<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="x-plugin-encrypted-connections">
      </a>
      22.5.3 Using Encrypted Connections with X Plugin
     </h3>
    </div>
   </div>
  </div>
  <p>
   This section explains how to configure X Plugin to use encrypted
      connections. For more background information, see
   <a class="xref" href="encrypted-connections.html" title="8.3 Using Encrypted Connections">
    Section 8.3, “Using Encrypted Connections”
   </a>
   .
  </p>
  <p>
   To enable configuring support for encrypted connections, X Plugin
      has
   <code class="literal">
    mysqlx_ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system variables, which can have different values from the
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system
      variables used with MySQL Server. For example, X Plugin can have
      SSL key, certificate, and certificate authority files that differ
      from those used for MySQL Server. These variables are described at
   <a class="xref" href="x-plugin-options-system-variables.html" title="22.5.6.2 X Plugin Options and System Variables">
    Section 22.5.6.2, “X Plugin Options and System Variables”
   </a>
   . Similarly,
      X Plugin has its own
   <code class="literal">
    Mysqlx_ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   status variables that correspond to the MySQL Server
      encrypted-connection
   <code class="literal">
    Ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   status
      variables. See
   <a class="xref" href="x-plugin-status-variables.html" title="22.5.6.3 X Plugin Status Variables">
    Section 22.5.6.3, “X Plugin Status Variables”
   </a>
   .
  </p>
  <p>
   At initialization, X Plugin determines its TLS context for
      encrypted connections as follows:
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      If all
      <code class="literal">
       mysqlx_ssl_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      system variables have their default values, X Plugin uses the
          same TLS context as the MySQL Server main connection
          interface, which is determined by the values of the
      <code class="literal">
       ssl_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      system
          variables.
     </p>
    </li>
    <li class="listitem">
     <p>
      If any
      <code class="literal">
       mysqlx_ssl_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      variable has a nondefault value, X Plugin uses the TLS
          context defined by the values of its own system variables.
          (This is the case if any
      <code class="literal">
       mysqlx_ssl_
       <em class="replaceable">
        <code>
         xxx
        </code>
       </em>
      </code>
      system variable is set to a value different from its default.)
     </p>
    </li>
   </ul>
  </div>
  <p>
   This means that, on a server with X Plugin enabled, you can
      choose to have MySQL Protocol and X Protocol connections share
      the same encryption configuration by setting only the
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   variables,
      or have separate encryption configurations for MySQL Protocol and
      X Protocol connections by configuring the
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   and
   <code class="literal">
    mysqlx_ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   variables separately.
  </p>
  <p>
   To have MySQL Protocol and X Protocol connections use the same
      encryption configuration, set only the
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system
      variables in
   <code class="filename">
    my.cnf
   </code>
   :
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa80050261"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">ssl_ca</span><span class="token attr-value"><span class="token punctuation">=</span>ca.pem</span>
<span class="token constant">ssl_cert</span><span class="token attr-value"><span class="token punctuation">=</span>server-cert.pem</span>
<span class="token constant">ssl_key</span><span class="token attr-value"><span class="token punctuation">=</span>server-key.pem</span></code></pre>
  </div>
  <p>
   To configure encryption separately for MySQL Protocol and
      X Protocol connections, set both the
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   and
   <code class="literal">
    mysqlx_ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system variables in
   <code class="filename">
    my.cnf
   </code>
   :
  </p>
  <div class="copytoclipboard-wrapper">
   <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa75845865"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">ssl_ca</span><span class="token attr-value"><span class="token punctuation">=</span>ca1.pem</span>
<span class="token constant">ssl_cert</span><span class="token attr-value"><span class="token punctuation">=</span>server-cert1.pem</span>
<span class="token constant">ssl_key</span><span class="token attr-value"><span class="token punctuation">=</span>server-key1.pem</span>

<span class="token constant">mysqlx_ssl_ca</span><span class="token attr-value"><span class="token punctuation">=</span>ca2.pem</span>
<span class="token constant">mysqlx_ssl_cert</span><span class="token attr-value"><span class="token punctuation">=</span>server-cert2.pem</span>
<span class="token constant">mysqlx_ssl_key</span><span class="token attr-value"><span class="token punctuation">=</span>server-key2.pem</span></code></pre>
  </div>
  <p>
   For general information about configuring connection-encryption
      support, see
   <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
    Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
   </a>
   . That
      discussion is written for MySQL Server, but the parameter names
      are similar for X Plugin. (The X Plugin
   <code class="literal">
    mysqlx_ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system variable names correspond to the MySQL Server
   <code class="literal">
    ssl_
    <em class="replaceable">
     <code>
      xxx
     </code>
    </em>
   </code>
   system
      variable names.)
  </p>
  <p>
   The
   <a class="link" href="server-system-variables.html#sysvar_tls_version">
    <code class="literal">
     tls_version
    </code>
   </a>
   system variable
      that determines the permitted TLS versions for MySQL Protocol
      connections also applies to X Protocol connections. The permitted
      TLS versions for both types of connections are therefore the same.
  </p>
  <p>
   Encryption per connection is optional, but a specific user can be
      required to use encryption for X Protocol and MySQL Protocol
      connections by including an appropriate
   <code class="literal">
    REQUIRE
   </code>
   clause in the
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   statement
      that creates the user. For details, see
   <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    Section 15.7.1.3, “CREATE USER Statement”
   </a>
   . Alternatively, to require all users
      to use encryption for X Protocol and MySQL Protocol connections,
      enable the
   <a class="link" href="server-system-variables.html#sysvar_require_secure_transport">
    <code class="literal">
     require_secure_transport
    </code>
   </a>
   system
      variable. For additional information, see
   <a class="xref" href="using-encrypted-connections.html#mandatory-encrypted-connections" title="Configuring Encrypted Connections as Mandatory">
    Configuring Encrypted Connections as Mandatory
   </a>
   .
  </p>
 </div>
 <br/>
</div>
