要要求客户端使用加密连接，请启用require_secure_transport系统变量。请参阅配置加密连接为必需。To require that clients connect using encrypted connections, enable the require_secure_transport system variable. See Configuring Encrypted Connections as Mandatory.

服务器端的这些系统变量指定了服务器在允许客户端建立加密连接时使用的证书和密钥文件：These system variables on the server side specify the certificate and key files the server uses when permitting clients to establish encrypted connections:

例如，要启用服务器的加密连接，请在 my.cnf 文件中使用以下行启动它，并根据需要更改文件名：For example, to enable the server for encrypted connections, start it with these lines in the my.cnf file, changing the file names as necessary:

[mysqld]
ssl_ca=ca.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem

此外，如果要指定客户端必须使用加密连接，请启用 require_secure_transport 系统变量：To specify in addition that clients are required to use encrypted connections, enable the require_secure_transport system variable:

[mysqld]
ssl_ca=ca.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem
require_secure_transport=ON

每个证书和密钥系统变量都指定一个 PEM 格式的文件。如果您需要创建所需的证书和密钥文件，请参见 第 8.3.3 节，“创建 SSL 和 RSA 证书及密钥”。使用 OpenSSL 编译的 MySQL 服务器可以在启动时自动生成缺失的证书和密钥文件。请参见 第 8.3.3.1 节，“使用 MySQL 创建 SSL 和 RSA 证书及密钥”。另外，如果您有 MySQL 的源代码发行版，您可以使用其 mysql-test/std_data 目录中的演示证书和密钥文件来测试您的设置。Each certificate and key system variable names a file in PEM format. Should you need to create the required certificate and key files, see Section 8.3.3, “Creating SSL and RSA Certificates and Keys”. MySQL servers compiled using OpenSSL can generate missing certificate and key files automatically at startup. See Section 8.3.3.1, “Creating SSL and RSA Certificates and Keys using MySQL”. Alternatively, if you have a MySQL source distribution, you can test your setup using the demonstration certificate and key files in its mysql-test/std_data directory.

服务器执行证书和密钥文件的自动发现。如果没有提供显式的加密连接选项来配置加密连接，服务器会在启动时尝试自动启用加密连接支持：The server performs certificate and key file autodiscovery. If no explicit encrypted-connection options are given to configure encrypted connections, the server attempts to enable encrypted-connection support automatically at startup:

如果服务器自动启用加密连接支持，它会在错误日志中写入一条说明。如果服务器发现 CA 证书是自签名的，它会在错误日志中写入警告。（如果证书是由服务器自动创建的，则为自签名证书。）If the server automatically enables encrypted connection support, it writes a note to the error log. If the server discovers that the CA certificate is self-signed, it writes a warning to the error log. (The certificate is self-signed if created automatically by the server.)

MySQL 还提供了这些用于服务器端加密连接控制的系统变量：MySQL also provides these system variables for server-side encrypted-connection control:

如果服务器无法从系统变量为服务器端加密连接控制创建有效的 TLS 上下文，则服务器将执行而不支持加密连接。If the server cannot create a valid TLS context from the system variables for server-side encrypted-connection control, the server executes without support for encrypted connections.

tls_xxx 和 ssl_xxx 系统变量是动态的，可以在运行时设置，而不仅仅是在启动时设置。如果使用 SET GLOBAL 进行更改，新值仅在服务器重启前生效。如果使用 SET PERSIST 进行更改，新值在随后的服务器重启后也会保留。参见 第 15.7.6.1 节，“SET 变量赋值语法”。然而，对这些变量的运行时更改不会立即影响新连接的 TLS 上下文，如本节后面所述。The tls_xxx and ssl_xxx system variables are dynamic and can be set at runtime, not just at startup. If changed with SET GLOBAL, the new values apply only until server restart. If changed with SET PERSIST, the new values also carry over to subsequent server restarts. See Section 15.7.6.1, “SET Syntax for Variable Assignment”. However, runtime changes to these variables do not immediately affect the TLS context for new connections, as explained later in this section.

随着允许在运行时更改 TLS 上下文相关系统变量的功能的引入，服务器还支持对用于新连接的实际 TLS 上下文进行运行时更新。例如，这一功能可能有助于在 MySQL 服务器运行时间过长导致 SSL 证书过期时，避免重启服务器。Along with the change that enables runtime changes to the TLS context-related system variables, the server enables runtime updates to the actual TLS context used for new connections. This capability may be useful, for example, to avoid restarting a MySQL server that has been running so long that its SSL certificate has expired.

为了创建初始 TLS 上下文，服务器使用启动时上下文相关系统变量的值。为了公开上下文值，服务器还初始化了一组对应的状态变量。下表显示了定义 TLS 上下文的系统变量以及用于公开当前活动上下文值的对应状态变量。To create the initial TLS context, the server uses the values that the context-related system variables have at startup. To expose the context values, the server also initializes a set of corresponding status variables. The following table shows the system variables that define the TLS context and the corresponding status variables that expose the currently active context values.

这些活动的 TLS 上下文值也作为属性在性能模式 tls_channel_status 表中公开，以及任何其他活动 TLS 上下文的属性。Those active TLS context values are also exposed as properties in the Performance Schema tls_channel_status table, along with the properties for any other active TLS contexts.

要在运行时重新配置 TLS 上下文，请使用以下步骤：To reconfigure the TLS context at runtime, use this procedure:

由于重配置过程的工作方式，每对系统变量和状态变量的成员可能暂时具有不同的值：The members of each pair of system and status variables may have different values temporarily due to the way the reconfiguration procedure works:

在某些情况下，仅执行 ALTER INSTANCE RELOAD TLS 就可能足以重新配置 TLS 上下文，而无需更改任何系统变量。假设由 ssl_cert 指定的文件中的证书已过期。只需用未过期的证书替换现有文件内容，并执行 ALTER INSTANCE RELOAD TLS，便可使新文件内容被读取并用于新连接。In some cases, ALTER INSTANCE RELOAD TLS by itself may suffice to reconfigure the TLS context, without changing any system variables. Suppose that the certificate in the file named by ssl_cert has expired. It is sufficient to replace the existing file contents with a nonexpired certificate and execute ALTER INSTANCE RELOAD TLS to cause the new file contents to be read and used for new connections.

服务器为管理连接接口实现了独立的连接加密配置。请参见 管理接口对加密连接的支持。此外，ALTER INSTANCE RELOAD TLS 被扩展了一个 FOR CHANNEL 子句，可用于指定要重新加载 TLS 上下文的通道（接口）。请参见 第 15.1.5 节，“ALTER INSTANCE 语句”。没有状态变量来显示管理接口的 TLS 上下文，但性能模式 tls_channel_status 表显示主接口和管理接口的 TLS 属性。请参见 第 29.12.22.9 节，“tls_channel_status 表”。The server implements independent connection-encryption configuration for the administrative connection interface. See Administrative Interface Support for Encrypted Connections. In addition, ALTER INSTANCE RELOAD TLS is extended with a FOR CHANNEL clause that enables specifying the channel (interface) for which to reload the TLS context. See Section 15.1.5, “ALTER INSTANCE Statement”. There are no status variables to expose the administrative interface TLS context, but the Performance Schema tls_channel_status table exposes TLS properties for both the main and administrative interfaces. See Section 29.12.22.9, “The tls_channel_status Table”.

更新主界面 TLS 上下文具有以下影响：Updating the main interface TLS context has these effects:

默认情况下，如果配置值不允许创建新的 TLS 上下文，RELOAD TLS 操作会回滚并产生错误，且不会生效。新的连接将继续使用之前的上下文值。如果提供了可选的 NO ROLLBACK ON ERROR 子句且无法创建新的上下文，则不会回滚。相反，会生成警告，并且针对语句应用的接口上的新连接将禁用加密。By default, the RELOAD TLS action rolls back with an error and has no effect if the configuration values do not permit creation of the new TLS context. The previous context values continue to be used for new connections. If the optional NO ROLLBACK ON ERROR clause is given and the new context cannot be created, rollback does not occur. Instead, a warning is generated and encryption is disabled for new connections on the interface to which the statement applies.

在连接接口上启用或禁用加密连接的选项仅在启动时生效。例如，--tls-version 和 --admin-tls-version 选项仅在启动时影响主接口和管理接口是否支持这些 TLS 版本。此类选项在运行时会被忽略，对 ALTER INSTANCE RELOAD TLS 的操作没有影响。例如，你可以设置 tls_version='' 来在主接口上禁用加密连接启动服务器，然后重新配置 TLS 并执行 ALTER INSTANCE RELOAD TLS，以在运行时启用加密连接。Options that enable or disable encrypted connections on a connection interface have an effect only at startup. For example, the --tls-version and --admin-tls-version options affect only at startup whether the main and administrative interfaces support those TLS versions. Such options are ignored and have no effect on the operation of ALTER INSTANCE RELOAD TLS at runtime. For example, you can set tls_version='' to start the server with encrypted connections disabled on the main interface, then reconfigure TLS and execute ALTER INSTANCE RELOAD TLS to enable encrypted connections at runtime.

有关建立加密连接的客户端选项的完整列表，请参见 加密连接的命令选项。For a complete list of client options related to establishment of encrypted connections, see Command Options for Encrypted Connections.

默认情况下，如果服务器支持加密连接，MySQL 客户端程序会尝试建立加密连接，并且可以通过 --ssl-mode 选项进行进一步控制：By default, MySQL client programs attempt to establish an encrypted connection if the server supports encrypted connections, with further control available through the --ssl-mode option:

如果服务器端启用了 require_secure_transport 系统变量以要求加密连接，则尝试建立未加密连接将失败。请参阅 将加密连接配置为强制。Attempts to establish an unencrypted connection fail if the require_secure_transport system variable is enabled on the server side to cause the server to require encrypted connections. See Configuring Encrypted Connections as Mandatory.

客户端的以下选项用于识别客户端在与服务器建立加密连接时使用的证书和密钥文件。它们类似于服务器端使用的 ssl_ca、ssl_cert 和 ssl_key 系统变量，但 --ssl-cert 和 --ssl-key 用于识别客户端的公钥和私钥：The following options on the client side identify the certificate and key files clients use when establishing encrypted connections to the server. They are similar to the ssl_ca, ssl_cert, and ssl_key system variables used on the server side, but --ssl-cert and --ssl-key identify the client public and private key:

为了比默认加密提供的安全性更高，客户端可以提供与服务器使用的相匹配的 CA 证书并启用主机名身份验证。通过这种方式，服务器和客户端对相同的 CA 证书建立信任，并且客户端验证其连接的主机是否为目标主机:For additional security relative to that provided by the default encryption, clients can supply a CA certificate matching the one used by the server and enable host name identity verification. In this way, the server and client place their trust in the same CA certificate and the client verifies that the host to which it connected is the one intended:

MySQL 还为客户端加密连接控制提供这些选项：MySQL also provides these options for client-side encrypted-connection control:

根据客户端所使用的 MySQL 账户的加密要求，客户端可能需要指定某些选项，以便使用加密连接到 MySQL 服务器。Depending on the encryption requirements of the MySQL account used by a client, the client may be required to specify certain options to connect using encryption to the MySQL server.

假设您想使用一个没有特殊加密要求的账户，或者使用包含 REQUIRE SSL 子句的 CREATE USER 语句创建的账户进行连接。假设服务器支持加密连接，客户端可以在没有 --ssl-mode 选项的情况下使用加密连接，也可以显式使用 --ssl-mode=PREFERRED 选项：Suppose that you want to connect using an account that has no special encryption requirements or that was created using a CREATE USER statement that included the REQUIRE SSL clause. Assuming that the server supports encrypted connections, a client can connect using encryption with no --ssl-mode option or with an explicit --ssl-mode=PREFERRED option:

mysql

或者：Or:

mysql --ssl-mode=PREFERRED

对于使用 REQUIRE SSL 子句创建的账户，如果无法建立加密连接，则连接尝试将失败。对于没有特殊加密要求的账户，如果无法建立加密连接，连接将回退到非加密连接。为了防止回退并在无法获得加密连接时失败，可以这样连接：For an account created with a REQUIRE SSL clause, the connection attempt fails if an encrypted connection cannot be established. For an account with no special encryption requirements, the attempt falls back to an unencrypted connection if an encrypted connection cannot be established. To prevent fallback and fail if an encrypted connection cannot be obtained, connect like this:

mysql --ssl-mode=REQUIRED

如果该账户有更严格的安全要求，则必须指定其他选项以建立加密连接：If the account has more stringent security requirements, other options must be specified to establish an encrypted connection:

有关 REQUIRE 子句的更多信息，请参见 第 15.7.1.3 节，“CREATE USER 语句”。For additional information about the REQUIRE clause, see Section 15.7.1.3, “CREATE USER Statement”.

MySQL 服务器可以生成客户端证书和密钥文件，客户端可以使用这些文件连接到 MySQL 服务器实例。请参见 第 8.3.3 节，“创建 SSL 和 RSA 证书及密钥”。MySQL servers can generate client certificate and key files that clients can use to connect to MySQL server instances. See Section 8.3.3, “Creating SSL and RSA Certificates and Keys”.

为了防止使用加密并覆盖其他 --ssl-xxx 选项，请使用 --ssl-mode=DISABLED 调用客户端程序：To prevent use of encryption and override other --ssl-xxx options, invoke the client program with --ssl-mode=DISABLED:

mysql --ssl-mode=DISABLED

要确定当前与服务器的连接是否使用加密，请检查 Ssl_cipher 状态变量的会话值。如果该值为空，说明连接未加密。否则，连接是加密的，该值表示加密算法。例如：To determine whether the current connection with the server uses encryption, check the session value of the Ssl_cipher status variable. If the value is empty, the connection is not encrypted. Otherwise, the connection is encrypted and the value indicates the encryption cipher. For example:

mysql> SHOW SESSION STATUS LIKE 'Ssl_cipher';
+---------------+---------------------------+
| Variable_name | Value                     |
+---------------+---------------------------+
| Ssl_cipher    | DHE-RSA-AES128-GCM-SHA256 |
+---------------+---------------------------+

对于 mysql 客户端，一种替代方式是使用 STATUS 或 \s 命令，并检查 SSL 行：For the mysql client, an alternative is to use the STATUS or \s command and check the SSL line:

mysql> \s
...
SSL: Not in use
...

或者：Or:

mysql> \s
...
SSL: Cipher in use is DHE-RSA-AES128-GCM-SHA256
...

--tls-certificates-enforced-validation 选项启用在服务器启动时验证服务器公钥证书文件、证书颁发机构 (CA) 证书文件以及证书吊销列表文件：The --tls-certificates-enforced-validation option enables validation of the server public key certificate file, Certificate Authority (CA) certificate files, and certificate revocation-list files at server startup:

mysqld --tls-certificates-enforced-validation

如果设置为ON，服务器在遇到无效证书时会停止启动执行。服务器会通过提供有效的调试信息、错误信息或两者兼有的方式通知数据库管理员，具体取决于证书的状态。例如，这个功能可能很有用，用于避免重启已经运行时间过长而 SSL 证书已过期的 MySQL 服务器。If set to ON, the server stops execution of the startup in case of invalid certificates. The server informs DBAs by providing valid debug messages, error messages, or both depending on the status of the certificates. This capability may be useful, for example, to avoid restarting a MySQL server that has been running so long that its SSL certificate has expired.

同样，当您执行 ALTER INSTANCE RELOAD TLS 语句以在运行时更改 TLS 上下文时，如果验证失败，将不会使用新的服务器和 CA 证书文件。在这种情况下，服务器将继续使用旧的证书。有关动态更改 TLS 上下文的更多信息，请参阅 加密连接的服务器端运行时配置和监控。Similarly, when you execute the ALTER INSTANCE RELOAD TLS statement to change the TLS context at runtime, the new server and CA certificate files are not used if validation fails. The server continues to use the old certificates in this case. For more information about changing the TLS context dynamically, see Server-Side Runtime Configuration and Monitoring for Encrypted Connections.

验证 CA 证书Validating CA Certificates

对于使用服务器主接口的连接：For a connection using the server main interface:

对于使用服务器管理界面的连接：For a connection using the server administrative interface:

验证服务器证书Validating the Server Certificate

对于使用服务器主接口的连接：For a connection using the server main interface:

对于使用服务器管理界面的连接：For a connection using the server administrative interface:

对于某些 MySQL 部署，使用加密连接可能不仅是可取的，而且是强制性的（例如，为了满足法规要求）。本节讨论了允许你实现此功能的配置设置。这些控制级别包括：For some MySQL deployments it may be not only desirable but mandatory to use encrypted connections (for example, to satisfy regulatory requirements). This section discusses configuration settings that enable you to do this. These levels of control are available:

要要求客户端使用加密连接，请启用require_secure_transport 系统变量。例如，在服务器 my.cnf 文件中添加以下行：To require that clients connect using encrypted connections, enable the require_secure_transport system variable. For example, put these lines in the server my.cnf file:

[mysqld]
require_secure_transport=ON

或者，要在运行时设置并保持该值，请使用以下语句：Alternatively, to set and persist the value at runtime, use this statement:

SET PERSIST require_secure_transport=ON;

SET PERSIST 为正在运行的 MySQL 实例设置一个值。它还会保存该值，使其在后续服务器重启时继续使用。参见 第 15.7.6.1 节，“变量赋值的 SET 语法”。SET PERSIST sets a value for the running MySQL instance. It also saves the value, causing it to be used for subsequent server restarts. See Section 15.7.6.1, “SET Syntax for Variable Assignment”.

启用 require_secure_transport 后，客户端连接到服务器时必须使用某种形式的安全传输，并且服务器只允许使用 SSL 的 TCP/IP 连接，或者使用套接字文件（在 Unix 上）或共享内存（在 Windows 上）的连接。服务器会拒绝不安全的连接尝试，这些尝试会以 ER_SECURE_TRANSPORT_REQUIRED 错误失败。With require_secure_transport enabled, client connections to the server are required to use some form of secure transport, and the server permits only TCP/IP connections that use SSL, or connections that use a socket file (on Unix) or shared memory (on Windows). The server rejects nonsecure connection attempts, which fail with an ER_SECURE_TRANSPORT_REQUIRED error.

要调用客户端程序，使其无论服务器是否要求加密都需要加密连接，请使用 --ssl-mode 选项值为 REQUIRED、VERIFY_CA 或 VERIFY_IDENTITY。例如：To invoke a client program such that it requires an encrypted connection whether or not the server requires encryption, use an --ssl-mode option value of REQUIRED, VERIFY_CA, or VERIFY_IDENTITY. For example:

mysql --ssl-mode=REQUIRED
mysqldump --ssl-mode=VERIFY_CA
mysqladmin --ssl-mode=VERIFY_IDENTITY

要配置 MySQL 帐户仅能通过加密连接使用，请在创建该帐户的 CREATE USER 语句中包含 REQUIRE 子句，在该子句中指定所需的加密特性。例如，要要求加密连接并使用有效的 X.509 证书，请使用 REQUIRE X509：To configure a MySQL account to be usable only over encrypted connections, include a REQUIRE clause in the CREATE USER statement that creates the account, specifying in that clause the encryption characteristics you require. For example, to require an encrypted connection and the use of a valid X.509 certificate, use REQUIRE X509:

CREATE USER 'jeffrey'@'localhost' REQUIRE X509;

有关 REQUIRE 子句的更多信息，请参见 第 15.7.1.3 节，“CREATE USER 语句”。For additional information about the REQUIRE clause, see Section 15.7.1.3, “CREATE USER Statement”.

要修改没有加密要求的现有账户，请使用ALTER USER 语句。To modify existing accounts that have no encryption requirements, use the ALTER USER statement.