Skip to main content

SEC.CFG.REQUIRE_SECURE_TRANSPORT — Nothing enforces the encryption the server already offers

  • Category: security
  • Severity: medium
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about a server setting, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: MySQL 8.4

Read this before dismissing it​

This is not "encryption is off".

MySQL 8 negotiates TLS by default and most clients take it. So on a server with require_secure_transport = OFF, the connections anybody checks are usually encrypted — every one you look at will be. That is what makes the finding easy to wave away, and wrong to.

What the setting decides is whether a connection that did not negotiate encryption gets refused. With it off, a client that omits TLS — or one whose TLS setup silently failed — connects exactly as before, in the clear, with nothing raised anywhere.

The state being reported is "nothing enforces it". That is how a misconfigured client goes unnoticed for years.

Why medium​

On a server reachable only over a private network the exposure is bounded by that network, and plenty of correct deployments rely on exactly that. What this setting removes is a guarantee, not a defense — and a finding that called a private-network deployment critical would be switched off before it was read.

The false positive this names rather than produces​

Several managed providers enforce transport at a proxy, outside the server's own configuration. The variable then reads OFF on a server that no connection can reach in the clear at all.

The finding says the server does not require it, in those words, and leaves the deployment to the reader.

What it looks like​

# my.cnf: a connection that skips encryption is accepted like any other.
require_secure_transport = OFF

What to do about it​

# Refuse anything that did not negotiate a secure transport.
require_secure_transport = ON

Check your clients first: turning it on refuses every connection that was quietly running in the clear, which is the point — but it is better to find those before they find you.