARIA_128_GCM_SHA256,TLS_DH_RSA_WITH_ARIA_256_GCM_SHA384,TLS_DHE_DSS_WITH_ARIA_128_GCM_SHA256,TLS_DHE_DSS_WITH_ARIA_256_GCM_SHA384,TLS_DH_DSS_WITH_ARIA_128_GCM_SHA256,TLS_DH_DSS_WITH_ARIA_256_GCM_SHA384,TLS_DH_anon_WITH_ARIA_128_GCM_SHA256,TLS_DH_anon_WITH_ARIA_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384,TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256,TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384,TLS_PSK_WITH_ARIA_128_CBC_SHA256,TLS_PSK_WITH_ARIA_256_CBC_SHA384,TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256,TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384,TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256,TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384,TLS_PSK_WITH_ARIA_128_GCM_SHA256,TLS_PSK_WITH_ARIA_256_GCM_SHA384,TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256,TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384,TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256,TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384,TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256,TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384,TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDH_ECDSA_WITH_CAMELLIA_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384,TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDH_RSA_WITH_CAMELLIA_256_CBC_SHA384,TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_DHE_RSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_DHE_RSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_DH_RSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_DH_RSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_DHE_DSS_WITH_CAMELLIA_128_GCM_SHA256,TLS_DHE_DSS_WITH_CAMELLIA_256_GCM_SHA384,TLS_DH_DSS_WITH_CAMELLIA_128_GCM_SHA256,TLS_DH_DSS_WITH_CAMELLIA_256_GCM_SHA384,TLS_DH_anon_WITH_CAMELLIA_128_GCM_SHA256,TLS_DH_anon_WITH_CAMELLIA_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_ECDH_ECDSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_ECDH_ECDSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256,TLS_ECDH_RSA_WITH_CAMELLIA_256_GCM_SHA384,TLS_PSK_WITH_CAMELLIA_128_GCM_SHA256,TLS_PSK_WITH_CAMELLIA_256_GCM_SHA384,TLS_DHE_PSK_WITH_CAMELLIA_128_GCM_SHA256,TLS_DHE_PSK_WITH_CAMELLIA_256_GCM_SHA384,TLS_RSA_PSK_WITH_CAMELLIA_128_GCM_SHA256,TLS_RSA_PSK_WITH_CAMELLIA_256_GCM_SHA384,TLS_PSK_WITH_CAMELLIA_128_CBC_SHA256,TLS_PSK_WITH_CAMELLIA_256_CBC_SHA384,TLS_DHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,TLS_DHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,TLS_RSA_PSK_WITH_CAMELLIA_128_CBC_SHA256,TLS_RSA_PSK_WITH_CAMELLIA_256_CBC_SHA384,TLS_ECDHE_PSK_WITH_CAMELLIA_128_CBC_SHA256,TLS_ECDHE_PSK_WITH_CAMELLIA_256_CBC_SHA384,TLS_RSA_WITH_AES_128_CCM,TLS_RSA_WITH_AES_256_CCM,TLS_DHE_RSA_WITH_AES_128_CCM,TLS_DHE_RSA_WITH_AES_256_CCM,TLS_RSA_WITH_AES_128_CCM_8,TLS_RSA_WITH_AES_256_CCM_8,TLS_DHE_RSA_WITH_AES_128_CCM_8,TLS_DHE_RSA_WITH_AES_256_CCM_8,TLS_PSK_WITH_AES_128_CCM,TLS_PSK_WITH_AES_256_CCM,TLS_DHE_PSK_WITH_AES_128_CCM,TLS_DHE_PSK_WITH_AES_256_CCM,TLS_PSK_WITH_AES_128_CCM_8,TLS_PSK_WITH_AES_256_CCM_8,TLS_PSK_DHE_WITH_AES_128_CCM_8,TLS_PSK_DHE_WITH_AES_256_CCM_8,TLS_ECDHE_ECDSA_WITH_AES_128_CCM,TLS_ECDHE_ECDSA_WITH_AES_256_CCM,TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8,TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8,TLS_ECCPWD_WITH_AES_128_GCM_SHA256,TLS_ECCPWD_WITH_AES_256_GCM_SHA384,TLS_ECCPWD_WITH_AES_128_CCM_SHA256,TLS_ECCPWD_WITH_AES_256_CCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_PSK_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256,TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256,TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_PSK_WITH_AES_128_GCM_SHA256,TLS_ECDHE_PSK_WITH_AES_256_GCM_SHA384,TLS_ECDHE_PSK_WITH_AES_128_CCM_8_SHA256,TLS_ECDHE_PSK_WITH_AES_128_CCM_SHA256;Application Name=Tonic

[bgrainger]

ssl_choose_client_version:unsupported protocol

This error code from your exception message makes me think that the TLS version itself is a problem, not the cipher list.

Try adding TLS Version=TLS 1.0, TLS 1.1; to your connection string.

[yuliiakorabelska]

Try adding TLS Version=TLS 1.0, TLS 1.1; to your connection string.

It looks like I encountered a different small bug.
With the following code
DbProviderFactory dbProviderFactory = DbProviderFactories.GetFactory("MySql");
DbConnectionStringBuilder connectionStringBuilder = dbProviderFactory.CreateConnectionStringBuilder();
... connectionStringBuilder.Add("TLS Version", "TLS 1.0,TLS 1.1,TLS 1.2,TLS 1.3");
I get an error when I try to open a connection
System.InvalidOperationException: Unexpected character '.' for TLS minor version.
at MySqlConnector.Core.ConnectionSettings..ctor(MySqlConnectionStringBuilder csb) in //src/MySqlConnector/Core/ConnectionSettings.cs:line 81
at MySqlConnector.Core.ConnectionPool.GetPool(String connectionString) in //src/MySqlConnector/Core/ConnectionPool.cs:line 460
at MySqlConnector.MySqlConnection.OpenAsync(Nullable`1 ioBehavior, CancellationToken cancellationToken) in //src/MySqlConnector/MySqlConnection.cs:line 386
at MySqlConnector.MySqlConnection.Open() in //src/MySqlConnector/MySqlConnection.cs:line 369

Looks like MySqlConnectionStringBuilder formats TLS versions differently than ConnectionSettings expects it to be. I believe it adds extra spaces changing a value from "TLS 1.0,TLS 1.1,TLS 1.2,TLS 1.3" to "TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3"

[bgrainger]

Yes, you are correct; that is a bug.

Since the bug only affects parsing of multiple values, you should be able to work around it by only specifying one TLS version, e.g., connectionStringBuilder.Add("TLS Version", "TLS 1.0") or connectionStringBuilder.Add("TLS Version", "TLS 1.1");.

[bgrainger]

bug only affects parsing of multiple values

Fixed in 2.1.7.