MySQL supports encrypted connections using the TLSv1, TLSv1.1, TLSv1.2, and TLSv1.3 protocols, listed in order from less secure to more secure. The set of protocols actually permitted for connections is subject to multiple factors:MySQL支持使用TLSv1、TLSv1.1、TLSv1.2和TLSv1.3协议的加密连接，按安全性从低到高的顺序列出。实际允许连接的协议集受多种因素的影响：

On the server side, the value of the tls_version system variable determines which TLS protocols a MySQL server permits for encrypted connections. 在服务器端，tls_version系统变量的值决定了MySQL服务器允许哪些tls协议用于加密连接。The tls_version value applies to connections from clients, regular source/replica replication connections where this server instance is the source, Group Replication group communication connections, and Group Replication distributed recovery connections where this server instance is the donor. tls_version值适用于来自客户端的连接、此服务器实例作为源的常规源/副本复制连接、组复制组通信连接以及此服务器实例为施主的组复制分布式恢复连接。The administrative connection interface is configured similarly, but uses the admin_tls_version system variable (see Section 5.1.12.2, “Administrative Connection Management”). 管理连接接口的配置类似，但使用admin_tls_version系统变量（请参阅第5.1.12.2节，“管理连接管理”）。This discussion applies to admin_tls_version as well.此讨论也适用于admin_tls_version。

The tls_version value is a list of one or more comma-separated protocol versions from this list (not case-sensitive): TLSv1, TLSv1.1, TLSv1.2, and (if available) TLSV1.3. By default, this variable lists all protocols supported by the SSL library used to compile MySQL. tls_version值是此列表中一个或多个逗号分隔的协议版本的列表（不区分大小写）：TLSv1、TLSv1.1、TLSv1.2和（如果可用）TLSv1.3。默认情况下，此变量列出了用于编译MySQL的SSL库支持的所有协议。To determine the value of tls_version at runtime, use this statement:要在运行时确定tls_version的值，请使用以下语句：

mysql> SHOW GLOBAL VARIABLES LIKE 'tls_version';
+---------------+-----------------------+
| Variable_name | Value                 |
+---------------+-----------------------+
| tls_version   | TLSv1,TLSv1.1,TLSv1.2 |
+---------------+-----------------------+

To change the value of tls_version, set it at server startup. 要更改tls_version的值，请在服务器启动时设置它。For example, to permit connections that use the TLSv1.1 or TLSv1.2 protocol, but prohibit connections that use the less-secure TLSv1 protocol, use these lines in the server my.cnf file:例如，要允许使用TLSv1.1或TLSv1.2协议的连接，但禁止使用不太安全的TLSv1协议的连接。请在服务器my.cnf文件中使用以下行：

[mysqld]
tls_version=TLSv1.1,TLSv1.2

To be even more restrictive and permit only TLSv1.2 connections, set tls_version like this:为了更严格地限制并只允许TLSv1.2连接，请按如下方式设置tls_version：

[mysqld]
tls_version=TLSv1.2

As of MySQL 8.0.16, tls_version can also be changed at runtime. See Server-Side Runtime Configuration and Monitoring for Encrypted Connections.从MySQL 8.0.16开始，tls_version也可以在运行时更改。请参阅加密连接的服务器端运行时配置和监视。

On the client side, the --tls-version option specifies which TLS protocols a client program permits for connections to the server. 在客户端，--tls-version选项指定客户端程序允许哪些tls协议连接到服务器。The format of the option value is the same as for the tls_version system variable described previously (a list of one or more comma-separated protocol versions).选项值的格式与前面描述的tls_version系统变量的格式相同（一个或多个逗号分隔的协议版本的列表）。

For source/replica replication connections where this server instance is the replica, the SOURCE_TLS_VERSION | MASTER_TLS_VERSION option for the CHANGE REPLICATION SOURCE TO statement (from MySQL 8.0.23) or CHANGE MASTER TO statement (before MySQL 8.0.23) specifies which TLS protocols the replica permits for connections to the source. 对于此服务器实例为副本的源/副本复制连接，CHANGE REPLICATION SOURCE TO语句（来自MySQL 8.0.23）或CHANGE MASTER TO语句（MySQL 8.0.22之前）的SOURCE_TLS_VERSION | MASTER _TLS_VERSION选项指定了副本允许连接到源的TLS协议。The format of the option value is the same as for the tls_version system variable described previously. 选项值的格式与前面描述的tls_version系统变量的格式相同。See Section 17.3.1, “Setting Up Replication to Use Encrypted Connections”.请参阅第17.3.1节，“设置复制以使用加密连接”。

The protocols that can be specified for SOURCE_TLS_VERSION | MASTER_TLS_VERSION depend on the SSL library. 可以为SOURCE_TLS_VERSION | MASTER_TLS_VERSION指定的协议取决于SSL库。This option is independent of and not affected by the server tls_version value. 此选项独立于服务器tls_version值，不受其影响。For example, a server that acts as a replica can be configured with tls_version set to TLSv1.3 to permit only incoming connections that use TLSv1.3, but also configured with SOURCE_TLS_VERSION | MASTER_TLS_VERSION set to TLSv1.2 to permit only TLSv1.2 for outgoing replica connections to the source.例如，充当副本的服务器可以配置为tls_version设置为TLSv1.3，只允许使用TLSv1.3的传入连接，也可以配置为SOURCE_TLS_VERSION | MASTER_TLS_VERSION设置为TLSv1.2，只允许TLSv1.2用于到源的传出副本连接。

For Group Replication distributed recovery connections where this server instance is the joining member that initiates distributed recovery (that is, the client), the group_replication_recovery_tls_version system variable specifies which protocols are permitted by the client. 对于组复制分布式恢复连接，其中此服务器实例是启动分布式恢复的加入成员（即客户端），group_replication_recovery_tls_version系统变量指定客户端允许哪些协议。This option is independent of and not affected by the server tls_version value, which applies when this server instance is the donor. 此选项独立于服务器tls_version值，不受其影响，当此服务器实例是施主时，该值适用。A Group Replication server generally participates in distributed recovery both as a donor and as a joining member over the course of its group membership, so both these system variables should be set. 组复一致性务器通常在其组成员身份过程中以捐赠者和加入成员的身份参与分布式恢复，因此应设置这两个系统变量。See Section 18.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”.请参阅第18.6.2节，“使用安全套接字层（SSL）保护组通信连接”。

TLS protocol configuration affects which protocol a given connection uses, as described in Connection TLS Protocol Negotiation.TLS协议配置会影响给定连接使用的协议，如连接TLS协议协商中所述。

Permitted protocols should be chosen such as not to leave “holes” in the list. For example, these server configuration values do not have holes:应选择允许的协议，以免在列表中留下“漏洞”。例如，这些服务器配置值没有漏洞：

tls_version=TLSv1,TLSv1.1,TLSv1.2,TLSv1.3
tls_version=TLSv1.1,TLSv1.2,TLSv1.3
tls_version=TLSv1.2,TLSv1.3
tls_version=TLSv1.3

These values do have holes and should not be used:这些值确实有孔，不应使用：

tls_version=TLSv1,TLSv1.2       (TLSv1.1 is missing)
tls_version=TLSv1.1,TLSv1.3     (TLSv1.2 is missing)

The prohibition on holes also applies in other configuration contexts, such as for clients or replicas.对漏洞的禁止也适用于其他配置环境，例如客户端或副本。

Unless you intend to disable encrypted connections, the list of permitted protocols should not be empty. If you set a TLS version parameter to the empty string, encrypted connections cannot be established:除非您打算禁用加密连接，否则允许的协议列表不应为空。如果将TLS版本参数设置为空字符串，则无法建立加密连接：

As of MySQL 8.0.26, the TLSv1 and TLSv1.1 connection protocols are deprecated and support for them is subject to removal in a future MySQL version. 从MySQL 8.0.26开始，TLSv1和TLSv1.1连接协议已弃用，在未来的MySQL版本中可能会删除对它们的支持。(For background, refer to the IETF memo Deprecating TLSv1.0 and TLSv1.1.) （有关背景，请参阅IETF备忘录《弃用TLSv1.0和TLSv1.1》。）It is recommended that connections be made using the more-secure TLSv1.2 and TLSv1.3 protocols. TLSv1.3 requires that both the MySQL server and the client application be compiled with OpenSSL 1.1.1 or higher.建议使用更安全的TLSv1.2和TLSv1.3协议进行连接。TLSv1.3要求MySQL服务器和客户端应用程序都使用OpenSSL 1.1.1或更高版本进行编译。

On the server side, this deprecation has the following effects:在服务器端，这种弃用具有以下影响：

On the client side, the deprecation has no visible effect. Clients do not issue a warning if configured to permit a deprecated TLS protocol. This includes:在客户端，弃用没有明显的效果。如果配置为允许弃用的TLS协议，客户端不会发出警告。这包括：

A default set of ciphers applies to encrypted connections, which can be overridden by explicitly configuring the permitted ciphers. During connection establishment, both sides of a connection must permit some cipher in common or the connection fails. 默认密码集适用于加密连接，可以通过显式配置允许的密码来覆盖。在连接建立过程中，连接的双方必须允许一些共同的密码，否则连接将失败。Of the permitted ciphers common to both sides, the SSL library chooses the one supported by the provided certificate that has the highest priority.在双方通用的允许密码中，SSL库选择所提供证书支持的具有最高优先级的密码。

To specify a cipher or ciphers applicable for encrypted connections that use TLS protocols up through TLSv1.2:要指定适用于使用TLS协议至TLSv1.2的加密连接的一个或多个密码：

For encrypted connections that use TLSv1.3, OpenSSL 1.1.1 and higher supports the following ciphersuites, the first three of which are enabled by default:对于使用TLSv1.3的加密连接，OpenSSL 1.1.1和更高版本支持以下密码套件，默认情况下启用前三个密码套件：

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256
TLS_AES_128_CCM_8_SHA256

To configure the permitted TLSv1.3 ciphersuites explicitly, set the following parameters. In each case, the configuration value is a list of zero or more colon-separated ciphersuite names.要显式配置允许的TLSv1.3密码套件，请设置以下参数。在每种情况下，配置值都是零个或多个冒号分隔的密码套件名称的列表。

A given cipher may work only with particular TLS protocols, which affects the TLS protocol negotiation process. 给定的密码可能只适用于特定的TLS协议，这会影响TLS协议协商过程。See Connection TLS Protocol Negotiation.请参阅连接TLS协议协商。

To determine which ciphers a given server supports, check the session value of the Ssl_cipher_list status variable:要确定给定服务器支持哪些密码，请检查Ssl_cipher_list状态变量的会话值：

SHOW SESSION STATUS LIKE 'Ssl_cipher_list';

The Ssl_cipher_list status variable lists the possible SSL ciphers (empty for non-SSL connections). Ssl_cipher_list状态变量列出了可能的Ssl密码（非Ssl连接为空）。If MySQL supports TLSv1.3, the value includes the possible TLSv1.3 ciphersuites.如果MySQL支持TLSv1.3，则该值包括可能的TLSv1.3密码套件。

For encrypted connections that use TLS.v1.3, MySQL uses the SSL library default ciphersuite list.对于使用TLSv1.3的加密连接，MySQL使用SSL库默认密码套件列表。

For encrypted connections that use TLS protocols up through TLSv1.2, MySQL passes the following default cipher list to the SSL library.对于通过TLSv1.2使用TLS协议的加密连接，MySQL会将以下默认密码列表传递给SSL库。

ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-ECDSA-AES256-SHA384
ECDHE-RSA-AES256-SHA384
DHE-RSA-AES128-GCM-SHA256
DHE-DSS-AES128-GCM-SHA256
DHE-RSA-AES128-SHA256
DHE-DSS-AES128-SHA256
DHE-DSS-AES256-GCM-SHA384
DHE-RSA-AES256-SHA256
DHE-DSS-AES256-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES128-SHA
DHE-RSA-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
DHE-RSA-AES256-SHA
AES128-GCM-SHA256
DH-DSS-AES128-GCM-SHA256
ECDH-ECDSA-AES128-GCM-SHA256
AES256-GCM-SHA384
DH-DSS-AES256-GCM-SHA384
ECDH-ECDSA-AES256-GCM-SHA384
AES128-SHA256
DH-DSS-AES128-SHA256
ECDH-ECDSA-AES128-SHA256
AES256-SHA256
DH-DSS-AES256-SHA256
ECDH-ECDSA-AES256-SHA384
AES128-SHA
DH-DSS-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES256-SHA
DH-DSS-AES256-SHA
ECDH-ECDSA-AES256-SHA
DHE-RSA-AES256-GCM-SHA384
DH-RSA-AES128-GCM-SHA256
ECDH-RSA-AES128-GCM-SHA256
DH-RSA-AES256-GCM-SHA384
ECDH-RSA-AES256-GCM-SHA384
DH-RSA-AES128-SHA256
ECDH-RSA-AES128-SHA256
DH-RSA-AES256-SHA256
ECDH-RSA-AES256-SHA384
ECDHE-RSA-AES128-SHA
ECDHE-ECDSA-AES128-SHA
ECDHE-RSA-AES256-SHA
ECDHE-ECDSA-AES256-SHA
DHE-DSS-AES128-SHA
DHE-RSA-AES128-SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
DHE-RSA-AES256-SHA
AES128-SHA
DH-DSS-AES128-SHA
ECDH-ECDSA-AES128-SHA
AES256-SHA
DH-DSS-AES256-SHA
ECDH-ECDSA-AES256-SHA
DH-RSA-AES128-SHA
ECDH-RSA-AES128-SHA
DH-RSA-AES256-SHA
ECDH-RSA-AES256-SHA
DES-CBC3-SHA

These cipher restrictions are in place:这些密码限制已经到位：

If the server is started with the ssl_cert system variable set to a certificate that uses any of the preceding restricted ciphers or cipher categories, the server starts with support for encrypted connections disabled.如果服务器启动时ssl_cert系统变量设置为使用任何前述受限密码或密码类别的证书，则服务器启动时将禁用对加密连接的支持。

Connection attempts in MySQL negotiate use of the highest TLS protocol version available on both sides for which a protocol-compatible encryption cipher is available on both sides. The negotiation process depends on factors such as the SSL library used to compile the server and client, the TLS protocol and encryption cipher configuration, and which key size is used:MySQL中的连接尝试协商使用双方可用的最高TLS协议版本，双方都有协议兼容的加密密码。协商过程取决于多种因素，如用于编译服务器和客户端的SSL库、TLS协议和加密密码配置，以及使用的密钥大小：

If the server and client do not have a permitted protocol in common, and a protocol-compatible cipher in common, the server terminates the connection request. Examples:如果服务器和客户端没有共同的许可协议，也没有共同的协议兼容密码，则服务器终止连接请求。示例：

MySQL permits specifying a list of protocols to support. This list is passed directly down to the underlying SSL library and is ultimately up to that library what protocols it actually enables from the supplied list. MySQL允许指定要支持的协议列表。此列表直接传递给底层SSL库，并最终取决于该库从提供的列表中实际启用的协议。Please refer to the MySQL source code and the OpenSSL SSL_CTX_new() documentation for information about how the SSL library handles this.有关SSL库如何处理此问题的信息，请参阅MySQL源代码和OpenSSL SSL_CTX_new()文档。

To determine which encryption TLS protocol and cipher the current client session uses, check the session values of the Ssl_version and Ssl_cipher status variables:要确定当前客户端会话使用哪种加密TLS协议和密码，请检查Ssl_version和Ssl_cipher状态变量的会话值：

mysql> SELECT * FROM performance_schema.session_status
WHERE VARIABLE_NAME IN ('Ssl_version','Ssl_cipher');
+---------------+---------------------------+
| VARIABLE_NAME | VARIABLE_VALUE            |
+---------------+---------------------------+
| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |
| Ssl_version   | TLSv1.2                   |
+---------------+---------------------------+

If the connection is not encrypted, both variables have an empty value.如果连接未加密，则两个变量都有空值。