Detections
Analytics

2.15 Limit Accepted Transport Layer Security (TLS) Versions

Information

MySQL supports multiple protocols of TLS. The higher the version, the stronger the security and/or the better the performance.

Requiring clients attempting to connect to MySQL to use higher versions of TLS better protects data in transit.

Solution

Set the version(s) of TLS you wish to accept in mysql.conf to specify TLS and Ciphers.

For example to accept only TLS 1.3, set tls_version in my.conf:

tls_version=TLSv1.3

If TLS 1.3 is not supported on the operating system then set to TLS 1.2:

tls_version=TLSv1.2

Note: with this setting, only clients that support the specified TLS version(s) are able to establish an encrypted connection to the server.

Impact:

Connections attempting to use an unsupported version of TLS or Cipher will fail.

See Also

https://workbench.cisecurity.org/benchmarks/22687

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND SERVICES ACQUISITION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SA-15, 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4, CSCv7|18.5

Plugin: MySQLDB

Control ID: 4719f644e06f73468569256b5113ab6b00cc4308e3b06b41a2c041deb7a225ed