在 MySQL 客户端与服务器之间使用未加密的连接时，任何能够访问网络的人都可以监视您所有的流量，并查看客户端与服务器之间发送或接收的数据。With an unencrypted connection between the MySQL client and the server, someone with access to the network could watch all your traffic and inspect the data being sent or received between client and server.

当您必须以安全的方式在网络上传输信息时，未加密的连接是不可接受的。为了使任何类型的数据不可读，应使用加密。加密算法必须包含安全元素，以抵御多种已知攻击，例如更改加密消息的顺序或重复发送数据。When you must move information over a network in a secure fashion, an unencrypted connection is unacceptable. To make any kind of data unreadable, use encryption. Encryption algorithms must include security elements to resist many kinds of known attacks such as changing the order of encrypted messages or replaying data twice.

MySQL 支持使用 TLS（传输层安全）协议在客户端和服务器之间建立加密连接。TLS 有时被称为 SSL（安全套接字层），但 MySQL 实际上并不使用 SSL 协议进行加密连接，因为其加密较弱（参见 第 8.3.2 节，“加密连接 TLS 协议和加密方式”）。MySQL supports encrypted connections between clients and the server using the TLS (Transport Layer Security) protocol. TLS is sometimes referred to as SSL (Secure Sockets Layer) but MySQL does not actually use the SSL protocol for encrypted connections because its encryption is weak (see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”).

TLS 使用加密算法来确保通过公共网络接收的数据是可信的。它具有检测数据更改、丢失或重放的机制。TLS 还结合了使用 X.509 标准提供身份验证的算法。TLS uses encryption algorithms to ensure that data received over a public network can be trusted. It has mechanisms to detect data change, loss, or replay. TLS also incorporates algorithms that provide identity verification using the X.509 standard.

X.509 使在互联网上识别某人成为可能。基本来说，应该有一个被称为 “证书颁发机构”（或 CA）的实体，向需要的人分配电子证书。证书依赖于具有两个加密密钥（公钥和私钥）的非对称加密算法。证书所有者可以向另一方出示证书以证明身份。证书包括其所有者的公钥。使用该公钥加密的任何数据只能使用相应的私钥解密，而该私钥由证书所有者持有。X.509 makes it possible to identify someone on the Internet. In basic terms, there should be some entity called a “Certificate Authority” (or CA) that assigns electronic certificates to anyone who needs them. Certificates rely on asymmetric encryption algorithms that have two encryption keys (a public key and a secret key). A certificate owner can present the certificate to another party as proof of identity. A certificate consists of its owner's public key. Any data encrypted using this public key can be decrypted only using the corresponding secret key, which is held by the owner of the certificate.

MySQL 对加密连接的支持是通过使用 OpenSSL 提供的。有关 OpenSSL 支持的加密协议和密码的信息，请参见 第 8.3.2 节，“加密连接 TLS 协议和密码”。Support for encrypted connections in MySQL is provided using OpenSSL. For information about the encryption protocols and ciphers that OpenSSL supports, see Section 8.3.2, “Encrypted Connection TLS Protocols and Ciphers”.

默认情况下，MySQL 实例在运行时会链接到可用的已安装 OpenSSL 库，以支持加密连接和其他与加密相关的操作。您可以从源码编译 MySQL 并使用 WITH_SSL CMake 选项来指定特定已安装的 OpenSSL 版本或替代的 OpenSSL 系统包的路径。在这种情况下，MySQL 会选择该版本。有关此操作的说明，请参阅 第 2.8.6 节，“配置 SSL 库支持”。By default, MySQL instances link to an available installed OpenSSL library at runtime for support of encrypted connections and other encryption-related operations. You may compile MySQL from source and use the WITH_SSL CMake option to specify the path to a particular installed OpenSSL version or an alternative OpenSSL system package. In that case, MySQL selects that version. For instructions to do this, see Section 2.8.6, “Configuring SSL Library Support”.

您可以使用 Tls_library_version 系统状态变量检查运行时使用的 OpenSSL 库版本。You can check what version of the OpenSSL library is in use at runtime using the Tls_library_version system status variable.

如果您使用某个版本的 OpenSSL 编译了 MySQL，但想在不重新编译的情况下更换到另一个版本，可以通过编辑动态库加载器路径（Unix 系统上的 LD_LIBRARY_PATH 或 Windows 系统上的 PATH）来实现。删除编译版本 OpenSSL 的路径，并添加替换版本的路径，并将其置于路径中任何其他 OpenSSL 库之前。启动时，如果 MySQL 在路径上找不到使用 WITH_SSL 指定的 OpenSSL 版本，它会改用路径上指定的第一个版本。If you compile MySQL with one version of OpenSSL and want to change to a different version without recompiling, you may do this by editing the dynamic library loader path (LD_LIBRARY_PATH on Unix systems or PATH on Windows systems). Remove the path to the compiled version of OpenSSL, and add the path to the replacement version, placing it before any other OpenSSL libraries on the path. At startup, when MySQL cannot find the version of OpenSSL specified with WITH_SSL on the path, it uses the first version specified on the path instead.

默认情况下，如果服务器支持加密连接，MySQL 程序会尝试使用加密进行连接；如果无法建立加密连接，则会回退到未加密连接。有关影响加密连接使用的选项的信息，请参阅 第 8.3.1 节，“配置 MySQL 使用加密连接” 和 加密连接的命令选项。By default, MySQL programs attempt to connect using encryption if the server supports encrypted connections, falling back to an unencrypted connection if an encrypted connection cannot be established. For information about options that affect use of encrypted connections, see Section 8.3.1, “Configuring MySQL to Use Encrypted Connections” and Command Options for Encrypted Connections.

MySQL 对每个连接执行加密，并且对特定用户使用加密可以是可选的或强制的。这使您可以根据各个应用程序的需求选择加密或未加密的连接。有关如何要求用户使用加密连接的信息，请参阅 第 15.7.1.3 节，“CREATE USER 语句” 中 CREATE USER 语句的 REQUIRE 子句的讨论。另请参阅 第 7.1.8 节，“服务器系统变量” 中 require_secure_transport 系统变量的描述。MySQL performs encryption on a per-connection basis, and use of encryption for a given user can be optional or mandatory. This enables you to choose an encrypted or unencrypted connection according to the requirements of individual applications. For information on how to require users to use encrypted connections, see the discussion of the REQUIRE clause of the CREATE USER statement in Section 15.7.1.3, “CREATE USER Statement”. See also the description of the require_secure_transport system variable at Section 7.1.8, “Server System Variables”

可以在源服务器和副本服务器之间使用加密连接。请参见第 19.3.1 节，“设置复制以使用加密连接”。Encrypted connections can be used between source and replica servers. See Section 19.3.1, “Setting Up Replication to Use Encrypted Connections”.

有关使用 MySQL C API 的加密连接的信息，请参阅 支持加密连接。For information about using encrypted connections from the MySQL C API, see Support for Encrypted Connections.

也可以通过 SSH 连接到 MySQL 服务器主机时使用加密进行连接。示例请参见第 8.3.4 节，“使用 SSH 从 Windows 远程连接 MySQL”。It is also possible to connect using encryption from within an SSH connection to the MySQL server host. For an example, see Section 8.3.4, “Connecting to MySQL Remotely from Windows with SSH”.