MySQL SSL/TLS Connections

By default, MySQL transmits data between the client and server without encryption. On public networks or cloud environments, this exposes credentials and query results to interception. SSL/TLS encryption protects data in transit.

Checking SSL Status

Run SHOW VARIABLES LIKE '%ssl%' to see whether SSL is enabled on the server. The have_ssl variable should show YES.

Requiring SSL for a User

You can require SSL for a specific user account using the REQUIRE SSL clause in GRANT or CREATE USER. This forces all connections from that user to be encrypted, even if the server supports unencrypted connections.

Connection with SSL (CLI)

When connecting with the MySQL client, use --ssl-mode=REQUIRED to enforce encryption. In PHP PDO, set PDO::MYSQL_ATTR_SSL_CA to the path of the CA certificate.

Example

-- Check SSL status
SHOW VARIABLES LIKE '%ssl%';

-- Require SSL for a user
CREATE USER 'secure_user'@'%'
    IDENTIFIED BY 'SecurePass!99'
    REQUIRE SSL;

-- Require specific SSL certificate
GRANT SELECT ON reporting_db.* TO 'secure_user'@'%'
    REQUIRE X509;

-- View current connection SSL status
STATUS;

SQL

Full Editor

Pro Tip

Always require SSL for database connections in production, especially on cloud or shared hosting.

Related Resources

MySQL Reference

Complete tag & property list

MySQL How-To Guides

Step-by-step practical guides

MySQL Exercises

Practice what you've learned