Enforce TLS, find non-TLS connections, renew certificates without restart

Command

SELECT @@require_secure_transport, @@tls_version, @@ssl_ca, @@ssl_cert;
SELECT * FROM performance_schema.tls_channel_status
WHERE PROPERTY IN ('Enabled', 'Current_tls_version', 'Current_tls_cert', 'Ssl_server_not_after');

-- Active connections and their TLS versions (empty = no TLS)
SELECT t.PROCESSLIST_USER AS user, t.PROCESSLIST_HOST AS host, t.CONNECTION_TYPE, sv.VARIABLE_VALUE AS tls_version
FROM performance_schema.threads t
LEFT JOIN performance_schema.status_by_thread sv ON sv.THREAD_ID = t.THREAD_ID AND sv.VARIABLE_NAME = 'Ssl_version'
WHERE t.TYPE = 'FOREGROUND' AND t.PROCESSLIST_USER IS NOT NULL;

SET PERSIST require_secure_transport = ON;
-- After copying the new certificate files
ALTER INSTANCE RELOAD TLS;

What it does

Shows the server TLS configuration, the certificate expiry date and whether each connection uses TLS; forbids unencrypted TCP connections entirely and renews certificates without stopping the server.

When to use it

For security audits / compliance, before certificate expiry, and when tracking down legacy clients connecting without encryption.

Caution

require_secure_transport=ON does not affect Unix socket and shared memory connections; those count as secure. Find clients connecting without TLS before enabling it, otherwise they fail with error 3159. ALTER INSTANCE RELOAD TLS does not affect existing connections, only new ones; if the certificate file is invalid it errors out and keeps the old certificate. The auto-generated self-signed certificate cannot be verified by clients with VERIFY_CA / VERIFY_IDENTITY; use a certificate signed by your CA in production.