MySQL 8.4 支持用于连接的 TLSv1.2 和 TLSv1.3 协议。要使用 TLSv1.3，MySQL 服务器和客户端应用程序都必须使用 OpenSSL 1.1.1 或更高版本编译。Group Replication 组件从 MySQL 8.0.18 开始支持 TLSv1.3（详情请参见 第 20.6.2 节，“使用安全套接字层 (SSL) 保护组通信连接”）。MySQL 8.4 supports the TLSv1.2 and TLSv1.3 protocols for connections. To use TLSv1.3, both the MySQL server and the client application must be compiled using OpenSSL 1.1.1 or higher. The Group Replication component supports TLSv1.3 from MySQL 8.0.18 (for details, see Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”).

MySQL 8.4 不支持旧的 TLSv1 和 TLSv1.1 协议。MySQL 8.4 does not support the old TLSv1 and TLSv1.1 protocols.

允许的 TLS 协议可以在服务器端和客户端配置，以仅包含支持的 TLS 协议的子集。两端的配置必须至少包含一个共同的协议，否则连接尝试将无法协商使用的协议。有关详细信息，请参见 连接 TLS 协议协商。Permitted TLS protocols can be configured on both the server side and client side to include only a subset of the supported TLS protocols. The configuration on both sides must include at least one protocol in common or connection attempts cannot negotiate a protocol to use. For details, see Connection TLS Protocol Negotiation.

主机系统可能只允许某些 TLS 协议，这意味着即使 MySQL 本身允许，MySQL 连接也无法使用主机不允许的协议。对此问题的可能解决方法包括以下几种：The host system may permit only certain TLS protocols, which means that MySQL connections cannot use protocols not allowed by the host even if MySQL itself permits them. Possible workarounds for this issue include the following:

MySQL 8.0 中已弃用并移除了对 TLSv1 和 TLSv1.1 连接协议的支持。如需背景信息，请参阅 RFC 8996（弃用 TLS 1.0 和 TLS 1.1）。在 MySQL 8.4 中，连接只能使用更安全的 TLSv1.2 和 TLSv1.3 协议。TLSv1.3 要求 MySQL 服务器和客户端应用程序都必须使用 OpenSSL 1.1.1 编译。Support for the TLSv1 and TLSv1.1 connection protocols was deprecated and removed in MySQL 8.0. For background information, refer to RFC 8996 (Deprecating TLS 1.0 and TLS 1.1). In MySQL 8.4, connections can be made using only the more secure TLSv1.2 and TLSv1.3 protocols. TLSv1.3 requires that both the MySQL server and the client application are compiled with OpenSSL 1.1.1.

有关更多信息，请参见 MySQL 8.4 支持 TLS 1.0 和 1.1 吗？For more information, see Does MySQL 8.4 support TLS 1.0 and 1.1?

在服务器端，tls_version 系统变量的值决定 MySQL 服务器允许哪些 TLS 协议用于加密连接。tls_version 的值适用于来自客户端的连接、该服务器实例作为源的常规源/复制连接、组复制组通信连接，以及该服务器实例作为捐赠者的组复制分布式恢复连接。管理连接接口的配置类似，但使用 admin_tls_version 系统变量（参见 第 7.1.12.2 节，“管理连接管理”）。此讨论也同样适用于 admin_tls_version。On the server side, the value of the tls_version system variable determines which TLS protocols a MySQL server permits for encrypted connections. The tls_version value applies to connections from clients, regular source/replica replication connections where this server instance is the source, Group Replication group communication connections, and Group Replication distributed recovery connections where this server instance is the donor. The administrative connection interface is configured similarly, but uses the admin_tls_version system variable (see Section 7.1.12.2, “Administrative Connection Management”). This discussion applies to admin_tls_version as well.

tls_version 的值是一个或多个用逗号分隔的 TLS 协议版本列表，不区分大小写。默认情况下，该变量列出由用于编译 MySQL 的 SSL 库支持以及由 MySQL Server 版本支持的所有协议。因此，默认设置如 MySQL Server TLS 协议默认设置 所示。The tls_version value is a list of one or more comma-separated TLS protocol versions, which is not case-sensitive. By default, this variable lists all protocols that are supported by the SSL library used to compile MySQL and by the MySQL Server release. The default settings are therefore as shown in MySQL Server TLS Protocol Default Settings.

要在运行时确定 tls_version 的值，请使用以下语句：To determine the value of tls_version at runtime, use this statement:

mysql> SHOW GLOBAL VARIABLES LIKE 'tls_version';
+---------------+-----------------------+
| Variable_name | Value                 |
+---------------+-----------------------+
| tls_version   | TLSv1.2,TLSv1.3       |
+---------------+-----------------------+

要更改 tls_version 的值，请在服务器启动时设置。例如，要允许使用 TLSv1.2 或 TLSv1.3 协议的连接，但禁止使用任何其他协议的连接，请在服务器的 my.cnf 文件中使用以下行：To change the value of tls_version, set it at server startup. For example, to permit connections that use the TLSv1.2 or TLSv1.3 protocol, but prohibit connections that use any other protocol, use these lines in the server my.cnf file:

[mysqld]
tls_version=TLSv1.2,TLSv1.3

要更严格，仅允许 TLSv1.3 连接，请按如下方式设置 tls_version：To be even more restrictive and permit only TLSv1.3 connections, set tls_version like this:

[mysqld]
tls_version=TLSv1.3

tls_version 可以在运行时更改。请参阅 服务器端加密连接的运行时配置和监控。tls_version can be changed at runtime. See Server-Side Runtime Configuration and Monitoring for Encrypted Connections.

在客户端，--tls-version 选项指定客户端程序允许用于与服务器连接的 TLS 协议。该选项值的格式与之前描述的 tls_version 系统变量相同（一个或多个逗号分隔的协议版本列表）。On the client side, the --tls-version option specifies which TLS protocols a client program permits for connections to the server. The format of the option value is the same as for the tls_version system variable described previously (a list of one or more comma-separated protocol versions).

对于源/副本复制连接，当此服务器实例为副本时，SOURCE_TLS_VERSION 选项用于 CHANGE REPLICATION SOURCE TO 语句，它指定副本允许与源连接所使用的 TLS 协议。此选项值的格式与前面描述的 tls_version 系统变量相同。请参见 第 19.3.1 节，“设置复制以使用加密连接”。For source/replica replication connections where this server instance is the replica, the SOURCE_TLS_VERSION option for the CHANGE REPLICATION SOURCE TO statement specifies which TLS protocols the replica permits for connections to the source. The format of the option value is the same as for the tls_version system variable described previously. See Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”.

可以为 SOURCE_TLS_VERSION 指定的协议取决于 SSL 库。此选项是独立的，并且不受服务器 tls_version 值的影响。例如，一个充当副本的服务器可以配置 tls_version 为 TLSv1.3，从而仅允许使用 TLSv1.3 的传入连接，但也可以将 SOURCE_TLS_VERSION 配置为 TLSv1.2，以仅允许对源服务器的传出副本连接使用 TLSv1.2。The protocols that can be specified for SOURCE_TLS_VERSION depend on the SSL library. This option is independent of and not affected by the server tls_version value. For example, a server that acts as a replica can be configured with tls_version set to TLSv1.3 to permit only incoming connections that use TLSv1.3, but also configured with SOURCE_TLS_VERSION set to TLSv1.2 to permit only TLSv1.2 for outgoing replica connections to the source.

对于 Group Replication 分布式恢复连接，如果此服务器实例是发起分布式恢复（即客户端）的加入成员，group_replication_recovery_tls_version 系统变量指定客户端允许使用的协议。同样，该选项独立于且不受服务器 tls_version 值的影响，后者适用于此服务器实例作为捐赠者时。Group Replication 服务器通常会在其组成员期间同时作为捐赠者和加入成员参与分布式恢复，因此这两个系统变量都应设置。参见 第 20.6.2 节，“使用安全套接层 (SSL) 保护组通信连接”。For Group Replication distributed recovery connections where this server instance is the joining member that initiates distributed recovery (that is, the client), the group_replication_recovery_tls_version system variable specifies which protocols are permitted by the client. Again, this option is independent of and not affected by the server tls_version value, which applies when this server instance is the donor. A Group Replication server generally participates in distributed recovery both as a donor and as a joining member over the course of its group membership, so both these system variables should be set. See Section 20.6.2, “Securing Group Communication Connections with Secure Socket Layer (SSL)”.

TLS 协议配置会影响给定连接使用的协议，如 连接 TLS 协议协商 中所述。TLS protocol configuration affects which protocol a given connection uses, as described in Connection TLS Protocol Negotiation.

应选择允许的协议，以避免在列表中留下 “漏洞”。例如，以下服务器配置值没有漏洞：Permitted protocols should be chosen such as not to leave “holes” in the list. For example, these server configuration values do not have holes:

tls_version=TLSv1.2,TLSv1.3
tls_version=TLSv1.3

对漏洞的禁止也适用于其他配置环境，例如客户端或副本。The prohibition on holes also applies in other configuration contexts, such as for clients or replicas.

除非您打算禁用加密连接，否则允许的协议列表不应为空。如果将 TLS 版本参数设置为空字符串，则无法建立加密连接：Unless you intend to disable encrypted connections, the list of permitted protocols should not be empty. If you set a TLS version parameter to the empty string, encrypted connections cannot be established:

加密连接默认使用一组密码套件，可以通过显式配置允许的密码套件来覆盖。在建立连接期间，连接的双方都必须允许至少一个共同的密码套件，否则连接将失败。在双方共同允许的密码套件中，SSL 库会选择由提供的证书支持且优先级最高的那个。A default set of ciphers applies to encrypted connections, which can be overridden by explicitly configuring the permitted ciphers. During connection establishment, both sides of a connection must permit some cipher in common or the connection fails. Of the permitted ciphers common to both sides, the SSL library chooses the one supported by the provided certificate that has the highest priority.

要为使用 TLSv1.2 的加密连接指定一个或多个适用的密码套件：To specify a cipher or ciphers applicable for encrypted connections that use TLSv1.2:

对于使用 TLSv1.3 的加密连接，OpenSSL 1.1.1 及更高版本支持以下密码套件，这些密码套件默认启用，可用于服务器系统变量 --tls-ciphersuites 或 --admin-tls-ciphersuites：For encrypted connections that use TLSv1.3, OpenSSL 1.1.1 and higher supports the following ciphersuites, all of which are enabled by default for use with server system variables --tls-ciphersuites or --admin-tls-ciphersuites:

TLS_AES_128_GCM_SHA256
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_CCM_SHA256

要明确配置允许的 TLSv1.3 加密套件，请设置以下参数。在每种情况下，配置值都是一个包含零个或多个以冒号分隔的加密套件名称的列表。To configure the permitted TLSv1.3 ciphersuites explicitly, set the following parameters. In each case, the configuration value is a list of zero or more colon-separated ciphersuite names.

密码套件支持要求 MySQL 服务器和客户端应用程序都使用 OpenSSL 1.1.1 或更高版本编译。Ciphersuite support requires that both the MySQL server and the client application be compiled using OpenSSL 1.1.1 or higher.

给定的密码可能只适用于特定的 TLS 协议，这会影响 TLS 协议协商过程。请参见 连接 TLS 协议协商。A given cipher may work only with particular TLS protocols, which affects the TLS protocol negotiation process. See Connection TLS Protocol Negotiation.

要确定给定服务器支持哪些密码，请检查 Ssl_cipher_list 状态变量的会话值：To determine which ciphers a given server supports, check the session value of the Ssl_cipher_list status variable:

SHOW SESSION STATUS LIKE 'Ssl_cipher_list';

Ssl_cipher_list 状态变量列出了可能的 SSL 密码（非 SSL 连接为空）。如果 MySQL 支持 TLSv1.3，该值包括可能的 TLSv1.3 密码套件。The Ssl_cipher_list status variable lists the possible SSL ciphers (empty for non-SSL connections). If MySQL supports TLSv1.3, the value includes the possible TLSv1.3 ciphersuites.

对于使用 TLS.v1.3 的加密连接，MySQL 使用 SSL 库默认的加密套件列表。For encrypted connections that use TLS.v1.3, MySQL uses the SSL library default ciphersuite list.

对于使用 TLSv1.2 的加密连接，当与服务器系统变量 --ssl-cipher 和 --admin-ssl-cipher 一起使用时，MySQL 会将以下默认密码列表传递给 SSL 库。For encrypted connections that use TLSv1.2, MySQL passes the following default cipher list to the SSL library when used with the server system variables --ssl-cipher and --admin-ssl-cipher.

ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305
ECDHE-RSA-CHACHA20-POLY1305
ECDHE-ECDSA-AES256-CCM
ECDHE-ECDSA-AES128-CCM
DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-CCM
DHE-RSA-AES128-CCM
DHE-RSA-CHACHA20-POLY1305

这些密码限制已到位：These cipher restrictions are in place:

如果服务器在启动时将 ssl_cert 系统变量设置为使用任何前述受限密码或密码类别的证书，则服务器启动时将禁用加密连接支持。If the server is started with the ssl_cert system variable set to a certificate that uses any of the preceding restricted ciphers or cipher categories, the server starts with support for encrypted connections disabled.

MySQL 中的连接尝试会协商使用双方都支持的最高 TLS 协议版本，并且双方都具有兼容的加密密码。协商过程取决于诸如用于编译服务器和客户端的 SSL 库、TLS 协议和加密密码配置以及所使用的密钥大小等因素：Connection attempts in MySQL negotiate use of the highest TLS protocol version available on both sides for which a protocol-compatible encryption cipher is available on both sides. The negotiation process depends on factors such as the SSL library used to compile the server and client, the TLS protocol and encryption cipher configuration, and which key size is used:

如果服务器和客户端没有共同允许的协议，也没有协议兼容的加密算法，服务器将终止连接请求。If the server and client do not have a permitted protocol in common, and a protocol-compatible cipher in common, the server terminates the connection request.

MySQL 允许指定要支持的协议列表。该列表会直接传递给底层的 SSL 库，最终由该库决定从提供的列表中实际启用哪些协议。有关 SSL 库处理方式的信息，请参考 MySQL 源代码以及 OpenSSL 的 SSL_CTX_new() 文档。MySQL permits specifying a list of protocols to support. This list is passed directly down to the underlying SSL library and is ultimately up to that library what protocols it actually enables from the supplied list. Please refer to the MySQL source code and the OpenSSL SSL_CTX_new() documentation for information about how the SSL library handles this.

要确定当前客户端会话使用的加密 TLS 协议和密码，请检查 Ssl_version 和 Ssl_cipher 状态变量的会话值：To determine which encryption TLS protocol and cipher the current client session uses, check the session values of the Ssl_version and Ssl_cipher status variables:

mysql> SELECT * FROM performance_schema.session_status
       WHERE VARIABLE_NAME IN ('Ssl_version','Ssl_cipher');
+---------------+---------------------------+
| VARIABLE_NAME | VARIABLE_VALUE            |
+---------------+---------------------------+
| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |
| Ssl_version   | TLSv1.2                   |
+---------------+---------------------------+

如果连接未加密，两个变量的值都是空的。If the connection is not encrypted, both variables have an empty value.