<div id="docs-body">
 <div class="section">
  <div class="titlepage">
   <div>
    <div>
     <h3 class="title">
      <a name="encrypted-connection-protocols-ciphers">
      </a>
      8.3.2 Encrypted Connection TLS Protocols and Ciphers
     </h3>
    </div>
   </div>
  </div>
  <p>
   MySQL supports multiple TLS protocols and ciphers, and enables
      configuring which protocols and ciphers to permit for encrypted
      connections. It is also possible to determine which protocol and
      cipher the current session uses.
  </p>
  <div class="itemizedlist">
   <ul class="itemizedlist" style="list-style-type: disc; ">
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-supported-protocols" title="Supported TLS Protocols">
       Supported TLS Protocols
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-deprecated-protocols" title="Removal of Support for the TLSv1 and TLSv1.1 Protocols">
       Removal of Support for the TLSv1 and TLSv1.1 Protocols
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-configuration" title="Connection TLS Protocol Configuration">
       Connection TLS Protocol Configuration
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-cipher-configuration" title="Connection Cipher Configuration">
       Connection Cipher Configuration
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-negotiation" title="Connection TLS Protocol Negotiation">
       Connection TLS Protocol Negotiation
      </a>
     </p>
    </li>
    <li class="listitem">
     <p>
      <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-monitoring" title="Monitoring Current Client Session TLS Protocol and Cipher">
       Monitoring Current Client Session TLS Protocol and Cipher
      </a>
     </p>
    </li>
   </ul>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-supported-protocols">
       </a>
       Supported TLS Protocols
      </h4>
     </div>
    </div>
   </div>
   <p>
    MySQL 8.4 supports the TLSv1.2 and TLSv1.3
        protocols for connections. To use TLSv1.3, both the MySQL server
        and the client application must be compiled using OpenSSL 1.1.1
        or higher. The Group Replication component supports TLSv1.3 from
        MySQL 8.0.18 (for details, see
    <a class="xref" href="group-replication-secure-socket-layer-support-ssl.html" title="20.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL)">
     Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”
    </a>
    ).
   </p>
   <p>
    MySQL 8.4 does not support the old TLSv1 and
        TLSv1.1 protocols.
   </p>
   <p>
    Permitted TLS protocols can be configured on both the server
        side and client side to include only a subset of the supported
        TLS protocols. The configuration on both sides must include at
        least one protocol in common or connection attempts cannot
        negotiate a protocol to use. For details, see
    <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-negotiation" title="Connection TLS Protocol Negotiation">
     Connection TLS Protocol Negotiation
    </a>
    .
   </p>
   <p>
    The host system may permit only certain TLS protocols, which
        means that MySQL connections cannot use protocols not allowed by
        the host even if MySQL itself permits them. Possible workarounds
        for this issue include the following:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Change the system-wide host configuration to permit
            additional TLS protocols. Consult your operating system
            documentation for instructions. For example, your system may
            have an
       <code class="literal">
        /etc/ssl/openssl.cnf
       </code>
       file that
            contains these lines to restrict TLS protocols to TLSv1.3 or
            higher:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa45481712"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[system_default_sect]</span>
<span class="token constant">MinProtocol</span> <span class="token attr-value"><span class="token punctuation">=</span> TLSv1.3</span></code></pre>
      </div>
      <p>
       Changing the value to a lower protocol version or
       <code class="literal">
        None
       </code>
       makes the system more permissive.
            This workaround has the disadvantage that permitting lower
            (less secure) protocols may have adverse security
            consequences.
      </p>
     </li>
     <li class="listitem">
      <p>
       If you cannot or prefer not to change the host system TLS
            configuration, change MySQL applications to use higher (more
            secure) TLS protocols that are permitted by the host system.
            This may not be possible for older versions of MySQL that
            support only lower protocol versions. For example, TLSv1 is
            the only supported protocol prior to MySQL 5.6.46, so
            attempts to connect to a pre-5.6.46 server fail even if the
            client is from a newer MySQL version that supports higher
            protocol versions. In such cases, an upgrade to a version of
            MySQL that supports additional TLS versions may be required.
      </p>
     </li>
    </ul>
   </div>
   <div class="variablelist">
    <dl class="variablelist">
     <dt>
      <span class="term">
       System-wide host configuration
      </span>
     </dt>
     <dd>
      <div class="itemizedlist">
       <ul class="itemizedlist" style="list-style-type: disc; ">
        <li class="listitem">
         <p>
          If the MySQL configuration permits TLSv1.2, and your
                  host system configuration permits only connections
                  that use TLSv1.2 or higher, you can establish MySQL
                  connections using TLSv1.2 only.
         </p>
        </li>
        <li class="listitem">
         <p>
          Suppose the MySQL configuration permits TLSv1.2, but
                  your host system configuration permits only
                  connections that use TLSv1.3 or higher. If this is the
                  case, you cannot establish MySQL connections at all,
                  because no protocol permitted by MySQL is permitted by
                  the host system.
         </p>
        </li>
       </ul>
      </div>
     </dd>
    </dl>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-deprecated-protocols">
       </a>
       Removal of Support for the TLSv1 and TLSv1.1 Protocols
      </h4>
     </div>
    </div>
   </div>
   <p>
    Support for the TLSv1 and TLSv1.1 connection protocols was
        deprecated and removed in MySQL 8.0. For background, refer to
        the IETF memo
    <a class="ulink" href="https://tools.ietf.org/id/draft-ietf-tls-oldversions-deprecate-02.html" target="_blank">
     Deprecating
        TLSv1.0 and TLSv1.1
    </a>
    . In MySQL 8.4,
        connections can be made using only the more secure TLSv1.2 and
        TLSv1.3 protocols. TLSv1.3 requires that both the MySQL server
        and the client application are compiled with OpenSSL 1.1.1.
   </p>
   <p>
    For more information, see
    <a class="link" href="faqs-security.html#faq-mysql-tls-versions" title="A.9.7.">
     Does MySQL
        8.4 support TLS 1.0 and 1.1?
    </a>
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-protocol-configuration">
       </a>
       Connection TLS Protocol Configuration
      </h4>
     </div>
    </div>
   </div>
   <p>
    On the server side, the value of the
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    system variable
        determines which TLS protocols a MySQL server permits for
        encrypted connections. The
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    value applies to
        connections from clients, regular source/replica replication
        connections where this server instance is the source, Group
        Replication group communication connections, and Group
        Replication distributed recovery connections where this server
        instance is the donor. The administrative connection interface
        is configured similarly, but uses the
    <a class="link" href="server-system-variables.html#sysvar_admin_tls_version">
     <code class="literal">
      admin_tls_version
     </code>
    </a>
    system
        variable (see
    <a class="xref" href="administrative-connection-interface.html" title="7.1.12.2 Administrative Connection Management">
     Section 7.1.12.2, “Administrative Connection Management”
    </a>
    ). This
        discussion applies to
    <a class="link" href="server-system-variables.html#sysvar_admin_tls_version">
     <code class="literal">
      admin_tls_version
     </code>
    </a>
    as well.
   </p>
   <p>
    The
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    value is a list
        of one or more comma-separated TLS protocol versions, which is
        not case-sensitive. By default, this variable lists all
        protocols that are supported by the SSL library used to compile
        MySQL and by the MySQL Server release. The default settings are
        therefore as shown in
    <a class="ulink" href="/doc/refman/8.0/en/encrypted-connection-protocols-ciphers.html#tls-support-defaults" target="_top">
     MySQL Server TLS Protocol Default Settings
    </a>
    .
   </p>
   <p>
    To determine the value of
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    at runtime, use
        this statement:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa76162695"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SHOW</span> <span class="token keyword">GLOBAL</span> <span class="token keyword">VARIABLES</span> <span class="token operator">LIKE</span> <span class="token string">'tls_version'</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Variable_name <span class="token punctuation">|</span> Value                 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> tls_version   <span class="token punctuation">|</span> TLSv1.2,TLSv1.3       <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    To change the value of
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    , set it at server
        startup. For example, to permit connections that use the TLSv1.2
        or TLSv1.3 protocol, but prohibit connections that use any other
        protocol, use these lines in the server
    <code class="filename">
     my.cnf
    </code>
    file:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa50920394"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">tls_version</span><span class="token attr-value"><span class="token punctuation">=</span>TLSv1.2,TLSv1.3</span></code></pre>
   </div>
   <p>
    To be even more restrictive and permit only TLSv1.3 connections,
        set
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    like this:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-ini"><div class="docs-select-all right" id="sa59766875"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-ini"><span class="token selector">[mysqld]</span>
<span class="token constant">tls_version</span><span class="token attr-value"><span class="token punctuation">=</span>TLSv1.3</span></code></pre>
   </div>
   <p>
    <code class="literal">
     tls_version
    </code>
    can be changed at runtime. See
    <a class="xref" href="using-encrypted-connections.html#using-encrypted-connections-server-side-runtime-configuration" title="Server-Side Runtime Configuration and Monitoring for Encrypted Connections">
     Server-Side Runtime Configuration and Monitoring for Encrypted
        Connections
    </a>
    .
   </p>
   <p>
    On the client side, the
    <a class="link" href="connection-options.html#option_general_tls-version">
     <code class="option">
      --tls-version
     </code>
    </a>
    option specifies
        which TLS protocols a client program permits for connections to
        the server. The format of the option value is the same as for
        the
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    system variable
        described previously (a list of one or more comma-separated
        protocol versions).
   </p>
   <p>
    For source/replica replication connections where this server
        instance is the replica, the
    <code class="literal">
     SOURCE_TLS_VERSION
    </code>
    option for the
    <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
     <code class="literal">
      CHANGE REPLICATION SOURCE TO
     </code>
    </a>
    statement specifies which TLS protocols the replica permits for
        connections to the source. The format of the option value is the
        same as for the
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    system variable described previously. See
    <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
     Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
    </a>
    .
   </p>
   <p>
    The protocols that can be specified for
    <code class="literal">
     SOURCE_TLS_VERSION
    </code>
    depend on the SSL library.
        This option is independent of and not affected by the server
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    value. For example,
        a server that acts as a replica can be configured with
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    set to TLSv1.3 to
        permit only incoming connections that use TLSv1.3, but also
        configured with
    <code class="literal">
     SOURCE_TLS_VERSION
    </code>
    set to
        TLSv1.2 to permit only TLSv1.2 for outgoing replica connections
        to the source.
   </p>
   <p>
    For Group Replication distributed recovery connections where
        this server instance is the joining member that initiates
        distributed recovery (that is, the client), the
    <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_version">
     <code class="literal">
      group_replication_recovery_tls_version
     </code>
    </a>
    system variable specifies which protocols are permitted by the
        client. Again, this option is independent of and not affected by
        the server
    <a class="link" href="server-system-variables.html#sysvar_tls_version">
     <code class="literal">
      tls_version
     </code>
    </a>
    value,
        which applies when this server instance is the donor. A Group
        Replication server generally participates in distributed
        recovery both as a donor and as a joining member over the course
        of its group membership, so both these system variables should
        be set. See
    <a class="xref" href="group-replication-secure-socket-layer-support-ssl.html" title="20.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL)">
     Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”
    </a>
    .
   </p>
   <p>
    TLS protocol configuration affects which protocol a given
        connection uses, as described in
    <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-negotiation" title="Connection TLS Protocol Negotiation">
     Connection TLS Protocol Negotiation
    </a>
    .
   </p>
   <p>
    Permitted protocols should be chosen such as not to leave
    <span class="quote">
     “
     <span class="quote">
      holes
     </span>
     ”
    </span>
    in the list. For example, these server
        configuration values do not have holes:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-terminal"><div class="docs-select-all right" id="sa14697150"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-terminal">tls_version<span class="token attr-value"><span class="token punctuation">=</span>TLSv1.2,TLSv1.3</span>
tls_version<span class="token attr-value"><span class="token punctuation">=</span>TLSv1.3</span></code></pre>
   </div>
   <p>
    The prohibition on holes also applies in other configuration
        contexts, such as for clients or replicas.
   </p>
   <p>
    Unless you intend to disable encrypted connections, the list of
        permitted protocols should not be empty. If you set a TLS
        version parameter to the empty string, encrypted connections
        cannot be established:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       <a class="link" href="server-system-variables.html#sysvar_tls_version">
        <code class="literal">
         tls_version
        </code>
       </a>
       : The server
            does not permit encrypted incoming connections.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="connection-options.html#option_general_tls-version">
        <code class="option">
         --tls-version
        </code>
       </a>
       : The client
            does not permit encrypted outgoing connections to the
            server.
      </p>
     </li>
     <li class="listitem">
      <p>
       <code class="literal">
        SOURCE_TLS_VERSION
       </code>
       : The replica does not
            permit encrypted outgoing connections to the source.
      </p>
     </li>
     <li class="listitem">
      <p>
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_version">
        <code class="literal">
         group_replication_recovery_tls_version
        </code>
       </a>
       :
            The joining member does not permit encrypted connections to
            the distributed recovery connection.
      </p>
     </li>
    </ul>
   </div>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-cipher-configuration">
       </a>
       Connection Cipher Configuration
      </h4>
     </div>
    </div>
   </div>
   <p>
    A default set of ciphers applies to encrypted connections, which
        can be overridden by explicitly configuring the permitted
        ciphers. During connection establishment, both sides of a
        connection must permit some cipher in common or the connection
        fails. Of the permitted ciphers common to both sides, the SSL
        library chooses the one supported by the provided certificate
        that has the highest priority.
   </p>
   <p>
    To specify a cipher or ciphers applicable for encrypted
        connections that use TLSv1.2:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       Set the
       <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
        <code class="literal">
         ssl_cipher
        </code>
       </a>
       system
            variable on the server side, and use the
       <a class="link" href="connection-options.html#option_general_ssl-cipher">
        <code class="option">
         --ssl-cipher
        </code>
       </a>
       option for
            client programs.
      </p>
     </li>
     <li class="listitem">
      <p>
       For regular source/replica replication connections, where
            this server instance is the source, set the
       <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
        <code class="literal">
         ssl_cipher
        </code>
       </a>
       system variable.
            Where this server instance is the replica, use the
       <code class="literal">
        SOURCE_SSL_CIPHER
       </code>
       option for the
       <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
        <code class="literal">
         CHANGE REPLICATION SOURCE TO
        </code>
       </a>
       statement. See
       <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
        Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       For a Group Replication group member, for Group Replication
            group communication connections and also for Group
            Replication distributed recovery connections where this
            server instance is the donor, set the
       <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
        <code class="literal">
         ssl_cipher
        </code>
       </a>
       system variable.
            For Group Replication distributed recovery connections where
            this server instance is the joining member, use the
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_ssl_cipher">
        <code class="literal">
         group_replication_recovery_ssl_cipher
        </code>
       </a>
       system variable. See
       <a class="xref" href="group-replication-secure-socket-layer-support-ssl.html" title="20.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL)">
        Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    For encrypted connections that use TLSv1.3, OpenSSL 1.1.1 and
        higher supports the following ciphersuites, all of which are
        enabled by default for use with server system variables
    <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
     <code class="literal">
      --tls-ciphersuites
     </code>
    </a>
    or
    <a class="link" href="server-system-variables.html#sysvar_admin_tls_ciphersuites">
     <code class="literal">
      --admin-tls-ciphersuites
     </code>
    </a>
    :
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa65442314"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256</code></pre>
   </div>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     In MySQL 8.4, use of
     <code class="literal">
      TLS_AES_128_CCM_8_SHA256
     </code>
     with server system
          variables
     <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
      <code class="literal">
       --tls-ciphersuites
      </code>
     </a>
     or
     <a class="link" href="server-system-variables.html#sysvar_admin_tls_ciphersuites">
      <code class="literal">
       --admin-tls-ciphersuites
      </code>
     </a>
     generates a deprecation warning.
    </p>
   </div>
   <p>
    To configure the permitted TLSv1.3 ciphersuites explicitly, set
        the following parameters. In each case, the configuration value
        is a list of zero or more colon-separated ciphersuite names.
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       On the server side, use the
       <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
        <code class="literal">
         tls_ciphersuites
        </code>
       </a>
       system
            variable. If this variable is not set, its default value is
       <code class="literal">
        NULL
       </code>
       , which means that the server permits
            the default set of ciphersuites. If the variable is set to
            the empty string, no ciphersuites are enabled and encrypted
            connections cannot be established.
      </p>
     </li>
     <li class="listitem">
      <p>
       On the client side, use the
       <a class="link" href="connection-options.html#option_general_tls-ciphersuites">
        <code class="option">
         --tls-ciphersuites
        </code>
       </a>
       option.
            If this option is not set, the client permits the default
            set of ciphersuites. If the option is set to the empty
            string, no ciphersuites are enabled and encrypted
            connections cannot be established.
      </p>
     </li>
     <li class="listitem">
      <p>
       For regular source/replica replication connections, where
            this server instance is the source, use the
       <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
        <code class="literal">
         tls_ciphersuites
        </code>
       </a>
       system
            variable. Where this server instance is the replica, use the
       <code class="literal">
        SOURCE_TLS_CIPHERSUITES
       </code>
       option for the
       <a class="link" href="change-replication-source-to.html" title="15.4.2.2 CHANGE REPLICATION SOURCE TO Statement">
        <code class="literal">
         CHANGE REPLICATION SOURCE TO
        </code>
       </a>
       statement. See
       <a class="xref" href="replication-encrypted-connections.html" title="19.3.1 Setting Up Replication to Use Encrypted Connections">
        Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”
       </a>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       For a Group Replication group member, for Group Replication
            group communication connections and also for Group
            Replication distributed recovery connections where this
            server instance is the donor, use the
       <a class="link" href="server-system-variables.html#sysvar_tls_ciphersuites">
        <code class="literal">
         tls_ciphersuites
        </code>
       </a>
       system
            variable. For Group Replication distributed recovery
            connections where this server instance is the joining
            member, use the
       <a class="link" href="group-replication-system-variables.html#sysvar_group_replication_recovery_tls_ciphersuites">
        <code class="literal">
         group_replication_recovery_tls_ciphersuites
        </code>
       </a>
       system variable. See
       <a class="xref" href="group-replication-secure-socket-layer-support-ssl.html" title="20.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL)">
        Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”
       </a>
       .
      </p>
     </li>
    </ul>
   </div>
   <p>
    Ciphersuite support requires that both the MySQL server and the
        client application be compiled using OpenSSL 1.1.1 or higher.
   </p>
   <p>
    A given cipher may work only with particular TLS protocols,
        which affects the TLS protocol negotiation process. See
    <a class="xref" href="encrypted-connection-protocols-ciphers.html#encrypted-connection-protocol-negotiation" title="Connection TLS Protocol Negotiation">
     Connection TLS Protocol Negotiation
    </a>
    .
   </p>
   <p>
    To determine which ciphers a given server supports, check the
        session value of the
    <a class="link" href="server-status-variables.html#statvar_Ssl_cipher_list">
     <code class="literal">
      Ssl_cipher_list
     </code>
    </a>
    status
        variable:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting one-line language-sql"><div class="docs-select-all right" id="sa66789796"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token keyword">SHOW</span> <span class="token keyword">SESSION</span> <span class="token keyword">STATUS</span> <span class="token operator">LIKE</span> <span class="token string">'Ssl_cipher_list'</span><span class="token punctuation">;</span></code></pre>
   </div>
   <p>
    The
    <a class="link" href="server-status-variables.html#statvar_Ssl_cipher_list">
     <code class="literal">
      Ssl_cipher_list
     </code>
    </a>
    status
        variable lists the possible SSL ciphers (empty for non-SSL
        connections). If MySQL supports TLSv1.3, the value includes the
        possible TLSv1.3 ciphersuites.
   </p>
   <div class="note" style="margin-left: 0.5in; margin-right: 0.5in;">
    <div class="admon-title">
     Note
    </div>
    <p>
     ECDSA ciphers only work in combination with an SSL certificate
          that uses ECDSA for the digital signature, and they do not
          work with certificates that use RSA. MySQL Server’s
          automatic generation process for SSL certificates does not
          generate ECDSA signed certificates, it generates only RSA
          signed certificates. Do not select ECDSA ciphers unless you
          have an ECDSA certificate available to you.
    </p>
   </div>
   <p>
    For encrypted connections that use TLS.v1.3, MySQL uses the SSL
        library default ciphersuite list.
   </p>
   <p>
    For encrypted connections that use TLSv1.2, MySQL passes the
        following default cipher list to the SSL library when used with
        the server system variables
    <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
     <code class="literal">
      --ssl-cipher
     </code>
    </a>
    and
    <a class="link" href="server-system-variables.html#sysvar_admin_ssl_cipher">
     <code class="literal">
      --admin-ssl-cipher
     </code>
    </a>
    .
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-none"><div class="docs-select-all right" id="sa41336208"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES256-CCM
ECDHE-ECDSA-AES128-CCM
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-CCM
DHE-RSA-AES128-CCM
DHE-RSA-CHACHA20-POLY1305</code></pre>
   </div>
   <p>
    These cipher restrictions are in place:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       The following ciphers are deprecated and produce a warning
            when used with the server system variables
       <a class="link" href="server-system-variables.html#sysvar_ssl_cipher">
        <code class="literal">
         --ssl-cipher
        </code>
       </a>
       and
       <a class="link" href="server-system-variables.html#sysvar_admin_ssl_cipher">
        <code class="literal">
         --admin-ssl-cipher
        </code>
       </a>
       :
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa53845696"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES128-SHA
DHE-RSA-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
DHE-RSA-AES256-SHA
AES128-GCM-SHA256
DH-DSS-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
AES256-GCM-SHA384
DH-DSS-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
AES128-SHA256
DH-DSS-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
AES256-SHA256
DH-DSS-AES256-SHA256
ECDH-ECDSA-AES256-SHA384
AES128-SHA
DH-DSS-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES256-SHA
DH-DSS-AES256-SHA
ECDH-ECDSA-AES256-SHA
DH-RSA-AES128-GCM-SHA256
ECDH-RSA-AES128-GCM-SHA256
DH-RSA-AES256-GCM-SHA384
ECDH-RSA-AES256-GCM-SHA384
DH-RSA-AES128-SHA256
ECDH-RSA-AES128-SHA256
DH-RSA-AES256-SHA256
ECDH-RSA-AES256-SHA384
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES128-SHA
DHE-RSA-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
DHE-RSA-AES256-SHA
AES128-SHA
DH-DSS-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES256-SHA
DH-DSS-AES256-SHA
ECDH-ECDSA-AES256-SHA
DH-RSA-AES128-SHA
ECDH-RSA-AES128-SHA
DH-RSA-AES256-SHA
ECDH-RSA-AES256-SHA
DES-CBC3-SHA</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       The following ciphers are permanently restricted:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa44880851"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">!DHE-DSS-DES-CBC3-SHA
!DHE-RSA-DES-CBC3-SHA
!ECDH-RSA-DES-CBC3-SHA
!ECDH-ECDSA-DES-CBC3-SHA
!ECDHE-RSA-DES-CBC3-SHA
!ECDHE-ECDSA-DES-CBC3-SHA</code></pre>
      </div>
     </li>
     <li class="listitem">
      <p>
       The following categories of ciphers are permanently
            restricted:
      </p>
      <div class="copytoclipboard-wrapper">
       <pre class="programlisting language-none"><div class="docs-select-all right" id="sa11359119"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-none">!aNULL
!eNULL
!EXPORT
!LOW
!MD5
!DES
!RC2
!RC4
!PSK
!SSLv3</code></pre>
      </div>
     </li>
    </ul>
   </div>
   <p>
    If the server is started with the
    <a class="link" href="server-system-variables.html#sysvar_ssl_cert">
     <code class="literal">
      ssl_cert
     </code>
    </a>
    system variable set to
        a certificate that uses any of the preceding restricted ciphers
        or cipher categories, the server starts with support for
        encrypted connections disabled.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-protocol-negotiation">
       </a>
       Connection TLS Protocol Negotiation
      </h4>
     </div>
    </div>
   </div>
   <p>
    Connection attempts in MySQL negotiate use of the highest TLS
        protocol version available on both sides for which a
        protocol-compatible encryption cipher is available on both
        sides. The negotiation process depends on factors such as the
        SSL library used to compile the server and client, the TLS
        protocol and encryption cipher configuration, and which key size
        is used:
   </p>
   <div class="itemizedlist">
    <ul class="itemizedlist" style="list-style-type: disc; ">
     <li class="listitem">
      <p>
       For a connection attempt to succeed, the server and client
            TLS protocol configuration must permit some protocol in
            common.
      </p>
     </li>
     <li class="listitem">
      <p>
       Similarly, the server and client encryption cipher
            configuration must permit some cipher in common. A given
            cipher may work only with particular TLS protocols, so a
            protocol available to the negotiation process is not chosen
            unless there is also a compatible cipher.
      </p>
     </li>
     <li class="listitem">
      <p>
       If TLSv1.3 is available, it is used if possible. (This means
            that server and client configuration both must permit
            TLSv1.3, and both must also permit some TLSv1.3-compatible
            encryption cipher.) Otherwise, MySQL continues through the
            list of available protocols, using TLSv1.2 if possible, and
            so forth. Negotiation proceeds from more secure protocols to
            less secure. Negotiation order is independent of the order
            in which protocols are configured. For example, negotiation
            order is the same regardless of whether
       <a class="link" href="server-system-variables.html#sysvar_tls_version">
        <code class="literal">
         tls_version
        </code>
       </a>
       has a value of
       <code class="literal">
        TLSv1.2,TLSv1.3
       </code>
       or
       <code class="literal">
        TLSv1.3,TLSv1.2
       </code>
       .
      </p>
     </li>
     <li class="listitem">
      <p>
       For better security, use a certificate with an RSA key size
            of at least 2048 bits.
      </p>
     </li>
    </ul>
   </div>
   <p>
    If the server and client do not have a permitted protocol in
        common, and a protocol-compatible cipher in common, the server
        terminates the connection request.
   </p>
   <p>
    MySQL permits specifying a list of protocols to support. This
        list is passed directly down to the underlying SSL library and
        is ultimately up to that library what protocols it actually
        enables from the supplied list. Please refer to the MySQL source
        code and the OpenSSL
    <a class="ulink" href="https://www.openssl.org/docs/man1.1.0/ssl/SSL_CTX_new.html" target="_blank">
     <code class="literal">
      SSL_CTX_new()
     </code>
    </a>
    documentation for information about how the SSL library handles
        this.
   </p>
  </div>
  <div class="simplesect">
   <div class="titlepage">
    <div>
     <div class="simple">
      <h4 class="title">
       <a name="encrypted-connection-protocol-monitoring">
       </a>
       Monitoring Current Client Session TLS Protocol and Cipher
      </h4>
     </div>
    </div>
   </div>
   <p>
    To determine which encryption TLS protocol and cipher the
        current client session uses, check the session values of the
    <a class="link" href="server-status-variables.html#statvar_Ssl_version">
     <code class="literal">
      Ssl_version
     </code>
    </a>
    and
    <a class="link" href="server-status-variables.html#statvar_Ssl_cipher">
     <code class="literal">
      Ssl_cipher
     </code>
    </a>
    status variables:
   </p>
   <div class="copytoclipboard-wrapper">
    <pre class="programlisting language-sql"><div class="docs-select-all right" id="sa52834629"><div class="copy-help left">Press ⌘+C to copy</div> <div class="right"><button class="clipboard-btn" title="Copy to Clipboard"><span class="icon-clipboard"></span></button></div></div><code class="language-sql"><span class="token prompt">mysql&gt;</span> <span class="token keyword">SELECT</span> <span class="token operator">*</span> <span class="token keyword">FROM</span> performance_schema<span class="token punctuation">.</span>session_status
       <span class="token keyword">WHERE</span> VARIABLE_NAME <span class="token keyword">IN</span> <span class="token punctuation">(</span><span class="token string">'Ssl_version'</span><span class="token punctuation">,</span><span class="token string">'Ssl_cipher'</span><span class="token punctuation">)</span><span class="token punctuation">;</span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> VARIABLE_NAME <span class="token punctuation">|</span> VARIABLE_VALUE            <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span>
<span class="token output"><span class="token punctuation">|</span> Ssl_cipher    <span class="token punctuation">|</span> DHE<span class="token punctuation">-</span>RSA<span class="token punctuation">-</span>AES128<span class="token punctuation">-</span>GCM<span class="token punctuation">-</span>SHA256 <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">|</span> Ssl_version   <span class="token punctuation">|</span> TLSv1.2                   <span class="token punctuation">|</span></span>
<span class="token output"><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">-</span><span class="token punctuation">+</span></span></code></pre>
   </div>
   <p>
    If the connection is not encrypted, both variables have an empty
        value.
   </p>
  </div>
 </div>
 <br/>
</div>
