Connecting to MySQL via SSL/TLS

The first thing to check when upgrading MySQL is SSL/TLS version compatibility. The server and client must have a common supported TLS version for the handshake to succeed; if the versions don't match, the encrypted connection itself fails.

In MySQL 8.0.28, support for TLSv1.0 and TLSv1.1 was removed. In contrast, in a MySQL 5.7.37 environment, tls_version shows as TLSv1,TLSv1.1,TLSv1.2, meaning the range of connectable TLS versions differs depending on the version.

Connecting with older Java and Python drivers actually triggers errors.

• In Java, SSLHandshakeException: Received fatal alert: protocol_version occurs.
• In Python, a TLSV1_ALERT_PROTOCOL_VERSION exception occurs.

Conversely, even when TLSv1.0/TLSv1.1 are disabled on the client side, as with Java 8 Update 291, if the server is an older version that doesn't support TLSv1.2, the handshake fails in the same way. In other words, the issue isn't limited to server upgrades—it can also arise simply from changing drivers or development language versions.

In production environments, the TLS support range on both the server and client sides should be checked in advance. In MySQL, the per-session connection method and TLS version can be verified by joining sys.session_ssl_status and performance_schema.threads, which allows tracking which session is connected using which TLS version.

The key point is that whenever you upgrade the MySQL version, replace drivers, or change the language runtime, you must also verify TLS version matching. Otherwise, even if the connection settings appear normal on the surface, the connection will actually be cut off right at the handshake stage.