<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h2 class="title">
      <a name="encrypted-connections">
      </a>
      8.3 Using Encrypted Connections
     </h2>
    </div>
   </div>
  </div>
  <div class="toc">
   <dl class="toc">
    <dt>
     <span class="section">
      <a href="using-encrypted-connections.html">
       8.3.1 Configuring MySQL to Use Encrypted Connections
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="encrypted-connection-protocols-ciphers.html">
       8.3.2 Encrypted Connection TLS Protocols and Ciphers
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="creating-ssl-rsa-files.html">
       8.3.3 Creating SSL and RSA Certificates and Keys
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="windows-and-ssh.html">
       8.3.4 Connecting to MySQL Remotely from Windows with SSH
      </a>
     </span>
    </dt>
    <dt>
     <span class="section">
      <a href="reusing-ssl-sessions.html">
       8.3.5 Reusing SSL Sessions
      </a>
     </span>
    </dt>
   </dl>
  </div>
  <a class="indexterm" name="idm46045247211600">
  </a>
  <a class="indexterm" name="idm46045247210560">
  </a>
  <a class="indexterm" name="idm46045247209488">
  </a>
  <a class="indexterm" name="idm46045247208448">
  </a>
  <a class="indexterm" name="idm46045247207408">
  </a>
  <a class="indexterm" name="idm46045247206336">
  </a>
  <p>
   With an unencrypted connection between the MySQL client and the
    server, someone with access to the network could watch all your
    traffic and inspect the data being sent or received between client
    and server.
  </p>
  <a class="indexterm" name="idm46045247204256">
  </a>
  <p>
   When you must move information over a network in a secure fashion,
    an unencrypted connection is unacceptable. To make any kind of data
    unreadable, use encryption. Encryption algorithms must include
    security elements to resist many kinds of known attacks such as
    changing the order of encrypted messages or replaying data twice.
  </p>
  <p>
   MySQL supports encrypted connections between clients and the server
    using the TLS (Transport Layer Security) protocol. TLS is sometimes
    referred to as SSL (Secure Sockets Layer) but MySQL does not
    actually use the SSL protocol for encrypted connections because its
    encryption is weak (see
   <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
    Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
   </a>
   ).
  </p>
  <p>
   TLS uses encryption algorithms to ensure that data received over a
    public network can be trusted. It has mechanisms to detect data
    change, loss, or replay. TLS also incorporates algorithms that
    provide identity verification using the X.509 standard.
  </p>
  <a class="indexterm" name="idm46045247200288">
  </a>
  <p>
   X.509 makes it possible to identify someone on the Internet. In
    basic terms, there should be some entity called a
   <span class="quote">
    “
    <span class="quote">
     Certificate
    Authority
    </span>
    ”
   </span>
   (or CA) that assigns electronic certificates to
    anyone who needs them. Certificates rely on asymmetric encryption
    algorithms that have two encryption keys (a public key and a secret
    key). A certificate owner can present the certificate to another
    party as proof of identity. A certificate consists of its owner's
    public key. Any data encrypted using this public key can be
    decrypted only using the corresponding secret key, which is held by
    the owner of the certificate.
  </p>
  <p>
   Support for encrypted connections in MySQL is provided using
    OpenSSL. For information about the encryption protocols and ciphers
    that OpenSSL supports, see
   <a class="xref" href="encrypted-connection-protocols-ciphers.html" title="8.3.2 Encrypted Connection TLS Protocols and Ciphers">
    Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”
   </a>
   .
  </p>
  <p>
   By default, MySQL instances link to an available installed OpenSSL
    library at runtime for support of encrypted connections and other
    encryption-related operations. You may compile MySQL from source and
    use the
   <a class="link" href="source-configuration-options.html#option_cmake_with_ssl">
    <code class="option">
     WITH_SSL
    </code>
   </a>
   <span class="command">
    <strong>
     CMake
    </strong>
   </span>
   option to specify the path to a particular
    installed OpenSSL version or an alternative OpenSSL system package.
    In that case, MySQL selects that version. For instructions to do
    this, see
   <a class="xref" href="source-ssl-library-configuration.html" title="2.8.6 Configuring SSL Library Support">
    Section 2.8.6, “Configuring SSL Library Support”
   </a>
   .
  </p>
  <p>
   You can check what version of the OpenSSL library is in use at
    runtime using the
   <a class="link" href="server-status-variables.html#statvar_Tls_library_version">
    <code class="literal">
     Tls_library_version
    </code>
   </a>
   system status
    variable.
  </p>
  <p>
   If you compile MySQL with one version of OpenSSL and want to change
    to a different version without recompiling, you may do this by
    editing the dynamic library loader path
    (
   <code class="literal">
    LD_LIBRARY_PATH
   </code>
   on Unix systems or
   <code class="literal">
    PATH
   </code>
   on Windows systems). Remove the path to the
    compiled version of OpenSSL, and add the path to the replacement
    version, placing it before any other OpenSSL libraries on the path.
    At startup, when MySQL cannot find the version of OpenSSL specified
    with
   <a class="link" href="source-configuration-options.html#option_cmake_with_ssl">
    <code class="option">
     WITH_SSL
    </code>
   </a>
   on the path, it uses the
    first version specified on the path instead.
  </p>
  <p>
   By default, MySQL programs attempt to connect using encryption if
    the server supports encrypted connections, falling back to an
    unencrypted connection if an encrypted connection cannot be
    established. For information about options that affect use of
    encrypted connections, see
   <a class="xref" href="using-encrypted-connections.html" title="8.3.1 Configuring MySQL to Use Encrypted Connections">
    Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”
   </a>
   and
   <a class="xref" href="connection-options.html#encrypted-connection-options" title="Command Options for Encrypted Connections">
    Command Options for Encrypted Connections
   </a>
   .
  </p>
  <p>
   MySQL performs encryption on a per-connection basis, and use of
    encryption for a given user can be optional or mandatory. This
    enables you to choose an encrypted or unencrypted connection
    according to the requirements of individual applications. For
    information on how to require users to use encrypted connections,
    see the discussion of the
   <code class="literal">
    REQUIRE
   </code>
   clause of the
   <a class="link" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    <code class="literal">
     CREATE USER
    </code>
   </a>
   statement in
   <a class="xref" href="create-user.html" title="15.7.1.3 CREATE USER Statement">
    Section 15.7.1.3, “CREATE USER Statement”
   </a>
   . See also the description of the
   <a class="link" href="server-system-variables.html#sysvar_require_secure_transport">
    <code class="literal">
     require_secure_transport
    </code>
   </a>
   system
    variable at
   <a class="xref" href="server-system-variables.html" title="7.1.8 Server System Variables">
    Section 7.1.8, “Server System Variables”
   </a>
  </p>
  <p>
   Encrypted connections can be used between source and replica
    servers. See
   <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
    Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
   </a>
   .
  </p>
  <p>
   For information about using encrypted connections from the MySQL C
    API, see
   <a class="ulink" href="/doc/c-api/8.4/en/c-api-encrypted-connections.html" target="_top">
    Support for Encrypted Connections
   </a>
   .
  </p>
  <p>
   It is also possible to connect using encryption from within an SSH
    connection to the MySQL server host. For an example, see
   <a class="xref" href="windows-and-ssh.html" title="8.3.4 Connecting to MySQL Remotely from Windows with SSH">
    Section 8.3.4, “Connecting to MySQL Remotely from Windows with SSH”
   </a>
   .
  </p>
 </div>
 <br/>
</div>
