Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working through a security audit for a system at my work and one of the requirements is to encrypt all traffic through public/unprotected networks. Since we are accessing the MySQL database (over port 3306) on one of our external servers from our office network, the connection to MySQL needs to be encrypted.

Is it already encrypted, and if not, how can I encrypt it?

I am using tools and scripts which can't use fancy SSH-port-forwards or VPNs... is it still possible?

share|improve this question
up vote 10 down vote accepted

No, by default mysql traffic is not encrypted. Setting up MySQL to work with OpenSSL on a per-connection basis is your best bet. Most binaries are built with SSL support these days, but it's easy enough to check if your version will support it. From the documentation:

To check whether a server binary is compiled with SSL support, invoke it with the --ssl option. An error will occur if the server does not support SSL:

shell> mysqld --ssl --help
060525 14:18:52 [ERROR] mysqld: unknown option '--ssl'
share|improve this answer
Hyperlink is dead. – JellicleCat Feb 18 '15 at 21:18
Link for v5.6: (also updated above) – smhg Mar 8 '15 at 12:02

By default MySQL does not encrypt its client/server communication

You can setup MySQL to accept connections over SSL and require users to use SSL. Here's the guide for SSL setup

share|improve this answer
the links are broken – knocte Jun 10 at 14:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.