本节说明如何配置 X 插件以使用加密连接。有关更多背景信息，请参见 第 8.3 节，“使用加密连接”。This section explains how to configure X Plugin to use encrypted connections. For more background information, see Section 8.3, “Using Encrypted Connections”.

为了能够配置对加密连接的支持，X 插件具有 mysqlx_ssl_xxx 系统变量，这些变量的值可能与用于 MySQL Server 的 ssl_xxx 系统变量不同。例如，X 插件可以具有与 MySQL Server 使用的不同的 SSL 密钥、证书和证书颁发机构文件。这些变量在 第 22.5.6.2 节，“X 插件选项和系统变量” 中有描述。同样，X 插件有其自己的 Mysqlx_ssl_xxx 状态变量，对应于 MySQL Server 加密连接的 Ssl_xxx 状态变量。参见 第 22.5.6.3 节，“X 插件状态变量”。To enable configuring support for encrypted connections, X Plugin has mysqlx_ssl_xxx system variables, which can have different values from the ssl_xxx system variables used with MySQL Server. For example, X Plugin can have SSL key, certificate, and certificate authority files that differ from those used for MySQL Server. These variables are described at Section 22.5.6.2, “X Plugin Options and System Variables”. Similarly, X Plugin has its own Mysqlx_ssl_xxx status variables that correspond to the MySQL Server encrypted-connection Ssl_xxx status variables. See Section 22.5.6.3, “X Plugin Status Variables”.

在初始化时，X 插件为加密连接确定其 TLS 上下文，如下所示：At initialization, X Plugin determines its TLS context for encrypted connections as follows:

这意味着，在启用了 X 插件的服务器上，您可以选择通过仅设置 ssl_xxx 变量，让 MySQL 协议和 X 协议连接共享相同的加密配置，或者通过分别配置 ssl_xxx 和 mysqlx_ssl_xxx 变量，为 MySQL 协议和 X 协议连接设置独立的加密配置。This means that, on a server with X Plugin enabled, you can choose to have MySQL Protocol and X Protocol connections share the same encryption configuration by setting only the ssl_xxx variables, or have separate encryption configurations for MySQL Protocol and X Protocol connections by configuring the ssl_xxx and mysqlx_ssl_xxx variables separately.

要让 MySQL 协议和 X 协议连接使用相同的加密配置，只需在 my.cnf 中设置 ssl_xxx 系统变量：To have MySQL Protocol and X Protocol connections use the same encryption configuration, set only the ssl_xxx system variables in my.cnf:

[mysqld]
ssl_ca=ca.pem
ssl_cert=server-cert.pem
ssl_key=server-key.pem

要分别为 MySQL 协议和 X 协议连接配置加密，请在 my.cnf 中同时设置 ssl_xxx 和 mysqlx_ssl_xxx 系统变量：To configure encryption separately for MySQL Protocol and X Protocol connections, set both the ssl_xxx and mysqlx_ssl_xxx system variables in my.cnf:

[mysqld]
ssl_ca=ca1.pem
ssl_cert=server-cert1.pem
ssl_key=server-key1.pem

mysqlx_ssl_ca=ca2.pem
mysqlx_ssl_cert=server-cert2.pem
mysqlx_ssl_key=server-key2.pem

有关配置连接加密支持的一般信息，请参见 第 8.3.1 节，“配置 MySQL 使用加密连接”。该讨论是针对 MySQL 服务器编写的，但参数名称与 X 插件类似。（X 插件的 mysqlx_ssl_xxx 系统变量名称对应 MySQL 服务器的 ssl_xxx 系统变量名称。）For general information about configuring connection-encryption support, see Section 8.3.1, “Configuring MySQL to Use Encrypted Connections”. That discussion is written for MySQL Server, but the parameter names are similar for X Plugin. (The X Plugin mysqlx_ssl_xxx system variable names correspond to the MySQL Server ssl_xxx system variable names.)

决定 MySQL 协议连接允许使用的 TLS 版本的 tls_version 系统变量同样适用于 X 协议连接。因此，两种类型连接允许的 TLS 版本是相同的。The tls_version system variable that determines the permitted TLS versions for MySQL Protocol connections also applies to X Protocol connections. The permitted TLS versions for both types of connections are therefore the same.

每个连接的加密是可选的，但可以通过在创建用户的 CREATE USER 语句中包含适当的 REQUIRE 子句，要求特定用户在 X 协议和 MySQL 协议连接中使用加密。详情请参见 第 15.7.1.3 节，“CREATE USER 语句”。或者，要要求所有用户在 X 协议和 MySQL 协议连接中使用加密，可以启用 require_secure_transport 系统变量。有关更多信息，请参见 配置强制加密连接。Encryption per connection is optional, but a specific user can be required to use encryption for X Protocol and MySQL Protocol connections by including an appropriate REQUIRE clause in the CREATE USER statement that creates the user. For details, see Section 15.7.1.3, “CREATE USER Statement”. Alternatively, to require all users to use encryption for X Protocol and MySQL Protocol connections, enable the require_secure_transport system variable. For additional information, see Configuring Encrypted Connections as Mandatory.