On the server side, the --ssl option specifies that the server permits but does not require encrypted connections. This option is enabled by default, so it need not be specified explicitly.在服务器端，--ssl选项指定服务器允许但不需要加密连接。默认情况下启用此选项，因此不需要显式指定。

To require that clients connect using encrypted connections, enable the require_secure_transport system variable. 要要求客户端使用加密连接进行连接，请启用require_secure_transport系统变量。See Configuring Encrypted Connections as Mandatory.请参阅强制配置加密连接。

These system variables on the server side specify the certificate and key files the server uses when permitting clients to establish encrypted connections:服务器端的这些系统变量指定了服务器在允许客户端建立加密连接时使用的证书和密钥文件：

For example, to enable the server for encrypted connections, start it with these lines in the my.cnf file, changing the file names as necessary:例如，要使服务器能够进行加密连接，请在my.cnf文件中用以下行启动它，必要时更改文件名：

[mysqld]
ssl_ca=ca.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem

To specify in addition that clients are required to use encrypted connections, enable the require_secure_transport system variable:要另外指定客户端需要使用加密连接，请启用require_secure_transport系统变量：

[mysqld]
ssl_ca=ca.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem
require_secure_transport=ON

Each certificate and key system variable names a file in PEM format. Should you need to create the required certificate and key files, see Section 6.3.3, “Creating SSL and RSA Certificates and Keys”. 每个证书和密钥系统变量都以PEM格式命名一个文件。如果您需要创建所需的证书和密钥文件，请参阅第6.3.3节，“创建SSL和RSA证书和密钥”。MySQL servers compiled using OpenSSL can generate missing certificate and key files automatically at startup. See Section 6.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL”. 使用OpenSSL编译的MySQL服务器可以在启动时自动生成丢失的证书和密钥文件。请参阅第6.3.3.1节，“使用MySQL创建SSL和RSA证书和密钥”。Alternatively, if you have a MySQL source distribution, you can test your setup using the demonstration certificate and key files in its mysql-test/std_data directory.或者，如果你有MySQL源代码发行版，你可以使用mysql-test/std_data目录中的演示证书和密钥文件来测试你的设置。

The server performs certificate and key file autodiscovery. 服务器执行证书和密钥文件自动发现。If no explicit encrypted-connection options are given other than --ssl (possibly along with ssl_cipher) to configure encrypted connections, the server attempts to enable encrypted-connection support automatically at startup:如果除了--ssl（可能与ssl_cipher一起）之外没有给出明确的加密连接选项来配置加密连接，则服务器会在启动时尝试自动启用加密连接支持：

If the server automatically enables encrypted connection support, it writes a note to the error log. If the server discovers that the CA certificate is self-signed, it writes a warning to the error log. 如果服务器自动启用加密连接支持，它会在错误日志中写入注释。如果服务器发现CA证书是自签名的，它会在错误日志中写入警告。(The certificate is self-signed if created automatically by the server or manually using mysql_ssl_rsa_setup.)（如果证书由服务器自动创建或使用mysql_ssl_rsa_setup手动创建，则证书是自签名的。）

MySQL also provides these system variables for server-side encrypted-connection control:MySQL还为服务器端加密连接控制提供了以下系统变量：

If the server cannot create a valid TLS context from the system variables for server-side encrypted-connection control, the server executes without support for encrypted connections.如果服务器无法从服务器端加密连接控制的系统变量创建有效的TLS上下文，则服务器将在不支持加密连接的情况下执行。

Prior to MySQL 8.0.16, the tls_xxx and ssl_xxx system variables that configure encrypted-connection support can be set only at server startup. 在MySQL 8.0.16之前，配置加密连接支持的tls_xxx和ssl_xxx系统变量只能在服务器启动时设置。These system variables therefore determine the TLS context the server uses for all new connections.因此，这些系统变量决定了服务器用于所有新连接的TLS上下文。

As of MySQL 8.0.16, the tls_xxx and ssl_xxx system variables are dynamic and can be set at runtime, not just at startup. 从MySQL 8.0.16开始，tls_xxx和ssl_xxx系统变量是动态的，可以在运行时设置，而不仅仅是在启动时。If changed with SET GLOBAL, the new values apply only until server restart. 如果使用SET GLOBAL更改，则新值仅在服务器重新启动之前适用。If changed with SET PERSIST, the new values also carry over to subsequent server restarts. 如果使用SET PERSIST进行更改，新值也会延续到后续的服务器重启。See Section 13.7.6.1, “SET Syntax for Variable Assignment”. 请参阅第13.7.6.1节，“变量赋值的SET语法”。However, runtime changes to these variables do not immediately affect the TLS context for new connections, as explained later in this section.但是，如本节稍后所述，对这些变量的运行时更改不会立即影响新连接的TLS上下文。

Along with the change in MySQL 8.0.16 that enables runtime changes to the TLS context-related system variables, the server enables runtime updates to the actual TLS context used for new connections. MySQL 8.0.16中的更改允许对与TLS上下文相关的系统变量进行运行时更改，服务器还允许对用于新连接的实际TLS上下文进行运行时更新。This capability may be useful, for example, to avoid restarting a MySQL server that has been running so long that its SSL certificate has expired.例如，此功能可能有助于避免重新启动运行时间过长以至于SSL证书已过期的MySQL服务器。

To create the initial TLS context, the server uses the values that the context-related system variables have at startup. To expose the context values, the server also initializes a set of corresponding status variables. 为了创建初始TLS上下文，服务器使用上下文相关系统变量在启动时的值。为了公开上下文值，服务器还初始化了一组相应的状态变量。The following table shows the system variables that define the TLS context and the corresponding status variables that expose the currently active context values.下表显示了定义TLS上下文的系统变量和暴露当前活动上下文值的相应状态变量。

As of MySQL 8.0.21, those active TLS context values are also exposed as properties in the Performance Schema tls_channel_status table, along with the properties for any other active TLS contexts.从MySQL 8.0.21开始，这些活动TLS上下文值也作为属性公开在性能模式tls_channel_status表中，以及任何其他活动TLS上下文的属性。

To reconfigure the TLS context at runtime, use this procedure:要在运行时重新配置TLS上下文，请使用以下过程：

The members of each pair of system and status variables may have different values temporarily due to the way the reconfiguration procedure works:由于重新配置过程的工作方式，每对系统和状态变量的成员可能暂时具有不同的值：

In some cases, ALTER INSTANCE RELOAD TLS by itself may suffice to reconfigure the TLS context, without changing any system variables. 在某些情况下，ALTER INSTANCE RELOAD TLS本身可能足以重新配置TLS上下文，而无需更改任何系统变量。Suppose that the certificate in the file named by ssl_cert has expired. 假设ssl_cert文件中的证书已过期。It is sufficient to replace the existing file contents with a nonexpired certificate and execute ALTER INSTANCE RELOAD TLS to cause the new file contents to be read and used for new connections.用非盗版证书替换现有文件内容并执行ALTER INSTANCE RELOAD TLS以读取新文件内容并用于新连接就足够了。

As of MySQL 8.0.21, the server implements independent connection-encryption configuration for the administrative connection interface. 从MySQL 8.0.21开始，服务器为管理连接接口实现了独立的连接加密配置。See Administrative Interface Support for Encrypted Connections. 请参阅加密连接的管理界面支持。In addition, ALTER INSTANCE RELOAD TLS is extended with a FOR CHANNEL clause that enables specifying the channel (interface) for which to reload the TLS context. 此外，ALTER INSTANCE RELOAD TLS还扩展了FOR CHANNEL子句，该子句允许指定重新加载TLS上下文的通道（接口）。See Section 13.1.5, “ALTER INSTANCE Statement”. 请参阅第13.1.5节，“ALTER INSTANCE语句”。There are no status variables to expose the administrative interface TLS context, but the Performance Schema tls_channel_status table exposes TLS properties for both the main and administrative interfaces. 没有状态变量来公开管理接口TLS上下文，但性能模式tls_channel_status表公开了主接口和管理接口的TLS属性。See Section 27.12.21.7, “The tls_channel_status Table”.请参阅第27.12.21.7节，“tls_channel_status表”。

Updating the main interface TLS context has these effects:更新主接口TLS上下文具有以下效果：

By default, the RELOAD TLS action rolls back with an error and has no effect if the configuration values do not permit creation of the new TLS context. 默认情况下，RELOAD TLS操作会回滚并显示错误，如果配置值不允许创建新的TLS上下文，则该操作无效。The previous context values continue to be used for new connections. 以前的上下文值继续用于新连接。If the optional NO ROLLBACK ON ERROR clause is given and the new context cannot be created, rollback does not occur. Instead, a warning is generated and encryption is disabled for new connections on the interface to which the statement applies.如果给出了可选的NO ROLLBACK ON ERROR子句，并且无法创建新上下文，则不会发生回滚。相反，会生成一个警告，并对应用该语句的接口上的新连接禁用加密。

Options that enable or disable encrypted connections on a connection interface have an effect only at startup. 在连接接口上启用或禁用加密连接的选项仅在启动时有效。For example, the --ssl and --admin-ssl options affect only at startup whether the main and administrative interfaces support encrypted connections. 例如，--ssl和--admin-ssl选项仅在启动时影响主接口和管理接口是否支持加密连接。Such options are ignored and have no effect on the operation of ALTER INSTANCE RELOAD TLS at runtime. 这些选项将被忽略，并且在运行时对ALTER INSTANCE RELOAD TLS的操作没有影响。For example, you can use --ssl=OFF to start the server with encrypted connections disabled on the main interface, then reconfigure TLS and execute ALTER INSTANCE RELOAD TLS to enable encrypted connections at runtime.例如，您可以使用--ssl=OFF在主界面上禁用加密连接的情况下启动服务器，然后重新配置TLS并执行ALTER INSTANCE RELOAD TLS以在运行时启用加密连接。

For a complete list of client options related to establishment of encrypted connections, see Command Options for Encrypted Connections.有关与建立加密连接相关的客户端选项的完整列表，请参阅加密连接的命令选项。

By default, MySQL client programs attempt to establish an encrypted connection if the server supports encrypted connections, with further control available through the --ssl-mode option:默认情况下，如果服务器支持加密连接，MySQL客户端程序会尝试建立加密连接，并通过--ssl-mode选项进行进一步控制：

Attempts to establish an unencrypted connection fail if the require_secure_transport system variable is enabled on the server side to cause the server to require encrypted connections. 如果服务器端启用了require_secure_transport系统变量，导致服务器需要加密连接，则尝试建立未加密连接失败。See Configuring Encrypted Connections as Mandatory.请参阅强制配置加密连接。

The following options on the client side identify the certificate and key files clients use when establishing encrypted connections to the server. 客户端的以下选项标识了客户端在与服务器建立加密连接时使用的证书和密钥文件。They are similar to the ssl_ca, ssl_cert, and ssl_key system variables used on the server side, but --ssl-cert and --ssl-key identify the client public and private key:它们类似于服务器端使用的ssl_ca、ssl_cert和ssl_key系统变量，但--ssl-cert和--ssl-key标识客户端公钥和私钥：

For additional security relative to that provided by the default encryption, clients can supply a CA certificate matching the one used by the server and enable host name identity verification. 为了获得相对于默认加密提供的额外安全性，客户端可以提供与服务器使用的CA证书匹配的CA证书，并启用主机名身份验证。In this way, the server and client place their trust in the same CA certificate and the client verifies that the host to which it connected is the one intended:通过这种方式，服务器和客户端将信任放在同一个CA证书上，客户端验证其连接的主机是否是预期的主机：

MySQL also provides these options for client-side encrypted-connection control:MySQL还为客户端加密连接控制提供了以下选项：

Depending on the encryption requirements of the MySQL account used by a client, the client may be required to specify certain options to connect using encryption to the MySQL server.根据客户端使用的MySQL帐户的加密要求，客户端可能需要指定某些选项，以便使用加密连接到MySQL服务器。

Suppose that you want to connect using an account that has no special encryption requirements or that was created using a CREATE USER statement that included the REQUIRE SSL clause. 假设您想使用没有特殊加密要求的帐户或使用包含REQUIRE SSL子句的CREATE USER语句创建的帐户进行连接。Assuming that the server supports encrypted connections, a client can connect using encryption with no --ssl-mode option or with an explicit --ssl-mode=PREFFERED option:假设服务器支持加密连接，客户端可以使用不带--ssl-mode选项的加密或显式的--ssl-mode=PREFFERED选项进行连接：

mysql

Or:或者：

mysql --ssl-mode=PREFERRED

For an account created with a REQUIRE SSL clause, the connection attempt fails if an encrypted connection cannot be established. 对于使用REQUIRE SSL子句创建的帐户，如果无法建立加密连接，则连接尝试将失败。For an account with no special encryption requirements, the attempt falls back to an unencrypted connection if an encrypted connection cannot be established. To prevent fallback and fail if an encrypted connection cannot be obtained, connect like this:对于没有特殊加密要求的帐户，如果无法建立加密连接，则尝试退回到未加密的连接。如果无法获得加密连接，为防止回退和失败，请按如下方式连接：

mysql --ssl-mode=REQUIRED

If the account has more stringent security requirements, other options must be specified to establish an encrypted connection:如果帐户有更严格的安全要求，则必须指定其他选项来建立加密连接：

For additional information about the REQUIRE clause, see Section 13.7.1.3, “CREATE USER Statement”.有关REQUIRE子句的更多信息，请参阅第13.7.1.3节，“CREATE USER语句”。

To prevent use of encryption and override other --ssl-xxx options, invoke the client program with --ssl-mode=DISABLED:要防止使用加密并覆盖其他--ssl-xxx选项，请使用--ssl-mode=DISABLED调用客户端程序：

mysql --ssl-mode=DISABLED

To determine whether the current connection with the server uses encryption, check the session value of the Ssl_cipher status variable. 要确定与服务器的当前连接是否使用加密，请检查Ssl_cipher状态变量的会话值。If the value is empty, the connection is not encrypted. Otherwise, the connection is encrypted and the value indicates the encryption cipher. For example:如果该值为空，则连接未加密。否则，连接将被加密，该值表示加密密码。例如：

mysql> SHOW SESSION STATUS LIKE 'Ssl_cipher';
+---------------+---------------------------+
| Variable_name | Value                     |
+---------------+---------------------------+
| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |
+---------------+---------------------------+

For the mysql client, an alternative is to use the STATUS or \s command and check the SSL line:对于mysql客户端，另一种方法是使用STATUS或\s命令并检查SSL行：

mysql> \s
...
SSL: Not in use
...

Or:或者：

mysql> \s
...
SSL: Cipher in use is DHE-RSA-AES128-GCM-SHA256
...

For some MySQL deployments it may be not only desirable but mandatory to use encrypted connections (for example, to satisfy regulatory requirements). This section discusses configuration settings that enable you to do this. These levels of control are available:对于某些MySQL部署，使用加密连接不仅是可取的，而且是强制性的（例如，为了满足监管要求）。本节讨论使您能够执行此操作的配置设置。这些控制级别可用：

To require that clients connect using encrypted connections, enable the require_secure_transport system variable. For example, put these lines in the server my.cnf file:要要求客户端使用加密连接进行连接，请启用require_secure_transport系统变量。例如，将以下行放入服务器my.cnf文件中：

[mysqld]
require_secure_transport=ON

Alternatively, to set and persist the value at runtime, use this statement:或者，要在运行时设置并持久化该值，请使用以下语句：

SET PERSIST require_secure_transport=ON;

SET PERSIST sets the value for the running MySQL instance. It also saves the value, causing it to be used for subsequent server restarts. See Section 13.7.6.1, “SET Syntax for Variable Assignment”.SET PERSIST设置正在运行的MySQL实例的值。它还保存了该值，使其用于后续的服务器重启。请参阅第13.7.6.1节，“变量赋值的SET语法”。

With require_secure_transport enabled, client connections to the server are required to use some form of secure transport, and the server permits only TCP/IP connections that use SSL, or connections that use a socket file (on Unix) or shared memory (on Windows). 启用require_secure_transport后，到服务器的客户端连接需要使用某种形式的安全传输，服务器只允许使用SSL的TCP/IP连接，或使用套接字文件（在Unix上）或共享内存（在Windows上）的连接。The server rejects nonsecure connection attempts, which fail with an ER_SECURE_TRANSPORT_REQUIRED error.服务器拒绝不安全的连接尝试，这些尝试会失败，并出现ER_SECURE_TRANSPORT_REQUIRED错误。

To invoke a client program such that it requires an encrypted connection whether or not the server requires encryption, use an --ssl-mode option value of REQUIRED, VERIFY_CA, or VERIFY_IDENTITY. For example:要调用客户端程序，使其需要加密连接，无论服务器是否需要加密，请使用--ssl-mode选项值REQUIRED、VERIFY_CA或VERIFY_IDENTITY。例如：

mysql --ssl-mode=REQUIRED
mysqldump --ssl-mode=VERIFY_CA
mysqladmin --ssl-mode=VERIFY_IDENTITY

To configure a MySQL account to be usable only over encrypted connections, include a REQUIRE clause in the CREATE USER statement that creates the account, specifying in that clause the encryption characteristics you require. 要将MySQL帐户配置为仅在加密连接上可用，请在创建帐户的CREATE USER语句中包含一个REQUIRE子句，在该子句中指定所需的加密特性。For example, to require an encrypted connection and the use of a valid X.509 certificate, use REQUIRE X509:例如，要要求加密连接和使用有效的X.509证书，请使用REQUIRE X509：

CREATE USER 'jeffrey'@'localhost' REQUIRE X509;

For additional information about the REQUIRE clause, see Section 13.7.1.3, “CREATE USER Statement”.有关REQUIRE子句的更多信息，请参阅第13.7.1.3节，“CREATE USER语句”。

To modify existing accounts that have no encryption requirements, use the ALTER USER statement.要修改没有加密要求的现有帐户，请使用ALTER USER语句。