--- title: Securing MySQL Databases with SSL/TLS. | daily.dev description: A hands-on walkthrough for securing MySQL 8 database connections with SSL/TLS on Ubuntu 22.04. Covers installing MySQL Community Server, running... canonical: https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Securing MySQL Databases with SSL/TLS. | daily.dev og:description: A hands-on walkthrough for securing MySQL 8 database connections with SSL/TLS on Ubuntu 22.04. Covers installing MySQL Community Server, running... og:url: https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff og:image: https://api.daily.dev/og/posts/ku5ewL8FF.png og:image:alt: Securing MySQL Databases with SSL/TLS. og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Securing MySQL Databases with SSL/TLS. **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary A hands-on walkthrough for securing MySQL 8 database connections with SSL/TLS on Ubuntu 22.04. Covers installing MySQL Community Server, running mysql_secure_installation, creating dedicated users, inspecting the server's auto-generated self-signed certificates, enabling SSL-required remote connections, restricting access via firewall rules, and testing SSL connections with different ssl-mode options (VERIFY_CA vs VERIFY_IDENTITY). Notes that VERIFY_IDENTITY does not work with MySQL's default self-signed certs and requires certificates from a proper CA, comparing AWS Certificate Manager Private CA against Teleport's open-source CA with MachineID as options for production setups. Part one of a two-part series, with part two covering Teleport MachineID for certificate auto-renewal. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I enable SSL/TLS for a MySQL 8 connection on Ubuntu 22.04? Add --ssl-mode=required when connecting, for example mysql -u root -p --ssl-mode=required. MySQL 8 automatically generates self-signed certificates (ca.pem, server-cert.pem, server-key.pem) at startup, and you can confirm encryption is active by running \s in the MySQL client and checking the SSL cipher line, or by checking SHOW VARIABLES LIKE '%ssl%'. _daily.dev surfaces practical guides like this for developers hardening database access with TLS._ ### Why doesn't VERIFY_IDENTITY work with MySQL's default self-signed certificates? VERIFY_IDENTITY checks the server hostname against the certificate, but certificates created automatically by MySQL 8 or manually via mysql_ssl_rsa_setup do not support hostname verification. This leaves connections encrypted but vulnerable to man-in-the-middle attacks. Fixing it requires issuing certificates from a proper certificate authority, such as AWS Certificate Manager Private CA or Teleport's open-source CA with MachineID. _Teams choosing a CA strategy for database TLS can compare trade-offs like these on daily.dev._ ### How do I restrict remote MySQL connections to a specific client IP for security? Use firewall rules alongside MySQL's SSL requirement: with iptables, run iptables -A INPUT -i eth0 -s CLIENT_IP -p tcp --destination-port 3306 -j ACCEPT, or with ufw, run ufw allow from CLIENT_IP to any port 3306. Combine this with require_secure_transport = ON and a non-default bind-address in mysqld.cnf to enforce encrypted, IP-restricted remote access. _daily.dev helps developers locking down remote database access keep these hardening steps handy._ ## Similar posts on daily.dev - [How to Install and Secure phpMyAdmin on Ubuntu Servers](https://daily.dev/posts/how-to-install-and-secure-phpmyadmin-on-ubuntu-servers-scur3fokc) · DigitalOcean Community · 0 upvotes · 0 comments - [Enforcing TLS and managing certificate rotation for RDS and Amazon Aurora PostgreSQL](https://daily.dev/posts/enforcing-tls-and-managing-certificate-rotation-for-rds-and-amazon-aurora-postgresql-mruniy8os) · AWS Database Blog · 0 upvotes · 0 comments - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments - [How To Install MySQL on Ubuntu 18.04](https://daily.dev/posts/how-to-install-mysql-on-ubuntu-18-04-rnonvuufg) · DigitalOcean Community · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ubuntu](https://daily.dev/tags/ubuntu), [#mysql](https://daily.dev/tags/mysql) [View this post on daily.dev](https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Securing MySQL Databases with SSL/TLS.","url":"https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff"},"datePublished":"2026-08-23T12:23:22.446Z","dateModified":"2026-08-23T12:53:14.048Z","description":"A hands-on walkthrough for securing MySQL 8 database connections with SSL/TLS on Ubuntu 22.04. Covers installing MySQL Community Server, running...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ubuntu,mysql","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Securing MySQL Databases with SSL/TLS."}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/securing-mysql-databases-with-ssl-tls--ku5ewl8ff#faq","mainEntity":[{"@type":"Question","name":"How do I enable SSL/TLS for a MySQL 8 connection on Ubuntu 22.04?","acceptedAnswer":{"@type":"Answer","text":"Add --ssl-mode=required when connecting, for example mysql -u root -p --ssl-mode=required. MySQL 8 automatically generates self-signed certificates (ca.pem, server-cert.pem, server-key.pem) at startup, and you can confirm encryption is active by running \\s in the MySQL client and checking the SSL cipher line, or by checking SHOW VARIABLES LIKE '%ssl%'. daily.dev surfaces practical guides like this for developers hardening database access with TLS."}},{"@type":"Question","name":"Why doesn't VERIFY_IDENTITY work with MySQL's default self-signed certificates?","acceptedAnswer":{"@type":"Answer","text":"VERIFY_IDENTITY checks the server hostname against the certificate, but certificates created automatically by MySQL 8 or manually via mysql_ssl_rsa_setup do not support hostname verification. This leaves connections encrypted but vulnerable to man-in-the-middle attacks. Fixing it requires issuing certificates from a proper certificate authority, such as AWS Certificate Manager Private CA or Teleport's open-source CA with MachineID. Teams choosing a CA strategy for database TLS can compare trade-offs like these on daily.dev."}},{"@type":"Question","name":"How do I restrict remote MySQL connections to a specific client IP for security?","acceptedAnswer":{"@type":"Answer","text":"Use firewall rules alongside MySQL's SSL requirement: with iptables, run iptables -A INPUT -i eth0 -s CLIENT_IP -p tcp --destination-port 3306 -j ACCEPT, or with ufw, run ufw allow from CLIENT_IP to any port 3306. Combine this with require_secure_transport = ON and a non-default bind-address in mysqld.cnf to enforce encrypted, IP-restricted remote access. daily.dev helps developers locking down remote database access keep these hardening steps handy."}}]} ```